feat(queue): add mazet to the auto-merge set - #73
Merged
Conversation
`github.com/LeTuR/mazet` joins AUTO_MERGE_REPOS on the same terms as thurbox and thurview: its own `.no-mistakes.yaml` and CI stand behind the attestation and checks gates. Its remote was the blocker — rebase-only until today, which MERGE_METHOD = "squash" would have refused on every pass — and it now allows squash and nothing else. SKILL.md's prose names the four. queue-selftest.sh gets 9j, mirroring 9i: an attested mazet PR merges by squash, an unvetted one is still handed back, a bare `LeTuR/mazet` is refused, and the whole set is read back and put through forge.RepoId.parse — the literal is never parsed at runtime, so a bare slug written there would match nothing and refuse nothing.
…nd unshadow 9j's topic var
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Intent
Let fleet's shepherd merge pull requests in github.com/LeTuR/mazet, now that the remote takes squash. Add exactly one entry — github.com/LeTuR/mazet, host-qualified — to AUTO_MERGE_REPOS in scripts/lib/queue.py, and make every place that states the set agree with the code: .agents/skills/fleet-queue/SKILL.md names all three repositories in prose and must now name four. AGENTS.md and FLEET.md were checked and refer to the set generically with a format example rather than enumerating it, so they deliberately stay untouched.
The remote was the blocker and is not any more: mazet allowed rebase merging only until 2026-09-11, and MERGE_METHOD is squash, so every shepherd pass would have produced a recorded refusal rather than a merge. It now reports allow_squash_merge true with rebase and merge-commit both false, delete_branch_on_merge true, and PR_TITLE/PR_BODY as the squash commit title and message — the same shape as fleet's own remotes. Its .no-mistakes.yaml and three CI workflows were verified against the live repository, which is what the code comment's stated test for adding an entry asks for.
Deliberate constraints from the task, so a reviewer does not read them as omissions:
Testing was written first and observed to fail for the right reason before the allowlist changed (the shepherd printed 'fleet does not merge in LeTuR/mazet on github.com; this one is yours'). The new queue-selftest.sh section 9j extends what 9i already asserts rather than adding a parallel check: an attested, green mazet pull request is merged by squash through the stubbed forge, an unvetted one is still handed back, a bare LeTuR/mazet in FLEET_AUTO_MERGE_REPOS is refused, and the default set is read back through auto_merge_repos() and every entry put through forge.RepoId.parse. That last assertion exists because the literal in queue.py is never parsed at runtime — only the environment override is — so a bare slug written into the set would match nothing, refuse nothing, and otherwise fail no test.
./scripts/check.sh was run to completion locally and exited 0, including the queue and skills checks.
Repository convention note: CONTRIBUTING.md says pull request titles are conventional and scopeless, but the whole recent history is scoped and the direct precedent for this change is 'feat(queue): add thurbox to the auto-merge set (#64)'. The scoped form was chosen to match the history.
A previous run of this same change (01M28VSQMRZCP0PFYGKMW6XBS9) passed intent, rebase, review and test, then failed at the document step because the pipeline agent exited 1 on a usage limit. Nothing was pushed and its rebased head is no longer reachable as an object, so this is a resubmission of the identical commit, not new work.
What Changed
AUTO_MERGE_REPOSinscripts/lib/queue.pygains one host-qualified entry,github.com/LeTuR/mazet, soqueue.sh shepherdmerges there instead of recording a refusal; the comment above the set records why the remote was the blocker (it allowed rebase only, against a squashMERGE_METHOD) and no other gate moved.queue-selftest.shgrows section 9j: against the stubbed forge, an attested green mazet pull request is merged with--squash --delete-branch, an unattested one is handed back unmerged, a bareLeTuR/mazetinFLEET_AUTO_MERGE_REPOSis refused rather than matched, and the whole set is read back throughauto_merge_repos()with every entry put throughforge.RepoId.parse— the literal inqueue.pyis never parsed at runtime, so an unqualified slug there would otherwise fail no test.Risk Assessment
✅ Low: The behavioral change is a single host-qualified entry added to an existing allowlist with every merge gate untouched, backed by a new selftest section that mirrors the precedent set by the previous addition; the only issues found are minor weaknesses in test assertion strength.
