@bridge_gpt/mcp-server 0.2.68 → 0.2.70

package/build/install-bridge-conductor.js

@@ -1,6 +1,16 @@
 /**
  * `install-bridge conductor` — the nested conductor bootstrap phase (BAPI-679).
  *
+ * BAPI-1461 — CONVERGING SETUP. With the production setup seams (always
+ * supplied by `install-bridge.ts`), this command is a loop, not a script: it
+ * reads the Claude login marker, confirms the base URL, checks `gh auth
+ * status`, collects every readiness finding read-only, fixes only the missing
+ * items in order (each write surface behind its own consent), checks again —
+ * running the deny-enforcement probe once, there — and prints one verdict
+ * beside the legacy completion line. The fixed eight-phase sequence below
+ * remains only for a caller that supplies no setup seams. See
+ * `install-bridge-conductor-setup.ts` for the item model and fix planner.
+ *
  * Standing up Epic Conductor v2 on a fresh repository previously meant a manual
  * sequence of API calls and hand-written config, with five server-side
  * prerequisites that were invisible until an epic was already running and
@@ -47,7 +57,7 @@
  *     MCP entries (`.mcp.json`, `.vscode/mcp.json`, `.cursor/mcp.json` only,
  *     never Codex or Copilot), then print the restart advisory, because
  *     `ACTIVE_GROUPS` is frozen at MCP server startup.
- *   local observability — install the managed conductor Git hooks, then report
+ *   local observability — install the managed Git hooks, then report
  *     native ledger loadability. The ledger probe is READ-ONLY, so it needs no
  *     consent and runs whether hook consent was accepted or declined.
  *
@@ -111,6 +121,13 @@ import { emptyConductorGateFlags, hasExplicitGateInput, parseLocalCommandFlag, p
 import { bootstrapConductorSupervisorDefaults, classifySupervisorBootstrapFailure, fetchConductorReadiness, previewConductorSupervisorBootstrap, } from "./conductor/bridge-api-client.js";
 import { CONDUCTOR_OPERATOR_RUNBOOK_POINTER, EXECUTOR_PROVISIONING_GUIDANCE, conductorInstallDoctorExitCode, conductorInstallDoctorHasFatal, formatConductorInstallDoctorReport, } from "./conductor/install-doctor.js";
 import { describeNativeLedgerAvailability, } from "./conductor/doctor.js";
+import { resolveGithubMergeRepositoryIdentity, } from "./credential-store.js";
+import { isUsableMergeCredentialValue, resolveLocalMergeCredentialDetailed, } from "./conductor/merge-credential.js";
+import { readStoredTestCommand, writeStoredTestCommand, } from "./testing-config-client.js";
+import { detectTestCommand } from "./test-command-detection.js";
+import { TestCommandValidationError, validateTestCommand } from "./test-command-validation.js";
+import { EPIC_IMPLEMENTER_CI_CHECK_NAME } from "./epic-ci-workflow.js";
+import { assessSetupIndex, catalogLabel, compareIndexedToMerge, planSetupFixes, projectSetupItems, readSetupPullRequest, renderSetupAssessment, setupVerdictLine, unmetBlockingItems, } from "./install-bridge-conductor-setup.js";
 import { CONDUCTOR_BIN_UNRESOLVED_ERROR, MANAGED_HOOK_NAMES, } from "./conductor/git-hooks.js";
 import os from "node:os";
 import path from "node:path";
@@ -119,6 +136,7 @@ import { bindEpicLaunchCredential, readStoredBinding, } from "./credential-store
 import { EPIC_LAUNCH_EXECUTION_MODES, EPIC_LAUNCH_PROFILE_NAME_PATTERN, EPIC_LAUNCH_PROFILE_VERSION, createNodeEpicLaunchStoreDeps, readEpicLaunchProfile, renderEpicLaunchCommand, resolveEpicLaunchTarget, writeEpicLaunchProfile, } from "./epic-launch-profile.js";
 import { DEFAULT_BAPI_BASE_URL } from "./executor/credentials.js";
 import { MCP_PACKAGE_NAME } from "./mcp-identity.js";
+import { LOCAL_MERGE_CREDENTIAL_ENV_KEYS } from "./conductor/merge-credential.js";
 import { CLAUDE_REVIEW_WORKFLOW_RELPATH, renderClaudeReviewWorkflow, } from "./claude-review-workflow.js";
 import { formatExecutorInstallPreflight, } from "./executor/install-preflight.js";
 import { buildExecutorServiceStartPlan, formatExecutorServiceStartFailure, } from "./executor/service-lifecycle.js";
@@ -149,24 +167,48 @@ export function getInstallBridgeConductorUsage() {
     return [
         "Usage: install conductor [options]",
         "",
-        "Bootstrap the Epic Implementer for this repository: run the unified read-only",
-        "doctor, write the safe project-default supervisor posture, optionally scaffold",
-        "the claude-review workflow, report the capability matrix, and re-run the doctor.",
+        "Set up this repository for the Epic Implementer. It checks everything first",
+        "(read-only), fixes only what is missing, checks again, and ends with one",
+        "verdict: \"Ready for your first epic\" or \"Not ready: N steps left\" with the fix",
+        "for each step. The last line is still complete or complete-with-manual-steps.",
+        "It exits 0 when ready and 1 otherwise (0 for --dry-run and for a declined URL",
+        "confirmation). `install-bridge conductor` is the same command.",
+        "",
+        "It first reads your Claude sign-in (~/.claude.json only) and, after the URL",
+        "confirmation, runs `gh auth status`. A ready repository gets no questions and no",
+        "writes. Otherwise it asks only what a missing item needs, each with a default of no:",
+        "  - which repository, only when it cannot tell;",
+        "  - saving the test command, only when none is stored;",
+        "  - opening the setup pull request with the CI workflow;",
+        "  - storing the repository gate and safe defaults, when they would change;",
+        "  - storing a GitHub merge token on this computer (read with no echo).",
+        "The URL confirmation is asked on every run and is not one of these. Without an",
+        "interactive terminal every question is a decline: no token is stored and no",
+        "pull request is opened. When setup reports that its setup pull request is",
+        "waiting, merge it and run setup again: the re-run queues one repository index",
+        "if needed and reports it pending until it finishes.",
+        "",
+        "Merge token: setup can store a GitHub token for this repository in your user",
+        "credential store (~/.config/bridge/credentials.json). GITHUB_MERGE_TOKEN, then",
+        "BAPI_LOCAL_MERGE_TOKEN, take precedence over it. It is never sent to Bridge.",
+        "When GitHub rejects it, setup offers to replace it. Removing it deletes the",
+        "local copy only; it does not revoke the token at GitHub, and a running executor",
+        "keeps the token it started with until it restarts.",
         "",
         "Options:",
+        "  --remove-merge-token       Remove the merge token stored on this computer for",
+        "                             this repository (its own consent), then exit.",
         "  --repo <name>              Repository name (default: BAPI_REPO_NAME / .bridge/config)",
-        "  --required-check <name>    A provider check for the gate (repeatable). Explicit",
-        "                             owner input: stored as a confirmed provider gate and",
-        "                             projected into the done gate, as before.",
+        "  --required-check <name>    A provider check for the gate (repeatable). Stored as a",
+        "                             confirmed provider gate and projected into the done gate.",
         "  --required-checks a,b      Comma-separated form of --required-check",
         "",
-        "Repository gate (BAPI-1391) — what must pass before a child merges. A CONFIRMED",
-        "gate is required: provider checks, local commands, both (mixed), or none.",
-        "Without gate flags, a confirmed gate already stored (including an older",
-        "--required-check setup) is used unchanged; otherwise discovery reads this",
-        "working tree and the provider's real check history and PROPOSES a gate, which",
-        "is stored only after you confirm or edit it at a prompt. Discovery saves",
-        "nothing. Explicit gate flags are owner input and are stored as confirmed.",
+        "Repository gate — what must pass before a child merges. A CONFIRMED gate is",
+        "required: provider checks, local commands, both (mixed), or none. Without gate",
+        "flags, a confirmed gate already stored is used unchanged; otherwise discovery",
+        "reads this working tree and the provider's real check history and PROPOSES a",
+        "gate, which is stored only after you confirm or edit it at a prompt. Discovery",
+        "saves nothing. Explicit gate flags are stored as confirmed.",
         "  --provider-check <name>    An exact provider-reported check name (repeatable).",
         "                             Admission refuses one that has never reported.",
         "  --local-command <cmd>      A local command the executor runs before each merge",
@@ -184,35 +226,20 @@ export function getInstallBridgeConductorUsage() {
         "  --clear-gate               Clear the confirmed gate (its own consent), then exit.",
         "  --qualify-gate             Qualify a confirmed local or mixed gate: queue the",
         "                             qualification job and drain it with a short-lived",
-        "                             repository-wide executor limited to that job type.",
-        "                             Alone, it does only that; with gate flags it runs",
-        "                             after they are stored, without the offer prompt.",
-        "  Every gate write first checks that the server advertises gate_profile.v1;",
-        "  against an older server it prints \"Bridge API update required\" and exits 1.",
+        "                             executor limited to that job type. Alone, it does only",
+        "                             that; with gate flags it runs after they are stored,",
+        "                             without the offer prompt.",
         "",
         `  --review-policy <source>   One of: ${CONDUCTOR_REVIEW_POLICY_SOURCES.join(", ")}`,
-        "                             Omitted, install assumes repository_policy: the",
-        "                             prospective default for a new feature-branch run at",
-        "                             first approval when neither the run nor the",
-        "                             repository sets a policy. It scaffolds no Claude",
-        "                             review workflow and stores no default at all.",
-        "                             AI review is an explicit opt-in: pass",
-        "                             --review-policy verdict_protocol to scaffold the",
-        "                             workflow. Supplying any value EXPLICITLY also",
-        "                             persists it as the supervisor project default,",
-        "                             stamped into a new run that carries no review",
-        "                             policy of its own.",
+        "                             Omitted, install assumes repository_policy and",
+        "                             scaffolds no Claude review workflow. AI review is an",
+        "                             explicit opt-in: pass --review-policy verdict_protocol",
+        "                             to scaffold the workflow. Supplying any value also",
+        "                             persists it as the project default, stamped into a new",
+        "                             run that carries no review policy of its own.",
         "  --epic-key <KEY>           Epic key for the setup-epic verification phase",
         "  --plan-file <path>         Plan sidecar for the setup-epic verification phase",
-        "  --executor-id <id>         Stable executor id. Supplying it OPTS IN to the",
-        "                             consented executor-provisioning phase below; the",
-        "                             phase is skipped entirely without it.",
-        "  --epic-run-id <id>         Claim scope for the generated unit (repeatable).",
-        "  --repo-wide                Claim-scope opt-out: claim from every authorized",
-        "                             repo, unscoped by run. EXACTLY ONE of --epic-run-id",
-        "                             or --repo-wide is required with --executor-id — the",
-        "                             executor refuses to start without one, so a unit",
-        "                             generated without it would fail on every boot.",
+        "  AI PR review only (--review-policy verdict_protocol):",
         "  --allowed-bot <slug>       claude-review workflow: allowed bot login",
         "  --secret-name <NAME>       claude-review workflow: OAuth token secret NAME",
         "  --branches a,b             claude-review workflow: PR branch triggers",
@@ -222,85 +249,50 @@ export function getInstallBridgeConductorUsage() {
         "                             install keeps the stored gate and only adds missing",
         "                             checks. Any requirement a replacement would remove",
         "                             is previewed and needs its own exact approval.",
-        "  --launch-profile <name>    (BAPI-1260) Opt in to the reusable epic launch: after",
-        "                             every mandatory prerequisite is verified, persist a",
-        "                             host-local profile and print the ONE drive-epic",
-        "                             command that selects it (runs in a fresh shell).",
