[kyle-sexton]

No related issue: completes the native merge path after #9450, #9459 and #9488

Summary

• Flips merge.lane-prs from gate to native in docs/conventions/pr-pipeline.yaml. The merge gate stops listing lanes App pull requests; native auto-merge and ci-status become their whole merge path.
• enable-auto-merge arms a lane pull request whose issue link the gate takes, a plain Refs: #<n> issue included (owner decision on feat(source-control): read a Refs: issue as the linked issue for pr-merge eligibility #9405). The link is decided by the gate's own Python rule.
• The native path now applies every gate hold it used to skip:
  • the gate's run-level refusals: demotion, rung off, a post-merge failure, merge.max-in-flight;
  • its review-lane hold: an open CRITICAL security finding, or a review not bound to the head;
  • in the merge queue, a pass that no longer binds the live link.
• The enable-auto-merge job now logs an api-budget line at job end (part of perf(ci): log api-budget lines from pr-verify, pr-test-windows, intake, work-unblock, post-merge and enable-auto-merge #9497).

Fix

• Link eligibility (evidence --lane-link). Before the verdict, the reader reads the link by babysit_merge_policy._linked_issue: one closing issue here, or, with none, the one issue plain Refs: lines name. A refused or unreadable link reads no verdict and leaves the pull request unarmed, or disarms it.

• Run-level refusals (lane-room, babysit_merge_policy.lane_room). Each scheduled or hand-started run reads this run's post-merge-dispatch report. It then applies the gate's run-level refusals, in the gate's order:

  • another authority;
  • a post-merge failure;
  • the effective rung off: merge.rung, the loop setting, the rung cap (vars.CLAUDE_LANES_MERGE_RUNG_CAP, passed as the merge job passes it), or a demotion record, an unreadable one included.

  While the gate holds its lane off, nothing is armed and every armed lane pull request is disarmed. At merge.max-in-flight nothing more is armed. The count is the gate's (the queue's lane entries plus the lane's unverified merges) plus armed pull requests the queue has not taken yet.

  When a read fails (a missing or unparsable post-merge report, config, or merge queue), the room is unknown, and unknown holds (owner Q677): nothing is armed and every armed lane pull request is disarmed, as on a refusal. Event runs read no room and never disarm on one.

• Risk-score hold (evidence --lane-reviews, lane_risk_refusal). After the verdict allows, the reader runs the gate's babysit_risk.score and holding over the inputs the gate builds, at the lane room's rung. The review lanes' evidence is bound to the head as the gate binds it (babysit_merge._lane_evidence). Each of these holds:

  • an open CRITICAL security finding, or a lane not bound to the head;
  • a symlink, submodule or other non-regular mode;
  • a high path, the manifest review, the trust gate, or the cost review.

  claude-review findings are reported only.

• Link binding in the merge queue (merge-holds.mjs linkHold). verdictHold accepted any pass at the head, so an armed Refs: #A pull request edited to Closes #B merged closing #B on a pass that judged #A. Now ci-status's merge-group step reads the counted pass's verdict.json (one artifact download) and the closing issues (one GraphQL read). It holds unless the live link, by the gate's rule, is the issue the pass judged, linked the same way. This is the reader's verify:spec-changed rule. A trusted approval of the head lifts it, as it lifts the verifier hold. refsIssue moves into merge-holds.mjs, which ci-status fetches as one file, and resolve-pr.mjs re-exports it, so the parity test with refs_issue still covers it.

• CRITICAL security hold (owner Q693). Before this, the native path held a CRITICAL finding only through the needs-human label. The chain:

  • plugins/review/skills/security-review/SKILL.md:231 (critical-security) tells the model when to hold;
  • ci-workflows pr-review-cli.yml (v0.65.0) applies the label only when the model's hold field says so;
  • pr-require-checks.yml:3712 (human_gated) fails ci-status while the label is on;
  • enable-auto-merge holdReason skips a labelled pull request.

  ci-workflows' apply-review-hold has no severity trigger of its own, so a missed hold let a CRITICAL finding through. The gate counts the findings themselves, and --lane-reviews now does the same on the native path.

• Default branch. A comment at PULLS_QUERY says it assumes main is the default branch; the gate reads it live (_base_refusal).

• Permissions. The enable-auto-merge job gains pull-requests: read and checks: read. lane-room runs under the job's GITHUB_TOKEN. The review-lane reads split tokens as the merge job's do: the timeline, comments and lane runs under the job's GITHUB_TOKEN (BABYSIT_VERIFY_GH_TOKEN), and the config, changed-file and permission reads under the lane token (GH_TOKEN).

