@arjunkhera/atlas 0.4.27 → 0.4.29

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "atlas",
-  "version": "0.4.27",
+  "version": "0.4.29",
   "description": "Atlas: the delivery lifecycle, its crews and the Atlas tools, for any repository.",
   "author": {
     "name": "Arjun Khera"

package/door/lib/gate-check.mjs

@@ -22,12 +22,14 @@
 // An owner result turns into success when a comment of the pull request holds
 // the owner's signed act for this repo, this pull request and this head
 // (roadmap R72, signed-act.mjs). The key comes from atlas/owner-signers on the
-// base, never from the head.
+// base, never from the head. An act for an older head carries to this head
+// when the new commits only merge the base in with no conflict (item 34b554e7).
 //
 // Red wins over owner: the pull request must be fixed before the owner signs.
 // Rules that hold everywhere here:
-// 1. The owner-only list and atlas.yaml come from the merge base, never from
-//    the head (owner-only.mjs reads them there).
+// 1. The owner-only list, atlas.yaml and the guarded workflows come from the
+//    base commit, never from the head and never from the merge base, which
+//    an agent can pick (item d56a9c03).
 // 2. Nothing of the head runs. Every read is a git object.
 // 3. It fails closed: a head or a merge base that git cannot read is red.
 import { spawnSync } from 'node:child_process';
@@ -205,7 +207,7 @@ export function saysNoBehaviourChange(body) {
   return !/^#/.test(first) && /^no\b/i.test(first);
 }
 
