@brainervirus/workit-core 1.0.11 → 1.1.0

package/src/core/external-action-effects.ts

@@ -1,5 +1,10 @@
-import { branchSetup, resolveBranchPolicyFor, resolveCommitPolicyFor } from "./branch";
-import { hostingCliAvailable, prCreate } from "./pr-create";
+import {
+  branchSetup,
+  classifyBranchDirt,
+  resolveBranchPolicyFor,
+  resolveCommitPolicyFor,
+} from "./branch";
+import { hostingCliAvailable, mergePr, prCreate } from "./pr-create";
 import {
   changelogContext,
   docsRefreshContext,
@@ -24,6 +29,7 @@ import { failure, success, sha256, type Caller, type Result, type Ref } from "./
 import { changelogApply, changelogApplyPreview } from "./changelog";
 import type { ExternalActionRequest } from "./external-action";
 import { externalActionDescriptor, externalActionRequest } from "./external-action";
+import { normalizeChainSteps } from "./authority";
 import { resolveInside, run as coreRun } from "../core";
 import { vcsConfig } from "./vcs-config";
 import { detectCommitFlavor, matchCommitFlavor, type CommitFlavor } from "./commit-flavors";
@@ -271,10 +277,33 @@ export const actionProposalQuestion = (
   const resolved = (payload.resolved ?? {}) as Record<string, unknown>;
   const payloadTarget = String(payload.target_branch ?? "");
   if (request.operation === "git.commit" && Array.isArray(payload.plan_steps)) {
-    const steps = payload.plan_steps as string[];
+    const steps = payload.plan_steps as unknown[];
+    const chain = normalizeChainSteps(steps);
+    if (!chain)
+      return {
+        presented: `Workit decision: action — Approve committing the plan's listed tasks?`,
+        approvedText: `Approve the listed plan commits.`,
+      };
+    const kinds = chain.map((step) => step.kind);
+    if (kinds.every((kind) => kind === "commit"))
+      return {
+        presented: `Workit decision: action — Approve committing the plan's ${steps.length} listed tasks on \`${String(payload.plan_branch ?? "")}\`?`,
+        approvedText: `Approve the ${steps.length} listed plan commits.`,
+      };
+    const summary = [
+      kinds.filter((kind) => kind === "branch").length
+        ? `${kinds.filter((kind) => kind === "branch").length} branch`
+        : null,
+      kinds.filter((kind) => kind === "commit").length
+        ? `${kinds.filter((kind) => kind === "commit").length} commits`
+        : null,
+      kinds.includes("pr") ? "PR" : null,
+    ]
+      .filter(Boolean)
+      .join(", ");
     return {
-      presented: `Workit decision: action — Approve committing the plan's ${steps.length} listed tasks on \`${String(payload.plan_branch ?? "")}\`?`,
-      approvedText: `Approve the ${steps.length} listed plan commits.`,
+      presented: `Workit decision: action — Approve the ${steps.length}-step chain on \`${String(payload.plan_branch ?? "")}\` (${summary})?`,
+      approvedText: `Approve the ${steps.length}-step chain (${summary}).`,
     };
   }
   switch (request.operation) {
@@ -327,6 +356,11 @@ export const actionProposalQuestion = (
         presented: `Workit decision: action — Open a PR from \`${String(resolved.source_branch ?? "")}\` to \`${payloadTarget}\` titled "${String(request.payload.title)}"?`,
         approvedText: `Open the PR: ${String(resolved.source_branch ?? "")} → ${payloadTarget}, "${String(request.payload.title)}".`,
       };
+    case "hosting.merge":
+      return {
+        presented: `Workit decision: action — Merge \`${String(resolved.source_branch ?? "")}\` into \`${payloadTarget}\` (squash, delete branch)?`,
+        approvedText: `Merge ${String(resolved.source_branch ?? "")} → ${payloadTarget}.`,
+      };
     case "changelog.apply":
       return {
         presented: `Workit decision: action — Apply changelog changes at \`${String(payload.path ?? "CHANGELOG.md")}\`?`,
@@ -375,6 +409,7 @@ export const approvedResolvedExternalAction = (content: string): Result<Resolved
     const value = JSON.parse(content) as { operation?: unknown; payload?: unknown };
     if (
       value.operation !== "hosting.pull_request" &&
+      value.operation !== "hosting.merge" &&
       value.operation !== "changelog.apply" &&
       value.operation !== "youtrack.update" &&
       value.operation !== "youtrack.time" &&
@@ -399,6 +434,15 @@ export const approvedResolvedExternalAction = (content: string): Result<Resolved
         typeof payload.target_branch !== "string")
     )
       return failure("invalid_input", "approved hosting target is incomplete");
+    if (
+      value.operation === "hosting.merge" &&
+      (typeof target.marker !== "string" ||
+        typeof target.source_branch !== "string" ||
+        typeof target.source_commit !== "string" ||
+        typeof target.remote !== "string" ||
+        typeof payload.target_branch !== "string")
+    )
+      return failure("invalid_input", "approved hosting target is incomplete");
     if (
       value.operation === "changelog.apply" &&
       (typeof target.target !== "string" ||
@@ -806,6 +850,32 @@ const youTrackWritePreflight = (): Result<null> => {
   return success(null, null, null);
 };
 