-        "                             Optional for production — drive-epic targets it with",
-        "                             no profile. Needed for local or durable-host targets.",
-        "  --base-url <url>           Explicit Bridge API target for --launch-profile.",
-        "                             Required there (or BAPI_BASE_URL): guided setup",
-        "                             approves one named server and has no default.",
-        "  --execution-mode <mode>    local | durable (default: durable with",
-        "                             --executor-id, otherwise local).",
-        "  --policy-file <path>       Run policy the profile references. An unattended",
-        "                             run escalates to a notify.webhook_url reachable",
-        "                             from the API server or, with none declared, to the",
-        "                             account's email (notify.local_sink is not enough).",
+        "  --epic-branch-ci-decision <include|decline>",
+        "                             (GitHub only) Record whether child merges into an epic",
+        "                             branch wait for CI on that PR. Without it you are",
+        "                             asked; a non-interactive run records nothing.",
         "  --dry-run                  Diagnose and preview only. Performs NO writes:",
         "                             no POST, no file write, no host MCP config write,",
         "                             no Git hook write, no install-state or capability",
-        "                             write, no service-unit write, no launchctl/systemctl",
-        "                             or other lifecycle command, and no write- or",
-        "                             start-consent prompt.",
-        "                             Still asks the base-URL confirmation below first —",
-        "                             its doctor readiness GET carries the repo API key.",
-        "  --epic-branch-ci-decision <include|decline>",
-        "                             (BAPI-1405, GitHub only) Record whether child merges",
-        "                             into an epic branch wait for CI on that PR. Without",
-        "                             it you are asked; a non-interactive run records",
-        "                             nothing. Never consent to change an approval rule.",
+        "                             write, no service-unit write, and no write- or",
+        "                             start-consent prompt. Still asks the base-URL",
+        "                             confirmation first — its readiness read carries the",
+        "                             repo API key.",
         "  -h, --help                 Show this help",
         "",
+        "Owner options (durable hosts and launch profiles; see `drive-epic --help-advanced`):",
+        "  --executor-id <id>         Stable executor id. Opts in to the consented",
+        "                             executor-provisioning phase.",
+        "  --epic-run-id <id>         Claim scope for the generated unit (repeatable).",
+        "  --repo-wide                Claim from every run in the repository. EXACTLY ONE of",
+        "                             --epic-run-id or --repo-wide is required with",
+        "                             --executor-id.",
+        "  --launch-profile <name>    Save a host-local launch profile and print the one",
+        "                             drive-epic command that selects it.",
+        "  --base-url <url>           Explicit Bridge API target for --launch-profile.",
+        "  --execution-mode <mode>    local | durable (default: durable with",
+        "                             --executor-id, otherwise local).",
+        "  --policy-file <path>       Run policy the profile references.",
+        "",
         "The resolved BAPI_BASE_URL is displayed and confirmed BEFORE any network call",
-        "(including the read-only doctor GET — BAPI_BASE_URL silently defaults to",
-        "production when unset). The bootstrap POST then asks its own, separate write",
-        "consent. Without a TTY there is no consent, so the command aborts.",
+        "(BAPI_BASE_URL silently defaults to production when unset). The bootstrap POST",
+        "then asks its own, separate write consent. Without a TTY there is no consent,",
+        "so the command aborts.",
         "",
         "Tool visibility (its own consent): adds the `epic_implementer` token to the",
         "BRIDGE_MCP_PROFILE of the Bridge entry in host MCP configurations that",
-        "ALREADY have one. Automatic merging covers .mcp.json, .vscode/mcp.json, and",
-        ".cursor/mcp.json only — never Codex or Copilot, which are neither inspected",
-        "nor changed. No file is ever created: when no supported config carries a",
-        "a Bridge entry, the run says so and points at the base `install` command.",
-        "The MCP server captures its active groups at startup, so a merge activates on",
-        "the next launch — restart your MCP client to see the Epic Implementer tools.",
+        "ALREADY have one (.mcp.json, .vscode/mcp.json, and .cursor/mcp.json only). No",
+        "file is ever created: when no supported config carries a Bridge entry, the run",
+        "says so and points at the base `install` command. Restart your MCP client to",
+        "see the Epic Implementer tools.",
         "",
-        "Local observability (a SEPARATE consent): installs or updates this",
-        "repository's managed conductor Git hooks (post-commit,",
-        "reference-transaction) and reports each hook's action. It then probes native",
-        "ledger loadability, which is READ-ONLY and therefore runs with or without",
-        "hook consent; a degraded ledger reports the module, NODE_MODULE_VERSION, and",
-        "failure kind, and never triggers an install, rebuild, or migration.",
-        "",
-        "Durable-host mode: this command is the supported bring-up for a persistent,",
-        "laptop-independent executor. It composes planning, separately consented unit",
-        "writing, separately consented start, read-only local inspection, and bounded",
-        "server-observed readiness. `executor install-service` still generates a unit and",
-        "nothing else, and remains available for operators who manage lifecycle themselves.",
-        "",
-        "Host ownership (operator-operated or Bridge-operated) is an operational selection,",
-        "not server policy: both run identical generation and lifecycle logic, and",
-        "BAPI_BASE_URL is the only ownership/location input. Bridge-operated mode allocates",
-        "no host — it configures one already assigned. A repository with no assigned durable",
-        "host is NOT ready; escalate that to Bridge operations.",
-        "",
-        "With --executor-id, this command does the whole leg. A preflight checks the platform,",
-        "`wt` / `git` / `claude` on PATH, and an explicit base URL, then reports whether",
-        "this host has a `claude login` marker — that line is ADVISORY and never blocks,",
-        "and no API key, token, or other credential is requested, stored, or checked.",
-        "",
-        "Two independent consents follow. The first writes the service unit; the second,",
-        `asked separately, starts it (${"`launchctl bootstrap`"} on darwin,`,
-        "`systemctl --user daemon-reload && systemctl --user enable --now` on linux) with",
-        "exactly one attempt and no retry loop. Declining either one, or a start that",
-        "fails, prints the exact start command and finishes at complete-with-manual-steps.",
-        "",
-        "After a successful start the command polls the server for roughly 90 seconds for",
-        "the executor to be observed. Only that live server observation can report",
-        "executor_ready: a written unit and a successful local start never can, so an",
-        "observation timeout finishes at complete-with-manual-steps and says exactly what",
-        "was and was not achieved.",
+        "Local observability (a SEPARATE consent): installs or updates this repository's",
+        "managed Git hooks (post-commit, reference-transaction) and reports each hook's",
+        "action. It then probes native ledger loadability, which is READ-ONLY; a degraded",
+        "ledger reports the module, NODE_MODULE_VERSION, and failure kind, and never",
+        "triggers an install, rebuild, or migration.",
         "",
         `See ${CONDUCTOR_OPERATOR_RUNBOOK_POINTER}.`,
     ].join("\n");
@@ -343,6 +335,7 @@ export function parseInstallBridgeConductorArgs(argv) {
     let executionMode;
     let policyFile;
     let epicBranchCiDecision;
+    let removeMergeToken = false;
     const takeValue = (arg, inline, next) => {
         if (inline !== undefined) {
             if (inline.trim().length === 0)
@@ -380,6 +373,12 @@ export function parseInstallBridgeConductorArgs(argv) {
                     return { status: "error", message: "--repo-wide takes no value" };
                 repoWide = true;
                 break;
+            case "--remove-merge-token":
+                if (inline !== undefined) {
+                    return { status: "error", message: "--remove-merge-token takes no value" };
+                }
+                removeMergeToken = true;
+                break;
             case "--gate-none":
             case "--confirm-gate":
             case "--clear-gate":
@@ -570,6 +569,36 @@ export function parseInstallBridgeConductorArgs(argv) {
                 "--executor-id.",
         };
     }
+    // BAPI-1461 — token removal is its own action: only --repo and --dry-run may
+    // accompany it, so it can never be mistaken for, or followed by, setup writes.
+    if (removeMergeToken) {
+        const conflicting = requiredChecks.length > 0 ||
+            hasExplicitGateInput(gate) ||
+            gate.clearGate ||
+            gate.qualifyGate ||
+            executorId !== undefined ||
+            epicRunIds.length > 0 ||
+            repoWide ||
+            launchProfile !== undefined ||
+            baseUrl !== undefined ||
+            executionMode !== undefined ||
+            policyFile !== undefined ||
+            epicKey !== undefined ||
+            planFile !== undefined ||
+            epicBranchCiDecision !== undefined ||
+            reviewPolicyExplicit ||
+            replaceDoneGate ||
+            skipWorkflow ||
+            allowedBot !== undefined ||
+            secretName !== undefined ||
+            branches !== undefined;
+        if (conflicting) {
+            return {
+                status: "error",
+                message: "--remove-merge-token is a standalone action: combine it only with --repo or --dry-run.",
+            };
+        }
+    }
     // BAPI-1260 — the launch-profile inputs only mean something together.
     if (launchProfile === undefined && (baseUrl !== undefined || executionMode !== undefined)) {
         return {
@@ -610,6 +639,7 @@ export function parseInstallBridgeConductorArgs(argv) {
                 : {}),
             ...(policyFile ? { policyFile } : {}),
             ...(epicBranchCiDecision ? { epicBranchCiDecision } : {}),
+            ...(removeMergeToken ? { removeMergeToken: true } : {}),
         },
     };
 }
@@ -706,15 +736,13 @@ const CONSENT_YES = new Set(["y", "yes"]);
 /** Fixed, value-free operator text for each bootstrap failure (BAPI-1288). */
 const BOOTSTRAP_FAILURE_TEXT = Object.freeze({
     "unsupported-protocol": "the Bridge API server does not support the gate-change preview protocol " +
-        "(it predates BAPI-1288) or answered a response this installer cannot verify. " +
-        "Upgrade the server before re-running; this installer never falls back to the " +
-        "older bootstrap that replaced configured gates.",
+        "or answered a response this installer cannot verify. Email info@bridgegpt.ai; this " +
+        "installer never falls back to the older bootstrap that replaced configured gates.",
     "approval-required": "the server requires an approved preview for this change. Re-run to preview it again.",
     "stale-preview": "the project defaults changed since the preview, or the approval expired. " +
         "Re-run to preview the current state again.",
     "unknown-stored-state": "a stored project-default row cannot be read with certainty, so no change to it " +
-        "can be evaluated. See the account-settings operator runbook " +
-        "(unknown_stored_state) before re-running.",
+        "can be evaluated. Email info@bridgegpt.ai (unknown_stored_state) before re-running.",
     "non-relaxable": "the change would turn auto-merge on or drop the human merge-approval requirement, " +
         "which no gate-change approval can authorize.",
     "invalid-proposal": "the server rejected the proposed configuration as unreadable.",
@@ -793,6 +821,15 @@ async function confirm(deps, promptText) {
     const answer = await deps.promptLine(promptText);
     return CONSENT_YES.has((answer ?? "").trim().toLowerCase());
 }
+/**
+ * BAPI-1452 — the merge-credential next step. Value-free configuration guidance
+ * only: it names the configuration keys and never reads, writes, migrates, or
+ * asks for a credential value. `GITHUB_MERGE_TOKEN` is the local merge
+ * credential; the machine-user credential is a distinct key, not an alias.