-// Product code sits under the `product_paths:` of atlas.yaml at the merge base
+// Product code sits under the `product_paths:` of atlas.yaml at the base
 // (roadmap R4 line 5). It is not a doc by the rule of fails-before, and not a
 // markdown file: a unit test cannot test skill text yet (roadmap R2 line 4).
 // A repo with no such key keeps the other two rules alone.
@@ -230,7 +232,7 @@ export function coveredFiles(root, green, mergeBase) {
 // for the files that main changed since that check was last green.
 function testRows({ root, mergeBase, head, body, redMain, rules, undo = null }) {
   const list = listChanged({ root, base: mergeBase, head });
-  const product = list.other_paths.filter(productTest(root, rules ?? mergeBase));
+  const product = list.other_paths.filter(productTest(root, rules));
   if (!product.length) return [];
   // The exact undo of a change that tripped the brake puts main back as it
   // was before that change, so it needs no new test (roadmap R13 line 4).
@@ -292,11 +294,16 @@ export function judge({ root, base, head, body = '', redMain = [], rules = null,
     answer.brake = { on: state.on, until: state.until, days: state.days, trips: state.trips, undo: undo?.culprit ?? null };
     answer.rows.push(...brakeRows(state, undo));
   }
-  for (const row of classify({ root: top, base: mergeBase, head: headSha, rules }).rows) answer.rows.push({ kind: 'owner', class: row.class ?? 'unlisted', path: row.path, cause: row.cause });
-  answer.rows.push(...jobRows(top, rules ?? mergeBase, headSha, changes));
+  // The rules come from the base commit, never from the merge base. An agent
+  // picks the merge base when it picks where its branch starts, also a middle
+  // commit of a merged pull request that weakened the list and then took the
+  // change back (item d56a9c03). The diff stays merge base to head.
+  const ruleRef = rules ?? baseSha;
+  for (const row of classify({ root: top, base: mergeBase, head: headSha, rules: ruleRef }).rows) answer.rows.push({ kind: 'owner', class: row.class ?? 'unlisted', path: row.path, cause: row.cause });
+  answer.rows.push(...jobRows(top, ruleRef, headSha, changes));
   answer.rows.push(...secretRows(top, mergeBase, headSha, changes));
   if (terms !== undefined) answer.rows.push(...termRows(top, baseSha, headSha, changes, terms));
-  answer.rows.push(...testRows({ root: top, mergeBase, head: headSha, body, redMain, rules, undo }));
+  answer.rows.push(...testRows({ root: top, mergeBase, head: headSha, body, redMain, rules: ruleRef, undo }));
   if (signed) signedRows(top, baseSha, headSha, signed, answer);
   return finish(answer);
 }
@@ -318,17 +325,106 @@ function signedRows(root, baseSha, headSha, { repo, pr, baseRef, texts }, answer
   if (!keys.length) { note(`no owner key in ${SIGNERS_FILE} on the base, so no signed act counts`); return; }
   note(`${keys.length} owner key(s) in ${SIGNERS_FILE} on the base: ${keys.map((key) => key.fingerprint).join(', ')}`);
   const verified = verifyTexts(texts, keys);
-  const found = findAct(verified, { kind: 'merge', repo, pr: Number(pr), base: baseRef, merge_base: answer.merge_base, head: headSha });
+  let found = findAct(verified, { kind: 'merge', repo, pr: Number(pr), base: baseRef, merge_base: answer.merge_base, head: headSha });
+  let carried = null;
+  if (!found) {
+    carried = carryAct(root, baseSha, headSha, verified, { repo, pr, baseRef }, answer);
+    if (carried?.found) found = carried.found;
+  }
   if (!found) {
     for (const row of verified.filter((each) => each.error).slice(0, 3)) note(`a signed act that does not count: ${row.error}`);
+    if (carried?.why) note(`a signed act for an older head does not carry: ${carried.why}`);
     if (verified.some((each) => !each.error)) note('a valid signed act names another pull request, base, merge base or head; sign this head');
     return;
   }
   const locked = answer.rows.filter((row) => row.kind === 'owner' && row.class === 'gate-checks');
   if (locked.length) { note('a signed act never clears a head job named like a check: remove that job'); return; }
   for (const row of answer.rows) if (row.kind === 'owner') row.kind = 'signed';
-  answer.signed = { key: found.key, signed_at: found.signed_at, verified: found.verified };
-  note(`the owner signed this head with key ${found.key} at ${found.signed_at}`);
+  answer.signed = { key: found.key, signed_at: found.signed_at, verified: found.verified, ...(carried?.found ? { carried_from: found.act.head } : {}) };
+  if (carried?.found) note(`the owner signed head ${found.act.head.slice(0, 7)} with key ${found.key} at ${found.signed_at}; this head only adds ${carried.merges} clean merge(s) of the base`);
+  else note(`the owner signed this head with key ${found.key} at ${found.signed_at}`);
+}
+
+// At most this many new commits between a signed head and this head.
+export const CARRY_LIMIT = 20;
+// At most this many signed heads are tried, so copies of one block cost little.
+export const CARRY_TRIES = 3;
+const contains = (root, older, newer) => spawnSync('git', [MERGE_BASE, '--is-ancestor', '--end-of-options', older, newer], { cwd: root }).status === 0;
+
+// Tracker item 34b554e7: a signed act survives a clean merge of the base. A
+// batch of signed pull requests merges one at a time, so each next one is
+// behind and must merge the base in, which makes a new head. The act for the
