[kyle-sexton]

Refs: #9577

Remaining work

None on #9577. #9602 (merged 2026-10-24T07:29Z, which closed #9577) shipped the recompute on unverified-stale, with its test of a pending merge whose answer is older than 2 minutes reading as a counted room, and the scope-addition ::warning:: annotation plus step-summary line for a held room. This pull request fixes two defects found after #9602 landed: the depth-1 checkout and the timeout.

Summary

The enable-auto-merge job checked out the default branch as a depth-1 clone, so the post-merge check's local containment test could not decide and every lane record fell back to a compare API call (about 150 calls). The lane-room recompute then hit the 4 minute VERIFY_TIMEOUT_MS, was killed, and nothing armed.

Fix

• Add fetch-depth: 0 to the job's "Check out the default branch tip" step, matching post-merge-dispatch and merge.
• Give the lane-room spawn its own LANE_ROOM_TIMEOUT_MS (8 minutes) as a backstop, since it may run a full post-merge check. VERIFY_TIMEOUT_MS stays 4 minutes for the verifier reads. A timeout still reads as unreadable and holds the lane.
• Raise the arm step's timeout from 14 to 18 minutes and the job's from 25 to 30, so the room read, the verdict budget and the last verifier read (8 + 5 + 4 = 17) still fit and the step timeouts stay under the job's.
• pythonRoom takes an optional spawn function so a test can observe the timeout.
• Tests: the lane-room spawn uses the new constant and a SIGTERM kill is an error (unreadable); the three default-branch checkouts pin fetch-depth: 0; the timeout-fit test uses the new constant.

Verification

• node --test .github/scripts/pr-merge/*.test.mjs: 310 pass, 0 fail.
• scripts/check-affected.sh --tests: 10 passed, 4 skipped.
• actionlint .github/workflows/pr-merge.yml: clean.
• Failing evidence: pr-merge run 40078071511, "Arm and disarm auto-merge" logged lane room: {"unreadable":"babysit_verify_evidence.py lane-room exited SIGTERM: ", ...} after 4m04s.

Related

• Refs: fix(pr-merge): lane_room reads its post-merge answer past the 2-minute unverified age and disarms the lane #9577

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-24T12:28:28.317167Z	bf03051	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

claude-review reviewed bf03051c892c3652a31d525cd9c333e55518ed92: 0 finding(s), 0 as inline comments.

No findings. I read the full diff (5 files) and the PR context. I didn't run anything; the test results in the PR description are author-claimed and unverified by me.

What I checked by reading the code:

• Checkouts: fetch-depth: 0 is now on all three default-branch checkouts in pr-merge.yml (post-merge-dispatch, merge, enable-auto-merge), so the new pinning test matches the workflow.
• Timeout arithmetic: The room read, verdict budget and last verifier read come to 8 + 5 + 4 = 17 minutes, inside the arm step's 18. The job's step timeouts total 2 + 2 + 2 + 18 + 1 = 25, under the job's 30, so the "step timeouts fit" test still holds.
• Timeout constants: LANE_ROOM_TIMEOUT_MS is used only by the lane-room spawn. The verifier reads at enable-auto-merge.mjs:460 still use VERIFY_TIMEOUT_MS. The constant is defined at module level after pythonRoom, but it is read only when the function is called, so it is initialised by then.
• pythonRoom: The new spawn parameter defaults to spawnSync. A timeout kill (null status, signal SIGTERM) still throws, so it reads as unreadable and holds the lane, which the new test covers.

Other items:

• Closing issues: The PR only references fix(pr-merge): lane_room reads its post-merge answer past the 2-minute unverified age and disarms the lane #9577 (Refs:) and closes no issue, so there are no acceptance criteria to check.
• Manifests: The diff changes no plugin manifest. A .changes fragment with bump: patch is included, which fits a fix.
• Hold: The change raises Actions step and job timeouts but adds no model or API call, infrastructure resource or trusted-actor file. No hold applies.

[github-actions]

claude-security-review reviewed bf03051c892c3652a31d525cd9c333e55518ed92: 0 finding(s), 0 as inline comments.

No security issues found in this pull request.

Scope read: all 5 files in .claude-lane/pr.diff, plus the PR context. Nothing in the PR context tries to steer the review.

• fetch-depth: 0 on the default-branch checkout (pr-merge.yml). It checks out refs/heads/main into .base, not pull-request-controlled code. persist-credentials: false is kept, so the token does not stay in .git/config. The only change is more history, which matches the post-merge-dispatch and merge jobs.
• LANE_ROOM_TIMEOUT_MS (8 minutes) in enable-auto-merge.mjs. A killed read still throws, so lane-room exited SIGTERM reads as unreadable and holds the lane. The failure path stays closed. The longer timeout only gives the recompute more time to finish.
• Step and job timeouts (14→18 and 25→30 minutes). These are availability settings. No permission, token scope, trigger or action pin changes.
• Optional spawn parameter on pythonRoom. It defaults to spawnSync, and the only caller outside tests passes nothing. The args, the environment and the token handling (BABYSIT_VERIFY_GH_TOKEN → GH_TOKEN) are unchanged, so there is no new injection or credential surface.
• Tests and the .changes entry. These add no security-relevant surface.

Other checks:

• No plugin manifest was touched, so there are no manifest <field> lines.
• No standing instruction or guardrail was deleted or softened.
• No trust-gate path was changed (trusted-actors, check-trusted-trigger, CODEOWNERS, .gitmodules).

critical-findings: 0