+ */
+export const MERGE_CREDENTIAL_INSTALL_GUIDANCE = `set ${LOCAL_MERGE_CREDENTIAL_ENV_KEYS.local} (the local merge credential) in the environment the ` +
+    `executor is launched from, or ${LOCAL_MERGE_CREDENTIAL_ENV_KEYS.machine_token} for machine-user ` +
+    "mode; Bridge never stores either.";
 function renderCapabilityMatrix(deps, readiness) {
     const apiReady = readiness !== null;
     // BAPI-1391 — a CONFIRMED local-only or `none` gate has no CI checks by
@@ -829,6 +866,7 @@ function renderCapabilityMatrix(deps, readiness) {
                     : ")") : ""));
     }
     deps.log(`  executor provisioning: ${EXECUTOR_PROVISIONING_GUIDANCE}`);
+    deps.log(`  merge credential:     ${MERGE_CREDENTIAL_INSTALL_GUIDANCE}`);
     deps.log(`  runbook:              ${CONDUCTOR_OPERATOR_RUNBOOK_POINTER}`);
     return { apiReady, configurationReady, executorReady };
 }
@@ -1065,7 +1103,7 @@ export function formatConductorRestartAdvisory(mergedProfile) {
 /** Remediation printed when no supported host config carries a Bridge entry. */
 export const CONDUCTOR_PROFILE_EMPTY_MERGE_REMEDIATION = `run \`${PRINTED_INSTALL_COMMAND}\` to create and register the host MCP entry, ` +
     "then re-run `install conductor`.";
-/** Remediation printed whenever the managed conductor hooks were not installed. */
+/** Remediation printed whenever the managed git hooks were not installed. */
 export const CONDUCTOR_HOOKS_MANUAL_REMEDIATION = "re-run `install conductor` and accept the local-observability consent, or run " +
     "`epic-implementer install-git-hooks` directly.";
 /**
@@ -1091,7 +1129,7 @@ async function runConductorToolVisibilityPhase(deps, local) {
         return {
             manualActions: [
                 "tool visibility: re-run `install conductor` and accept the profile consent to " +
-                    "make the conductor MCP tools visible.",
+                    "make the Epic Implementer MCP tools visible.",
             ],
         };
     }
@@ -1143,7 +1181,7 @@ async function runConductorToolVisibilityPhase(deps, local) {
 /**
  * Phase: local observability.
  *
- * Installs the managed conductor Git hooks behind its OWN consent — never
+ * Installs the managed Git hooks behind its OWN consent — never
  * inferred from the base-URL, bootstrap, workflow, profile-token, or executor
  * consents — and then always reports native ledger loadability, which is
  * read-only and therefore needs no consent at all.
@@ -1151,7 +1189,7 @@ async function runConductorToolVisibilityPhase(deps, local) {
 async function runConductorLocalObservabilityPhase(deps, local) {
     const manualActions = [];
     let fatal = false;
-    const consented = await confirm(deps, "Install or update this repository's managed conductor Git hooks " +
+    const consented = await confirm(deps, "Install or update this repository's managed Git hooks " +
         "(post-commit, reference-transaction)? [y/N]: ");
     if (!consented) {
         deps.log("  declined — no Git hook and no install state were written.");
@@ -1166,7 +1204,7 @@ async function runConductorLocalObservabilityPhase(deps, local) {
             // Generic by design: the caught value can carry a hooks-directory path.
             // The phase is marked fatal but does NOT return here — the read-only
             // ledger report below still owes the operator its answer.
-            deps.errorLog("  the conductor Git hooks could not be installed.");
+            deps.errorLog("  the Epic Implementer Git hooks could not be installed.");
             manualActions.push(`local observability: ${CONDUCTOR_HOOKS_MANUAL_REMEDIATION}`);
             fatal = true;
         }
@@ -1207,7 +1245,7 @@ async function runConductorLocalObservabilityPhase(deps, local) {
             if (!result.is_worktree) {
                 deps.log("  not a git worktree, so no managed hook was installed (degraded optional capability).");
                 manualActions.push("local observability: run `install conductor` from a git worktree to install the " +
-                    "managed conductor hooks.");
+                    "managed git hooks.");
             }
             else {
                 for (const hook of result.installed) {
@@ -1290,7 +1328,7 @@ async function runConductorLocalObservabilityPhase(deps, local) {
             deps.log(`  ledger degraded — ${availability.module} did not load ` +
                 `(NODE_MODULE_VERSION ${availability.nodeModulesAbi}, failure: ${availability.failureKind}).`);
             manualActions.push(`local observability: reinstall ${availability.module} for this Node runtime to ` +
-                "restore the local conductor event ledger.");
+                "restore the local Epic Implementer event ledger.");
         }
     }
     return { manualActions, fatal };
@@ -1399,6 +1437,15 @@ function assessNotification(policy, attended, targetBaseUrl, readiness) {
             "delivers a verification to it at approval, and a failure there holds activation.",
     };
 }
+/** BAPI-1461 — whether a stored profile already records exactly this launch. */
+function launchProfileMatches(prior, next) {
+    return (prior.baseUrl === next.baseUrl &&
+        prior.repoName === next.repoName &&
+        prior.executionMode === next.executionMode &&
+        JSON.stringify(prior.runtime) === JSON.stringify(next.runtime) &&
+        JSON.stringify(prior.policyRef ?? null) === JSON.stringify(next.policyRef ?? null) &&
+        prior.credentialRef?.target === `bapi:${next.repoName}`);
+}
 /**
  * Verify every mandatory launch prerequisite at the selected target, then —
  * and only then — persist the profile and print the one command that selects
@@ -1422,7 +1469,7 @@ async function runLaunchProfilePhase(deps, options, inputs) {
     deps.log(`  mode:       ${mode}`);
     // (1) Access at THIS target — only a server answer proves the key works there.
     if (inputs.readiness === null) {
-        gaps.push("the selected target's conductor readiness could not be read with this repository's credential.");
+        gaps.push("the selected target's Epic Implementer readiness could not be read with this repository's credential.");
     }
     // (2) The policy reference and what it implies.
     let policy = null;
@@ -1456,7 +1503,7 @@ async function runLaunchProfilePhase(deps, options, inputs) {
         gaps.push(consent === false
             ? "unattended consent is off for this repository; turn on 'Allow unattended Epic " +
                 "Implementer runs' on the repository's Setup page in the Bridge admin panel " +
-                "(if it is already on, contact Bridge support) — this command never writes it."
+                "(if it is already on, email info@bridgegpt.ai) — this command never writes it."
             : "unattended consent could not be verified at the selected target (older server or unreadable report).");
     }
     // (4) Notification, from the server's network perspective.
@@ -1535,29 +1582,41 @@ async function runLaunchProfilePhase(deps, options, inputs) {
             `--base-url ${inputs.baseUrl} --required-check <name> ...`);
         return { complete: false };
     }
-    const write = await confirm(deps, `Write epic launch profile '${name}' (references only, no secrets)? [y/N]: `);
-    if (!write) {
-        deps.log("  declined — no profile was written.");
-        return { complete: false };
+    const policyRef = policyPath !== null ? { kind: "file", path: policyPath } : null;
+    let profile;
+    // BAPI-1461: an approved profile that already says exactly this is not
+    // rewritten — no write consent is asked and nothing is written.
+    if (existing.ok && launchProfileMatches(existing.profile, {
+        baseUrl: inputs.baseUrl, repoName, executionMode: mode, runtime: inputs.runtime.runtime, policyRef,
+    })) {
+        deps.log(`  profile '${name}' already matches — nothing written.`);
+        profile = existing.profile;
     }
-    const profile = {
-        version: EPIC_LAUNCH_PROFILE_VERSION,
-        name,
-        baseUrl: inputs.baseUrl,
-        repoName,
-        executionMode: mode,
-        host: lp.hostname(),
-        runtime: inputs.runtime.runtime,
-        policyRef: policyPath !== null ? { kind: "file", path: policyPath } : null,
-        credentialRef: { store: "bridge-credentials", target: `bapi:${repoName}` },
-        approvedAt: lp.nowIso(),
-    };
-    const written = await lp.writeProfile(profile);
-    if (!written.ok) {
-        deps.errorLog(`  profile write failed: ${written.message}`);
-        return { complete: false };
+    else {
+        const write = await confirm(deps, `Write epic launch profile '${name}' (references only, no secrets)? [y/N]: `);
+        if (!write) {
+            deps.log("  declined — no profile was written.");
+            return { complete: false };
+        }
+        profile = {
+            version: EPIC_LAUNCH_PROFILE_VERSION,
+            name,
+            baseUrl: inputs.baseUrl,
+            repoName,
+            executionMode: mode,
+            host: lp.hostname(),
+            runtime: inputs.runtime.runtime,
+            policyRef,
+            credentialRef: { store: "bridge-credentials", target: `bapi:${repoName}` },
+            approvedAt: lp.nowIso(),
+        };
+        const written = await lp.writeProfile(profile);
+        if (!written.ok) {
+            deps.errorLog(`  profile write failed: ${written.message}`);
+            return { complete: false };
+        }
+        deps.log(`  ${written.action} ${written.path}`);
     }
-    deps.log(`  ${written.action} ${written.path}`);
     deps.log("");
     deps.log("Launch command (fresh shell; no exports needed):");
     deps.log(`  ${renderEpicLaunchCommand(profile, {
@@ -1569,23 +1628,24 @@ async function runLaunchProfilePhase(deps, options, inputs) {
         .replace("'<path>'", "<path>")}`);
     return { complete: true };
 }
-export async function runInstallBridgeConductorCli(argv, deps) {
-    const parsed = parseInstallBridgeConductorArgs(argv);
-    if (parsed.status === "help") {
-        deps.log(parsed.usage);
-        return 0;
-    }
-    if (parsed.status === "error") {
-        deps.errorLog(`Error: ${parsed.message}`);
-        deps.errorLog("");
-        deps.errorLog(getInstallBridgeConductorUsage());
-        return 1;
-    }
-    const options = parsed.options;
-    // ---- Base URL: normalized ONCE, confirmed BEFORE any network call ------
-    // BAPI-1260: an epic launch profile has NO production default. Its target is
-    // --base-url or BAPI_BASE_URL (they must agree), decided here before any
-    // request; the hosted default below applies to the legacy flow only.
+// ---------------------------------------------------------------------------
+// Shared steps (used by both runners)
+// ---------------------------------------------------------------------------
+/**
+ * Resolve the base URL ONCE and confirm it BEFORE any network call.
+ *
+ * BAPI-1260: an epic launch profile has NO production default. Its target is
+ * --base-url or BAPI_BASE_URL (they must agree), decided here before any
+ * request; the hosted default applies to the ordinary flow only.
