@ashlr/hub 3.2.6 → 3.3.0

package/dist/core/inbox/merge.js

@@ -98,7 +98,7 @@ import { execFileSync } from 'node:child_process';
 import { existsSync, mkdirSync, writeFileSync, unlinkSync, symlinkSync, readFileSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { join } from 'node:path';
-import { randomBytes } from 'node:crypto';
+import { createHash, randomBytes } from 'node:crypto';
 import { isDeepStrictEqual } from 'node:util';
 import { loadProposal, recordRealizedMerge, setStatus, updateProposalField } from './store.js';
 import { canonicalModelTag } from '../run/model-catalog.js';
@@ -128,6 +128,7 @@ import { acquireProposalMutationLock, releaseProposalMutationLock } from './prop
 import { acquireOutwardMutationFence, ownsOutwardMutationFence, releaseOutwardMutationFence, } from '../sandbox/mutation-fence.js';
 import { isAuthenticatedAwaitingRemoteHandoff, isApprovedRemoteHandoffRetryCandidate, remoteAuthorityBinding, remoteAuthorityMatchesRepo, remoteIntentAuthorizationId, REMOTE_HANDOFF_RECOVERY_MARKER, } from './remote-handoff.js';
 import { findLocalRealizedMergeDescendant } from './realized-merge.js';
+import { prepareHostMergeRevocation, transitionHostMergeRevocation, readHostMergeRevocationState, } from '../autonomy/host-merge-revocation-protocol.js';
 function auditAutoMergeCanaryFailure(repo, sandboxId) {
     try {
         audit({
@@ -159,6 +160,20 @@ function decisionReadIsHealthy(decisions) {
 const MERGE_BRANCH_PREFIX = 'ashlr/merge/';
 /** Timeout for git operations (ms). */
 const GIT_TIMEOUT = 30_000;
+/**
+ * Gate 6.5 (self-eval parity, M54/M86): how many times to run test:invariants
+ * per flag state before declaring it red. >1 tolerates a one-off transient
+ * blip (lock timing, momentary contention) without weakening the gate — a
+ * genuinely broken invariant still fails every attempt. Kept small (one
+ * retry, short delay): sustained multi-minute contention from a concurrent
+ * test run can't be "waited out" here anyway — cross-tick retry (the
+ * proposal simply stays pending and is re-evaluated next pass, see
+ * automerge-pass.ts) is what actually absorbs that, and this must stay
+ * short enough to never turn a fast fail-closed refusal into a slow one.
+ */
+const SELF_EVAL_PARITY_RETRY_ATTEMPTS = 2;
+/** Delay between self-eval parity retry attempts (ms). */
+const SELF_EVAL_PARITY_RETRY_DELAY_MS = 500;
 // ---------------------------------------------------------------------------
 // git helpers — arg arrays, no shell
 // ---------------------------------------------------------------------------
@@ -612,7 +627,23 @@ export function evaluateAutoMergeReadinessPreflight(proposal, cfg) {
             return block('proposal has no repo');
         if (proposal.verifyResult?.passed === false) {
             const failed = proposal.verifyResult.failed?.filter(Boolean).join('; ');
-            return block(`known verification failure: proposal.verifyResult.passed is false${failed ? ` (${failed})` : ''}`);
+            const category = proposal.verifyResult.failureCategory;
+            // A verifier that could NOT be executed (missing binary, exit 127, spawn
+            // ENOENT) or that hit a bounded timeout/infra hiccup is a DIFFERENT
+            // outcome from a verifier that ran and found the diff broken. Both stay
+            // fail-closed (ready:false — this NEVER makes an unverified change
+            // eligible to merge), but only a real 'code' failure (or an
+            // unclassified/legacy record) may accrue toward stuckPassCount/
+            // autoArchive. An infra-flavored failure must not permanently kill a
+            // proposal whose only crime was that the verifier was momentarily
+            // unavailable — it stays pending and is retried next pass.
