@1aboveio/skills 0.0.0-stage → 1.0.0

package/skills/cicd/mergify/scripts/audit.test.mjs

@@ -0,0 +1,201 @@
+import { test } from 'node:test'
+import assert from 'node:assert/strict'
+import fs from 'node:fs'
+import { fileURLToPath } from 'node:url'
+import { spawnSync } from 'node:child_process'
+
+// @characterizes mergify-audit-cli
+// @covers mergify-audit-core
+// @level integration
+import { auditText, blockUnder, pullRequestBranches } from './audit-core.mjs'
+
+const SCRIPT = fileURLToPath(new URL('./audit.mjs', import.meta.url))
+const TEMPLATE = fileURLToPath(new URL('../assets/templates/mergify.yml', import.meta.url))
+const status = (f, check) => f.find((x) => x.check === check)?.status
+const run = (args) => spawnSync('node', [SCRIPT, ...args], { encoding: 'utf8' })
+const tmp = (body) => { const p = `${fs.mkdtempSync('/tmp/mgaudit-')}/m.yml`; fs.writeFileSync(p, body); return p }
+
+// ---- blockUnder: the one bit of structure-awareness ----
+test('blockUnder returns the indented body of a key, and null when absent', () => {
+  const y = 'a:\n  x: 1\n  y: 2\nb:\n  z: 3\n'
+  assert.match(blockUnder(y, 'a'), /x: 1/)
+  assert.doesNotMatch(blockUnder(y, 'a'), /z: 3/) // stops at the dedent to `b`
+  assert.equal(blockUnder(y, 'nope'), null)
+})
+
+// ---- the shipped template audits clean (dogfood: the default passes its own audit) ----
+test('the skill template passes its own audit with no warn/fail', () => {
+  const f = auditText(fs.readFileSync(TEMPLATE, 'utf8'))
+  const bad = f.filter((x) => x.status === 'warn' || x.status === 'fail')
+  assert.deepEqual(bad, [], `template should be clean, got: ${JSON.stringify(bad)}`)
+  assert.equal(status(f, 'enqueue-policy'), 'pass')
+})
+
+// ---- decidable failures ----
+test('deprecated auto_merge: true is a FAIL', () => {
+  assert.equal(status(auditText('merge_protections_settings:\n  auto_merge: true\n'), 'deprecated-forms'), 'fail')
+})
+test('deprecated autoqueue is a FAIL', () => {
+  assert.equal(status(auditText('queue_rules:\n  - name: d\n    autoqueue: true\n'), 'deprecated-forms'), 'fail')
+})
+test('a comment that merely NAMES a deprecated form does not trip the check', () => {
+  assert.equal(status(auditText('# do not use auto_merge: true here\nqueue_rules: {}\n'), 'deprecated-forms'), 'pass')
+})
+
+// ---- enqueue policy ----
+test('auto_merge_conditions without a review arm WARNs (the retired indiscriminate form)', () => {
+  assert.equal(status(auditText('merge_protections_settings:\n  auto_merge_conditions:\n    - "-draft"\n'), 'enqueue-policy'), 'warn')
+})
+test('auto_merge_conditions with approval but no changes-requested arm WARNs', () => {
+  const y = 'merge_protections_settings:\n  auto_merge_conditions:\n    - "#approved-reviews-by >= 1"\n'
+  assert.equal(status(auditText(y), 'enqueue-policy'), 'warn')
+})
+test('hybrid (approval + no open change request) PASSes', () => {
+  const y = 'merge_protections_settings:\n  auto_merge_conditions:\n    - "#approved-reviews-by >= 1"\n    - "#changes-requested-reviews-by = 0"\n'
+  assert.equal(status(auditText(y), 'enqueue-policy'), 'pass')
+})
+test('no auto_merge_conditions is a NOTE (manual enqueue, ok if deliberate) — not a warn', () => {
+  assert.equal(status(auditText('merge_protections_settings:\n  post_comment: true\n'), 'enqueue-policy'), 'note')
+})
+
+// ---- injection mode ----
+test('missing branch_protection_injection_mode: merge WARNs when a queue exists', () => {
+  assert.equal(status(auditText('queue_rules:\n  - name: d\n'), 'injection-mode'), 'warn')
+})
+test('no queue_rules → injection check ABSTAINs, never a false pass', () => {
+  assert.equal(status(auditText('merge_protections_settings: {}\n'), 'injection-mode'), 'abstain')
+})
+
+// ---- draft placement (epic-986) ----
+test('-draft inside queue_conditions WARNs; in auto_merge_conditions it does NOT', () => {
+  const bad = 'queue_rules:\n  - name: d\n    queue_conditions:\n      - -draft\n'
+  assert.equal(status(auditText(bad), 'draft-placement'), 'warn')
+  const ok = 'merge_protections_settings:\n  auto_merge_conditions:\n    - "-draft"\n    - "#approved-reviews-by >= 1"\n'
+  assert.equal(status(auditText(ok), 'draft-placement'), 'pass')
+})
+
+// ---- gate anchor ----
+test('a gate anchor asserted <2× WARNs; ≥2× PASSes', () => {
+  assert.equal(status(auditText('x: &gate {}\ny: *gate\n'), 'gate-anchor'), 'warn')
+  assert.equal(status(auditText('x: &gate {}\ny: *gate\nz: *gate\n'), 'gate-anchor'), 'pass')
+})
+
+// ---- batch mode (SKILL.md Rule 3) ----
+test('no batch_size WARNs — unset runs at Mergify\'s built-in 1, so batches never form', () => {
+  assert.equal(status(auditText('queue_rules:\n  - name: d\n    queue_conditions:\n      - base = main\n'), 'batch-mode'), 'warn')
+})
+test('explicit batch_size: 1 WARNs (batching off)', () => {
+  assert.equal(status(auditText('queue_rules:\n  - name: d\n    batch_size: 1\n'), 'batch-mode'), 'warn')
+})
+test('batch_size: 3 PASSes (batching on)', () => {
+  assert.equal(status(auditText('queue_rules:\n  - name: d\n    batch_size: 3\n'), 'batch-mode'), 'pass')
