lsm / HyperNeo / 31219575359
40%

DEFAULT BRANCH: dev
Ran
Jobs 0
Files 0
Run time –
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst
31219575359

push

github

web-flow 
Enforce deterministic current-head approval before post-approval merge [#866] (#2391)

* feat(space): add deterministic merge_pr gate + validator [#866]

The post-approval merger merged via the gh CLI merge subcommand with only
prompt-only "verify the approval covers the current head" checks, which the
model reasoned around on #857 (it saw the approval covered the old head,
inferred `approval_source: human` overrode the requirement, and merged anyway).

Add a `merge_pr` Space MCP tool backed by a pure validator that checks, in code:
PR open; current head covered by a real GitHub APPROVED review (or an own-PR
"Recommendation: APPROVE" comment whose commit_id == headRefOid); required CI
passing; zero unresolved review conversations; and branch-protection
reviewDecision satisfied — then merges bound to the validated head via
--match-head-commit so a concurrent push fails safely. Returns structured
blockers (stale_approval / missing_github_approved / missing_internal_recommendation
/ unresolved_threads / ci_not_passing / branch_protection / permissions /
head_changed / fetch_failed).

Task-approval provenance (approval_source) is deliberately NOT an input to the
validator — it is task provenance, never a merge authorization. Regression tests
reproduce the #857 shape (prior-head approval + empty CI + human task approval
stays blocked), current-head approval passes, own-PR recommendation vs real
APPROVED are distinguished, concurrent push fails as head_changed, and no
admin/human signal can bypass the head-coverage requirement.

* feat(space): block raw post-approval merges; route merger through merge_pr [#866]

Make the merge_pr gate the only merge path: add a declarative Bash guard
(MERGER_RAW_MERGE_GUARD) on every merger slot that denies raw PR-merge
commands — the gh CLI PR-merge subcommand, the GraphQL mergePullRequest
mutation, and the REST pulls/<n>/merge endpoint — so the model cannot bypass
the validator by shelling out directly (the #857 failure).... (continued)
Source Files on build 31219575359
Detailed source file information is not available for this build.