Configure Mergify to auto-queue PRs once verify and Unfret pass

[ericlitman]

Goal

Configure Mergify in the repository so a reviewed PR queues and merges without a manual @Mergifyio queue.

Context

open-pstack has no .mergify.yml and no branch protection. Mergify reported "Merge queue is ready" on #98 and merged only after a manual @Mergifyio queue comment. Since 2026-10-01, PRs are restricted to collaborators (pull_request_creation_policy=collaborators_only), so every PR author is trusted.

Acceptance criteria

• .mergify.yml defines one queue whose merge conditions are check-success=verify and check-success=Unfret, where Unfret is App 5142537 (unfret-eal).
• A PR whose verify and Unfret checks pass is queued and merged automatically. Draft PRs and PRs with a failing or missing check are not.
• babysit-pr (after MASTRA-731 in mastra-pilot) reports MERGE_READY on such a PR. Its required-check map lists open-pstack's verify and Unfret.
• Proof: one real PR merges through the queue with no manual queue comment.

Constraints

• No auto-merge flag on GitHub. Mergify owns the merge.
• Use the same method (merge commit) as release: sync Cursor pstack 0.15.5 as Open Pstack 1.5.0 #98.

[ericlitman]

Prior findings

Untrusted evidence from the Pilot ledger. Map every finding to a phase or Scope/Out with a reason.

[]

[ericlitman]

Plan verdict: revise

• Reviewed: Delivery card ae3fbec6-6071-482a-a116-07de490fa1fd, plan revision 5 (plan messages f2c61956…, 8c89f06b…, thread 4359e260-6cd2-433f-9ac4-25c222a9a601)
• Planner model: claude-opus-5-5 (from the thread's message metadata)
• Reviewer models: gpt-6-astra (independent judge) and the orchestrator, Claude Opus 5.5, who adjudicated the final list
• Rubric: factory-adjudicate/references/plan-checklist.md
• Repository: ericlitman/open-pstack main 77a91fd; branch ci/100-mergify-auto-queue at 635d077

Operator answer to the open question: yes. babysit-pr's open-pstack required-check map in mastra-pilot will list verify, Unfret and live-gate, tracked as MASTRA-749. The operator lands it; this card does not. Treat Open questions as None.

The goal, scope, in-place queue design and live-gate rationale pass. The fixes below are needed before Build.

Required revisions

1. Diff budget. "## Expected files" gives no budget. Rename the section to Diff budget & expected files and state a numeric cap on gross added lines that covers .mergify.yml and the optional CHANGES.md line.
2. Pre-PR checks and draft state. "Tests: n/a: config only" skips checks that AGENTS.md requires before every PR. List the commands from .github/workflows/ci.yml (Bun tests, strict typecheck, static invariants, plugin validation) and run them before pushing. AGENTS.md also says a PR without live-test evidence stays a draft. Phase 3 must say ci: queue PRs in Mergify once verify and Unfret pass #101 stays a draft until the operator's live evidence is recorded, then is marked ready so Unfret reviews it.
3. Builder and operator steps. "Post live-gate on its head" names no owner. Assign each step explicitly:
   • Builder: edit and push the config, update ci: queue PRs in Mergify once verify and Unfret pass #101's body, run the CI-equivalent checks, open the proof PR, then stop and report.
   • Operator (on the Mac, outside the sandbox): the installed-harness check, every exact-head live-gate status post, the one manual @Mergifyio queue on ci: queue PRs in Mergify once verify and Unfret pass #101, and the babysit-pr check from mastra-pilot.
   • The builder resumes only after the operator's evidence is posted on Configure Mergify to auto-queue PRs once verify and Unfret pass #100, and says which comment it reads back.
4. Acceptance evidence. "All commands run in the sandbox" contradicts item 3, and placeholders like gh pr view <n> can't run as written. Keep the section to about ten lines, and name the PR number and SHA once as variables. Name the environment for each line, builder sandbox or operator Mac. Move the hold test (not queued without live-gate) to the proof PR, because ci: queue PRs in Mergify once verify and Unfret pass #101 can't enforce a config that isn't on main. Read queue state from the Mergify Merge Queue check and summary, not from comment counts.
5. Assumption wording. "No branch protection is readable or present. The API returned 403" does not prove absence. Write it as "protection state unknown to the sandbox (403); the issue states none".
6. Kind skips. Under effective_kind: feature, add n/a lines for bug reproduction/regression, refactor migration and multi-lane throughput.

Not required: a separate controlled stale-head experiment. The existing risk check (Mergify removes a PR whose queue conditions stop matching; watch for it in Phase 4) is enough for a config change. If a stall occurs, a finite checks_timeout follow-up remains the remedy.