+})
+test('dynamic batch_size {min, max} PASSes (batching on)', () => {
+  assert.equal(status(auditText('queue_rules:\n  - name: d\n    batch_size:\n      min: 1\n      max: 10\n'), 'batch-mode'), 'pass')
+})
+test('no queue_rules → batch check ABSTAINs, never a false pass', () => {
+  assert.equal(status(auditText('merge_protections_settings: {}\n'), 'batch-mode'), 'abstain')
+})
+
+test('a queue rule with no checks_timeout WARNs: unset means auto, which dequeues green PRs', () => {
+  const f = auditText('queue_rules:\n  - name: main\n    batch_size: 3\n')
+  assert.equal(status(f, 'checks-timeout'), 'warn')
+  assert.match(f.find((x) => x.check === 'checks-timeout').detail, /main \(unset = auto\)/)
+})
+test('an explicit checks_timeout duration WARNs and names the rule', () => {
+  const f = auditText('queue_rules:\n  - name: docs\n    checks_timeout: null\n  - name: main\n    checks_timeout: 35 minutes\n')
+  assert.equal(status(f, 'checks-timeout'), 'warn')
+  const detail = f.find((x) => x.check === 'checks-timeout').detail
+  assert.match(detail, /main \(35 minutes\)/)
+  assert.doesNotMatch(detail, /docs/)
+})
+test('checks_timeout: null on every rule PASSes', () => {
+  const f = auditText('queue_rules:\n  - name: docs\n    checks_timeout: null\n  - name: main\n    batch_size: 3\n    checks_timeout: null\n')
+  assert.equal(status(f, 'checks-timeout'), 'pass')
+})
+test('checks_timeout: null in defaults.queue_rule covers rules that do not override it', () => {
+  const base = 'defaults:\n  queue_rule:\n    checks_timeout: null\nqueue_rules:\n  - name: main\n    batch_size: 3\n'
+  assert.equal(status(auditText(base), 'checks-timeout'), 'pass')
+  assert.equal(status(auditText(base + '  - name: slow\n    checks_timeout: 1 hour\n'), 'checks-timeout'), 'warn')
+})
+test('a comment that mentions checks_timeout: null does not count as setting it', () => {
+  const f = auditText('queue_rules:\n  - name: main\n    # checks_timeout: null\n    batch_size: 3\n')
+  assert.equal(status(f, 'checks-timeout'), 'warn')
+})
+test('no queue_rules → checks-timeout ABSTAINs, never a false pass', () => {
+  assert.equal(status(auditText('merge_protections_settings: {}\n'), 'checks-timeout'), 'abstain')
+})
+
+test('absent batch_size WARN points at batch_size: 3 (the skill default)', () => {
+  const f = auditText('queue_rules:\n  - name: d\n')
+  const d = f.find((x) => x.check === 'batch-mode').detail
+  assert.match(d, /batch_size: 3/)
+})
+
+// ---- CLI exit codes ----
+// ---- stack-ready: commits kept, CI on stacked PRs (configuration.md, "Stack-ready") ----
+test('a queue rule that squashes is a NOTE and names the rule; merge and merge-batch PASS', () => {
+  // kyc 2026-10-16: the default queue squashed, so a PR built on another conflicted after its parent landed.
+  // stack-sandbox 2026-10-20: a squash queue landed a GitHub-native stack, partial landing included, so it only matters off native stacks.
+  const cfg = (m) => `queue_rules:\n  - name: release\n    merge_method: merge\n  - name: default\n    merge_method: ${m}\n`
+  const squash = auditText(cfg('squash')).find((x) => x.check === 'merge-method')
+  assert.equal(squash.status, 'note')
+  assert.match(squash.detail, /default \(squash\) — fine for GitHub-native stacks; a Depends-On stack/)
+  assert.doesNotMatch(squash.detail, /release/)
+  assert.equal(status(auditText(cfg('merge-batch')), 'merge-method'), 'pass')
+  assert.equal(status(auditText(cfg("'squash'")), 'merge-method'), 'note', 'a quoted squash is still a squash')
+  assert.equal(status(auditText(cfg('somethingnew')), 'merge-method'), 'abstain', 'an unrecognized method is checked by hand, never passed')
+  assert.equal(status(auditText('a: 1\n'), 'merge-method'), 'abstain')
+})
+
+test('pullRequestBranches reads the base filter in every trigger shape, and null means any base', () => {
+  assert.deepEqual(pullRequestBranches('on:\n  pull_request:\n    branches: [main]\n    paths-ignore:\n      - docs/**\n'), ['main'], 'fmm-express test.yml')
+  assert.equal(pullRequestBranches('on:\n  pull_request:\n    branches: ["**"]\n  schedule:\n    - cron: "0 6 * * 1"\n'), null, 'a1 security-scan.yml')
+  assert.deepEqual(pullRequestBranches('on:\n  pull_request:\n    branches:\n      - main\n      - release/*\n'), ['main', 'release/*'])
+  assert.deepEqual(pullRequestBranches('on: { pull_request: { branches: [main] }, workflow_dispatch: }\n'), ['main'])
+  assert.equal(pullRequestBranches('on: { pull_request: , workflow_dispatch: }\n'), null)
+  assert.equal(pullRequestBranches('on:\n  pull_request:\n  workflow_dispatch:\n'), null)
+  assert.equal(pullRequestBranches('on:\n  push:\n    branches: [main]\n'), null, 'no pull_request trigger is not this check\'s business')
+  assert.equal(pullRequestBranches('on:\n  pull_request_target:\n    branches: [main]\n'), null)
+  assert.equal(pullRequestBranches('on:\n  pull_request:\n    # branches: [main]\n'), null, 'a commented-out filter is no filter')
+  // Round-5 audit: branches-ignore skips some base too, so a stack on that base gets no CI.