+            const infraLike = category === 'tool' || category === 'timeout' || category === 'infra';
+            const advisories = infraLike
+                ? [
+                    `verifier-unavailable: verification could not run to completion (${category}) — not counted toward auto-archive; will retry`,
+                ]
+                : [];
+            return block(`known verification failure: proposal.verifyResult.passed is false${failed ? ` (${failed})` : ''}`, advisories, !infraLike);
         }
         const trustBasis = cfg.foundry?.['autoMerge']
             ? cfg.foundry['autoMerge']?.['trustBasis'] ?? 'tier'
@@ -1417,6 +1448,7 @@ export function verifyResultFromProposalResult(result, source = 'auto-merge', ve
     return {
         passed: result.ok,
         ...(result.ok ? {} : { failed: [result.detail] }),
+        ...(result.ok || result.failureCategory === undefined ? {} : { failureCategory: result.failureCategory }),
         detail: result.detail,
         ran: [...result.ran],
         ...(result.browser ? { browser: result.browser } : {}),
@@ -1534,6 +1566,7 @@ function verifyResultFromStored(result) {
         ...(result.browser ? { browser: result.browser } : {}),
         ...(result.baseBranch ? { baseBranch: result.baseBranch } : {}),
         ...(result.baseHead ? { baseHead: result.baseHead } : {}),
+        ...(result.failureCategory ? { failureCategory: result.failureCategory } : {}),
     };
 }
 function truncateEvidenceText(text, limit = 500) {
@@ -1685,15 +1718,24 @@ export async function verifyProposal(proposal, cfg) {
         }
         // Apply the diff to the worktree ONLY AFTER capturing the base-derived
         // command list, then run those (immutable) commands against the patched tree.
+        // M??? (merge-pipeline reliability): --3way lets git fall back to a
+        // three-way merge (using the blob shas already embedded in `git diff`'s
+        // extended headers) when the diff's ORIGINAL base has since moved but the
+        // proposal's edits don't actually conflict with what changed. Plain
+        // `apply` fails on any context drift even for benign staleness; `--3way`
+        // only fails closed on a REAL textual conflict, which is the outcome we
+        // actually want to distinguish from "diff is corrupt". Safe: this
+        // worktree is always removed in the finally block below regardless of
+        // outcome, so a conflicted intermediate state is never observed.
         patchFile = writeTmpFile(diff);
         try {
-            gitRun(tmpDir, ['apply', '--index', patchFile]);
+            gitRun(tmpDir, ['apply', '--3way', '--index', patchFile]);
         }
         catch (err) {
             return {
                 ok: false,
                 ran: [],
-                detail: `git apply failed in verify worktree: ${err instanceof Error ? err.message : String(err)}`,
+                detail: `git apply failed in verify worktree (3-way fallback also failed — likely a real conflict, not just a stale base): ${err instanceof Error ? err.message : String(err)}`,
                 baseBranch: base,
                 baseHead,
             };
@@ -1711,6 +1753,7 @@ export async function verifyProposal(proposal, cfg) {
                         detail: `required verify '${vc.kind}' failed (exit ${res.exitCode}): ${res.command}`,
                         baseBranch: base,
                         baseHead,
+                        ...(res.failureCategory ? { failureCategory: res.failureCategory } : {}),
                     };
                 }
                 // M281: for test commands, only block if NEW failures were introduced.
@@ -1788,6 +1831,7 @@ export async function verifyProposal(proposal, cfg) {
                     detail: `verify '${vc.kind}' failed (exit ${res.exitCode}): ${res.command}`,
                     baseBranch: base,
                     baseHead,
+                    ...(res.failureCategory ? { failureCategory: res.failureCategory } : {}),
                 };
             }
         }
@@ -1968,6 +2012,223 @@ function reconcileLocalMergeIntent(id, cfg) {
     });
     return { ok: true, merged: true, reason };
 }
+// ---------------------------------------------------------------------------
+// Host merge — the last hop of the remote handoff path: the actual
+// `gh pr merge`. Gated by durable per-authority revocation
+// (autonomy/host-merge-revocation-protocol.ts) on top of every existing
+// mechanical/judge/self-target gate already run above. Default DISABLED via
+// cfg.foundry.autoMerge.hostAutoMerge (separate opt-in from pushToRemote —
+// opening a PR and actually merging it are different trust levels).
