Reusable Dependabot merge workflow that disarms auto-merge when a PR carries non-Dependabot commits

.agents/pm/chores/pm-github-dependabot-activation.toon

@@ -0,0 +1,24 @@
+id: pm-github-dependabot-activation
+title: Verify live Dependabot merge safety and coordinate fleet activation
+description: "Read-only Actions API inspection now reports dependabot-auto-merge.yml active, superseding the earlier disabled snapshot. PR #221 delivers the reusable provenance policy, trusted default-branch caller and independent scheduled audit source. Workflow state alone does not prove safe runtime activation. Keep repository token, event-policy, protected-branch and live-acceptance verification and fleet caller adoption separate from this implementation. Coordinate with companion pm-cli-website-wis6."
+type: Chore
+status: blocked
+priority: 2
+tags[4]: ci,dependabot,follow-up,security
+created_at: "2026-11-05T00:52:51.053Z"
+updated_at: "2026-11-05T11:10:09.277Z"
+author: codex-agent
+acceptance_criteria: "After reviewed delivery and release, verify each selected caller pins a release containing the policy or uses the reviewed trusted local path.; Verify the active caller has a repository-scoped merge token as Actions and Dependabot secrets when needed, required Actions event policy permits its trusted trigger, and server-enforced protected-branch checks and review requirements prevent unreviewed merges.; With owner authorization record live bot-only arm, foreign-commit revocation and independent scheduled audit acceptance without permitting an unintended merge, and coordinate remaining fleet adoption separately."
+blocked_by: pm-github-dependabot-merge
+dependencies[1]{id,kind,created_at,author,source_kind,author_source}:
+  pm-github-dependabot-merge,blocked_by,"2026-11-05T00:52:51.053Z",codex-agent,"cli:create:blocked_by",detected
+comments[2]{created_at,author,text}:
+  "2026-11-05T10:29:37.084Z",codex-agent,"PRRT_kwDOTbN4pM6z_gYw verified: Actions API currently reports the existing workflow active. Updated title, description and acceptance criteria to remove the obsolete enable request. Item remains blocked on reviewed implementation and runtime token/protection/live acceptance; active workflow state is not proof of fleet activation. No live workflow or secret settings changed."
+  "2026-11-05T11:10:03.277Z",codex-agent,"Round 2 source delivered and tested without changing live settings: activation snapshot corrected, trusted default-branch caller plus scheduled/manual provenance audit implemented. Focused regression covers this item and passes through the pinned pm runner; restoring the obsolete item fails it. Runtime token, event-policy, branch-protection, live arm/revoke/audit and fleet adoption checks remain blocked pending orchestrator verification. Releasing only my claim; this item remains open."
+files[1]{path,scope}:
+  .github/workflows/dependabot-auto-merge.yml,project
+tests[1]{command,scope,provenance{author,created_at,source_kind,source_ref}}:
+  node --test --test-concurrency=2 --test-name-pattern=activation test/dependabot-merge.test.ts,project,codex-agent,"2026-11-05T10:33:59.799Z",local_mutation,feat/reusable-dependabot-merge
+docs[1]{path,scope}:
+  README.md,project
+body: ""

.agents/pm/history/pm-github-gaq8.jsonl

@@ -1 +1,10 @@
 {"hash_algorithm":"sha256","ts":"2026-11-03T01:36:20.521Z","author":"pi-ollama","author_source":"asserted","agent_harness":"pi","agent_model":"glm-5.3:cloud","agent_model_source":"environment","agent_instance":"fffd5142cf13337359aa8b1f","agent_provenance":{"model":{"value":"glm-5.3:cloud","source":"environment"},"effort":null,"role":{"value":"implementer","source":"argv"},"topic":null},"op":"create","patch":[{"op":"add","path":"/metadata/id","value":"pm-github-gaq8"},{"op":"add","path":"/metadata/title","value":"closeout-workflow.test.ts fails wholesale on the local shared host while CI stays green on main"},{"op":"add","path":"/metadata/description","value":"Running the closeout workflow suite on the package worktree fails nearly every test on pristine main (assertions receive git branch-switch output and a pm 'Command failed' receipt instead of expected diagnostics), while the CI workflow on the same main commit is green. The suite also exceeds 4 minutes locally and hits local timeouts. Root-cause the host-local incompatibility (host git version prints advice output the fixtures do not expect) or make the fixtures version-tolerant; out of scope for the release-tag normalization work."},{"op":"add","path":"/metadata/type","value":"Issue"},{"op":"add","path":"/metadata/status","value":"open"},{"op":"add","path":"/metadata/priority","value":2},{"op":"add","path":"/metadata/tags","value":["regression","test"]},{"op":"add","path":"/metadata/created_at","value":"2026-11-03T01:36:20.521Z"},{"op":"add","path":"/metadata/updated_at","value":"2026-11-03T01:36:20.521Z"},{"op":"add","path":"/metadata/author","value":"pi-ollama"}],"before_hash":"3cc22dff72be7b14824654a7a64ea62b04799939b2fee54c1b5f52ca60bf6df0","after_hash":"94886e60dad04ae37f0050f2f0582027306c31074b7fb23634b8a012b21c389c","item_hash_version":3,"message":"","event_class":"substantive","record_hash_version":1,"record_hash":"9929569a61b7b9df20da0249aa2ab88e008c563faab6fbbf8669388ac95f3f6a"}