+ *
+ * This consent gates the FIRST network request of any kind — including the
+ * read-only doctor readiness GET (which carries this repository's API key) and
+ * the dry-run flow. The resolver silently defaults to production when
+ * BAPI_BASE_URL is unset, so the operator must see and confirm the target before
+ * the key is sent anywhere. No TTY means no consent means abort. The answer is
+ * never persisted: every run asks again.
+ */
+async function resolveAndConfirmBaseUrl(options, deps, promptText) {
     let baseUrl;
     if (options.launchProfile !== undefined) {
         const target = resolveEpicLaunchTarget({
@@ -1596,7 +1656,7 @@ export async function runInstallBridgeConductorCli(argv, deps) {
         if (!target.ok) {
             deps.errorLog(target.message);
             deps.errorLog("Nothing was sent anywhere and nothing was written.");
-            return 1;
+            return { ok: false, code: 1 };
         }
         baseUrl = target.baseUrl;
     }
@@ -1604,65 +1664,51 @@ export async function runInstallBridgeConductorCli(argv, deps) {
         const baseUrlResult = deps.resolveBaseUrl(deps.env);
         if (!baseUrlResult.ok) {
             deps.errorLog(baseUrlResult.error);
-            return 1;
+            return { ok: false, code: 1 };
         }
         baseUrl = baseUrlResult.value;
     }
-    // ---- Consent #1: the resolved base URL ---------------------------------
-    // This consent gates the FIRST network request of any kind — including the
-    // read-only doctor readiness GET (which carries this repository's API key)
-    // and the dry-run flow. The resolver silently defaults to production when
-    // BAPI_BASE_URL is unset, so the operator must see and confirm the target
-    // before the key is sent anywhere. No TTY means no consent means abort.
     deps.log(`Bridge API base URL: ${baseUrl}`);
     if (options.launchProfile !== undefined) {
         deps.log(`  explicit target for epic launch profile '${options.launchProfile}'` +
             (baseUrl === DEFAULT_BAPI_BASE_URL ? " — this is the PRODUCTION Bridge API, selected deliberately." : "."));
     }
-    const baseUrlOk = await confirm(deps, "Bootstrap against this URL? [y/N]: ");
+    const baseUrlOk = await confirm(deps, promptText);
     if (!baseUrlOk) {
         deps.log("Aborted — no network call (readiness GET or bootstrap POST) was attempted.");
-        return 0;
+        return { ok: false, code: 0 };
     }
-    const accessResult = await deps.resolveAccess(options.repo, baseUrl);
-    const access = accessResult.ok ? accessResult.access : null;
-    const accessError = accessResult.ok ? undefined : accessResult.error;
-    // ---- BAPI-1391: the two standalone gate actions -----------------------
-    // `--clear-gate`, and `--qualify-gate` without gate flags, act on the stored
-    // gate and stop: they never bootstrap, scaffold, or provision anything else.
-    const gateIo = {
+    return { ok: true, baseUrl };
+}
+function gateIoFor(deps) {
+    return {
         log: deps.log,
         errorLog: deps.errorLog,
         promptLine: deps.promptLine,
         fetchJson: deps.fetchJson,
         postJson: deps.postJson,
     };
+}
+/**
+ * BAPI-1391: the two standalone gate actions. `--clear-gate`, and
+ * `--qualify-gate` without gate flags, act on the stored gate and stop: they
+ * never bootstrap, scaffold, or provision anything else. Returns null when
+ * neither was requested.
+ */
+async function runStandaloneGateAction(options, deps, gateIo, access, accessError, baseUrl) {
     const qualifyOnly = options.gate.qualifyGate && !hasExplicitGateInput(options.gate);
-    if (options.gate.clearGate || qualifyOnly) {
-        if (!access) {
-            deps.errorLog(`Bridge API access could not be resolved: ${accessError ?? "unknown"}`);
-            deps.errorLog("Nothing was written.");
-            return 1;
-        }
-        return options.gate.clearGate
-            ? runClearConductorGate(gateIo, access, { dryRun: options.dryRun })
-            : runQualifyConductorGate(gateIo, access, deps.gate, { dryRun: options.dryRun, baseUrl });
-    }
-    // ---- Phase 1: unified doctor, BEFORE every write -----------------------
-    deps.log("Phase 1/8 — running the unified epic-implementer doctor (read-only)…");
-    const firstReport = await deps.runDoctor({
-        access,
-        accessError,
-        reviewPolicySource: options.reviewPolicy,
-    });
-    deps.log(formatConductorInstallDoctorReport(firstReport));
-    if (conductorInstallDoctorHasFatal(firstReport)) {
-        deps.errorLog("");
-        deps.errorLog("Fatal prerequisite(s) above. Aborting before any write — no bootstrap, workflow, " +
-            "install-state, or verification step was attempted.");
+    if (!options.gate.clearGate && !qualifyOnly)
+        return null;
+    if (!access) {
+        deps.errorLog(`Bridge API access could not be resolved: ${accessError ?? "unknown"}`);
+        deps.errorLog("Nothing was written.");
         return 1;
     }
-    // ---- Review policy: per-run, and a repository default when explicit ----
+    return options.gate.clearGate
+        ? runClearConductorGate(gateIo, access, { dryRun: options.dryRun })
+        : runQualifyConductorGate(gateIo, access, deps.gate, { dryRun: options.dryRun, baseUrl });
+}
+function renderReviewPolicy(deps, options) {
     deps.log("");
     deps.log(`Review policy: ${options.reviewPolicy}`);
     deps.log(options.reviewPolicyExplicit
@@ -1674,15 +1720,15 @@ export async function runInstallBridgeConductorCli(argv, deps) {
             "Claude review workflow is scaffolded. A new feature-branch run receives " +
             "repository_policy at first approval when nothing else sets one — pass " +
             "--review-policy verdict_protocol to opt in to AI review.");
-    // ---- Executor preflight: AFTER the URL consent, BEFORE any mutation ----
-    // Placed here so an unsupported host or a missing `wt`/`git`/`claude` refuses
-    // before the bootstrap POST, the workflow write, or a single filesystem
-    // effect — provisioning a service that cannot run is worse than refusing —
-    // and before the dry-run return, so `--dry-run` reports the same refusal.
+}
+/**
+ * The executor preflight (BAPI-779): AFTER the URL consent, BEFORE any
+ * mutation, and before the dry-run return, so `--dry-run` reports the same
+ * refusal. Runs only with --executor-id.
+ */
+async function runExecutorPreflightPhase(options, deps, baseUrl, access) {
     const executor = deps.executorProvisioning;
-    const local = deps.localProvisioning;
     const executorRequested = Boolean(executor && options.executorId);
-    let executorPlans = null;
     if (executor && executorRequested) {
         deps.log("");
         deps.log("Executor provisioning — preflight (read-only)…");
@@ -1696,12 +1742,12 @@ export async function runInstallBridgeConductorCli(argv, deps) {
             // credential complaint: the only auth-related output above is the
             // advisory login line.
             deps.errorLog("");
-            deps.errorLog("Executor provisioning refused — this host cannot run a conductor executor.");
+            deps.errorLog("Executor provisioning refused — this host cannot run an Epic Implementer executor.");
             for (const remediation of preflight.remediations)
                 deps.errorLog(`  → ${remediation}`);
             deps.log("");
             deps.log("complete-with-manual-steps");
-            return 1;
+            return { kind: "refused" };
         }
         // The unit serves the repository this run resolved access for. When access
         // could not be resolved the doctor above has already produced a fatal
@@ -1713,15 +1759,78 @@ export async function runInstallBridgeConductorCli(argv, deps) {
             deps.errorLog(`Executor provisioning refused — ${planned.error}`);
             deps.log("");
             deps.log("complete-with-manual-steps");
-            return 1;
+            return { kind: "refused" };
         }
-        executorPlans = planned.plans;
+        return { kind: "ok", plans: planned.plans };
     }
-    else if (executor) {
+    if (executor) {
         deps.log("");
         deps.log("  executor provisioning skipped — pass --executor-id <id> to write and start a " +
             "service unit for this host.");
     }
+    return { kind: "ok", plans: null };
+}
+export async function runInstallBridgeConductorCli(argv, deps) {
+    const parsed = parseInstallBridgeConductorArgs(argv);
+    if (parsed.status === "help") {
+        deps.log(parsed.usage);
+        return 0;
+    }
+    if (parsed.status === "error") {
+        deps.errorLog(`Error: ${parsed.message}`);
+        deps.errorLog("");
+        deps.errorLog(getInstallBridgeConductorUsage());
+        return 1;
+    }
+    const options = parsed.options;
+    // BAPI-1461: production supplies the setup seams, which select the converging
+    // check → fix → check → verdict runner. A caller without them keeps the
+    // original phase sequence below, unchanged.
+    if (deps.setup !== undefined) {
+        return runConvergingSetup(options, deps, deps.setup);
+    }
+    if (options.removeMergeToken === true) {
+        deps.errorLog("Error: --remove-merge-token is unavailable here: this caller supplied no credential-store seams.");
+        return 1;
+    }
+    const confirmed = await resolveAndConfirmBaseUrl(options, deps, "Bootstrap against this URL? [y/N]: ");
+    if (!confirmed.ok)
+        return confirmed.code;
+    const baseUrl = confirmed.baseUrl;
+    const accessResult = await deps.resolveAccess(options.repo, baseUrl);
+    const access = accessResult.ok ? accessResult.access : null;
+    const accessError = accessResult.ok ? undefined : accessResult.error;
+    const gateIo = gateIoFor(deps);
+    const standalone = await runStandaloneGateAction(options, deps, gateIo, access, accessError, baseUrl);
+    if (standalone !== null)
+        return standalone;
+    // ---- Phase 1: unified doctor, BEFORE every write -----------------------
+    deps.log("Phase 1/8 — running the unified epic-implementer doctor (read-only)…");
+    const firstReport = await deps.runDoctor({
+        access,
+        accessError,
+        reviewPolicySource: options.reviewPolicy,
+    });
+    deps.log(formatConductorInstallDoctorReport(firstReport));
+    if (conductorInstallDoctorHasFatal(firstReport)) {
+        deps.errorLog("");
+        deps.errorLog("Fatal prerequisite(s) above. Aborting before any write — no bootstrap, workflow, " +
+            "install-state, or verification step was attempted.");
+        return 1;
+    }
+    // ---- Review policy: per-run, and a repository default when explicit ----
+    renderReviewPolicy(deps, options);
+    // ---- Executor preflight: AFTER the URL consent, BEFORE any mutation ----
+    // Placed here so an unsupported host or a missing `wt`/`git`/`claude` refuses
+    // before the bootstrap POST, the workflow write, or a single filesystem
+    // effect — provisioning a service that cannot run is worse than refusing —
+    // and before the dry-run return, so `--dry-run` reports the same refusal.