+// ---------------------------------------------------------------------------
+/** Bounded lifetime of a single host-merge authority window (< the protocol's 15m cap). */
+export const HOST_MERGE_AUTHORITY_TTL_MS = 10 * 60 * 1000;
+/** Timeout for the `gh pr merge` invocation itself (network op). */
+const HOST_MERGE_TIMEOUT_MS = 30_000;
+/**
+ * Placeholder kill-switch epoch. ~/.ashlr/KILL has no versioning of its own
+ * today; this binds every host-merge authority to a fixed protocol
+ * generation so the identity schema is forward-compatible if a real epoch
+ * counter is added later. It is NOT a substitute for the direct
+ * killSwitchOn() checks below — those remain the live, load-bearing gate.
+ */
+export const HOST_MERGE_KILL_EPOCH_DIGEST = createHash('sha256')
+    .update('ashlr.host-merge-revocation.kill-epoch.v1', 'utf8')
+    .digest('hex');
+export function hostMergeOperationId(id, suffix) {
+    const candidate = `${id}-${suffix}`;
+    return /^[A-Za-z0-9][A-Za-z0-9_.:-]{0,159}$/.test(candidate) ? candidate : null;
+}
+/**
+ * Digest binding the currently-configured auto-merge policy surface.
+ * Changing any of these values between prepare and arm changes the
+ * authority's identity (and therefore its authorityId), so a stale grant
+ * prepared under an old policy can never silently carry forward under a
+ * different one — transitionHostMergeRevocation would refuse it as
+ * 'authority-missing' instead.
+ */
+export function hostMergePolicyEpoch(input) {
+    return createHash('sha256').update(JSON.stringify(input), 'utf8').digest('hex');
+}
+export function buildHostMergeRevocationIdentity(input) {
+    return {
+        nameWithOwner: input.nameWithOwner,
+        repositoryId: input.repositoryId,
+        baseRef: input.base,
+        baseOid: input.baseOid,
+        headRef: input.branch,
+        headOid: input.headOid,
+        pullRequestId: input.pullRequestId,
+        pullRequestNumber: input.pullRequestNumber,
+        evidencePackDigest: input.evidencePackDigest,
+        verifierManifestDigest: input.verifierManifestDigest,
+        protectionPolicyDigest: input.protectionPolicyDigest,
+        killEpoch: HOST_MERGE_KILL_EPOCH_DIGEST,
+        policyEpoch: input.policyEpoch,
+        expiresAt: new Date(input.now.getTime() + HOST_MERGE_AUTHORITY_TTL_MS).toISOString(),
+    };
+}
+/** Run `gh pr merge` directly (never throws). */
+function hostMergeGhPrMerge(cwd, args) {
+    try {
+        const stdout = execFileSync('gh', args, {
+            cwd,
+            timeout: HOST_MERGE_TIMEOUT_MS,
+            stdio: 'pipe',
+            encoding: 'utf8',
+            env: {
+                ...process.env,
+                GH_HOST: 'github.com',
+                GH_NO_UPDATE_NOTIFIER: '1',
+                NO_COLOR: '1',
+            },
+        });
+        return { ok: true, detail: (typeof stdout === 'string' ? stdout.trim() : '') || 'gh pr merge exited 0' };
+    }
+    catch (err) {
+        const e = err;
+        const stderr = typeof e.stderr === 'string'
+            ? e.stderr
+            : e.stderr instanceof Buffer
+                ? e.stderr.toString('utf8')
+                : undefined;
+        return { ok: false, detail: (stderr || e.message || 'gh pr merge failed').trim().slice(0, 2000) };
+    }
+}
+/**
+ * Attempt the last hop of the remote handoff: the actual `gh pr merge`.
+ * Returns a human-readable mergeNote describing the outcome; NEVER throws.