+  assert.deepEqual(pullRequestBranches('on:\n  pull_request:\n    branches-ignore: [rush/**]\n'), ['!rush/**'])
+  assert.deepEqual(pullRequestBranches('on:\n  pull_request:\n    branches-ignore:\n      - \'stack/**\'\n'), ['!stack/**'])
+})
+
+test('stacked-pr-ci is a NOTE on base-filtered workflows, PASSes without filters, and ABSTAINs with none read', () => {
+  // fmm-express and identity 2026-10-16: required CI ran on PRs into main only, so Depends-On stacked PRs got none.
+  // stack-sandbox 2026-10-20: a [main]-filtered workflow ran on every PR of a GitHub-native stack.
+  const w = (name, text) => ({ name, text })
+  const filtered = auditText('a: 1\n', { workflows: [w('test.yml', 'on:\n  pull_request:\n    branches: [main]\n'), w('deploy.yml', 'on:\n  push:\n    branches: [main]\n')] }).find((x) => x.check === 'stacked-pr-ci')
+  assert.equal(filtered.status, 'note')
+  assert.match(filtered.detail, /test\.yml \[main\] — fine for GitHub-native stacks/)
+  assert.doesNotMatch(filtered.detail, /deploy\.yml/)
+  assert.equal(status(auditText('a: 1\n', { workflows: [w('ci.yml', 'on:\n  pull_request:\n')] }), 'stacked-pr-ci'), 'pass')
+  assert.equal(status(auditText('a: 1\n', { workflows: [] }), 'stacked-pr-ci'), 'abstain')
+  assert.equal(status(auditText('a: 1\n'), 'stacked-pr-ci'), 'abstain')
+})
+
+test('CLI reads .github/workflows beside the config, or --workflows', () => {
+  const dir = fs.mkdtempSync('/tmp/mgaudit-')
+  fs.mkdirSync(`${dir}/.github/workflows`, { recursive: true })
+  fs.writeFileSync(`${dir}/.github/workflows/test.yml`, 'on:\n  pull_request:\n    branches: [main]\n')
+  fs.copyFileSync(TEMPLATE, `${dir}/.mergify.yml`)
+  const beside = run(['--file', `${dir}/.mergify.yml`, '--json'])
+  assert.equal(beside.status, 0, 'a base filter is a note: GitHub-native stacks still get CI')
+  assert.equal(JSON.parse(beside.stdout).findings.find((x) => x.check === 'stacked-pr-ci').status, 'note')
+  fs.mkdirSync(`${dir}/clean`)
+  fs.writeFileSync(`${dir}/clean/ci.yml`, 'on:\n  pull_request:\n')
+  const clean = run(['--file', `${dir}/.mergify.yml`, '--workflows', `${dir}/clean`, '--json'])
+  assert.equal(clean.status, 0)
+  assert.equal(JSON.parse(clean.stdout).findings.find((x) => x.check === 'stacked-pr-ci').status, 'pass')
+})
+
+test('CLI exits 2 on FAIL, 1 on WARN, 0 with --allow-warn, 0 on PASS', () => {
+  assert.equal(run(['--file', tmp('merge_protections_settings:\n  auto_merge: true\n')]).status, 2)
+  const warnCfg = tmp('queue_rules:\n  - name: d\n')
+  assert.equal(run(['--file', warnCfg]).status, 1)
+  assert.equal(run(['--file', warnCfg, '--allow-warn']).status, 0)
+  assert.equal(run(['--file', TEMPLATE]).status, 0)
+  assert.equal(run(['--file', '/nonexistent.yml']).status, 2)
+})

package/skills/cicd/mergify/scripts/entrypoints.test.mjs

@@ -0,0 +1,106 @@
+// @covers mergify-core-wrapper-topology
+// @level integration
+import { test } from 'node:test'
+import assert from 'node:assert/strict'
+import { spawnSync } from 'node:child_process'
+import { cpSync, mkdirSync, mkdtempSync, readFileSync, rmSync, symlinkSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { dirname, join } from 'node:path'
+import { fileURLToPath, pathToFileURL } from 'node:url'
+
+const SCRIPTS = dirname(fileURLToPath(import.meta.url))
+const SKILL = dirname(SCRIPTS)
+const TEMPLATE = join(SKILL, 'assets', 'templates', 'mergify.yml')
+const AUDIT_CORE = join(SCRIPTS, 'audit-core.mjs')
+const AUDIT_WRAPPER = join(SCRIPTS, 'audit.mjs')
+const WATCH_CORE = join(SCRIPTS, 'watch-pr-delivery-core.mjs')
+const WATCH_WRAPPER = join(SCRIPTS, 'watch-pr-delivery.mjs')
+const STACK_CORE = join(SCRIPTS, 'stack-push-core.mjs')
+const STACK_WRAPPER = join(SCRIPTS, 'stack-push.mjs')
+const PRODUCTION_MODULES = [AUDIT_CORE, AUDIT_WRAPPER, WATCH_CORE, WATCH_WRAPPER, STACK_CORE, STACK_WRAPPER]
+
+const runNode = (args) => spawnSync(process.execPath, args, { encoding: 'utf8' })
+
+function importWrapper(wrapper, argv) {
+  const source = [