• API budget. The job-end step logs only the Python gh calls. createGitHub and head-ref-map.mjs record nothing, so event runs log no line and the lanes-app figure leaves out the JS calls. The second commit's message says the step "reports both"; it reports both tokens' Python readings only.

Cost (measured). On each scheduled run the job reads the lane's room from the post-merge report that the same run's post-merge-dispatch job keeps as a one-day artifact (needs: post-merge-dispatch, downloaded with no run-id, so only this run's artifact is read). It runs no post-merge check of its own. With no report, nothing is armed and every armed lane pull request is disarmed.

New calls per scheduled run:

• lane-room: 9 GITHUB_TOKEN calls (8 measured, plus the demotion-record check added at ready);
• --lane-reviews: 36 per pull request whose verdict already allows (measured on feat(source-control)!: ship the pr_open_state default as ready #9483), split between the two tokens as the gate's lane-evidence read is.

The post-merge check adds none. Measured locally and read-only.

Event runs skip post-merge-dispatch and run as before; they never arm.

Timeouts. The arm step has 14 minutes (the room read, then the verdict budget). The job has 25, and workflow.test.mjs checks that the step timeouts fit inside it. On the schedule the job now starts after post-merge-dispatch ends; that job took 97-127 s on recent runs (its own comment).

Open question for the owner. --remediate dequeues the lane's queue entries but leaves armed pull requests armed, so GitHub can enqueue one before the next reader run disarms it. The coordinator is filing that follow-up.

Verification

• node --test .github/scripts/pr-merge/*.test.mjs .github/scripts/pr-verify/*.test.mjs: 342 pass, 0 fail. New tests:
  • through the real CLI and scorer: a lane pull request adding a symlink is not armed, an armed one adding a submodule pointer is disarmed, and a doc change arms;
  • while the gate holds the lane off (demotion, rung cap, post-merge failure), nothing arms, armed pull requests are disarmed, and no verdict is read;
  • at the cap nothing more arms, and an armed pull request already in the queue is not counted twice;
  • an unreadable room arms nothing and disarms every armed lane pull request (the old order, which left them armed, fails it);
  • an event run leaves an armed lane pull request armed;
  • an event run reads no room;
  • pythonRoom passes the rung cap and the job token;
  • linkHold cases from the README "Eligibility" rule;
  • a review-lane hold blocks the arm and disarms;
  • the wiring is pinned in workflow.test.mjs.
• scripts/ci-lanes-pr-hold.test.sh: 121 pass. The kill switch on (either variable, empty or any value but false) fails a lanes App pull request but not a person's or Dependabot's, and the step reads both switches from vars; making the check inert fails 4 cases. New merge-group cases:
  • a Refs: pass passes;
  • Refs: #1 edited to Closes #2 fails;
  • a Refs-slice pass does not cover the issue closed;
  • two Refs: lines or two closing issues hold;
  • a bad or undownloadable record fails closed;
  • a trusted approval lifts.
• ci-hold-merge-group, ci-hold-cost-decision and ci-hold-lifted-by pass: 22, 72 and 33 cases.
• Python: python3 -m unittest discover -s tests -p 'test_babysit_merge*.py': 945 OK. tests.test_babysit_lane_reviews, tests.test_babysit_lane_room, tests.test_babysit_verify_evidence, tests.test_verify_rules_sync, tests.test_merge_holds_sync and tests.test_babysit_merge_policy: 646 OK.
• Breaking each new hold on purpose fails its tests:
  • effective_rung always C2: 3 lane-room tests fail;
  • roomHold inert: 3 JS tests fail;
  • linkHold returning null: 5 step-body cases fail.
• scripts/run-ruff.sh check passes, and actionlint is clean on both workflows.
• Live, read-only:
  • the lane-evidence check answered None for open lanes App pull requests feat(source-control)!: ship the pr_open_state default as ready #9483 and feat(evals): close the eval suite's judge-calibration sample gaps #9479. For docs(prerequisites): name an existing skill in the example's check field #9487 it answered evidence-unbound:claude-security-review: not bound: skip-not-no-change, which the gate holds as well.
  • On merged docs(harness-ops): add harness-ops:prerequisites row to README skills table #9475 and fix(skill-quality): emit-plugin-eval allows read-only tools beside Skill #9461 it answered no-run. Merged pull requests are not candidates.
• lane_room reads its config, default branch and cap through the run cache. carry-run-cache.mjs:87 carries only carried-run-record, carried-fail-head-ref and carried-on-branch, so a poisoned cache entry cannot change the rung or the cap.
• Live: lane-room on this repository answered {"refusal": null, "unreadable": null, "count": 0, "cap": 5, "queued": [9510]}.
• A lanes-App auto-merge enqueues with the lanes App as enqueuer (docs(harness-ops): add harness-ops:prerequisites row to README skills table #9475's AddedToMergeQueueEvent), so the in-flight count sees native merges.
• The job token's permissions for these reads are unverified until a live scheduled run.