+ * Fails closed on every ambiguity (kill switch, unreadable/degraded/missing
+ * revocation state, missing identity inputs). The proposal always ends up in
+ * the existing awaiting-host-merge state regardless of this function's
+ * outcome — the pre-existing reconcileRemoteHandoffs() sweep is the durable
+ * source of truth for whatever actually happened on the host, whether we
+ * merged it just now or a human merges it later.
+ *
+ * Exported (with its identity-building helpers) so tests can drive it
+ * directly, and so a test can independently prepare/arm/revoke the EXACT
+ * authority this function will look up (same identity, same clock) to
+ * exercise durable revocation without needing to fabricate an entire
+ * end-to-end autoMergeProposal() gate-chain pass.
+ */
+export async function attemptHostAutoMerge(input) {
+    const { repo, id, cfg, nameWithOwner, repositoryId, url, base, baseOid, branch, headOid, observedPr, evidencePackDigest, verifierManifestDigest, protectionPolicyDigest, maxRisk, managerGateEnabled, allowSelfMerge, maxFiles, maxLines, } = input;
+    const hostAutoMergeEnabled = autoMergeConfigValue(cfg, 'hostAutoMerge') === true;
+    if (!hostAutoMergeEnabled) {
+        return 'PR opened; host auto-merge is disabled (cfg.foundry.autoMerge.hostAutoMerge !== true)';
+    }
+    if (!verifierManifestDigest) {
+        return 'PR opened; host auto-merge refused because no required-verifier manifest digest is bound to this attempt';
+    }
+    if (killSwitchOn()) {
+        return 'PR opened; host auto-merge refused because the autonomy kill switch is ON';
+    }
+    // Re-derive PR identity fresh — never trust an object handed in from an
+    // earlier step of this same invocation. This is also what makes an
+    // interrupted host merge reconcilable: if a prior, crashed attempt already
+    // got the PR merged, we observe that here and never re-invoke gh pr merge.
+    const freshBeforeAttempt = viewPr(repo, url, { repo: nameWithOwner });
+    if (!freshBeforeAttempt) {
+        return 'PR opened; host auto-merge refused because the PR could not be freshly re-read before merging';
+    }
+    if (freshBeforeAttempt.state === 'MERGED' || Boolean(freshBeforeAttempt.mergedAt)) {
+        return 'PR opened; already merged on the host (observed before any merge attempt this pass)';
+    }
+    if (freshBeforeAttempt.state !== 'OPEN' ||
+        !freshBeforeAttempt.headRefOid || freshBeforeAttempt.headRefOid.toLowerCase() !== headOid.toLowerCase() ||
+        freshBeforeAttempt.baseRefName !== base) {
+        return `PR opened; host auto-merge refused because the live PR state changed (state=${freshBeforeAttempt.state ?? 'unknown'})`;
+    }
+    const pullRequestId = observedPr?.id ?? freshBeforeAttempt.id;
+    const pullRequestNumber = observedPr?.number ?? freshBeforeAttempt.number;
+    if (!pullRequestId || typeof pullRequestNumber !== 'number' || !Number.isSafeInteger(pullRequestNumber)) {
+        return 'PR opened; host auto-merge refused because the PR node id/number could not be resolved';
+    }
+    const policyEpoch = hostMergePolicyEpoch({
+        maxRisk, managerGateEnabled, allowSelfMerge, hostAutoMergeEnabled, maxFiles, maxLines,
+    });
+    const now = input.now ?? new Date();
+    const identity = buildHostMergeRevocationIdentity({
+        nameWithOwner, repositoryId, base, baseOid, branch, headOid,
+        pullRequestId, pullRequestNumber, evidencePackDigest, verifierManifestDigest,
+        protectionPolicyDigest, policyEpoch, now,
+    });
+    const prepareOpId = hostMergeOperationId(id, 'host-merge-prepare');
+    const armOpId = hostMergeOperationId(id, 'host-merge-arm');
+    const consumeOpId = hostMergeOperationId(id, 'host-merge-consume');
+    if (!prepareOpId || !armOpId || !consumeOpId) {
+        return 'PR opened; host auto-merge refused because a durable operation id could not be derived';
+    }
+    const prepared = prepareHostMergeRevocation({ identity, operationId: prepareOpId, now });
+    if (!('receipt' in prepared)) {
+        return `PR opened; host auto-merge refused: revocation prepare ${prepared.status} (${prepared.reason})`;
+    }
+    const armed = transitionHostMergeRevocation({
+        identity,
+        action: 'arm',
+        operationId: armOpId,
+        expectedSequence: prepared.receipt.sequence,
+        expectedReceiptDigest: prepared.receipt.receiptDigest,
+        now,
+    });
+    if (!('receipt' in armed)) {
+        return `PR opened; host auto-merge refused: revocation arm ${armed.status} (${armed.reason})`;
+    }
+    // Immediately before the irreversible act: re-check the kill switch AND do
+    // a FRESH authenticated read of the durable revocation store — never trust
+    // the in-memory `armed` result, since a concurrent revoker could have acted
+    // in between.