+// old head H0 carries to this head H only when all of these hold:
+// 1. The act names this repo, this pull request and this base branch.
+// 2. H0 is in the history of H, and the merge base of the act is in the
+//    history of the merge base now: the base only moved forward.
+// 3. Each commit in H that is not in H0 and not in the base is a merge with
+//    two parents. Its second parent was a tip of the base branch after the
+//    touch: a first-parent commit of the base after the signed merge base. Its tree is the tree that
+//    git makes for a merge of its two parents with no conflict. So no commit
+//    adds a line that the owner did not see, and a conflict fix needs a new touch.
+//    A clean merge brings in only what the base already holds, so the pull
+//    request changes no path now that it did not change at H0.
+// 4. The brake is not on: an act signed before a brake never clears it.
+// 5. Only the newest touch on this pull request carries, so a rollback to a
+//    head that the owner moved past does not clear.
+// It fails closed: a commit or a merge that git cannot read stops the carry.
+function carryAct(root, baseSha, headSha, verified, { repo, pr, baseRef }, answer) {
+  const same = (a, b) => String(a).toLowerCase() === String(b).toLowerCase();
+  // Every valid merge act of this pull request, on any base branch and head.
+  const mine = [];
+  for (const row of verified) {
+    if (row.error) continue;
+    for (const act of row.acts) if (act.kind === 'merge' && same(act.repo, repo) && Number(act.pr) === Number(pr)) mine.push({ act, signed_at: row.signed_at, key: row.key, verified: row.verified });
+  }
+  if (!mine.length) return null;
+  // Only the newest touch carries. An older act names a head that the owner
+  // moved past, so a rollback to it must not clear (security review finding 2).
+  const newest = mine.reduce((top, one) => (one.signed_at > top ? one.signed_at : top), '');
+  const seen = new Set();
+  const candidates = mine.filter((one) => {
+    const id = `${one.act.base} ${one.act.merge_base} ${one.act.head}`;
+    if (one.signed_at !== newest || one.act.base !== baseRef || one.act.head === headSha || seen.has(id)) return false;
+    seen.add(id);
+    return true;
+  }).slice(0, CARRY_TRIES);
+  if (!candidates.length) return { why: 'the newest signed act of this pull request names another base branch or head' };
+  if (answer.rows.some((row) => row.kind === 'owner' && row.class === 'brake')) return { why: 'the brake is on, so the owner signs this head' };
+  let why = null;
+  for (const one of candidates) {
+    const result = carryOne(root, baseSha, headSha, answer.merge_base, one.act);
+    if (result.merges) return { found: one, merges: result.merges };
+    why ??= result.why;
+  }
+  return { why: `${why} (${candidates.length} signed head(s) tried)` };
+}
+
+// git with no replace objects and no system config, so the merge that the
+// gate makes depends on the commits alone.
+const PINNED = { ...process.env, GIT_NO_REPLACE_OBJECTS: '1', GIT_CONFIG_NOSYSTEM: '1', GIT_CONFIG_GLOBAL: '/dev/null' };
+
+function carryOne(root, baseSha, headSha, mergeBase, act) {
+  const old = commitOf(root, act.head);
+  if (old !== act.head) return { why: `the signed head ${act.head.slice(0, 7)} is not a commit in this clone` };
+  if (commitOf(root, act.merge_base) !== act.merge_base) return { why: `the signed merge base ${act.merge_base.slice(0, 7)} is not a commit in this clone` };
+  if (!contains(root, old, headSha)) return { why: `the signed head ${old.slice(0, 7)} is not in the history of this head` };
+  if (!contains(root, act.merge_base, mergeBase)) return { why: 'the base did not only move forward since the touch' };
+  const shas = (git(root, ['rev-list', `--max-count=${CARRY_LIMIT + 1}`, headSha, `^${old}`, `^${baseSha}`], { allowFail: true }) ?? '').split('\n').filter(Boolean);
+  if (!shas.length) return { why: 'this head adds no merge of the base' };
+  if (shas.length > CARRY_LIMIT) return { why: `this head adds more than ${CARRY_LIMIT} commits` };
+  // The tips that the base branch held since the touch: its first-parent
+  // commits after the signed merge base. A merge may bring in only one of
+  // them, never a middle commit of a merged pull request (finding 3).
+  const tips = new Set((git(root, ['rev-list', '--first-parent', baseSha, `^${act.merge_base}`], { allowFail: true }) ?? '').split('\n').filter(Boolean));
+  for (const sha of shas) {
+    const [tree, ...parents] = (git(root, ['show', '-s', '--format=%T %P', sha], { allowFail: true }) ?? '').trim().split(' ');
+    if (parents.length !== 2) return { why: `commit ${sha.slice(0, 7)} is not a merge of two parents` };
+    if (!tips.has(parents[1])) return { why: `merge ${sha.slice(0, 7)} brings in ${parents[1].slice(0, 7)}, which was never a tip of the base after the touch` };
+    const made = spawnSync('git', ['-c', 'merge.renames=true', '-c', 'merge.conflictStyle=merge', 'merge-tree', '--write-tree', '--no-messages', '--end-of-options', parents[0], parents[1]], { cwd: root, encoding: 'utf8', env: PINNED, timeout: 30_000 });
+    if (made.status !== 0) return { why: `merge ${sha.slice(0, 7)} has a conflict, so its fix needs a new touch` };
+    if (made.stdout.split('\n')[0].trim() !== tree) return { why: `merge ${sha.slice(0, 7)} changes more than a clean merge of its parents` };
+  }
+  return { merges: shas.length };
 }
 