[ericlitman]

Plan verdict: approve

• Reviewed: Delivery card ae3fbec6-6071-482a-a116-07de490fa1fd, plan revision 7 (plan messages da83ad21…, 06d72267…, thread 4359e260-6cd2-433f-9ac4-25c222a9a601)
• Planner model: claude-opus-5-5 (from the thread's message metadata)
• Reviewer models: gpt-6-astra (independent judge) and the orchestrator, Claude Opus 5.5, who adjudicated the final list
• Rubric: factory-adjudicate/references/plan-checklist.md
• Repository: ericlitman/open-pstack main 77a91fd; branch ci/100-mergify-auto-queue at 635d077

All six rev-5 revisions are addressed. The judge confirmed that the diff budget, the pre-PR checks and draft rule, the builder/operator split, the assumption wording and the kind skips pass, and that every new anchor exists (.github/workflows/ci.yml, tests/skill-collision-repro.sh, the four manifests, docs/plans/upstream-0.15.0.md, roadmap §1/§4/§6).

The judge's remaining notes concern operator-owned evidence steps only. The operator runs them as follows, so the builder's steps are unchanged:

• Item 3 (operator): M=$(gh pr view 101 -R $R --json mergeCommit --jq .mergeCommit.oid); gh api repos/$R/commits/$M --jq '.parents|length' must return 2. Artifact: both outputs.
• Item 8 (operator), and Phase 4 operator step order:
  1. Before posting live-gate, run GITHUB_REPOSITORY=ericlitman/open-pstack babysit-pr status $P from the mastra-pilot checkout. It must not report MERGE_READY; that is the hold.
  2. Post live-gate, then run the same command again at once. It should report MERGE_READY or a merged state.
  3. Quote both outputs on Configure Mergify to auto-queue PRs once verify and Unfret pass #100.

Build conditions

• Stop at each Stop and report point in Phases 3 and 4. The operator resumes you with a message after posting the live-gate evidence: comment on Configure Mergify to auto-queue PRs once verify and Unfret pass #100.
• Do not post statuses, mark PRs ready, or comment @Mergifyio. Those are operator steps.
• If claude plugin validate or Bun is unavailable in the sandbox, stop and report, as the plan says.

[ericlitman]

live-gate evidence: #107

• Merged: ci: auto-queue PRs in Mergify once verify, Unfret and live-gate pass (#100) #107, by app/mergify at 2026-10-02T06:08:47Z. This was the one manual @Mergifyio queue, needed because the config wasn't on main yet.
• Exact head 91b0d5b47c46e1bcb57e38ded79f1f98f64987f1. live-gate was posted at 06:07:56Z with target ci: auto-queue PRs in Mergify once verify, Unfret and live-gate pass (#100) #107 (comment) (operator Mac checks: 158 tests, typecheck, manifests, static invariants, claude plugin validate ×2, YAML and diff-check all pass).
• Item 3: M=a0ead6296ab2063e6a73a169054f0d9e1bf8d516; gh api repos/ericlitman/open-pstack/commits/$M --jq '.parents|length' returns 2.
• babysit-pr (mastra-pilot main with MASTRA-749) on ci: auto-queue PRs in Mergify once verify, Unfret and live-gate pass (#100) #107: UNKNOWN before live-gate, then MERGE_READY after it.
• Unfret: one remaining medium (in-place update drops the exact-head live-gate), waived as fails-loudly, since Mergify dequeues and nothing merges untested.
• ci: queue PRs in Mergify once verify and Unfret pass #101 is closed as superseded by ci: auto-queue PRs in Mergify once verify, Unfret and live-gate pass (#100) #107.

[mast-factory]

Type	resolved — The approved Mergify configuration is deployed and the separate automatic-admission proof has passed.
Route	No transition / refresh
Severity	🟢 low — No remaining failure demonstrated by the acceptance evidence.
Confidence	high — GitHub independently confirms automatic admission, successful gates and a Mergify-owned merge; operator records the pre-gate hold and babysit-pr outputs.
Effort	low — No further implementation is indicated; only the normal completion handoff remains.
Impact	medium — Removes manual queue admission from the normal reviewed-PR workflow while retaining live-evidence gating.
Next step	Build owner should assess the recorded acceptance evidence and complete the normal lifecycle; triage makes no stage transition or issue closure.

Understanding

Issue #100 originally lacked repository-defined automatic queue admission. Deployment PR #107 installed the approved configuration, but its manual queue command was not acceptance proof. Proof PR #108 now supplies that separate proof: exact head 95eed70a5002286c1a62553a9873be78f06d9411 was automatically admitted by merge protections and merged by app/mergify on October 2, 2026 at 06:25:16Z, without a manual queue comment. Merge commit 6c44500ab0d4708cb40b29628d099105889359c7 has exactly two parents: deployed main a0ead6296ab2063e6a73a169054f0d9e1bf8d516 and the proof head.