+    `process.argv = ['node', ${JSON.stringify(wrapper)}, ...${JSON.stringify(argv)}]`,
+    `const namespace = await import(${JSON.stringify(pathToFileURL(wrapper).href)})`,
+    "process.stderr.write(`WRAPPER_EXPORTS:${JSON.stringify(Object.keys(namespace))}`)",
+  ].join('\n')
+  return runNode(['--input-type=module', '--eval', source])
+}
+
+function assertSameRun(actual, expected, label) {
+  assert.equal(actual.status, expected.status, `${label}: exit status changed`)
+  assert.equal(actual.stdout, expected.stdout, `${label}: stdout changed`)
+  assert.equal(actual.stderr, expected.stderr, `${label}: stderr changed`)
+}
+
+test('importing either core is quiet and never launches a CLI', () => {
+  for (const core of [AUDIT_CORE, WATCH_CORE, STACK_CORE]) {
+    const result = runNode(['--input-type=module', '--eval', `await import(${JSON.stringify(pathToFileURL(core).href)})`])
+    assert.equal(result.status, 0, `${core}: ${result.stderr}`)
+    assert.equal(result.stdout, '', `${core} wrote CLI output during import`)
+    assert.equal(result.stderr, '', `${core} wrote CLI diagnostics during import`)
+  }
+})
+
+test('wrappers export nothing and invoke their core even when loaded through import()', () => {
+  const audit = importWrapper(AUDIT_WRAPPER, ['--file', TEMPLATE, '--json'])
+  assert.equal(audit.status, 0, audit.stderr)
+  assert.match(audit.stdout, /"verdict": "PASS"/)
+  assert.equal(audit.stderr, 'WRAPPER_EXPORTS:[]')
+
+  const watch = importWrapper(WATCH_WRAPPER, ['--help'])
+  assert.equal(watch.status, 0, watch.stderr)
+  assert.match(watch.stdout, /watch-pr-delivery --repo/)
+  assert.equal(watch.stderr, 'WRAPPER_EXPORTS:[]')
+
+  const stack = importWrapper(STACK_WRAPPER, ['--help'])
+  assert.equal(stack.status, 0, stack.stderr)
+  assert.match(stack.stdout, /stack-push --trunk/)
+  assert.equal(stack.stderr, 'WRAPPER_EXPORTS:[]')
+})
+
+test('direct, canonical-copy, and Claude-symlink wrapper launches preserve both CLI contracts', () => {
+  const home = mkdtempSync(join(tmpdir(), 'mergify-install-topology-'))
+  try {
+    const canonical = join(home, '.agents', 'skills', 'mergify')
+    const claude = join(home, '.claude', 'skills', 'mergify')
+    mkdirSync(dirname(canonical), { recursive: true })
+    mkdirSync(dirname(claude), { recursive: true })
+    cpSync(SKILL, canonical, { recursive: true })
+    symlinkSync(canonical, claude, 'dir')
+
+    const directAudit = runNode([AUDIT_WRAPPER, '--file', TEMPLATE, '--json'])
+    const directWatch = runNode([WATCH_WRAPPER, '--help'])
+    assert.equal(directAudit.status, 0, directAudit.stderr)
+    assert.equal(directWatch.status, 0, directWatch.stderr)
+
+    for (const [label, installedSkill] of [['canonical', canonical], ['claude-symlink', claude]]) {
+      assertSameRun(
+        runNode([join(installedSkill, 'scripts', 'audit.mjs'), '--file', TEMPLATE, '--json']),
+        directAudit,
+        `${label} audit`,
+      )
+      assertSameRun(
+        runNode([join(installedSkill, 'scripts', 'watch-pr-delivery.mjs'), '--help']),
+        directWatch,
+        `${label} watcher`,
+      )
+    }
+  } finally {
+    rmSync(home, { recursive: true, force: true })
+  }
+})
+
+test('Mergify production modules have no Engineering Workflow import or runtime dependency', () => {
+  for (const file of PRODUCTION_MODULES) {
+    const source = readFileSync(file, 'utf8')
+    assert.doesNotMatch(
+      source,
+      /engineering-runtime|engineering\/_lib|_lib\/main-module|isMainModule/,
+      `${file} reaches into Engineering Workflow`,
+    )
+  }
+})

package/skills/cicd/mergify/scripts/pr-620-mergify-comments.fixture.json

@@ -0,0 +1,30 @@
+[
+  {
+    "author": {
+      "login": "mergify"
+    },
+    "createdAt": "2026-07-28T10:31:42Z",