 // Line 1: while the brake is on, every pull request of the repo comes to the
@@ -366,6 +462,7 @@ export function renderText(answer) {
   }
   if (answer.result === 'red') out.push(`RED: ${oneLine(answer.rows.find((row) => row.kind === 'red').cause)}. Fix it; red wins over owner.`);
   else if (answer.result === 'owner') out.push(`OWNER: ${oneLine(answer.class)}. ${answer.signed_act}`);
+  else if (answer.signed?.carried_from) out.push(`SUCCESS: the owner signed head ${oneLine(answer.signed.carried_from).slice(0, 7)}, and this head only merges in the base.`);
   else if (answer.signed) out.push('SUCCESS: the owner signed this head.');
   else out.push('SUCCESS: no rule holds this pull request.');
   return out;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@arjunkhera/atlas",
-  "version": "0.4.27",
+  "version": "0.4.29",
   "description": "Atlas: the delivery lifecycle, its crews and the Atlas tools, as a Claude Code plugin for any repository.",
   "type": "module",
   "license": "UNLICENSED",

package/work/lib/numbers.mjs

@@ -16,6 +16,7 @@ import { deliveryFacts, FATAL_CONCLUSIONS } from './delivery.mjs';
 import { standingOf, isOwnerMessage, isStepIn, senderOfMark } from './step-ins.mjs';
 import { ACTIONS_APP_ID } from '../../door/lib/gate.mjs';
 import { groupOf } from '../../door/lib/changed-tests.mjs';
+import { SIGNERS_FILE, parseSigners, verifyTexts, findAct } from '../../door/lib/signed-act.mjs';
 
 export const NUMBERS_MAX_DAYS = 92;
 export const NUMBERS_DEFAULT_DAYS = 28;
@@ -24,20 +25,21 @@ export const PAGE = 100;
 // never cut.
 export const MAX_PULL_PAGES = 10;
 const MAX_FILE_PAGES = 30;
+const MAX_COMMENT_PAGES = 10;
 const CONCURRENCY = 8;
 const DAY = 86_400_000;
 // The second check of a changed test (roadmap R73). A signed act (R72) is
-// the other one; it is not built yet.
+// the other one.
 export const SECOND_CHECK = 'passes-after';
 // A changed or removed file of these groups is an old test that changed. A
 // package.json or a runner config changes for many reasons, so it is not.
 const TEST_GROUPS = Object.freeze(['unit-test', 'check-block', 'scenario-words', 'test-helper', 'kit-manifest']);
 // The GitHub counts and the tracker counts of one row.
-export const GITHUB_COUNTS = Object.freeze(['merges', 'not_on_green', 'reverts', 'unchecked_test_changes']);
+export const GITHUB_COUNTS = Object.freeze(['merges', 'not_on_green', 'reverts', 'unchecked_test_changes', 'signed_acts']);
 export const GRAPH_COUNTS = Object.freeze(['reopens', 'step_ins', 'owner_messages', 'platform_messages']);
-// Line 2: the counts that wait on items not built yet. They are named, never
+// Line 2: the count that waits on an item not built yet. It is named, never
 // shown as zero.
-export const WAITING = Object.freeze({ signed_acts: 'waits on R72, the signed act', audit_unsigned_merges: 'waits on R14, the audit job' });
+export const WAITING = Object.freeze({ audit_unsigned_merges: 'waits on R14 line 3, the unsigned-merge finding of the audit job' });
 
 const DATE = /^\d{4}-\d{2}-\d{2}$/;
 const dayOf = (value) => String(value ?? '').slice(0, 10);
@@ -106,6 +108,29 @@ async function readAllFiles(repo, number, readGitHub) {
   throw new Error(`pull request ${number} changed more than ${MAX_FILE_PAGES * PAGE} files`);
 }
 
