[kyle-sexton]

Refs: #9276

Summary

This is PR 9 of the #9276 plan. The new merge.lane-prs setting, default native, retires pr-merge's gate and enqueue for lanes App pull requests. Since #9399 those pull requests merge through GitHub's native auto-merge: the enable-auto-merge job arms them and ci-status gates them. Under native, the merge job's candidate listing stops asking for them, so the gate no longer scores, escalates, toggles or enqueues one. Adopted owner pull requests and Dependabot's are listed and gated exactly as before.

This repository ships on lane-prs: gate, so merging this PR changes no behavior.

• Native auto-merge currently arms lanes App PRs that have no pr-verify PASS, and pr-merge's gate is the only place the verdict and the FAIL cap are enforced.
• The post-merge check also reads a native merge's missing pin comment as a failure (fix(source-control): judge native lane auto-merges without a pin read-back #9447).
• So docs/conventions/pr-pipeline.yaml sets gate, and the key's default stays native.
• Switching this repository to native is a one-line follow-up that depends on the native-merge verdict fix and fix(source-control): judge native lane auto-merges without a pin read-back #9447. Make that change only after both land.

Fix

• docs/conventions/pr-pipeline/pr-pipeline.schema.json: adds merge.lane-prs, enum native | gate, default native.
• .github/actions/resolve-config/resolve.mjs: resolveMerge returns lane-prs, defaulting to native.
• docs/conventions/pr-pipeline.yaml: sets lane-prs: gate for now. A comment explains both values and the two prerequisites for switching to native.
• .github/workflows/pr-merge.yml, merge job:
  • Read report-only outputs lane-prs as resolve-config resolved it.
  • List the candidate PRs adds app/<agent-identity slug> to the authors only when the value is not native. The slug is still validated.
  • The jq that builds candidates and drafts reads (add // []), so a run with no listed author yields an empty list instead of an error.
• Untouched:
  • The enable-auto-merge job, post-merge-dispatch, dispatch-full-run, refire-refused, clear-escalations (it lists pull requests itself), the Dependabot tiers and owner adoption.
  • head-ref-map.mjs, rotation.mjs and babysit_verify_evidence.py. Those belong to a peer session, and they only see fewer candidates.
• gate lists the lanes App's pull requests for the gate as well, which is the behavior on main today: the authors list, its order and the gh calls are identical. enable-auto-merge arms lane pull requests in both modes, so gate is today's double path, not a gate-only fallback.
• README: a paragraph under "Native auto-merge". Changelog: a pr-pipeline fragment.

Calls removed per pr-merge run once this repository sets native (no call is added in either mode)

• Always: one gh pr list --author app/melodic-automation-lanes call per merge run (GITHUB_TOKEN).
• For each open lanes App pull request:
  • Every gate read and write the gate made on it: lane token, plus the GITHUB_TOKEN verdict and review-evidence reads.
  • Its skip-unchanged GraphQL share.
  • Its pin comment and merge-queue enqueue.
• Estimate per lane pull request per run:
  • About 38 to 131 GITHUB_TOKEN calls and 120 to 160 lane-token calls.
  • Basis: sweep-cost lines of merge jobs 120497375990 (lane 484, github-token 151, 4 candidates) and 120492084819 (lane 480, github-token 394, 3 candidates), divided per candidate, fixed run overhead included.
  • No lanes App pull request was open in those runs (all candidates were adopted owner PRs), so today's measured saving is the one listing call.

Verification

• npm test in .github/actions/resolve-config: 679/679 pass. New test: lane-prs takes native and gate, rejects anything else, and the schema default equals the resolver default. VALID_MERGE and the materialized-defaults test now include lane-prs: native.
• node --test .github/scripts/pr-merge/*.test.mjs: 217/217 pass. New tests in merge-job.test.mjs, each failing on main's workflow:
  • Under native, the listing never asks for app/melodic-automation-lanes, while the adopted person and app/dependabot are still listed.
  • Under gate, the author list is today's (app/melodic-automation-lanes first).
  • native with no other author makes no gh call and writes empty candidates and drafts with count=0.
  • Read report-only run against a resolved config outputs lane-prs=native and lane-prs=gate.
  • Existing listing tests run under gate unchanged.
• actionlint 1.7.12 (local): no findings apart from the pre-existing concurrency.queue key, which this local version does not know. CI's pinned action runs its own version.
• Broker: the token broker reads pr-pipeline.schema.json and pr-pipeline.yaml together from main as trust files (fixtures/broker-vendored-lists.json binding.trust_files), so the new key and its schema entry arrive at the same time. A warm instance's cached resolve.mjs only lacks the new resolved field, which the broker does not read.
• scripts/check-affected.sh --tests on the merged head: 10 passed, 4 skipped.
• clear-escalations.test.mjs: under native, a lanes App PR's pr-merge escalation at an old head is kept. Under gate it clears as before, and an adopted owner PR clears under native.