+    "body": "# Merge Protections\n\n🔴 **1 of 2 protections blocking** · waiting on 👀 reviews\n\n| | Protection | Waiting on |\n|:--:|:--|:--:|\n| 🔴 | **🚦 Auto-queue** | 👀 reviews |\n| 🟢 | skill-script-tests (or exempt) before merge | — |\n\n## 🔴 🚦 Auto-queue\n\n**Waiting for**\n\n- [ ] `#approved-reviews-by >= 1`\n\n<details><summary>This rule is failing.</summary>\n\nWhen all merge protections are satisfied and these conditions match, this pull request will be queued automatically.\n- [ ] `#approved-reviews-by >= 1`\n- [X] `#changes-requested-reviews-by = 0`\n- [X] `-draft`\n- [X] any of:\n  - [X] `check-success = skill-script-tests`\n  - [ ] all of:\n    - [ ] `-files ~= ^skills/`\n    - [X] `-files ~= ^\\.github/workflows/skill-gates\\.yml$`\n\n</details>\n\n---\n\n<details><summary>Show 1 satisfied protection</summary>\n\n## 🟢 skill-script-tests (or exempt) before merge\n\nThe one CI gate, asserted as a required merge protection. Green when skill-script-tests succeeded, or when the PR touches no gated path (so the job was never created) — never absent, so the ruleset can require it without stranding a docs-only PR.\n- [X] any of:\n  - [X] `check-success = skill-script-tests`\n  - [ ] all of:\n    - [ ] `-files ~= ^skills/`\n    - [X] `-files ~= ^\\.github/workflows/skill-gates\\.yml$`\n\n</details>"
+  },
+  {
+    "author": {
+      "login": "mergify"
+    },
+    "createdAt": "2026-07-28T11:02:07Z",
+    "body": "<!---\nDO NOT EDIT\n-*- Mergify Payload -*-\n{\"version\": 1, \"state\": \"dequeued\", \"queue_rule_name\": \"default\", \"queued_at\": \"2026-07-28T11:02:06.211243+00:00\", \"estimated_time_of_merge\": null, \"speculative_check_pr\": null, \"required_conditions\": []}\n-*- Mergify Payload End -*-\n-->\n\n# Merge Queue Status\n\n- ✅ **Entered queue** — `2026-07-28 11:02 UTC` · Rule: `default` · triggered by @exoulster with the [`@mergifyio queue` command](https://github.com/1aboveio/ai/pull/620#issuecomment-5103273321)\n- ❌ **Checks failed** · on draft #624\n- 🚫 **Left the queue** — `2026-07-28 11:04 UTC` · at `e6a855b3c80d22c47661b3a47cadba7ad58a862e`\n\nThis pull request spent **2 minutes 33 seconds** in the queue, including **1 minute 14 seconds** running CI.\n\n<details>\n<summary><strong>Waiting for</strong></summary>\n\n- [ ] any of:\n  - [ ] `check-success = skill-script-tests`\n  - [ ] `-files ~= ^skills/`\n- [ ] any of:\n  - [ ] `check-success = skill-script-tests`\n  - [ ] `-files ~= ^skills/`\n- [ ] any of:\n  - [ ] `check-success = skill-script-tests-queue`\n  - [ ] `-files ~= ^skills/`\n\n</details>\n<details>\n<summary>All conditions</summary>\n\n- [ ] all of [🛡 Merge Protections rule `skill-script-tests (or exempt) before merge`]:\n  - [ ] any of:\n    - [ ] `check-success = skill-script-tests`\n    - [ ] all of:\n      - [ ] `-files ~= ^skills/`\n      - [X] `-files ~= ^\\.github/workflows/skill-gates\\.yml$`\n- [ ] any of:\n  - [ ] `check-success = skill-script-tests`\n  - [ ] all of:\n    - [ ] `-files ~= ^skills/`\n    - [X] `-files ~= ^\\.github/workflows/skill-gates\\.yml$`\n- [ ] any of:\n  - [ ] `check-success = skill-script-tests-queue`\n  - [ ] all of:\n    - [ ] `-files ~= ^skills/`\n    - [X] `-files ~= ^\\.github/workflows/skill-gates\\.yml$`\n\n</details>\n\n## Reason\n\nThe merge conditions cannot be satisfied due to failing checks\n\n- `skill-script-tests-queue`\n\nFailing checks:\n- 🟠 [skill-script-tests](https://github.com/1aboveio/ai/actions/runs/30353228583/job/90255382376) ([job log](https://github.com/1aboveio/ai/actions/runs/30353228583/job/90255382376))\n- ❌ [skill-script-tests-queue](https://github.com/1aboveio/ai/actions/runs/30353228583/job/90255382413) ([job log](https://github.com/1aboveio/ai/actions/runs/30353228583/job/90255382413))\n\n## Hint\n\nYou may have to fix your CI before adding the pull request to the queue again.\nIf you update this pull request, to fix the CI, it will automatically be requeued once the queue conditions match again.\nIf you think this was a flaky issue instead, you can requeue the pull request, without updating it, by posting a `@mergifyio queue` comment.\n\nRequeued — the merge queue status continues in [this comment ↓](https://github.com/1aboveio/ai/pull/620#issuecomment-5103476982)."