+    if (killSwitchOn()) {
+        const killRevokeOpId = hostMergeOperationId(id, 'host-merge-revoke-kill');
+        if (killRevokeOpId) {
+            // Best-effort durable revoke — gives the kill switch real teeth against
+            // this specific authority, even though we abort THIS invocation either way.
+            transitionHostMergeRevocation({
+                identity,
+                action: 'revoke',
+                operationId: killRevokeOpId,
+                expectedSequence: armed.receipt.sequence,
+                expectedReceiptDigest: armed.receipt.receiptDigest,
+                now,
+            });
+        }
+        return 'PR opened; host auto-merge refused because the autonomy kill switch is ON';
+    }
+    const preMergeState = readHostMergeRevocationState(identity);
+    if (preMergeState.state !== 'healthy' || preMergeState.record.phase !== 'armed') {
+        const detail = preMergeState.state === 'healthy'
+            ? `phase=${preMergeState.record.phase}`
+            : preMergeState.state === 'degraded'
+                ? preMergeState.reason
+                : 'authority missing';
+        return `PR opened; host auto-merge refused: revocation authority is not armed (${detail})`;
+    }
+    const mergeMethodCfg = autoMergeConfigValue(cfg, 'mergeMethod');
+    const methodFlag = mergeMethodCfg === 'merge' ? '--merge' : mergeMethodCfg === 'rebase' ? '--rebase' : '--squash';
+    const attempt = hostMergeGhPrMerge(repo, ['pr', 'merge', url, '--repo', nameWithOwner, methodFlag]);
+    const freshAfterAttempt = viewPr(repo, url, { repo: nameWithOwner });
+    const confirmedMerged = Boolean(freshAfterAttempt &&
+        (freshAfterAttempt.state === 'MERGED' || freshAfterAttempt.mergedAt) &&
+        freshAfterAttempt.headRefOid?.toLowerCase() === headOid.toLowerCase());
+    if (confirmedMerged) {
+        transitionHostMergeRevocation({
+            identity,
+            action: 'consume',
+            operationId: consumeOpId,
+            expectedSequence: armed.receipt.sequence,
+            expectedReceiptDigest: armed.receipt.receiptDigest,
+            now,
+        });
+        return `PR opened and merged via host auto-merge (gh pr merge)${attempt.ok ? '' : `; gh reported: ${attempt.detail}`}`;
+    }
+    // Not confirmed merged — leave the authority 'armed' (never consumed, never
+    // revoked) so a later retry via the existing remoteHandoff recovery path
+    // replays the SAME authority instead of minting a new one, and so
+    // reconcileRemoteHandoffs() remains the single source of truth if the host
+    // actually completes the merge after our read.
+    return attempt.ok
+        ? 'PR opened; host auto-merge invoked gh pr merge but the merge was not confirmed on re-read; will reconcile'
+        : `PR opened; host auto-merge refused: ${attempt.detail}`;
+}
 /** Build the staging branch holding the proposal's diff, off the default branch.