+{"hash_algorithm":"sha256","ts":"2026-11-05T08:35:28.981Z","author":"codex-agent","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"f8c646e54f65d0e947913d44","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":null,"topic":null},"op":"comment_add","patch":[{"op":"replace","path":"/metadata/updated_at","value":"2026-11-05T08:35:28.981Z"},{"op":"add","path":"/metadata/comments","value":[{"created_at":"2026-11-05T08:35:28.981Z","author":"codex-agent","text":"PR 221 review-round baseline confirmation: with Node 26.13.0/npm 11.20.0, public npm config and isolated Git config, the single schedule-without-repository-payload scenario fails on both the branch and a disposable origin/main snapshot (650797d). Exact command: nice -n 10 node --test --test-concurrency=2 --test-name-pattern=\"schedule without repository payload\" test/closeout-workflow.test.ts . Failure is npm EUSAGE: npm ci requires a package-lock in the synthetic caller, despite the fixture npm shim. The closeout workflow and test are byte-identical between branch and main. This is an environment-specific baseline fixture failure, not attributed to the Dependabot policy changes. No fixture or threshold was weakened. Full release evidence is being collected separately in CI on c21d40e."}]}],"before_hash":"94886e60dad04ae37f0050f2f0582027306c31074b7fb23634b8a012b21c389c","after_hash":"de918bd8e1ccf4e2f5c9cba799eaa7312d6dc5f58d4b90b2bb3d498b75aac931","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"0b4307510d3e4f871ecbefcda313bfd0f6bfda4513b307aea012f5e5179e8625"}
+{"hash_algorithm":"sha256","ts":"2026-11-05T14:11:12.379Z","author":"codex-agent","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"e3988a40b22786ba4c8da608","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":{"value":"implementer","source":"argv"},"topic":null},"op":"claim","patch":[{"op":"replace","path":"/metadata/updated_at","value":"2026-11-05T14:11:12.379Z"},{"op":"add","path":"/metadata/assignee","value":"codex-agent"},{"op":"add","path":"/metadata/claim_principal","value":"codex-agent"}],"before_hash":"de918bd8e1ccf4e2f5c9cba799eaa7312d6dc5f58d4b90b2bb3d498b75aac931","after_hash":"5f2175d05021c273f93d2bb13ccd64136fc6a7f0b8be7b6b7b4ccbd3081c4c14","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"df1085282acd9f8b721929ee3c97f56fc8636f1a147e25382e01e8e6575b160b"}
+{"hash_algorithm":"sha256","ts":"2026-11-05T14:11:16.577Z","author":"codex-agent","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"e3988a40b22786ba4c8da608","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":{"value":"implementer","source":"argv"},"topic":null},"op":"update","patch":[{"op":"replace","path":"/metadata/updated_at","value":"2026-11-05T14:11:16.577Z"},{"op":"replace","path":"/metadata/status","value":"in_progress"}],"before_hash":"5f2175d05021c273f93d2bb13ccd64136fc6a7f0b8be7b6b7b4ccbd3081c4c14","after_hash":"4291c2da835beb03d65648ee74ecd06e893240284283c48f419a617f0a8b9216","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"512de60619196cfdd9aecfc6ba3d19b4876d2575790d9d07967edf4832458401"}
+{"hash_algorithm":"sha256","ts":"2026-11-05T14:11:20.359Z","author":"codex-agent","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"e3988a40b22786ba4c8da608","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":null,"topic":null},"op":"comment_add","patch":[{"op":"add","path":"/metadata/comments/1","value":{"created_at":"2026-11-05T14:11:20.358Z","author":"codex-agent","text":"Correction to the 2026-11-05 baseline comment: withdraw the attribution of npm EUSAGE to the closeout workflow npm ci call. At reviewed head fadf64d, test/closeout-workflow.test.ts creates an npm shim that exits zero for ci --ignore-scripts and prepends its command directory to the workflow PATH; the workflow uses that exact invocation. The historical failing process invocation and resolved executable were not captured, so its actual cause is unestablished. The lockfile diagnosis and environment-specific causal claim are unsupported. This correction retains the original hashed event unchanged; the existing baseline issue remains open for investigation."}},{"op":"replace","path":"/metadata/updated_at","value":"2026-11-05T14:11:20.359Z"}],"before_hash":"4291c2da835beb03d65648ee74ecd06e893240284283c48f419a617f0a8b9216","after_hash":"3b73ded9162d2060cc16d7803b0838f5c03a411cd491bf2b357bacb6916c7f59","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"154e3c3cbc4614d290bd06d325cfc9c21fca60f9fcde63e69476dceff9251815"}