Testing
The configured
./scripts/check.shbaseline had already passed; on top of it I re-ran the queue check and the queue selftest directly (both exit 0, with the nine new section 9j assertions and the five reworked section 14 assertions green), then drove./scripts/queue.sh shepherdend-to-end three times against throwaway queues with a stand-in forge CLI to capture reviewer-readable transcripts: the before-state where mazet is handed back, the after-state where an attested green mazet pull request is squash-merged with the branch deleted andpublish.state = mergedpersisted onto the task, and an adversarial pass showing the stale-attestation, no-push-access, failed-checks and fork gates all still refusing on the newly allowlisted repo. The bare-slug override is refused and merges nothing, and the environment override still replaces the shipped set. The change has no UI surface, so the evidence is CLI transcripts and persisted queue state rather than screenshots. Two things were not driven live: a merge against the live repository, which would irreversibly merge a real pull request (its premise — squash-only merging, delete-on-merge, PR_TITLE/PR_BODY, a.no-mistakes.yamland three active workflows — was instead confirmed read-only against the real remote); and the agreement between the documentation that enumerates the set and the code, which was read rather than exercised and therefore carries no live result../scripts/queue.sh shepherd --topic mazet-liveagainst a throwaway queue; the row readsmerged: squash-merged, branch deleted, the shepherd issued `gh pr merge https://github.com/LeTuR/mazet/pull/…FLEET_AUTO_MERGE_REPOS='github.com/Thurbeen/fleet github.com/Thurbeen/thurbox github.com/Thurbeen/thurview': the row reads `ready: fleet does not merge in LeT…policy: the body carries no no-mistakes attestationthendispatched: Re-open PR #302 through the pipeline, recorded aspublish.state = unattested; the merge log names on…FLEET_AUTO_MERGE_REPOS='LeTuR/mazet' ./scripts/queue.sh shepherd --dry-runprintsignoring 'LeTuR/mazet' — an auto-merge entry must name its forge, the mazet pull request stays `ready: fleet does…Merging is limited toline names exactly those three and mazet is excluded despite being in the shipped literal; with no override the l…./scripts/queue.sh shepherd --topic mazet-gatesover five mazet pull requests: an attestation for an earlier head ispolicyand gets a fixer, an author with no push access isnot-merged, failing…Merging is limited to github.com/LeTuR/mazet, github.com/Thurbeen/fleet, github.com/Thurbeen/thurbox, github.com/Thurbeen/thurview; queue-selftest section 9j reads the…discovering the instance put nothing of it on that set; driving the same line with…gh api repos/LeTuR/mazetreturns allow_squash_merge true, allow_rebase_merge false, allow_merge_commit false, delete_branch_on_merge true, PR_TITLE/PR_BODY; it…git grep, not by driving the running product, so the prior payload records no live result for it. Documentation consistency has no runtime surface…Evidence: Shepherd transcript: mazet before and after the allowlist entry
Evidence: Shepherd transcript: every merge gate exercised on the new repo
Evidence: Live read-only check of the github.com/LeTuR/mazet remote
Evidence: Queue selftest: section 9j and section 14 assertions
Evidence: Section 14's narrowed assertion is sensitive, not vacuous
Evidence: Every tracked place that enumerates the auto-merge set
Evidence: The merge the shepherd performs on mazet, and what it wrote down
Pipeline
Updates from git push no-mistakes
✅ **intent** - passed
✅ No issues found.
✅ **Rebase** - passed
✅ No issues found.
scripts/queue-selftest.sh:5409- §14 still asserts "because the merge set is exactly the three repos it always was" against the literal "github.com/Thurbeen/fleet, github.com/Thurbeen/thurbox, github.com/Thurbeen/thurview", and it was not updated with the allowlist. The intent requires "make every place that states the set agree with the code"; this is such a place and it no longer does. Concrete trace: scripts/lib/queue.py:5371 prints "Merging is limited to " + ", ".join(sorted(auto_merge_repos())); sorted() now yields github.com/LeTuR/mazet first ('L' < 'T'), so the printed line is "…limited to github.com/LeTuR/mazet, github.com/Thurbeen/fleet, github.com/Thurbeen/thurbox, github.com/Thurbeen/thurview, …" and expect()'s grep -qF still finds the stale three-repo substring. The test therefore passes while asserting a set that is wrong by one entry — a wrong label that never fails. It is also silently fragile: an entry sorting between fleet and thurbox would make this expect fail for a reason unrelated to what §14 is about. Smallest remedy: put github.com/LeTuR/mazet at the head of the expected string and say four in the label, or narrow the assertion to what §14 actually proves (that acme/group/widgets on the discovered GitLab host is absent from the printed set). Flagged ask-user rather than auto-fix because it is the intent's "every place that states the set" criterion that is unmet, so the author should confirm which of the two forms they want.scripts/queue-selftest.sh:2672- The allowlist is now spelled out verbatim in four places: scripts/lib/queue.py:4345, .agents/skills/fleet-queue/SKILL.md:825, the new entries= expectation here, and the §14 expectation at line 5409. The readback assertion here is worth keeping — without an exact-membership check, "unqualified=none" would also pass on an empty set — but noting the cost, which is exactly what produced the §14 miss above: a fifth entry means editing four literals, and only one of them fails loudly when it is forgotten.scripts/queue-selftest.sh:2585- §9j reassigns mtopic, which §9h (line 2456) already used for the many-prs pagination topic. Nothing after §9j reads the old value today, so there is no current failure, but any assertion later appended about the §9h topic would silently target the mazet topic instead — the neighbouring sections deliberately use distinct names (stopic, ttopic, gdtopic). Rename to something like ztopic/maztopic.🔧 Fix applied.