  *  Returns the branch name on success, or null + detail on failure. */
 function buildMergeBranch(repo, id, diff, base, expectedBaseHead, finalAuthority) {
@@ -2021,7 +2282,12 @@ function buildMergeBranch(repo, id, diff, base, expectedBaseHead, finalAuthority
             const applyAuthorityFailure = finalAuthority?.();
             if (applyAuthorityFailure)
                 throw new Error(applyAuthorityFailure);
-            gitRun(tmpDir, ['apply', '--index', patchFile]);
+            // --3way: see the matching comment in verifyProposal()'s apply site —
+            // same rationale, harmless here since expectedBaseHead (when supplied)
+            // already guarantees this worktree's base is byte-identical to what was
+            // verified, so 3-way and plain apply agree; it only helps callers that
+            // omit expectedBaseHead.
+            gitRun(tmpDir, ['apply', '--3way', '--index', patchFile]);
             const commitAuthorityFailure = finalAuthority?.();
             if (commitAuthorityFailure)
                 throw new Error(commitAuthorityFailure);
@@ -2467,11 +2733,12 @@ export async function autoMergeProposal(id, cfg, invocation = {}) {
         let maxLinesForEvidence = 0;
         // ── Gate 5.5 (M86): scope cap — only small, fully-bounded diffs auto-merge
         // to main. Defaults are conservative; bounded config keys allow opt-in relaxation.
-        // We require risk==='low' here (Gate 5 already enforces ≤maxRisk, but
-        // maxRisk could be raised to 'medium' — scope cap applies ONLY when risk is
-        // strictly 'low', so even a cfg.maxRisk='medium' run is scoped to low-risk
-        // diffs for the size check). File + line counts reuse the same diff parser
-        // as classifyRisk so the two gates are consistent.
+        // NOTE (was stale): this used to hard-require risk==='low' regardless of
+        // cfg.maxRisk, silently overriding an operator's higher maxRisk for the
+        // scope check even though Gate 5 above had already cleared it. M295 (below)
+        // fixed that — the size cap now applies up to the CONFIGURED maxRisk, so
+        // the two gates agree. File + line counts reuse the same diff parser as
+        // classifyRisk so the two gates are consistent.
         {
             const autoMergeCfg = cfg.foundry
                 ?.autoMerge;
@@ -2593,12 +2860,32 @@ export async function autoMergeProposal(id, cfg, invocation = {}) {
                             : 'npm';
                 if (scriptsForParity['test:invariants']) {
                     // Fast path: run only the invariant suite.
+                    //
+                    // Bounded retry (merge-pipeline reliability): test:invariants
+                    // includes concurrency/timing/disk-cap tests (h3/h5) that are
+                    // legitimately flaky under host contention — a second live daemon
+                    // tick, another sandboxed agent's test run, or transient disk
+                    // pressure can make ONE pass momentarily red for reasons that have
+                    // nothing to do with the proposal's diff. Unlike the main verify
+                    // path (Gate 6, M281/M293) there is no per-proposal baseline to
+                    // diff against here — this check runs against the UNPATCHED repo
+                    // tree, so a single flaky run previously meant 3 non-parity
+                    // refusals permanently auto-archived an otherwise-good proposal.
+                    // A genuinely broken invariant fails EVERY attempt and is still
+                    // refused — this only tolerates transient noise, never a real break.
                     const invariantCmd = {
                         kind: 'test',
                         cmd: [pm, 'run', 'test:invariants'],
                     };
-                    const res = await runVerifyCommandAsync(invariantCmd, repo, parityCfg);
-                    return res.ok;
+                    for (let attempt = 1; attempt <= SELF_EVAL_PARITY_RETRY_ATTEMPTS; attempt++) {
+                        const res = await runVerifyCommandAsync(invariantCmd, repo, parityCfg);
+                        if (res.ok)
+                            return true;
+                        if (attempt < SELF_EVAL_PARITY_RETRY_ATTEMPTS) {
+                            await new Promise((resolveDelay) => setTimeout(resolveDelay, SELF_EVAL_PARITY_RETRY_DELAY_MS));
+                        }
+                    }
+                    return false;
                 }
                 // Fallback: no targeted script — run all detected verify commands.