+  },
+  {
+    "author": {
+      "login": "mergify"
+    },
+    "createdAt": "2026-07-28T11:20:58Z",
+    "body": "<!---\nDO NOT EDIT\n-*- Mergify Payload -*-\n{\"version\": 1, \"state\": \"merged\", \"queue_rule_name\": \"default\", \"queued_at\": \"2026-07-28T11:20:56.782765+00:00\", \"estimated_time_of_merge\": null, \"speculative_check_pr\": null, \"required_conditions\": []}\n-*- Mergify Payload End -*-\n-->\n\n# Merge Queue Status\n\n- ✅ **Entered queue** — `2026-07-28 11:20 UTC` · Rule: `default` · triggered by @exoulster with the [`@mergifyio queue` command](https://github.com/1aboveio/ai/pull/620#issuecomment-5103472242)\n- ✅ **Checks passed** · on draft #627\n- ✅ **Merged** — `2026-07-28 11:25 UTC` · at `e6a855b3c80d22c47661b3a47cadba7ad58a862e` · merge\n\nThis pull request spent **4 minutes 29 seconds** in the queue, including **3 minutes 1 second** running CI.\n\n<details>\n<summary>Required conditions to merge</summary>\n\n- [X] all of [🛡 Merge Protections rule `skill-script-tests (or exempt) before merge`]:\n  - [X] any of:\n    - [X] `check-success = skill-script-tests`\n    - [ ] all of:\n      - [ ] `-files ~= ^skills/`\n      - [X] `-files ~= ^\\.github/workflows/skill-gates\\.yml$`\n- [X] any of:\n  - [X] `check-success = skill-script-tests`\n  - [ ] all of:\n    - [ ] `-files ~= ^skills/`\n    - [X] `-files ~= ^\\.github/workflows/skill-gates\\.yml$`\n- [X] any of:\n  - [X] `check-success = skill-script-tests-queue`\n  - [ ] all of:\n    - [ ] `-files ~= ^skills/`\n    - [X] `-files ~= ^\\.github/workflows/skill-gates\\.yml$`\n\n</details>"
+  },
+  {
+    "author": {
+      "login": "mergify"
+    },
+    "createdAt": "2026-07-28T11:21:32Z",
+    "body": "> queue\n\n#### ☑️ Command `queue` ignored because it is already running from a previous command.\n\n\n\n"
+  }
+]

package/skills/cicd/mergify/scripts/stack-push-core.mjs

@@ -0,0 +1,258 @@
+// Import-only core for pushing a Mergify stack: one commit per PR, pushed with the flags every
+// stack push needs, PR numbers reported, optionally enqueued together.
+//
+//   node stack-push.mjs [--trunk origin/main] [--enqueue] [--draft] [--dry-run]
+//
+// Exit: 0 pushed (or planned), 2 usage, 3 not a stack repo, 4 fix the commits first,
+// 5 push or enqueue failed, 6 mergify CLI older than MIN_CLI_VERSION.
+import { execFileSync } from 'node:child_process'
+import { existsSync } from 'node:fs'
+import { isAbsolute, join } from 'node:path'
+
+export const EXIT = { OK: 0, USAGE: 2, NOT_STACK_REPO: 3, FIX_COMMITS: 4, FAILED: 5, OLD_CLI: 6 }
+// The oldest mergify CLI this skill supports: GitHub-native stacks by default (2026.9.16.1),
+// called stable (2026.10.3), plus the retry and single-change fixes of 2026.10.4.
+export const MIN_CLI_VERSION = '2026.10.5'
+export const MISSING_CHANGE_ID_STATUS = 7
+// `stack list` straight after a push can lag GitHub, and the push's own lines are not always
+// readable (ai #1766, 2026-10-17: no PR read back, yet a list seconds later had it). Re-read
+// the stack this many times, this far apart, before calling a commit PR-less.
+export const REREAD_ATTEMPTS = 4
+export const REREAD_DELAY_MS = 5_000
+const sleepSync = (ms) => Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms)
+
+const HELP = `stack-push --trunk origin/main [--enqueue] [--draft] [--dry-run]
+
+Push the current branch's commits as a Mergify stack (one commit = one PR).
+  --trunk <remote/branch>  stack base (default origin/main)
+  --enqueue                post "@mergifyio queue" on every stack PR, in one pass
+  --draft                  open new PRs as drafts
+  --dry-run                show the push plan; push nothing
+Always keeps PR titles and bodies; never skips git hooks.
+`
+
+export function parseArgs(argv) {
+  const opts = { trunk: 'origin/main', enqueue: false, draft: false, dryRun: false, help: false }
+  for (let i = 0; i < argv.length; i++) {
+    const arg = argv[i]
+    if (arg === '--help' || arg === '-h') opts.help = true
+    else if (arg === '--enqueue') opts.enqueue = true
+    else if (arg === '--draft') opts.draft = true
+    else if (arg === '--dry-run') opts.dryRun = true
+    else if (arg === '--trunk') {
+      const value = argv[++i]
+      if (!value || !/^[^/\s]+\/\S+$/.test(value)) throw new Error('--trunk needs REMOTE/BRANCH, e.g. origin/main')
+      opts.trunk = value
+    } else throw new Error(`unknown option: ${arg}`)
+  }
+  if (opts.enqueue && opts.dryRun) throw new Error('--enqueue and --dry-run are mutually exclusive')
+  return opts
+}
+
+export function run(cmd, args) {
+  try {
+    const stdout = execFileSync(cmd, args, { encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'], timeout: 10 * 60_000 })
+    return { status: 0, stdout, stderr: '' }
+  } catch (error) {
+    return {
+      status: typeof error.status === 'number' ? error.status : 1,
+      stdout: String(error.stdout ?? ''),
+      stderr: String(error.stderr ?? error.message ?? ''),
+    }
+  }
+}
+
+// The hooks directory git actually uses: core.hooksPath when set, else <common git dir>/hooks.