+    const executor = deps.executorProvisioning;
+    const local = deps.localProvisioning;
+    const preflight = await runExecutorPreflightPhase(options, deps, baseUrl, access);
+    if (preflight.kind === "refused")
+        return 1;
+    const executorPlans = preflight.plans;
     // ---- BAPI-1391: the repository gate, decided BEFORE any write ----------
     // Capability probe first (a read, after the base-URL consent), then the stored
     // gate, explicit gate flags, or a discovery proposal the owner confirms. Under
@@ -1793,12 +1902,12 @@ export async function runInstallBridgeConductorCli(argv, deps) {
         // hook installer, the capability recorder, or the phase's ledger probe —
         // this branch returns before every one of them.
         deps.log(local
-            ? "  Tool visibility: would ask its OWN consent before adding the `conductor` " +
+            ? "  Tool visibility: would ask its OWN consent before adding the `epic_implementer` " +
                 "profile to existing .mcp.json / .vscode/mcp.json / .cursor/mcp.json entries."
             : "  Tool visibility: skipped (this caller supplied no local-provisioning seams)");
         deps.log(local
             ? "  Local observability: would ask a SEPARATE consent before installing the " +
-                "managed conductor Git hooks; the ledger probe is read-only."
+                "managed Git hooks; the ledger probe is read-only."
             : "  Local observability: skipped (this caller supplied no local-provisioning seams)");
         if (executorPlans) {
             deps.log(`  Would write executor unit: ${executorPlans.install.unitPath}`);
@@ -1963,62 +2072,64 @@ export async function runInstallBridgeConductorCli(argv, deps) {
     });
     if (epicBranchCi.manualAction !== null)
         manualActions.push(epicBranchCi.manualAction);
-    // ---- Phase 3: optional workflow scaffold -------------------------------
-    deps.log("");
-    deps.log("Phase 3/8 — claude-review workflow…");
-    if (options.skipWorkflow || options.reviewPolicy !== "verdict_protocol") {
-        deps.log(`  skipped — the '${options.reviewPolicy}' review policy does not consume the ` +
-            "sticky verdict this workflow emits.");
-    }
-    else if (!options.allowedBot || !options.secretName || !options.branches) {
-        deps.log("  skipped — --allowed-bot, --secret-name, and --branches are required to render " +
-            "the workflow template.");
-    }
-    else {
-        const wantWorkflow = await confirm(deps, `Write ${CLAUDE_REVIEW_WORKFLOW_RELPATH}? [y/N]: `);
-        if (!wantWorkflow) {
-            deps.log("  declined — no file was written.");
+    if (options.reviewPolicy === "verdict_protocol") {
+        // ---- Phase 3: optional workflow scaffold -------------------------------
+        deps.log("");
+        deps.log("Phase 3/8 — claude-review workflow…");
+        if (options.skipWorkflow) {
+            deps.log(`  skipped — the '${options.reviewPolicy}' review policy does not consume the ` +
+                "sticky verdict this workflow emits.");
+        }
+        else if (!options.allowedBot || !options.secretName || !options.branches) {
+            deps.log("  skipped — --allowed-bot, --secret-name, and --branches are required to render " +
+                "the workflow template.");
         }
         else {
-            let content;
-            try {
-                content = renderClaudeReviewWorkflow({
-                    allowedBot: options.allowedBot,
-                    secretName: options.secretName,
-                    branches: options.branches,
-                });
+            const wantWorkflow = await confirm(deps, `Write ${CLAUDE_REVIEW_WORKFLOW_RELPATH}? [y/N]: `);
+            if (!wantWorkflow) {
+                deps.log("  declined — no file was written.");
             }
-            catch (err) {
-                deps.errorLog(`  workflow parameters rejected: ${err instanceof Error ? err.message : "invalid"}`);
-                return 1;
-            }
-            let result = await deps.writeWorkflow(deps.cwd, content, {});
-            if (result.ok && result.outcome === "skipped") {
-                // A DIFFERENT file already exists. Overwriting review automation needs
-                // its own decision — never inferred from the earlier consents.
-                const overwrite = await confirm(deps, `${CLAUDE_REVIEW_WORKFLOW_RELPATH} exists and differs. Overwrite? [y/N]: `);
-                if (!overwrite) {
-                    deps.log("  existing workflow left untouched.");
+            else {
+                let content;
+                try {
+                    content = renderClaudeReviewWorkflow({
+                        allowedBot: options.allowedBot,
+                        secretName: options.secretName,
+                        branches: options.branches,
+                    });
                 }
-                else {
-                    result = await deps.writeWorkflow(deps.cwd, content, { overwriteConsent: true });
+                catch (err) {
+                    deps.errorLog(`  workflow parameters rejected: ${err instanceof Error ? err.message : "invalid"}`);
+                    return 1;
                 }
-            }
-            if (!result.ok) {
-                deps.errorLog(`  workflow write failed: ${result.error}`);
-                return 1;
-            }
-            if (result.outcome === "written") {
-                deps.log(`  wrote ${CLAUDE_REVIEW_WORKFLOW_RELPATH}`);
-                const recorded = await deps.recordArtifact(deps.cwd, CLAUDE_REVIEW_WORKFLOW_RELPATH);
-                if (!recorded.ok) {
-                    // Advisory: install-state is a diagnostic aid, not a correctness
-                    // dependency, so a failure here warns rather than failing the run.
-                    deps.errorLog(`  note: install-state not updated (${recorded.error ?? "unknown"})`);
+                let result = await deps.writeWorkflow(deps.cwd, content, {});
+                if (result.ok && result.outcome === "skipped") {
+                    // A DIFFERENT file already exists. Overwriting review automation needs
+                    // its own decision — never inferred from the earlier consents.
+                    const overwrite = await confirm(deps, `${CLAUDE_REVIEW_WORKFLOW_RELPATH} exists and differs. Overwrite? [y/N]: `);
+                    if (!overwrite) {
+                        deps.log("  existing workflow left untouched.");
+                    }
+                    else {
+                        result = await deps.writeWorkflow(deps.cwd, content, { overwriteConsent: true });
+                    }
+                }
+                if (!result.ok) {
+                    deps.errorLog(`  workflow write failed: ${result.error}`);
+                    return 1;
+                }
+                if (result.outcome === "written") {
+                    deps.log(`  wrote ${CLAUDE_REVIEW_WORKFLOW_RELPATH}`);
+                    const recorded = await deps.recordArtifact(deps.cwd, CLAUDE_REVIEW_WORKFLOW_RELPATH);
+                    if (!recorded.ok) {
+                        // Advisory: install-state is a diagnostic aid, not a correctness
+                        // dependency, so a failure here warns rather than failing the run.
+                        deps.errorLog(`  note: install-state not updated (${recorded.error ?? "unknown"})`);
+                    }
+                }
+                else if (result.outcome === "unchanged") {
+                    deps.log(`  ${CLAUDE_REVIEW_WORKFLOW_RELPATH} already matches — nothing written.`);
                 }
-            }
-            else if (result.outcome === "unchanged") {
-                deps.log(`  ${CLAUDE_REVIEW_WORKFLOW_RELPATH} already matches — nothing written.`);
             }
         }
     }
@@ -2027,7 +2138,7 @@ export async function runInstallBridgeConductorCli(argv, deps) {
     // executor provisioning, and the capability report, so a run that stops at a
     // later phase has still closed the local gap it consented to close.
     deps.log("");
-    deps.log("Phase 4/8 — conductor tool visibility…");
+    deps.log("Phase 4/8 — Epic Implementer tool visibility…");
     if (local) {
         const outcome = await runConductorToolVisibilityPhase(deps, local);
         manualActions.push(...outcome.manualActions);
@@ -2040,7 +2151,7 @@ export async function runInstallBridgeConductorCli(argv, deps) {
             "`epic_implementer` profile to your host MCP configuration.");
     }
     deps.log("");
-    deps.log("Phase 5/8 — conductor local observability…");
+    deps.log("Phase 5/8 — local observability…");
     let observabilityFatal = false;
     if (local) {
         const outcome = await runConductorLocalObservabilityPhase(deps, local);
@@ -2050,7 +2161,7 @@ export async function runInstallBridgeConductorCli(argv, deps) {
     else {
         deps.log("  skipped — this caller supplied no local-provisioning seams.");
         manualActions.push("local observability: run the packaged `install conductor` command, or " +
-            "`epic-implementer install-git-hooks`, to install the managed conductor Git hooks.");
+            "`epic-implementer install-git-hooks`, to install the managed Git hooks.");
     }
     // The fail-loud hook-binary refusal (a package that ships no hook binary)
     // exits 1 — but only AFTER the phase's read-only ledger report has been
@@ -2166,3 +2277,851 @@ export async function runInstallBridgeConductorCli(argv, deps) {
     deps.log(allReady ? "complete" : "complete-with-manual-steps");
     return conductorInstallDoctorExitCode(finalReport);
 }
+// ---------------------------------------------------------------------------
+// The converging setup runner (BAPI-1461)
+// ---------------------------------------------------------------------------
+/**
+ * Ask for consent to one write surface. A missing prompt seam (no terminal) is
+ * a decline, never a default yes, and says so in one line naming the step.
+ */
+async function askConsent(deps, promptText, step) {
+    if (!deps.promptLine) {
+        deps.log(`  skipped ${step}: there is no interactive terminal, so this counts as declined.`);
+        return false;
+    }
+    return confirm(deps, promptText);
+}
+/**
+ * Collect every independent read-only finding. A failed read becomes an
+ * `unknown` finding, never an aborted collection, and nothing here writes.
+ */
+async function collectSetupEvidence(deps, setup, access, readiness, inputs) {
+    // Repository identity: the server's name first, the local remote second, and a
+    // disagreement reads nothing.
+    const identityResult = resolveGithubMergeRepositoryIdentity({
+        providerRepository: readiness?.provider_repository ?? null,
+        localRemote: inputs.localRemote,
+    });
+    const identity = identityResult.ok ? identityResult.identity : null;
+    const repository = identity !== null ? `${identity.owner}/${identity.repo}` : null;
+    // The stored test command, read back from the server.
+    let storedCommand = null;
+    let testCommand = { state: "unknown" };
+    try {
+        const read = await readStoredTestCommand(setup.testingConfig(access));
+        if (read.ok) {
+            storedCommand = read.testCommand;
+            testCommand = read.testCommand === null ? { state: "missing" } : { state: "stored" };
+        }
+    }
+    catch {
+        testCommand = { state: "unknown" };
+    }
+    // The managed workflow, through the installer's own read-only preflight.
+    let workflow = { state: "unknown" };
+    if (storedCommand === null) {
+        workflow = testCommand.state === "missing" ? { state: "needs_command" } : { state: "unknown" };
+    }
+    else if (inputs.githubSignIn === "signed_in") {
+        workflow = await assessWorkflow(setup, storedCommand);
+    }
+    // The setup pull request and, once it merged, the index.