+// Line 2: the comment texts of one pull request, every page. More than
+// MAX_COMMENT_PAGES pages is refused, never cut.
+export async function readAllComments(repo, number, readGitHub) {
+  const texts = [];
+  for (let page = 1; page <= MAX_COMMENT_PAGES; page += 1) {
+    const rows = await readGitHub(`repos/${repo}/issues/${number}/comments?per_page=${PAGE}&page=${page}`);
+    if (!Array.isArray(rows)) throw new Error(`the comments of pull request ${number} are not a list`);
+    texts.push(...rows.map((row) => String(row?.body ?? '')));
+    if (rows.length < PAGE) return texts;
+  }
+  throw new Error(`pull request ${number} has more than ${MAX_COMMENT_PAGES * PAGE} comments`);
+}
+
+// Line 2: the owner's signed act for the merged head of one pull request, or
+// null. The key comes from atlas/owner-signers at the first parent of the
+// merge, as the gate reads it from the base. The act must name this repo,
+// this pull request, its base branch and its last head. The gate checked the
+// merge base when it let the head pass; this count does not read it again.
+export function signedActOf({ repo, pull, texts, keys }) {
+  const found = findAct(verifyTexts(texts, keys), { kind: 'merge', repo, pr: Number(pull.number), base: pull.base?.ref, head: pull.head?.sha });
+  return found ? { signed_at: found.signed_at, key: found.key } : null;
+}
+
 // Run each job, at most `limit` at a time. The first failure stops the rest
 // and is thrown, so a count is whole or refused.
 async function pool(jobs, limit = CONCURRENCY) {
@@ -179,38 +204,48 @@ export function secondCheckPassed(runs = [], mergedAt) {
 export async function readMerges({ repo, defaultBranch, period, readGitHub }) {
   const pulls = await readAllPulls(repo, readGitHub, period.start);
   const merges = pulls.filter((pull) => pull.merged_at && time(pull.merged_at) >= period.start && time(pull.merged_at) < period.end && (!defaultBranch || pull.base?.ref === defaultBranch));
-  const facts = new Map();
-  const requiredAt = (sha) => {
-    if (!facts.has(sha)) facts.set(sha, (async () => {
+  const cache = new Map();
+  // One file at one commit, read once. A file that is not there is null.
+  const textAt = (path, sha) => {
+    const key = `${path}@${sha}`;
+    if (!cache.has(key)) cache.set(key, (async () => {
       let file;
-      try { file = await readGitHub(`repos/${repo}/contents/atlas.yaml?ref=${sha}`); }
-      catch (error) { if (error?.status === 404 || /HTTP 404|Not Found/i.test(String(error?.message ?? ''))) return []; throw error; }
-      if (!file || typeof file.content !== 'string') return [];
-      return deliveryFacts(Buffer.from(file.content, 'base64').toString('utf8')).required;
+      try { file = await readGitHub(`repos/${repo}/contents/${path}?ref=${sha}`); }
+      catch (error) { if (error?.status === 404 || /HTTP 404|Not Found/i.test(String(error?.message ?? ''))) return null; throw error; }
+      if (!file || typeof file.content !== 'string') return null;
+      return Buffer.from(file.content, 'base64').toString('utf8');
     })());
-    return facts.get(sha);
+    return cache.get(key);
+  };
+  const requiredAt = async (sha) => {
+    const text = await textAt('atlas.yaml', sha);
+    return text === null ? [] : deliveryFacts(text).required;
   };
   return pool(merges.map((pull) => async () => {
     const head = pull.head?.sha, merge = pull.merge_commit_sha;
     if (!/^[0-9a-f]{40}$/i.test(String(head)) || !/^[0-9a-f]{40}$/i.test(String(merge))) throw new Error(`GitHub names no head or merge commit for pull request ${pull.number}`);
-    const requiredBefore = async () => {
+    const before = async () => {
       const parent = (await readGitHub(`repos/${repo}/commits/${merge}`))?.parents?.[0]?.sha;
       if (!/^[0-9a-f]{40}$/i.test(String(parent))) throw new Error(`GitHub names no parent of the merge commit of pull request ${pull.number}`);
-      return requiredAt(parent);
+      const [required, signers] = await Promise.all([requiredAt(parent), textAt(SIGNERS_FILE, parent)]);
+      return { required, signers };
     };
-    const [checks, files, required] = await Promise.all([
+    const [checks, files, { required, signers }] = await Promise.all([
       readGitHub(`repos/${repo}/commits/${head}/check-runs?per_page=${PAGE}`),
       readAllFiles(repo, pull.number, readGitHub),
-      requiredBefore(),
+      before(),
     ]);
     if (!Array.isArray(checks?.check_runs)) throw new Error(`the check runs of pull request ${pull.number} are not a list`);
     const runs = checks.check_runs;
     if (Number(checks?.total_count ?? runs.length) > runs.length) throw new Error(`the head of pull request ${pull.number} has more than ${PAGE} check runs`);
     const tests = changedOldTests(files);
+    // With no owner key at the merge, no act can count: the comments are not read.
+    const keys = parseSigners(signers ?? '').keys;
+    const signed = keys.length ? signedActOf({ repo, pull, texts: await readAllComments(repo, pull.number, readGitHub), keys }) : null;
     return {
       repo, number: pull.number, url: pull.html_url ?? `https://github.com/${repo}/pull/${pull.number}`, title: oneLine(pull.title ?? '', 200), merged_at: pull.merged_at,
       not_on_green: notOnGreenReasons({ required, runs, mergedAt: pull.merged_at }), revert: isRevert(pull),
-      changed_tests: tests, unchecked: tests.length > 0 && !secondCheckPassed(runs, pull.merged_at),
+      changed_tests: tests, signed, unchecked: tests.length > 0 && !signed && !secondCheckPassed(runs, pull.merged_at),
     };
   }));
 }
@@ -283,6 +318,7 @@ export async function readNumbers({ product, repos, items, marks, period, readGi
       if (merge.not_on_green.length) events.push(['not_on_green', merge.merged_at]);
       if (merge.revert) events.push(['reverts', merge.merged_at]);
       if (merge.unchecked) events.push(['unchecked_test_changes', merge.merged_at]);
+      if (merge.signed) events.push(['signed_acts', merge.merged_at]);
     }
     for (const mark of reopens) if (itemRepos.get(mark.fields.item).includes(repo.id)) events.push(['reopens', mark.fields.marked_at]);
     for (const pair of pairs) {
@@ -304,6 +340,7 @@ export async function readNumbers({ product, repos, items, marks, period, readGi
       not_on_green: refused ? null : merges.filter((merge) => merge.not_on_green.length).map((merge) => ({ pr: merge.url, merged_at: merge.merged_at, reasons: merge.not_on_green })),
       reverts: refused ? null : merges.filter((merge) => merge.revert).map((merge) => ({ pr: merge.url, title: merge.title })),
       unchecked_test_changes: refused ? null : merges.filter((merge) => merge.unchecked).map((merge) => ({ pr: merge.url, tests: merge.changed_tests })),
+      signed_acts: refused ? null : merges.filter((merge) => merge.signed).map((merge) => ({ pr: merge.url, signed_at: merge.signed.signed_at, key: merge.signed.key })),
     });
   }
   const delivered = deliveredRows({ marks: marks.filter((mark) => mark.fields?.product === product), items, period });