+{"hash_algorithm":"sha256","ts":"2026-11-05T14:12:31.740Z","author":"codex-agent","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"e3988a40b22786ba4c8da608","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":null,"topic":null},"op":"files_add","patch":[{"op":"replace","path":"/metadata/updated_at","value":"2026-11-05T14:12:31.740Z"},{"op":"add","path":"/metadata/files","value":[{"path":"test/closeout-workflow.test.ts","scope":"project","note":"Evidence for npm shim and workflow PATH"}]}],"before_hash":"3b73ded9162d2060cc16d7803b0838f5c03a411cd491bf2b357bacb6916c7f59","after_hash":"608b1547b6f24a585d716a30415ca704809df4bba530a1a39838945515742307","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"maintenance","record_hash_version":1,"record_hash":"5af94f5fcddf9cff4b5e966d9506a8b924083e16460d31393618672a9cb3cb13"}
+{"hash_algorithm":"sha256","ts":"2026-11-05T14:12:38.969Z","author":"codex-agent","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"e3988a40b22786ba4c8da608","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":null,"topic":null},"op":"docs_add","patch":[{"op":"replace","path":"/metadata/updated_at","value":"2026-11-05T14:12:38.969Z"},{"op":"add","path":"/metadata/docs","value":[{"path":".github/workflows/pm-github-closeout.yml","scope":"project","note":"Exact npm ci invocation intercepted by fixture"}]}],"before_hash":"608b1547b6f24a585d716a30415ca704809df4bba530a1a39838945515742307","after_hash":"19ff95113f4f60fa9afca462ec26112a6950e64be89d525fa1c1d2d1ea3339de","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"maintenance","record_hash_version":1,"record_hash":"b2199c60e0b05ef685130eb02a4250dd8ce5528380c3807d25850f13a084bcc3"}
+{"hash_algorithm":"sha256","ts":"2026-11-05T14:14:08.421Z","author":"codex-agent","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"e3988a40b22786ba4c8da608","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":{"value":"implementer","source":"argv"},"topic":null},"op":"update","patch":[{"op":"replace","path":"/metadata/updated_at","value":"2026-11-05T14:14:08.421Z"},{"op":"replace","path":"/metadata/status","value":"open"}],"before_hash":"19ff95113f4f60fa9afca462ec26112a6950e64be89d525fa1c1d2d1ea3339de","after_hash":"975553a3cc5cc4108937615e67e64caafb29355b59509047389f20f34b2be958","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"12664f520f36e7f0f7bbb81856dc94fc958e2aa728ddb7a29b0113bd6fb28298"}
+{"hash_algorithm":"sha256","ts":"2026-11-05T14:14:12.106Z","author":"codex-agent","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"e3988a40b22786ba4c8da608","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":{"value":"implementer","source":"argv"},"topic":null},"op":"release","patch":[{"op":"remove","path":"/metadata/claim_principal"},{"op":"remove","path":"/metadata/assignee"},{"op":"replace","path":"/metadata/updated_at","value":"2026-11-05T14:14:12.106Z"}],"before_hash":"975553a3cc5cc4108937615e67e64caafb29355b59509047389f20f34b2be958","after_hash":"baebd6c4c5d1f4a757bb5fc7fe4f1533879ab52d2740c04e2022bc1a04fb1e29","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"maintenance","record_hash_version":1,"record_hash":"5b1f6672355fc4f4eebc7205e5d232d98ff0a09e8970330d0258b963ba70040c"}
+{"hash_algorithm":"sha256","ts":"2026-11-05T14:37:47.768Z","author":"codex-agent","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"e3988a40b22786ba4c8da608","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":null,"topic":null},"op":"comment_add","patch":[{"op":"add","path":"/metadata/comments/2","value":{"created_at":"2026-11-05T14:37:47.768Z","author":"codex-agent","text":"Current verification following the append-only correction: npm run release:check on Node 24.19.0/npm 11.17.0 with isolated HOME/Git configuration and public npm config passed the unchanged schedule without repository payload scenario (226775 ms), including its two closeout publication runs. The full gate is still running. This is a present-run pass, not a reconstruction or diagnosis of the historical EUSAGE process; its invocation and resolved executable remain unknown."}},{"op":"replace","path":"/metadata/updated_at","value":"2026-11-05T14:37:47.768Z"}],"before_hash":"baebd6c4c5d1f4a757bb5fc7fe4f1533879ab52d2740c04e2022bc1a04fb1e29","after_hash":"04dfb477ebd91b3237e7e6dd1e9744fada59b1cdf7c466ee10b0d0c8ca021976","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"831a2827b8aa02d941e0793f5c2079505070bf540316c1eea0d84accb76f5249"}