+    let setupPullRequest = { state: "unknown" };
+    let index = { state: "not_applicable" };
+    if (repository !== null && inputs.githubSignIn === "signed_in") {
+        setupPullRequest = await readSetupPullRequest(setup.runGh, repository);
+        index = await assessSetupIndex(setupPullRequest, () => setup.fetchParseStatus(access), (mergeSha, indexedSha) => compareIndexedToMerge(setup.runGh, repository, mergeSha, indexedSha));
+    }
+    if (workflow.state === "installed" && setupPullRequest.state === "unknown") {
+        index = { state: "not_applicable" };
+    }
+    const mergeCredential = await assessMergeCredential(deps, setup, readiness, identity);
+    return {
+        evidence: {
+            readiness,
+            claudeLoggedIn: inputs.claudeLoggedIn,
+            githubSignIn: inputs.githubSignIn,
+            repositoryIdentity: identityResult.ok ? "resolved" : identityResult.reason,
+            testCommand,
+            workflow,
+            setupPullRequest,
+            index,
+            mergeCredential,
+            gateChangeDeclined: inputs.gateChangeDeclined,
+            advisories: inputs.advisories,
+        },
+        identity,
+        repository,
+        storedCommand,
+    };
+}
+/** Classify the managed workflow with the installer's read-only dry run. */
+async function assessWorkflow(setup, testCommand) {
+    let result;
+    try {
+        result = await setup.installCiWorkflow(testCommand, { dryRun: true, quiet: true });
+    }
+    catch {
+        return { state: "unknown" };
+    }
+    switch (result.outcome) {
+        case "identical":
+            return { state: "installed" };
+        case "existing-pr":
+            return { state: "pr_open", url: result.prUrl };
+        case "dry-run":
+            return { state: "needs_pr" };
+        case "installed-pr-opened":
+        case "upgrade-pr-opened":
+            // A dry run never opens one; treat an impossible answer as unknown.
+            return { state: "unknown" };
+        case "failed":
+            if (result.reason === "worktree_not_clean" || result.reason === "not_repository_root") {
+                return { state: "precondition", remedy: result.remediation };
+            }
+            return result.prUrl !== undefined && result.reason === "existing_pr_differs"
+                ? { state: "blocked", remedy: `${result.remediation} (${result.prUrl})` }
+                : { state: "blocked", remedy: result.remediation };
+    }
+}
+/**
+ * The merge credential, as setup's own check sees it. The order is fixed:
+ * `GITHUB_MERGE_TOKEN`, `BAPI_LOCAL_MERGE_TOKEN`, then the stored entry. An
+ * invalid env value is never rescued. Machine-user mode reads only its own key.
+ * A stored token counts only after the bounded probe confirms GitHub accepts
+ * it; an unavailable probe is uncertainty, never a rejection.
+ */
+async function assessMergeCredential(deps, setup, readiness, identity) {
+    const mode = readiness?.resolved_merge_execution_mode;
+    if (mode === "github_actions")
+        return { state: "not_applicable" };
+    if (mode === "machine_token") {
+        const machine = resolveLocalMergeCredentialDetailed(deps.env, "machine_token");
+        if (machine.status === "resolved")
+            return { state: "configured", source: "machine" };
+        if (machine.status === "invalid")
+            return { state: "env_invalid", sourceKey: machine.source_key };
+        return { state: "machine_missing" };
+    }
+    const env = resolveLocalMergeCredentialDetailed(deps.env, "local");
+    if (env.status === "resolved")
+        return { state: "configured", source: env.via_alias ? "alias" : "env" };
+    if (env.status === "invalid")
+        return { state: "env_invalid", sourceKey: env.source_key };
+    if (identity === null)
+        return { state: "missing" };
+    let stored;
+    try {
+        stored = await setup.readMergeToken(identity);
+    }
+    catch {
+        return { state: "unknown" };
+    }
+    if (stored.status === "unavailable")
+        return { state: "unknown" };
+    if (stored.status === "absent")
+        return { state: "missing" };
+    if (!isUsableMergeCredentialValue(stored.token))
+        return { state: "stored_rejected" };
+    let verdict;
+    try {
+        verdict = await setup.probeMergeToken({
+            repository: `${identity.owner}/${identity.repo}`,
+            credential: { kind: "local", token: stored.token },
+        });
+    }
+    catch {
+        return { state: "unknown" };
+    }
+    if (verdict === "passed")
+        return { state: "configured", source: "store" };
+    if (verdict === "credential_invalid" || verdict === "no_access")
+        return { state: "stored_rejected" };
+    return { state: "unknown" };
+}
+/**
+ * The doctor's store context for this run's repository. The store is read
+ * through setup's own seam, so the doctor and setup's check can never read two
+ * different stores, and the doctor probes a stored token the same bounded way.
+ */
+function storedMergeContextFor(setup, providerRepository, localRemote) {
+    return {
+        allowStoredEntry: true,
+        providerRepository,
+        localRemote,
+        readStored: (identity) => setup.readMergeToken(identity),
+        probe: (args) => setup.probeMergeToken(args),
+    };
+}
+/** Whether the gate or the supervisor defaults would change (no POST needed). */
+function gateOrDefaultsNeedWrite(gatePlan, readiness) {
+    if (gatePlan === null)
+        return false;
+    if (gatePlan.write !== null)
+        return true;
+    if (readiness === null)
+        return false;
+    return !readiness.supervisor.setup_present || !readiness.supervisor.config_present;
+}
+/** Whether a bootstrap preview shows anything the apply would change. */
+function bootstrapPreviewChangesSomething(preview) {
+    return (preview.approval_required ||
+        preview.changed_field_names.length > 0 ||
+        preview.setup_outcome !== "preserved" ||
+        preview.config_outcome !== "preserved");
+}
+function bootstrapRequestFor(options, checks) {
+    return {
+        required_checks: checks,
+        ...(options.reviewPolicyExplicit ? { review_policy: { source: options.reviewPolicy } } : {}),
+        merge_approval_required: "true",
+        ...(options.replaceDoneGate ? { replace_done_gate: true } : {}),
+    };
+}
+/**
+ * Fix: store the repository gate and the safe supervisor defaults, under ONE
+ * consent for this surface (plus the separate exact approval a weakening change
+ * needs). Never inferred from the setup-PR or any other consent.
+ */
+async function fixGateAndDefaults(deps, options, access, gatePlan) {
+    const gateIo = gateIoFor(deps);
+    deps.log("");
+    deps.log("Repository gate and safe defaults");
+    const ok = await askConsent(deps, "Store the repository gate and the safe supervisor defaults now? [y/N]: ", "storing the repository gate and the safe supervisor defaults");
+    if (!ok) {
+        deps.log("  declined — nothing was written.");
+        return false;
+    }
+    const checks = gatePlan.desired.providerChecks;
+    const request = bootstrapRequestFor(options, checks);
+    const gateFirst = gatePlan.write !== null && (checks.length === 0 || gatePlan.current.source === "stored");
+    if (gateFirst && (await storeConductorGate(gateIo, access, gatePlan)) === null)
+        return false;
+    let preview;
+    try {
+        preview = await previewConductorSupervisorBootstrap(access, request, deps.postJson);
+    }
+    catch (err) {
+        reportBootstrapFailure(deps, "preview", classifySupervisorBootstrapFailure(err));
+        return false;
+    }
+    if (bootstrapPreviewChangesSomething(preview)) {
+        renderBootstrapPreview(deps, preview);
+        let applyRequest = request;
+        if (preview.approval_required) {
+            const exact = await askConsent(deps, "Approve EXACTLY the gate changes listed above? [y/N]: ", "approving the listed gate changes");
+            if (!exact || !preview.approval_token) {
+                deps.log("  not approved — every configured requirement is unchanged.");
+                return false;
+            }
+            applyRequest = { ...request, approval: { approve: true, approval_token: preview.approval_token } };
+        }
+        let response;
+        try {
+            response = await bootstrapConductorSupervisorDefaults(access, applyRequest, deps.postJson);
+        }
+        catch (err) {
+            reportBootstrapFailure(deps, "apply", classifySupervisorBootstrapFailure(err));
+            return false;
+        }
+        if (response.setup_outcome === null || response.config_outcome === null) {
+            reportBootstrapFailure(deps, "apply", "unsupported-protocol");
+            return false;
+        }
+        renderBootstrapOutcome(deps, response);
+    }
+    else {
+        deps.log("  the safe supervisor defaults are already in place — nothing to write.");
+    }
+    if (!gateFirst && gatePlan.write !== null && (await storeConductorGate(gateIo, access, gatePlan)) === null) {
+        return false;
+    }
+    return true;
+}
+/**
+ * Fix: save the repository's test command through the setup route, after one
+ * contextual agreement. The command is never run here. Only the value read back
+ * from the server is used afterwards.
+ */
+async function fixTestCommand(deps, setup, access) {
+    const config = setup.testingConfig(access);
+    deps.log("");
+    deps.log("Test command");
+    let detection;
+    try {
+        detection = await detectTestCommand({ skipStoredRead: true }, { config, readFile: (relPath) => setup.readRepositoryFile(relPath) });
+    }
+    catch {
+        detection = { status: "failed", reason: "repository_read_failed" };
+    }
+    let command = null;
+    if (detection.status === "detected") {
+        deps.log(`  Proposed: \`${detection.selected}\` (found in ${detection.provenance}). It is not run now.`);
+        const save = await askConsent(deps, "Save this as the repository's test command? [y/N]: ", "saving the test command");
+        if (save)
+            command = detection.selected;
+    }
+    else {
+        deps.log("  No test command could be found in this repository.");
+        if (!deps.promptLine) {
+            deps.log("  skipped saving a test command: there is no interactive terminal, so this counts as declined.");
+        }
+        else {
+            const typed = (await deps.promptLine("Test command that runs your tests (press Enter to skip; a command you type is saved): ")).trim();
+            if (typed.length > 0)
+                command = typed;
+        }
+    }
+    if (command === null) {
+        deps.log("  not saved — the test command stays a step left.");
+        return null;
+    }
+    try {
+        command = validateTestCommand(command);
+    }
+    catch (err) {
+        const reason = err instanceof TestCommandValidationError ? err.reason : "invalid";
+        deps.log(`  not saved — that command cannot be stored (${reason}).`);
+        return null;
+    }
+    const written = await writeStoredTestCommand(config, command);
+    if (!written.ok) {
+        deps.log(`  the save did not complete (${written.reason}); reading the stored value back…`);
+    }
+    // Read back after a save AND after an uncertain one; never retry the write.
+    const readBack = await readStoredTestCommand(config);
+    if (!readBack.ok || readBack.testCommand === null) {
+        deps.log("  the stored test command could not be confirmed; it stays a step left.");
+        return null;
+    }
+    deps.log("  saved — the stored test command is now in place.");
+    return readBack.testCommand;
+}
+/** Fix: open the one setup pull request through the artifact-set installer. */
+async function fixSetupPullRequest(deps, setup, testCommand, repository) {
+    deps.log("");
+    deps.log("CI workflow");
+    let result;
+    try {
+        result = await setup.installCiWorkflow(testCommand, { dryRun: false }, (promptText) => askConsent(deps, promptText, "opening the setup pull request"));
+    }
+    catch {
+        deps.log("  the setup pull request could not be prepared; re-run setup.");
+        return { workflow: { state: "unknown" }, pr: null };
+    }
+    switch (result.outcome) {
+        case "installed-pr-opened":
+        case "upgrade-pr-opened":
+            deps.log(`  opened the setup PR: ${result.prUrl}`);
+            return { workflow: { state: "pr_open", url: result.prUrl }, pr: null };
+        case "existing-pr":
+            deps.log(`  the setup PR is already open: ${result.prUrl}`);
+            return { workflow: { state: "pr_open", url: result.prUrl }, pr: null };
+        case "identical":
+            deps.log("  the CI workflow is already in place — nothing to change.");
+            return { workflow: { state: "installed" }, pr: null };
+        case "dry-run":
+            return { workflow: { state: "needs_pr" }, pr: null };
+        case "failed": {
+            if (result.reason === "consent_declined") {
+                deps.log("  declined — no branch was pushed and no pull request was opened.");
+                return { workflow: { state: "needs_pr" }, pr: null };
+            }
+            deps.log(`  the setup pull request was not opened (${result.reason}): ${result.remediation}`);
+            if (result.prUrl !== undefined)
+                deps.log(`  pull request: ${result.prUrl}`);
+            if (result.compareUrl !== undefined)
+                deps.log(`  open it by hand: ${result.compareUrl}`);
+            // An uncertain creation is re-read, never repeated.