package/work/lib/roundup.mjs

@@ -251,7 +251,7 @@ function render(view) {
 }
 
 // Part 6. A refused count reads "refused", never 0.
-const COLUMNS = [['merges', 'merges'], ['not_on_green', 'not on green'], ['reverts', 'reverts'], ['unchecked_test_changes', 'unchecked test changes'], ['reopens', 'reopens'], ['step_ins', 'step-ins'], ['owner_messages', 'owner messages'], ['platform_messages', 'platform messages']];
+const COLUMNS = [['merges', 'merges'], ['not_on_green', 'not on green'], ['reverts', 'reverts'], ['unchecked_test_changes', 'unchecked test changes'], ['signed_acts', 'signed acts'], ['reopens', 'reopens'], ['step_ins', 'step-ins'], ['owner_messages', 'owner messages'], ['platform_messages', 'platform messages']];
 const countsLine = (row) => COLUMNS.map(([key, word]) => `${row[key] === null ? 'refused' : row[key]} ${word}`).join(' · ');
 function renderNumbers(numbers, more) {
   const out = [`6. The numbers, ${numbers.from} to ${numbers.to} (UTC)`];
@@ -269,7 +269,7 @@ function renderNumbers(numbers, more) {
   out.push(`   input to live: ${numbers.delivered.length} delivered ${numbers.delivered.length === 1 ? 'item' : 'items'}${median === null ? '' : `, median ${median} days`}`);
   for (const row of numbers.delivered.slice(0, SHOWN)) out.push(listLine(row.title, `${row.item.slice(0, 8)} · ${row.days ?? '?'} days · live ${dayOf(row.live_at)}`, '     '));
   out.push(...more(numbers.delivered));
-  out.push(`   owner acts: signed acts ${numbers.owner_acts.signed_acts}; unsigned merges ${numbers.owner_acts.audit_unsigned_merges}`);
+  out.push(`   owner acts: unsigned merges ${numbers.owner_acts.audit_unsigned_merges}`);
   if (numbers.not_counted_sessions) out.push(`   ${numbers.not_counted_sessions} sessions ran with the hooks off, so their messages were not counted`);
   return out.join('\n');
 }

package/work/mcp.mjs

@@ -216,6 +216,10 @@ export const GITHUB_READS = Object.freeze([
   new RegExp(`^repos/${REPO}/pulls/\\d{1,9}/files\\?per_page=\\d{1,3}&page=\\d{1,3}$`),
   // Roadmap R14 line 6: the newest run of the daily audit, for the roundup.
   new RegExp(`^repos/${REPO}/actions/workflows/atlas-jobs\\.yml/runs\\?per_page=\\d{1,3}$`),
+  // Roadmap R16 line 2: the comments of a merge, for the owner's signed act,
+  // and the owner key file at the first parent of the merge.
+  new RegExp(`^repos/${REPO}/issues/\\d{1,9}/comments\\?per_page=\\d{1,3}&page=\\d{1,3}$`),
+  new RegExp(`^repos/${REPO}/contents/atlas/owner-signers\\?ref=${SHA}$`),
 ]);
 export function githubReader() {
   return async (path) => {