Review (ready, local fresh-context code and security reviews)

• Fixed: clear-escalations.mjs lifted a pr-merge escalation as head-moved on the premise that pr-merge re-judges the new head. Under native it never does, so LANE_PRS now reaches that step, and a lanes App PR keeps its label. No added call: the pull it checks is already read.
• Fixed (claude-security-review and Codex threads): this repository now sets gate until the verdict is enforced outside the gate and fix(source-control): judge native lane auto-merges without a pin read-back #9447 lands.
• Fixed: the require-verifier-verdict comment in pr-pipeline.yaml now says it applies to the PRs the gate lists.
• Not fixed here, filed as fix(pr-pipeline): hold lane PRs on marketplace sources and cost paths under native auto-merge #9449: two path sets the gate scores but HOLD_PATH_FLOOR lacks, marketplace source changes and cost paths. These gaps predate this PR, but under native, ci-status and enable-auto-merge become the only controls on lane PRs.
• Not fixed, recorded:
  • Under native, lane PRs drop out of the gate's "Blocked for over 24 hours" summary and refusal counts, and lose the gate's risk escalation. ci-status and the review-lane holds still stop them.
  • A lane PR that a pre-switch whole-review toggle left as a draft is no longer re-readied by this job. Today no lanes App PR is open.
  • An older merge gate-check on a lane PR's unchanged head stays. It is informational and not required.

Related

• feat(pr-pipeline): review lanes hold a risky PR with needs-human, ci-status enforces it, and clean PRs auto-merge natively #9276, plan item 9. Follow-ups: fix(source-control): judge native lane auto-merges without a pin read-back #9447 (prerequisite for switching to native) and fix(pr-pipeline): hold lane PRs on marketplace sources and cost paths under native auto-merge #9449. feat(pr-pipeline): arm native auto-merge for lane pull requests #9399 (item 8, native auto-merge) and feat(pr-pipeline): turn on review-lane holds and require both review lanes in ci-status #9361 (ci-status review gate) are what this relies on.
• Follow-up (UNVERIFIED, no native lane merge has happened yet): native lane merges have no babysit-merge-pin comment. feat(source-control): hold only the takeover set on the babysit HIGH floor #9413 shows that the account enabling auto-merge becomes the AddedToMergeQueueEvent enqueuer. For a lane pull request that is the lanes App, so babysit_postmerge._judge would judge it by_identity. With no pin, that becomes a read-back failure after the dispatch deadline (babysit_postmerge.py:1492-1506). The consequences would be a demotion record and an in-flight count that never clears, which would hold the gate for adopted and Dependabot pull requests. Filed as fix(source-control): judge native lane auto-merges without a pin read-back #9447.
• This change touches resolve-config and .github/**, so the babysit HIGH floor holds it for a person.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-23T16:07:22.790585Z	e9d310c	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

claude-security-review: 1 inline finding(s) on e9d310cc6b8cdaf8f03c6d8d2188e3742b4b5392; the summary is in this lane's pull request comment.

claude-lane: claude-security-review

[github-actions]

claude-security-review reviewed 349c7c9bcf02b6116b74f71402779d0ae66f6c98: 0 finding(s), 0 as inline comments.

Incremental security review of the changes since e9d310c, covering .changes/pr-pipeline/feat-lane-prs-native-8d31c5a0.md and docs/conventions/pr-pipeline.yaml. I found no security issues.

• docs/conventions/pr-pipeline.yaml: merge.lane-prs changes from native to gate. This is the safer direction. Under gate, pr-merge's gate still lists, scores and enqueues lanes App pull requests, and it keeps enforcing the pr-verify verdict and the FAIL cap. The PR description says native auto-merge does not enforce those today. The new comment states the two prerequisites for switching this repository to native: ci-status or enable-auto-merge must enforce the verdict, and the post-merge check must handle a native merge that has no pin comment. This change removes the control gap that an earlier review round raised.
• .changes/...md: This is a changelog wording change only. It now says this repository sets gate.
• Manifests: The diff touches no plugin.json or marketplace.json, so there are no manifest <field> lines.
• Instruction-surface deletions: None. The diff deletes or softens no standing instruction.
• Hold for a person: None. The changed files are not trust-gate paths and there are no CRITICAL findings.
• PR context: It contains no embedded directives aimed at this lane.

critical-findings: 0

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e9d310cc6b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[github-actions]

claude-review reviewed 349c7c9bcf02b6116b74f71402779d0ae66f6c98: 0 finding(s), 0 as inline comments.

Incremental review of the changes since e9d310c. I read .claude-lane/incremental.diff and the PR context, and found nothing to report.

• docs/conventions/pr-pipeline.yaml now sets merge.lane-prs: gate. The comment explains both values and says the default is native when the key is absent. It also names the two conditions for switching to native: ci-status or enable-auto-merge enforcing the pr-verify verdict, and the post-merge check judging a native merge with no pin comment. This matches the PR description, which says the repository stays on gate so the merge changes no behavior.
• The changelog fragment .changes/pr-pipeline/feat-lane-prs-native-8d31c5a0.md keeps bump: minor, which fits a new config key with a new default. Its text now says this repository sets gate and why, which matches the YAML.
• Closing issues: the PR only references feat(pr-pipeline): review lanes hold a risky PR with needs-human, ci-status enforces it, and clean PRs auto-merge natively #9276 (Refs:) and closes none, so no acceptance criteria apply.
• No plugin.json or marketplace.json change is in this increment, so there are no manifest lines to report.
• No hold applies. The increment adds no model or API spend and touches no trust-gate path, CODEOWNERS file or .gitmodules file, and it has no critical security issue. The PR context says the babysit HIGH floor holds the PR for a person because it touches resolve-config and .github/**. That is the PR's own pipeline, not a hold class in this lane.

I did not run any tests. The test results in the PR description are author-claimed and unverified by me.