+export function hooksDir({ exec }) {
+  const configured = exec('git', ['config', '--get', 'core.hooksPath'])
+  const top = exec('git', ['rev-parse', '--show-toplevel'])
+  if (configured.status === 0 && configured.stdout.trim()) {
+    const path = configured.stdout.trim()
+    return isAbsolute(path) ? path : join(top.stdout.trim(), path)
+  }
+  const common = exec('git', ['rev-parse', '--path-format=absolute', '--git-common-dir'])
+  if (common.status !== 0) return null
+  return join(common.stdout.trim(), 'hooks')
+}
+
+const versionParts = (text) => text.match(/\d+(?:\.\d+)+/)?.[0].split('.').map(Number) ?? null
+
+// -1, 0 or 1 when the installed CLI is older, equal or newer than `min`; null when unreadable.
+export function compareCliVersion(stdout, min = MIN_CLI_VERSION) {
+  const have = versionParts(stdout ?? ''), want = versionParts(min)
+  if (!have) return null
+  for (let i = 0; i < Math.max(have.length, want.length); i++) {
+    const d = (have[i] ?? 0) - (want[i] ?? 0)
+    if (d) return Math.sign(d)
+  }
+  return 0
+}
+
+export function missingChangeIdSha(stderr) {
+  const match = /Change-Id:`? line is missing on commit ([0-9a-f]{7,40})/.exec(stderr)
+  return match ? match[1] : null
+}
+
+export function readStack({ exec }, trunk) {
+  const listed = exec('mergify', ['stack', 'list', '--json', '--trunk', trunk])
+  if (listed.status === MISSING_CHANGE_ID_STATUS || missingChangeIdSha(listed.stderr)) {
+    return { error: 'missing-change-id', sha: missingChangeIdSha(listed.stderr), detail: listed.stderr.trim() }
+  }
+  if (listed.status !== 0) return { error: 'list-failed', detail: (listed.stderr || listed.stdout).trim() }
+  try {
+    const parsed = JSON.parse(listed.stdout)
+    return { entries: Array.isArray(parsed.entries) ? parsed.entries : [] }
+  } catch {
+    return { error: 'list-failed', detail: 'mergify stack list --json returned non-JSON output' }
+  }
+}
+
+export function pushArgs(opts) {
+  const args = ['stack', 'push', '--trunk', opts.trunk, '--keep-pull-request-title-and-body']
+  if (opts.draft) args.push('--draft')
+  if (opts.dryRun) args.push('--dry-run')
+  return args
+}
+
+// The PR each commit got, from `mergify stack push`'s own output, in stack order:
+//   `  · [created]<TAB><TAB>https://github.com/o/r/pull/1757<TAB>fix(mergify): …`
+//   `  ✓ [created]<TAB>af9adcc<TAB>https://github.com/o/r/pull/1839<TAB>fix(ci): …`
+// The bullet and the commit column vary by push; match any bullet before the `[status]`.
+// The push is the authority on what it just created. A `stack list` read straight after it can
+// lag GitHub and report a fresh PR as missing (fmm-express #1816, ai #1756, 2026-10-16).
+export function pushedPrs(stdout = '') {
+  const out = []
+  for (const line of stdout.split('\n')) {
+    const url = line.match(/https:\/\/github\.com\/[^\s]+\/pull\/(\d+)/)
+    if (!url || !/^\s*\S\s+\[[^\]]+\]/.test(line)) continue
+    const title = line.slice(line.indexOf(url[0]) + url[0].length).trim()
+    out.push({ title: title || null, url: url[0], pr: Number(url[1]) })
+  }
+  return out
+}
+
+const summarize = (entries) => entries.map((e) => ({
+  commit: e.commit_sha,
+  title: e.title,
+  pr: e.pull_number ?? null,
+  url: e.pull_url ?? null,
+  status: e.status ?? null,
+}))
+
+export function stackPush(argv, { exec = run, exists = existsSync, out = process.stdout, err = process.stderr, sleep = sleepSync } = {}) {
+  let opts
+  try {
+    opts = parseArgs(argv)
+  } catch (error) {
+    err.write(`stack-push: ${error.message}\n\n${HELP}`)
+    return EXIT.USAGE
+  }
+  if (opts.help) {
+    out.write(HELP)
+    return EXIT.OK
+  }
+
+  const hooks = hooksDir({ exec })
+  if (!hooks || !exists(join(hooks, 'mergify-hooks'))) {
+    err.write('stack-push: this repo has no Mergify stack hooks. Push with `git push` and open the PR with `gh pr create` (github-flow).\n')
+    return EXIT.NOT_STACK_REPO
+  }
+
+  const version = exec('mergify', ['--version'])
+  const order = version.status === 0 ? compareCliVersion(version.stdout) : null
+  if (order === null) {
+    err.write(`stack-push: could not read the mergify CLI version; this skill needs ${MIN_CLI_VERSION} or newer. Pushing anyway.\n`)
+  } else if (order < 0) {
+    err.write(`stack-push: mergify CLI ${version.stdout.trim().replace(/^mergify\s+/, '')} is older than ${MIN_CLI_VERSION}, the oldest this skill supports. Upgrade (\`brew upgrade mergify-cli\`; uv: \`uv tool upgrade mergify-cli\`), then rerun.\n`)
+    return EXIT.OLD_CLI
+  }
+
+  const before = readStack({ exec }, opts.trunk)
+  if (before.error === 'missing-change-id') {
+    err.write(`stack-push: commit ${before.sha ?? '(unknown)'} has no Change-Id. Tip commit: \`git commit --amend --no-edit\`. Older commit: \`mergify stack edit <sha>\`, \`git commit --amend --no-edit\`, \`git rebase --continue\`. Then rerun.\n`)
+    return EXIT.FIX_COMMITS
+  }
+  if (before.error) {
+    err.write(`stack-push: could not read the stack: ${before.detail}\n`)
+    return EXIT.FAILED
+  }
+  if (before.entries.length === 0) {
+    err.write(`stack-push: no commits on this branch above ${opts.trunk}. Commit first.\n`)
+    return EXIT.FIX_COMMITS
+  }
+
+  const pushed = exec('mergify', pushArgs(opts))
+  if (pushed.stdout) err.write(pushed.stdout)
+  if (pushed.status !== 0) {
+    const text = `${pushed.stderr}\n${pushed.stdout}`
+    if (/rebase failed|conflict/i.test(text)) {
+      err.write(`stack-push: rebase onto ${opts.trunk} hit a conflict. Resolve it, \`git rebase --continue\`, then rerun.\n`)
+    } else {
+      err.write(`stack-push: mergify stack push failed (exit ${pushed.status}): ${pushed.stderr.trim()}\n`)
+    }
+    return EXIT.FAILED
+  }
+  // The CLI falls back to a Depends-On stack where GitHub's stacking API is unavailable; that
+  // stack retargets only through head-branch deletion and needs the full Depends-On chain.