Security notes.

• A body can name any issue on its Refs: line. That only passes the link check: a pass must still bind with spec_kind: refs to a trusted spec, and in the queue it must still bind the live link.
• Every new read fails closed: no arm. A refusal derived from the gate's own reading disarms.
• ci-status runs linkHold from the base commit's merge-holds.mjs, so a pull request cannot rewrite it.

Review at ready

The local code and security reviews at the ready flip (no CI review lane ran on this repository) found these. Fixed in 62c6679:

• lane_room used the post-merge report without the gate's reuse checks. A re-run of enable-auto-merge downloads the run's first report, up to a day old, so a demotion filed since went unseen. It now applies shared_refusal's age rules and _demotion_changed, and an answer that fails them reads as unreadable, which holds.
• The report was read only when post-merge-dispatch succeeded. A failed full-run step after the report was kept disarmed every armed lane pull request, which the gate does not do. It is now read whenever that job ran.
• The merge queue's relink hold said pr-verify judges the new link. pr-verify skips a head it already passed, so the hold now says to push a new head or get an approval.

Fixed in 10c0940 (owner-approved parity with the gate):

• Risk-score parity. evidence --lane-reviews now runs the gate's whole babysit_risk.score() and holding() over the inputs the gate builds for a lane pull request (score_unattended). It scores at the lane room's effective rung (now in lane-room's report), uses the base config tightened by main's, and passes the cost decision on the linked issue. So these hold Closes and Refs: pull requests alike:

  • HIGH from non-regular modes, such as a symlink or a submodule pointer (_mode_problems);
  • configured high paths, the manifest review, the trust gate and the cost review;
  • the review lanes' evidence, as before.

  Any read error holds. Cost: 38 gh calls per pull request whose verdict already allows, measured read-only on feat(source-control)!: ship the pr_open_state default as ready #9483 including its pull-request and config reads. That is up from 36 for the lane-evidence read alone: one base-tree read for Pulumi directories and the manifest contents. It is spent only on pull requests every other rule would arm or keep armed.

• Kill switch. ci-status's lanes App step fails while CLAUDE_LANES_DISABLED or CLAUDE_LANES_REPO_DISABLED reads anything but false, the check-kill-switch rule. An armed lane pull request therefore stops in the merge queue. It reads the vars context: no API call. Owner and Dependabot pull requests exit before the check.

Recorded for the owner, not changed here:

• Body edit after the queue check. An edit after ci-status passes in the merge queue, but before GitHub merges, changes the issue the merge closes. No required check can close a window that opens after it completes; it is the same window the body hold has.

Related

• feat(source-control): read a Refs: issue as the linked issue for pr-merge eligibility #9405: Refs: eligibility at the gate, the rule this reuses
• fix(pr-merge): require a pr-verify pass before a lane pull request merges natively #9450, fix(source-control): judge a native auto-merge of a lane pull request in post-merge #9459, fix(pr-pipeline): hold native lane PRs on marketplace and cost paths #9488: the native-path prerequisites
• fix(pr-merge): bind a cost decision to the pull request head it approves #9493: bind a cost decision to the head it approves
• perf(ci): log api-budget lines from pr-verify, pr-test-windows, intake, work-unblock, post-merge and enable-auto-merge #9497: api-budget lines for enable-auto-merge and other jobs; this pull request adds the enable-auto-merge one, partly (see Fix)
• feat(pr-pipeline): review lanes hold a risky PR with needs-human, ci-status enforces it, and clean PRs auto-merge natively #9276: lane pull requests merge through native auto-merge, one of its done-when items

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-23T23:26:36.045026Z	a553dfc	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a553dfcdaa

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[github-actions]

claude-security-review: 1 inline finding(s) on a553dfcdaa0a84e261f7cc1d5adc69f8a5237c9d; the summary is in this lane's pull request comment.

claude-lane: claude-security-review

[github-actions]

claude-security-review reviewed d3c80641d3f89c8cee674e13c606272e3b1747b8: 0 finding(s), 0 as inline comments.