+            const pr = repository !== null ? await readSetupPullRequest(setup.runGh, repository) : null;
+            if (pr?.state === "open")
+                return { workflow: { state: "pr_open", url: pr.url }, pr };
+            return { workflow: { state: "blocked", remedy: result.remediation }, pr };
+        }
+    }
+}
+/**
+ * Fix: store (or replace) the GitHub merge token for this repository, after its
+ * own consent, read with no echo. Never printed, logged, committed, or sent.
+ */
+async function fixMergeToken(deps, setup, identity, replacing) {
+    const repository = `${identity.owner}/${identity.repo}`;
+    deps.log("");
+    deps.log("GitHub merge token");
+    if (replacing) {
+        deps.log(`  GitHub rejected the merge token stored for ${repository} (expired, revoked, or without write access).`);
+    }
+    else {
+        deps.log(`  Merges need a GitHub token with write access to ${repository}. Setup can keep it in your ` +
+            "user credential store on this computer, for this repository only. It is never sent to Bridge.");
+    }
+    const ok = await askConsent(deps, replacing
+        ? `Replace the stored merge token for ${repository}? [y/N]: `
+        : `Store a GitHub merge token for ${repository} on this computer? [y/N]: `, replacing ? "replacing the stored merge token" : "storing a merge token");
+    if (!ok) {
+        deps.log(replacing
+            ? "  declined — the stored token was left as it is."
+            : "  declined — nothing was stored. You can set GITHUB_MERGE_TOKEN instead.");
+        return false;
+    }
+    if (!setup.promptSecret) {
+        deps.log("  skipped reading the token: there is no interactive terminal. Nothing was stored.");
+        return false;
+    }
+    let token = "";
+    try {
+        token = (await setup.promptSecret("GitHub merge token (input is hidden): ")).trim();
+    }
+    catch {
+        token = "";
+    }
+    if (token.length === 0) {
+        deps.log("  no token was entered; nothing was stored.");
+        return false;
+    }
+    if (!isUsableMergeCredentialValue(token)) {
+        deps.log("  that value cannot be a GitHub token (it has spaces or control characters); nothing was stored.");
+        return false;
+    }
+    const result = await setup.storeMergeToken(identity, token);
+    let stored = result.ok;
+    if (!result.ok && result.kind === "post-rename-uncertain") {
+        // Uncertain publication: read the entry back before deciding.
+        const reread = await setup.readMergeToken(identity);
+        stored = reread.status === "present" && reread.token === token;
+    }
+    token = "";
+    if (!stored) {
+        deps.log(`  the token could not be stored (${result.ok ? "unconfirmed" : result.kind}); nothing changed.`);
+        return false;
+    }
+    deps.log(`  stored the merge token for ${repository} on this computer.`);
+    if (replacing) {
+        deps.log("  A run already in progress keeps the token its executor started with until that executor restarts.");
+    }
+    return true;
+}
+/**
+ * Fix: queue ONE repository parse when the merged setup PR is not yet indexed.
+ * Re-reads the parse status first and never queues while one is queued or
+ * running. Concurrent runs rely on the server's coalescing.
+ */
+async function fixReindex(deps, setup, access) {
+    deps.log("");
+    deps.log("Repository indexing");
+    let status;
+    try {
+        status = await setup.fetchParseStatus(access);
+    }
+    catch {
+        deps.log("  the indexing status could not be read; nothing was queued. Re-run setup later.");
+        return { state: "unknown" };
+    }
+    if (status.status === "queued" || status.status === "in_progress") {
+        deps.log("  indexing is already running; nothing new was queued.");
+        return { state: "in_progress" };
+    }
+    try {
+        await setup.triggerParse(access);
+    }
+    catch {
+        deps.log("  indexing could not be queued right now; re-run setup later.");
+        return { state: "behind" };
+    }
+    deps.log("  queued one repository index so it reaches the merged setup PR. It is pending until it finishes.");
+    return { state: "queued_by_setup" };
+}
+/**
+ * `--remove-merge-token`: remove this repository's stored merge token under the
+ * store lock, behind its own consent, then stop. The repository comes from the
+ * local github.com remote, so no network call is needed. Read-only on --dry-run.
+ */
+async function runRemoveMergeToken(options, deps, setup) {
+    const remote = await setup.readLocalGithubRemote();
+    const identity = resolveGithubMergeRepositoryIdentity({ localRemote: remote });
+    if (!identity.ok) {
+        deps.errorLog("Could not tell which repository's token to remove: run this from a checkout whose `origin` " +
+            "remote is the github.com repository. Nothing was removed.");
+        return 1;
+    }
+    const repository = `${identity.identity.owner}/${identity.identity.repo}`;
+    deps.log(`Stored GitHub merge token for ${repository}`);
+    if (options.dryRun) {
+        deps.log("  Dry run — would ask, then remove the token stored on this computer. Nothing was removed.");
+        return 0;
+    }
+    const ok = await askConsent(deps, `Remove the merge token stored for ${repository} on this computer? [y/N]: `, "removing the stored merge token");
+    if (!ok) {
+        deps.log("  declined — nothing was removed.");
+        return 0;
+    }
+    const result = await setup.removeMergeToken(identity.identity);
+    if (!result.ok) {
+        deps.errorLog(`  the token could not be removed (${result.kind}); nothing changed.`);
+        return 1;
+    }
+    deps.log(result.action === "removed"
+        ? `  removed the merge token stored for ${repository}.`
+        : `  no merge token was stored for ${repository}; nothing to remove.`);
+    deps.log("  This deletes the local copy only; it does not revoke the token at GitHub. GITHUB_MERGE_TOKEN or " +
+        "BAPI_LOCAL_MERGE_TOKEN in your environment, and a token already handed to a running executor, " +
+        "still work. To cut access now, revoke the token at GitHub and stop the executor.");
+    return 0;
+}
+/** Advisory, never blocking: local extras the default flow no longer asks about. */
+function localAdvisories(report) {
+    const out = [];
+    const section = (id) => report.sections.find((s) => s.id === id);
+    const profile = section("epic-implementer-profile-token");
+    if (profile !== undefined && profile.status !== "ok") {
+        out.push("to see the Epic Implementer tools in your editor, add `epic_implementer` to BRIDGE_MCP_PROFILE " +
+            "in your MCP configuration, then restart the editor");
+    }
+    const hooks = section("conductor-hook-targets");
+    if (hooks !== undefined && hooks.status !== "ok") {
+        out.push("for local event history, run `epic-implementer install-git-hooks`");
+    }
+    return out;
+}
+/**
+ * The converging setup: check everything read-only, fix only what is missing
+ * (each fix behind its own consent), check again, and print one verdict.
+ *
+ * The four pinned properties hold: base-URL consent comes before any network
+ * call (every run, never persisted); --dry-run writes nothing; each write
+ * surface asks for itself; and executor readiness is only ever the server's
+ * observation.
+ */
+async function runConvergingSetup(options, deps, setup) {
+    if (options.removeMergeToken === true)
+        return runRemoveMergeToken(options, deps, setup);
+    // ---- First operational check: the Claude login marker (a file read only) --
+    let claudeLoggedIn = null;
+    try {
+        claudeLoggedIn = (await setup.detectClaudeLogin()).detected;
+    }
+    catch {
+        claudeLoggedIn = false;
+    }
+    // ---- Base URL, confirmed before any network call -----------------------
+    const confirmed = await resolveAndConfirmBaseUrl(options, deps, "Set up against this URL? [y/N]: ");
+    if (!confirmed.ok)
+        return confirmed.code;
+    const baseUrl = confirmed.baseUrl;
+    // ---- GitHub sign-in, right after the URL consent -----------------------
+    let githubSignIn = "unavailable";
+    try {
+        githubSignIn = await setup.checkGithubSignIn();
+    }
+    catch {
+        githubSignIn = "unavailable";
+    }
+    let localRemote = null;
+    try {
+        localRemote = await setup.readLocalGithubRemote();
+    }
+    catch {
+        localRemote = null;
+    }
+    // ---- Repository: ask only when it is genuinely ambiguous ----------------
+    let accessResult = await deps.resolveAccess(options.repo, baseUrl);
+    if (!accessResult.ok && options.repo === undefined && deps.promptLine) {
+        const suggestion = localRemote?.split("/")[1] ?? null;
+        deps.log("");
+        deps.log("Which repository is this? Bridge could not tell from the environment or .bridge/config.");
+        const answer = (await deps.promptLine(suggestion !== null
+            ? `Bridge repository name [${suggestion}]: `
+            : "Bridge repository name (press Enter to skip): ")).trim();
+        const chosen = answer.length > 0 ? answer : suggestion;
+        if (chosen !== null)
+            accessResult = await deps.resolveAccess(chosen, baseUrl);
+    }
+    const access = accessResult.ok ? accessResult.access : null;
+    const accessError = accessResult.ok ? undefined : accessResult.error;
+    const gateIo = gateIoFor(deps);
+    const standalone = await runStandaloneGateAction(options, deps, gateIo, access, accessError, baseUrl);
+    if (standalone !== null)
+        return standalone;
+    // ---- Check 1: the read-only doctor (no deny probe yet) ------------------
+    deps.log("");
+    deps.log("Checking your setup (read-only)…");
+    const storedContext = storedMergeContextFor(setup, null, localRemote);
+    const firstReport = await deps.runDoctor({
+        access,
+        accessError,
+        reviewPolicySource: options.reviewPolicy,
+        skipDenyProbe: true,
+        storedMergeCredential: storedContext,
+    });
+    if (conductorInstallDoctorHasFatal(firstReport) || !access) {
+        deps.log(formatConductorInstallDoctorReport(firstReport));
+        deps.errorLog("");
+        deps.errorLog("Setup cannot continue until the problem above is fixed. Nothing was written.");
+        deps.log("");
+        deps.log("Not ready: 1 step left");
+        deps.log("complete-with-manual-steps");
+        return 1;
+    }
+    const preflight = await runExecutorPreflightPhase(options, deps, baseUrl, access);
+    if (preflight.kind === "refused")
+        return 1;
+    const executorPlans = preflight.plans;
+    // ---- The gate: explicit flags win; otherwise the CI check is added ------
+    const gatePhase = await resolveConductorGate(gateIo, access, options.gate, deps.gate, {
+        dryRun: options.dryRun,
+        ...(hasExplicitGateInput(options.gate) ? {} : { ensureProviderCheck: EPIC_IMPLEMENTER_CI_CHECK_NAME }),
+    });
+    if (gatePhase.kind === "exit")
+        return gatePhase.code;
+    const gatePlan = gatePhase.kind === "plan" ? gatePhase.plan : null;
+    const gateChangeDeclined = gatePhase.kind === "plan" && gatePhase.ensureDeclined === true;
+    const advisories = localAdvisories(firstReport);
+    const collectInputs = { claudeLoggedIn, githubSignIn, localRemote, gateChangeDeclined, advisories };