2 infos still open:
scripts/queue-selftest.sh:2672- The set readback asserts exact membership with a substring match, so it does not actually pin the set for the most likely future addition.expectgreps withgrep -qF(scripts/queue-selftest.sh:172), and the needle isentries=github.com/LeTuR/mazet github.com/Thurbeen/fleet github.com/Thurbeen/thurbox github.com/Thurbeen/thurviewwith nothing after it. Concrete trace: addgithub.com/acme/widgetsto AUTO_MERGE_REPOS.sorted()comparesgithub.com/then 'a' (97) against 'T' (84), so the new entry lands LAST and the printed line becomesentries=...thurview github.com/acme/widgets— which still contains the needle verbatim, so the assertion passes while its own label says "the four repositories fleet may merge in". Any owner whose name sorts afterThurbeen(every lowercase one) slips through. Theunqualified=noneassertion beside it is unaffected and still catches a bare slug wherever it sorts, so this is a weakened label rather than a hole in the parse claim the intent asked for. Smallest remedy is mechanical: emit a terminator the needle includes, e.g.print("entries=" + " ".join(repos) + " .")and end the expected string withthurview .. (A trailing newline cannot be used —grep -Ftreats a newline in the pattern as an alternation, which would make the assertion weaker still.)scripts/queue-selftest.sh:5410- In the fix round's §14 rewrite,limitedis defined as the output ofgrep 'Merging is limited to', and the very next line asserts thatlimitedcontainsMerging is limited to. That assertion can only fail when grep matched nothing, i.e. it is a non-empty check written circularly; the claim §14 actually makes is carried entirely by therefuteongitlab.example.comthat follows. Not a defect — the pair still fails correctly if the shepherd stops printing the line (limited is empty, expect fails) — but the expect reads as if it verifies content it cannot. Noting it rather than asking for a change.✅ **Test** - passed
✅ No issues found.
./scripts/queue.sh shepherd --topic mazet-liveagainst a throwaway queue; the row readsmerged: squash-merged, branch deleted, the shepherd issued `gh pr merge https://github.com/LeTuR/mazet/pull/…FLEET_AUTO_MERGE_REPOS='github.com/Thurbeen/fleet github.com/Thurbeen/thurbox github.com/Thurbeen/thurview': the row reads `ready: fleet does not merge in LeT…policy: the body carries no no-mistakes attestationthendispatched: Re-open PR #302 through the pipeline, recorded aspublish.state = unattested; the merge log names on…FLEET_AUTO_MERGE_REPOS='LeTuR/mazet' ./scripts/queue.sh shepherd --dry-runprintsignoring 'LeTuR/mazet' — an auto-merge entry must name its forge, the mazet pull request stays `ready: fleet does…Merging is limited toline names exactly those three and mazet is excluded despite being in the shipped literal; with no override the l…./scripts/queue.sh shepherd --topic mazet-gatesover five mazet pull requests: an attestation for an earlier head ispolicyand gets a fixer, an author with no push access isnot-merged, failing…Merging is limited to github.com/LeTuR/mazet, github.com/Thurbeen/fleet, github.com/Thurbeen/thurbox, github.com/Thurbeen/thurview; queue-selftest section 9j reads the…discovering the instance put nothing of it on that set; driving the same line with…gh api repos/LeTuR/mazetreturns allow_squash_merge true, allow_rebase_merge false, allow_merge_commit false, delete_branch_on_merge true, PR_TITLE/PR_BODY; it…git grep, not by driving the running product, so the prior payload records no live result for it. Documentation consistency has no runtime surface…./scripts/check.sh./scripts/check.sh queue(queue selftest through the repo's own gate, exit 0)./scripts/queue-selftest.sh(direct run for per-assertion output; all §9j and §14 assertions green, exit 0)Manual end-to-end drive of./scripts/queue.sh shepherd --topic <topic>underFLEET_AUTO_MERGE_REPOS='github.com/Thurbeen/fleet github.com/Thurbeen/thurbox github.com/Thurbeen/thurview'(before-state) and under the shipped set (after-state)Manual drive of./scripts/queue.sh shepherdover five mazet pull requests exercising each merge gate: stale attestation, author without push access, failed checks, fork head branch, and a clean controlFLEET_AUTO_MERGE_REPOS='LeTuR/mazet' ./scripts/queue.sh shepherd --topic <topic> --dry-run(bare slug, adversarial)FLEET_AUTO_MERGE_REPOS='github.com/LeTuR/mazet gitlab.example.com/acme/group/widgets' ./scripts/queue.sh shepherd --dry-run(sensitivity of section 14's narrowed assertion)gh api repos/LeTuR/mazet,gh api repos/LeTuR/mazet/contents/.no-mistakes.yaml,gh api repos/LeTuR/mazet/actions/workflows(read-only, live remote)git grep -n 'Thurbeen/thurview' -- '*.md' '*.py' '*.sh'to confirm every place that enumerates the set now names four repositories✅ **Document** - passed
✅ No issues found.
✅ **Lint** - passed
✅ No issues found.
✅ **Push** - passed
✅ No issues found.