fix(ci): point the merge brain at a populated store (verisimdb-data)

[hyperpolymath]

The problem

Merge Orchestrate (scheduled) is active and has been ticking hourly at :17. It reads MERGE_ORCH_STORE, which defaults to the in-repo data/verisim.

data/verisim/ contains:

annealing-states  dispatch  health  neural-states  outcomes  patterns  recipes  scan-history

No observations/. And lib/merge_orchestration/loop.ex:30 documents that as exactly what the loop reads:

* `observations/*.json`        — per-PR observations (from `observe.sh`)

So every tick has sensed nothing, decided nothing, and uploaded an empty merge-decisions.jsonl that expired after 7 days.

The fix this workflow already specified

Its own header comment named it:

"Point MERGE_ORCH_STORE at a populated store (e.g. a checked-out verisim-data) via a repo variable; the default data/verisim is the in-repo store."

This does that as the default rather than requiring a repo variable be set by hand. Checks out hyperpolymath/verisimdb-data (public) at ./store and defaults MERGE_ORCH_STORE to it. The vars.MERGE_ORCH_STORE override still wins.

That repo is the right target and is demonstrably live — last push 2026-08-25T06:37Z with commit scan: estate rescan (run 32810961229), and 20+ modules in this repo already read from it (verisim_connector.ex, fleet_dispatcher.ex, dispatch_manifest.ex, pattern_registry.ex, outcome_tracker.ex, …).

Safety

• The brain stays token-free. This is a read-only checkout of a public repo; no PAT, no write. The architecture's whole point — that a compromised scanner cannot write to 400 repos — is preserved.
• Nothing merges. This only lets the cycle see real observations and write a manifest artifact. actuate.sh remains unwired per the owner ruling of 2026-08-25.
• No behaviour change without the companion PR. The producer that fills observations/ is hyperpolymath/.git-private-farm#127. Until that lands, this checkout finds an empty observations/ and the cycle behaves exactly as it does today.

Lockfile

No actions.lock change required. The added step reuses actions/checkout@v7.0.1, already registered for this workflow at .github/workflows/actions.lock:52. Verified rather than assumed — an unregistered entry would kill the workflow at 0s with startup_failure.

Companion

• hyperpolymath/.git-private-farm#127 — wires observe.sh, the producer
• fix(ci): dispatch to .git-private-farm, not the nonexistent dot-git-private-farm #720 — unrelated, fixes the dot-git-private-farm dispatch 404

🤖 Generated with Claude Code

[gitar-bot]

Important

You are using the Gitar free plan. Upgrade to unlock code review, CI analysis, auto-apply, custom automations, and more.

_Gitar