+    const first = await collectSetupEvidence(deps, setup, access, firstReport.readiness, collectInputs);
+    const state = {
+        evidence: first.evidence,
+        identity: first.identity,
+        repository: first.repository,
+        storedCommand: first.storedCommand,
+        failedOperations: [],
+    };
+    const firstItems = projectSetupItems(state.evidence);
+    for (const line of renderSetupAssessment(firstItems, "What setup found"))
+        deps.log(line);
+    const fixes = planSetupFixes(state.evidence, {
+        gateOrDefaultsNeedWrite: gateOrDefaultsNeedWrite(gatePlan, firstReport.readiness),
+        dryRun: options.dryRun,
+    });
+    // ---- Dry run: preview only, before every write and write prompt ---------
+    if (options.dryRun) {
+        deps.log("");
+        deps.log("Dry run — nothing was written and nothing was asked.");
+        if (fixes.length === 0)
+            deps.log("  No fix is needed.");
+        for (const fix of fixes)
+            deps.log(`  Would offer: ${DRY_RUN_FIX_TEXT[fix]}`);
+        if (executorPlans) {
+            deps.log(`  Would write executor unit: ${executorPlans.install.unitPath}`);
+            deps.log(`  Would start it with:       ${executorPlans.start.manualCommand}`);
+        }
+        deps.log("");
+        deps.log(setupVerdictLine(firstItems));
+        deps.log("complete-with-manual-steps (dry run)");
+        return 0;
+    }
+    // ---- Fix only what is missing, once, in order ---------------------------
+    if (fixes.length > 0) {
+        deps.log("");
+        deps.log("Fixing what is missing…");
+    }
+    for (const fix of fixes) {
+        if (fix === "save_test_command") {
+            const saved = await fixTestCommand(deps, setup, access);
+            if (saved !== null) {
+                state.storedCommand = saved;
+                state.evidence = { ...state.evidence, testCommand: { state: "stored" } };
+            }
+        }
+        else if (fix === "setup_pr") {
+            if (state.storedCommand === null) {
+                deps.log("");
+                deps.log("CI workflow");
+                deps.log("  skipped — it is built from the stored test command, which is not saved yet.");
+                continue;
+            }
+            const opened = await fixSetupPullRequest(deps, setup, state.storedCommand, state.repository);
+            state.evidence = { ...state.evidence, workflow: opened.workflow };
+        }
+        else if (fix === "gate_and_defaults" && gatePlan !== null) {
+            await fixGateAndDefaults(deps, options, access, gatePlan);
+        }
+        else if (fix === "merge_token" && state.identity !== null) {
+            await fixMergeToken(deps, setup, state.identity, state.evidence.mergeCredential.state === "stored_rejected");
+        }
+        else if (fix === "reindex") {
+            state.evidence = { ...state.evidence, index: await fixReindex(deps, setup, access) };
+        }
+    }
+    // ---- Explicit operations, each behind its own consent (unchanged) -------
+    if (options.gate.qualifyGate && gatePlan !== null && gatePlan.desired.localCommands.length > 0) {
+        await runConductorGateQualification(gateIo, access, deps.gate, {
+            revision: gatePlan.current.revision,
+            baseUrl,
+        });
+    }
+    if (options.epicBranchCiDecision !== undefined) {
+        const epicBranchCi = await runEpicBranchCiInspection(gateIo, access, deps.gate, {
+            decisionFlag: options.epicBranchCiDecision,
+            dryRun: false,
+        });
+        if (epicBranchCi.manualAction !== null)
+            state.evidence.advisories.push(epicBranchCi.manualAction);
+    }
+    if (options.reviewPolicy === "verdict_protocol" && !options.skipWorkflow) {
+        await runClaudeReviewWorkflowOperation(deps, options, state);
+    }
+    if (options.epicKey && options.planFile) {
+        deps.log("");
+        deps.log("Verifying the plan with `setup-epic --dry-run`…");
+        const verification = await deps.runSetupEpicDryRun([
+            "--dry-run",
+            "--epic-key",
+            options.epicKey,
+            "--plan-file",
+            options.planFile,
+            "--review-policy",
+            options.reviewPolicy,
+            ...(options.repo ? ["--repo", options.repo] : []),
+        ]);
+        if (verification.exitCode !== 0) {
+            state.failedOperations.push({
+                id: "setup-epic-verification",
+                label: "Plan verification",
+                state: "needs_action",
+                blocking: true,
+                remedy: "fix the plan problems `setup-epic --dry-run` reported, then re-run setup",
+            });
+        }
+        else {
+            deps.log("  passed.");
+        }
+    }
+    let observedReadiness = null;
+    if (deps.executorProvisioning && executorPlans) {
+        deps.log("");
+        deps.log("Executor service");
+        observedReadiness = await runExecutorProvisioningPhase(deps, deps.executorProvisioning, executorPlans, access);
+    }
+    // ---- Check 2: the closing assessment (deny probe runs once, here) -------
+    deps.log("");
+    deps.log("Checking again…");
+    const finalReport = await deps.runDoctor({
+        access,
+        reviewPolicySource: options.reviewPolicy,
+        storedMergeCredential: storedMergeContextFor(setup, firstReport.readiness?.provider_repository ?? null, localRemote),
+    });
+    const finalReadiness = observedReadiness ?? finalReport.readiness;
+    const closing = await collectSetupEvidence(deps, setup, access, finalReadiness, {
+        ...collectInputs,
+        advisories: state.evidence.advisories,
+    });
+    // A parse this run queued is pending, whatever the first read-back says.
+    if (state.evidence.index.state === "queued_by_setup" && closing.evidence.index.state !== "reached") {
+        closing.evidence.index = { state: "queued_by_setup" };
+    }
+    const items = [...projectSetupItems(closing.evidence), ...state.failedOperations];
+    if (deniesEnforcementUnknown(finalReport)) {
+        items.push({
+            id: "conductor.deny-enforcement",
+            label: catalogLabel("conductor.deny-enforcement"),
+            state: "unknown",
+            blocking: false,
+            remedy: "the worker safety check could not run; run `epic-implementer doctor` to see why",
+        });
+    }
+    // ---- BAPI-1260: the reusable launch profile (explicit) ------------------
+    if (options.launchProfile !== undefined) {
+        const launch = await runLaunchProfilePhase(deps, options, {
+            access,
+            baseUrl,
+            readiness: finalReadiness,
+            actorObserved: observedReadiness !== null || finalReadiness?.executor.ready === true,
+            runtime: resolveLaunchRuntime(deps.executorProvisioning, options.executionMode ?? "local"),
+        });
+        if (!launch.complete) {
+            items.push({
+                id: "launch-profile",
+                label: `Launch profile '${options.launchProfile}'`,
+                state: "needs_action",
+                blocking: true,
+                remedy: "finish the launch-profile steps listed above, then re-run setup with --launch-profile",
+            });
+        }
+    }
+    for (const line of renderSetupAssessment(items, "Where things stand"))
+        deps.log(line);
+    for (const advisory of closing.evidence.advisories)
+        deps.log(`  - ${advisory}`);
+    deps.log("");
+    const ready = unmetBlockingItems(items).length === 0;
+    deps.log(setupVerdictLine(items));
+    deps.log(ready ? "complete" : "complete-with-manual-steps");
+    return ready ? conductorInstallDoctorExitCode(finalReport) : 1;
+}
+/** The deny probe could not answer: an advisory, never readiness. */
+function deniesEnforcementUnknown(report) {
+    const deny = report.legacyConductor?.deny_enforcement;
+    return deny !== undefined && deny !== null && deny.enforced !== true;
+}
+/** Short previews of each fix for --dry-run. */
+const DRY_RUN_FIX_TEXT = Object.freeze({
+    save_test_command: "save the repository's test command (one question, then PUT /setup/testing-config)",
+    setup_pr: "open the setup pull request with the CI workflow (its own consent)",
+    gate_and_defaults: "store the repository gate and the safe supervisor defaults (its own consent)",
+    merge_token: "store a GitHub merge token on this computer (its own consent, read with no echo)",
+    reindex: "queue one repository index so it reaches the merged setup PR",
+});
+/**
+ * The claude-review workflow, only for an explicit `--review-policy
+ * verdict_protocol`: its own write consent and a separate overwrite consent.
+ */
+async function runClaudeReviewWorkflowOperation(deps, options, state) {
+    deps.log("");
+    deps.log("Claude review workflow");
+    if (!options.allowedBot || !options.secretName || !options.branches) {
+        deps.log("  skipped — --allowed-bot, --secret-name, and --branches are required to write it.");
+        return;
+    }
+    const want = await askConsent(deps, `Write ${CLAUDE_REVIEW_WORKFLOW_RELPATH}? [y/N]: `, "writing the review workflow");
+    if (!want) {
+        deps.log("  declined — no file was written.");
+        return;
+    }
+    let content;
+    try {
+        content = renderClaudeReviewWorkflow({
+            allowedBot: options.allowedBot,
+            secretName: options.secretName,
+            branches: options.branches,
+        });
+    }
+    catch (err) {
+        deps.errorLog(`  workflow parameters rejected: ${err instanceof Error ? err.message : "invalid"}`);
+        state.failedOperations.push({
+            id: "claude-review-workflow",
+            label: "Claude review workflow",
+            state: "needs_action",
+            blocking: true,
+            remedy: "fix --allowed-bot, --secret-name, or --branches, then re-run setup",
+        });
+        return;
+    }
+    let result = await deps.writeWorkflow(deps.cwd, content, {});
+    if (result.ok && result.outcome === "skipped") {
+        const overwrite = await askConsent(deps, `${CLAUDE_REVIEW_WORKFLOW_RELPATH} exists and differs. Overwrite? [y/N]: `, "overwriting the review workflow");
+        if (overwrite)
+            result = await deps.writeWorkflow(deps.cwd, content, { overwriteConsent: true });
+        else
+            deps.log("  existing workflow left untouched.");
+    }
+    if (!result.ok) {
+        deps.errorLog(`  workflow write failed: ${result.error}`);
+        state.failedOperations.push({
+            id: "claude-review-workflow",
+            label: "Claude review workflow",
+            state: "needs_action",
+            blocking: true,
+            remedy: "re-run setup to write the review workflow",
+        });
+        return;
+    }
+    if (result.outcome === "written") {
+        deps.log(`  wrote ${CLAUDE_REVIEW_WORKFLOW_RELPATH}`);
+        const recorded = await deps.recordArtifact(deps.cwd, CLAUDE_REVIEW_WORKFLOW_RELPATH);
+        if (!recorded.ok)
+            deps.errorLog(`  note: install-state not updated (${recorded.error ?? "unknown"})`);
+    }
+    else if (result.outcome === "unchanged") {
+        deps.log(`  ${CLAUDE_REVIEW_WORKFLOW_RELPATH} already matches — nothing written.`);
+    }
+}