No security issues found in the incremental change (since 2948665). critical-findings: 0

Incremental scope. The change touches babysit_merge_policy.py (lane_room), its test, the change note, and the pr-pipeline README. The README and change note are prose that describe the new behaviour.

lane_room now calls shared_refusal. It previously ran only _shared_age_refusal, an identity comparison and _demotion_changed. I read shared_refusal (babysit_merge_policy.py:3955-4041). It runs every check the old code did, plus these:

• the binding checks: identity, self-logins and lane;
• the config-floor comparison;
• a re-read of the default-branch head, with a scan for lane merges the report did not count (new-merge:#<n>).

Every refusal it returns becomes LaneRoom(unreadable=...). The caller treats unreadable as "hold: arm nothing and disarm every armed lanes App pull request". The change therefore only adds ways to refuse. It does not loosen any gate or remove any control.

Fail-closed behaviour.

• A missing agent identity now returns unreadable where it used to return the generic identity-mismatch text. It still holds.
• If shared.self_logins is non-empty, it differs from the frozenset() passed here and yields self-logins-differ. That holds the lane. It is a possible availability problem, not a security one.
• The remaining reads use _get and newest_config_commit. Their failures map to config-unreadable, merged-unreadable or demotion-changed, all of which hold.

Instruction-surface and manifest items. The diff deletes no standing instruction, adds no manifest field, and touches no trust-gate path (trusted-actors, check-trusted-trigger, CODEOWNERS, .gitmodules). The register file was not needed. There is no manifest <field> line to report.

Tests. The new test pins the shared_refusal binding (branch, base_sha, identity, lane, authority, self_logins) and asserts that no in-flight read follows an unusable answer. The mocks in test_babysit_lane_room.py are test-only.

PR context. It contains no embedded directives aimed at the reviewer.

[github-actions]

claude-review: 1 inline finding(s) on a553dfcdaa0a84e261f7cc1d5adc69f8a5237c9d; the summary is in this lane's pull request comment.

claude-lane: claude-review

[github-actions]

claude-review reviewed d3c80641d3f89c8cee674e13c606272e3b1747b8: 0 finding(s), 0 as inline comments.

Incremental review of the changes since 2948665: the changelog fragment, the pr-pipeline README, babysit_merge_policy.py and test_babysit_lane_room.py. I found nothing to flag.

What changed. lane_room no longer applies its own copy of the age and demotion checks. It now calls the gate's shared_refusal, so it also catches a lane merge that landed after the report was computed (new-merge:#<n>).

What I checked by reading the code. I ran no tests or commands.

• Call arguments. lane_room passes identity, lane=True, authority=PR_MERGE, self_logins=frozenset(), branch=default and base_sha=config.base_sha. The post-merge report is written by .github/workflows/pr-merge.yml:195 with --lane-merges-only and no --self-login. Its selfLogins is therefore empty and laneMergesOnly is true, so the binding checks in shared_refusal (identity, self logins, lane) pass for a report from the same run. The call cannot reject every report.
• Dropped checks. The identity, age and demotion checks removed from lane_room are all covered by shared_refusal, and the return order is the same. A missing report, an unusable one and a refusal still produce unreadable or refusal as before.
• New hold. shared_refusal can now also return floor-differs, config-unreadable, merged-history-truncated, merged-unreadable and new-merge:#<n>. All of them make the room unreadable, which holds and disarms. That matches the PR's stated "unknown holds" rule.
• Tests. The existing room() helper patches newest_config_commit and _get so that only age and demotion decide the outcome. test_a_lane_merge_the_answer_does_not_count_is_unreadable covers the new new-merge path. It also pins the arguments the gate binds a candidate with, and checks that no in-flight read follows an unusable answer.
• Docs. The README and changelog edits match the code change.

Docs wording, not reported. The changelog and README describe a report the gate would not reuse as "older than 30 minutes". shared_refusal also rejects a passing report that still has an unverified lane merge once it is older than SHARED_UNVERIFIED_MAX_AGE, which is 2 minutes (babysit_run_cache.MAX_AGE). The old code had the same behaviour, so this change did not introduce it. I'm noting it only because the reworded line still omits that bound.

Manifest fields. None: the diff touches no plugin.json or marketplace.json.

Closing issue. The PR states "No related issue", so there are no acceptance criteria to check.

Hold. None. The files changed here are not in the cost or trust-gate classes.

[github-actions]

claude-security-review: 1 inline finding(s) on 39d1971dedd743c90c06790be6bf9ef54a847ebb; the summary is in this lane's pull request comment.

claude-lane: claude-security-review