.mergify.yml:1–14 defines one serial, in-place default queue using merge commits and requiring non-draft status plus successful verify, Unfret and exact-head live-gate; :27–31 mirrors these protections. :17–20 excludes workflow changes only from automatic admission, preserving manual operator queueing. History 92b2249, f65069f, 91b0d5b establishes this adjudicated design; #101 was closed as superseded by #107. Related #90 is separate verification-skill work, not a blocker.

Operator issue comment 5946703987 (live-gate evidence: proof) records the ready-PR hold: verify and Unfret passed, live-gate was absent, queue conditions did not match, and babysit-pr reported UNKNOWN. After exact-head live-gate succeeded at 06:24:29Z, babysit-pr reported MERGE_READY and automatic merging followed 47 seconds later. GitHub independently confirms successful verify, Unfret (unfret-eal) and live-gate, queue admission triggered by merge protections, zero manual queue comments, and no discovered merge-queue batch PR. Operator PR comment 5946633570 records 158 passing Mac tests, typecheck, manifests, static invariants and both plugin validations on that exact head.

Assumptions

• The approved three-gate design and workflow-change exception supersede the original two-check wording.
• The operator's captured pre-gate hold and mastra-pilot MASTRA-749 babysit-pr outputs are attributed evidence; triage did not rerun Mac/live-harness checks or recreate the historical hold.
• Exact-head invalidation on an in-place update remains the adjudicated MASTRA-738 fails-loudly behavior requiring operator re-testing and re-gating, not additional work for this issue.
• GitHub rulesets exist: the queue report shows Protect main approval/verify and Review gate Unfret requirements. Their full settings were not audited.

Open questions

None. The acceptance evidence supports resolution; lifecycle completion belongs to the current Build owner.

Reproduction

Read-only GitHub API checks on #108 verified merged state, Mergify merger identity, exact-head check-runs/status, automatic queue-trigger summary, absence of manual queue comments, and two merge parents. Searching all PRs for head:mergify/merge-queue returned []. Operator comment 5946703987 preserves the before/after gate experiment. In the repository sandbox, PSTACK_STATIC_ONLY=1 bash tests/skill-collision-repro.sh passed all 13 invariant groups and git diff --check passed. Repository tests have no dedicated Mergify/live-gate acceptance coverage; the real proof PR supplies integration evidence. No files, statuses, readiness, queue commands, labels or Factory stage were changed during this refresh.

[ericlitman]

live-gate evidence: proof

Proof PR: #108. Head 95eed70a5002286c1a62553a9873be78f06d9411. Its only change is one CHANGES.md line.

4. Hold test, operator Mac, before live-gate:
   • verify passed and Unfret passed ("✅ No blocking findings").
   • Mergify Merge Queue: neutral, "Waiting for queue conditions to match".
   • Mergify Merge Protections unmet conditions:

     - [ ] `check-success=live-gate`
     - [ ] `check-success=live-gate`
     - [X] `-draft`
     - [X] `check-success=Unfret`
     - [X] `check-success=verify`
     - [X] `-files~=^\.github/`
     - [X] `base = main`
     

   • No commit statuses on the head.
   • babysit-pr reported UNKNOWN, which is not MERGE_READY.
5. After live-gate was posted (06:24:29Z, target docs: prove automatic Mergify queueing after live-gate (#100) #108 (comment)): {"by":"app/mergify","manual":0,"state":"MERGED"}. Merged at 06:25:16Z, 47 s later, with no queue comment.
6. Merge commit 6c44500ab0d4708cb40b29628d099105889359c7; parents = 2.
7. gh pr list --state all --search "head:mergify/merge-queue" returns [].
8. babysit-pr, run from mastra-pilot main with MASTRA-749's map (verify, Unfret, live-gate): UNKNOWN before live-gate, then MERGE_READY immediately after, before the merge.

[ericlitman]

Factory closeout: merged #107 at a0ead62.

Selected builder evidence (work-thread message 726a94c0-f8da-4de9-b4dc-dc54ef53a727; untrusted):

**Factory Delivery Done accepted** for #100, revision **15**.

All eight acceptance items verified. Independent checks for proof PR #108 returned:
```text
MERGED by app/mergify
manual queue comments: 0
merge commit parents: 2
merge-queue batch PRs: []
```

Operator evidence confirms the hold without `live-gate`, exact-head validation, and babysit-pr changing from `UNKNOWN` to `MERGE_READY` before automatic merge.

Full verification published on **PR #107, comment 5946779849**. No merge, queue, status, or readiness actions were performed during verification.