                 const cmds = detectVerifyCommands(repo, 'merge');
@@ -2608,8 +2895,18 @@ export async function autoMergeProposal(id, cfg, invocation = {}) {
                     return true;
                 }
                 for (const vc of cmds) {
-                    const res = await runVerifyCommandAsync(vc, repo, parityCfg);
-                    if (!res.ok && vc.required !== false)
+                    const attempts = vc.kind === 'test' ? SELF_EVAL_PARITY_RETRY_ATTEMPTS : 1;
+                    let ok = false;
+                    for (let attempt = 1; attempt <= attempts; attempt++) {
+                        const res = await runVerifyCommandAsync(vc, repo, parityCfg);
+                        ok = res.ok;
+                        if (ok)
+                            break;
+                        if (attempt < attempts) {
+                            await new Promise((resolveDelay) => setTimeout(resolveDelay, SELF_EVAL_PARITY_RETRY_DELAY_MS));
+                        }
+                    }
+                    if (!ok && vc.required !== false)
                         return false;
                 }
                 return true;
@@ -2773,7 +3070,15 @@ export async function autoMergeProposal(id, cfg, invocation = {}) {
                         engine: inlineJudgeEngine,
                         model: inlineJudgeEngine,
                         verdict: verdict.verdict,
-                        detail: verdict.wouldMerge && inlineReviewerIndependence.independent ? 'would-merge' : '',
+                        // M507: a judgeFailure verdict is a synthetic fail-closed fallback, not
+                        // a considered judgment. It must be distinguishable in the ledger from a
+                        // real 'review' — conflating them is what made ~22% of judge calls look
+                        // like deliberate rejections. Mirrors automerge-pass.ts:243 so BOTH judge
+                        // paths record the same way. `wouldMerge` is always false on a failure,
+                        // so this never displaces the 'would-merge' marker.
+                        detail: verdict.judgeFailure
+                            ? (verdict.judgeFailure === 'parse' ? 'judge-parse-failure' : 'judge-network-failure')
+                            : (verdict.wouldMerge && inlineReviewerIndependence.independent ? 'would-merge' : ''),
                         ...(verdict.semanticEvents ? { semanticEvents: verdict.semanticEvents } : {}),
                         ...(inlineAttestation !== undefined ? { judgeAttestation: inlineAttestation } : {}),
                         ...(inlineAttestation !== undefined
@@ -3384,9 +3689,37 @@ export async function autoMergeProposal(id, cfg, invocation = {}) {
                         else if (!originStable) {
                             mergeNote = 'PR opened; host auto-merge refused because canonical GitHub origin changed';
                         }
+                        else if (!url) {
+                            mergeNote = 'PR opened; host auto-merge refused because no canonical PR URL is available';
+                        }
                         else {
+                            // Reaching this branch means every protected-handoff precondition was
+                            // confirmed (PR identity, base OID, live protection, canonical origin,
+                            // canonical URL). Record that BEFORE attempting the host merge, so the
+                            // strictHandoffUncertain reconciliation path below stays correct
+                            // regardless of what the merge attempt itself returns.
                             finalProtectedHandoffConfirmed = true;
-                            mergeNote = 'PR opened; host auto-merge is disabled until durable revocation is available';
+                            mergeNote = await attemptHostAutoMerge({
+                                repo,
+                                id,
+                                cfg,
+                                nameWithOwner: githubOrigin.nameWithOwner,
+                                repositoryId: latestProtection.evidence.repositoryId,
+                                url,
+                                base,
+                                baseOid: boundBaseHead,
+                                branch,
+                                headOid: stagedHead,
+                                observedPr,
+                                evidencePackDigest,
+                                verifierManifestDigest: requiredVerifierManifest?.digest ?? null,
+                                protectionPolicyDigest: latestProtection.evidence.policyHash,
+                                maxRisk,
+                                managerGateEnabled,
+                                allowSelfMerge,
+                                maxFiles: maxFilesForEvidence,
+                                maxLines: maxLinesForEvidence,
+                            });
                         }
                     }
                     const durableReason = `${mergeNote}${url ? `: ${url}` : ''} (remote handoff; awaiting host merge)`;