+  if (/not registered on GitHub/i.test(`${pushed.stdout}\n${pushed.stderr}`)) {
+    err.write('stack-push: not a GitHub-native stack: GitHub refused registration, so this is a Depends-On stack. Keep delete_branch_on_merge on (traps.md).\n')
+  }
+  if (opts.dryRun) {
+    out.write(`${JSON.stringify({ trunk: opts.trunk, dryRun: true, commits: summarize(before.entries) }, null, 2)}\n`)
+    return EXIT.OK
+  }
+
+  const reported = pushedPrs(pushed.stdout)
+  let prs
+  for (let attempt = 1; ; attempt++) {
+    const after = readStack({ exec }, opts.trunk)
+    if (after.error) {
+      err.write(`stack-push: pushed, but could not re-read the stack: ${after.detail}\n`)
+      return EXIT.FAILED
+    }
+    const listed = summarize(after.entries)
+    // Match by title, then by position when every commit got exactly one line.
+    const match = (p, i) => reported.find((x) => x.title && x.title === p.title)
+      ?? (reported.length === listed.length ? reported[i] : undefined)
+    prs = listed.map((p, i) => {
+      if (p.pr !== null) return p
+      const r = match(p, i)
+      return r ? { ...p, pr: r.pr, url: r.url, status: p.status === 'no_pr' ? 'open' : p.status } : p
+    })
+    if (attempt >= REREAD_ATTEMPTS || prs.every((p) => p.pr !== null)) break
+    sleep(REREAD_DELAY_MS)
+  }
+  const missing = prs.filter((p) => p.pr === null)
+  if (missing.length > 0) {
+    err.write(`stack-push: pushed, but ${missing.length} commit(s) have no PR: ${missing.map((p) => p.commit.slice(0, 12)).join(', ')}\n`)
+    return EXIT.FAILED
+  }
+
+  const enqueued = []
+  if (opts.enqueue) {
+    for (const p of prs) {
+      const commented = exec('gh', ['pr', 'comment', String(p.pr), '--body', '@mergifyio queue'])
+      if (commented.status !== 0) {
+        err.write(`stack-push: enqueue failed on #${p.pr}: ${commented.stderr.trim()}\n`)
+        out.write(`${JSON.stringify({ trunk: opts.trunk, prs, enqueued }, null, 2)}\n`)
+        return EXIT.FAILED
+      }
+      enqueued.push(p.pr)
+    }
+  }
+
+  // Mergify cancels a PR's queue request, queued or still waiting on checks, when new commits
+  // land on it (fmm-express #1846, 2026-10-17: a rebase push cancelled it and nothing said so).
+  const wasAt = new Map(before.entries.filter((e) => e.pull_number).map((e) => [e.pull_number, e.commit_sha]))
+  const moved = opts.enqueue ? [] : prs.filter((p) => wasAt.has(p.pr) && wasAt.get(p.pr) !== p.commit).map((p) => p.pr)
+  if (moved.length > 0) {
+    err.write(`stack-push: new commits on ${moved.map((n) => `#${n}`).join(' ')} cancel any Mergify queue request on them; requeue with --enqueue or \`@mergifyio queue\`\n`)
+  }
+  out.write(`${JSON.stringify({ trunk: opts.trunk, prs, enqueued }, null, 2)}\n`)
+  err.write(`stack-push: ${prs.length} PR(s): ${prs.map((p) => `#${p.pr}`).join(' ')}${opts.enqueue ? ' — all enqueued; watch each with watch-pr-delivery.mjs' : ''}\n`)
+  return EXIT.OK
+}
+
+export function runCli(argv) {
+  return stackPush(argv)
+}

package/skills/cicd/mergify/scripts/stack-push.mjs

@@ -0,0 +1,4 @@
+#!/usr/bin/env node
+import { runCli } from './stack-push-core.mjs'
+
+process.exitCode = runCli(process.argv.slice(2))