+/**
+ * A dirty tree binds stash up front so the proposal names it and one
+ * approval carries the whole effect instead of failing at preflight.
+ * Carry-class dirt (untracked or docs-confined) rides along silently.
+ * Returns the original resolution untouched unless an upgrade applies.
+ */
+export const upgradeBranchSetupForStash = (
+  root: string,
+  parsed: ExternalActionRequest,
+  resolved: Result<ResolvedExternalAction>,
+): Result<ResolvedExternalAction> => {
+  if (!resolved.ok || resolved.data.request.operation !== "git.branch_setup") return resolved;
+  if (
+    (resolved.data.descriptorPayload as { resolved?: { dirty?: unknown } }).resolved?.dirty !==
+      true ||
+    (resolved.data.descriptorPayload as { stash?: unknown }).stash === "yes" ||
+    classifyBranchDirt(root) !== "stash-required"
+  )
+    return resolved;
+  const upgraded = resolveExternalActionRequest(root, {
+    ...parsed,
+    payload: { ...(parsed.payload as Record<string, unknown>), stash: "yes" },
+  } as typeof parsed);
+  return upgraded.ok ? upgraded : resolved;
+};
+
 export const resolveExternalActionRequest = (
   root: string,
   request: ExternalActionRequest,
@@ -855,6 +925,11 @@ export const resolveExternalActionRequest = (
       }
       case "git.push": {
         const branch = request.payload.branch ?? gitValue(root, ["branch", "--show-current"]);
+        if (branch && isProtectedBranch(root, branch))
+          return failure("invalid_input", `cannot push protected branch ${branch}`, {
+            outcome: "not_started",
+            fields: [{ path: "branch", reason: "protected branch" }],
+          });
         const commit = branch ? gitValue(root, ["rev-parse", branch]) : null;
         const remote = pushRemote(root);
         const identity = remote ? credentialFreeRemote(remote) : null;
@@ -872,26 +947,41 @@ export const resolveExternalActionRequest = (
         if (!head) return failure("storage_error", "Git state could not be resolved");
         const branch = gitValue(root, ["branch", "--show-current"]);
         if (planSteps !== undefined || planBranch !== undefined) {
-          if (
-            !Array.isArray(planSteps) ||
-            planSteps.some((step) => typeof step !== "string" || !step.trim()) ||
-            new Set(planSteps).size !== planSteps.length ||
-            planSteps.length === 0 ||
-            planSteps.length > 32
-          )
+          const chain = Array.isArray(planSteps) ? normalizeChainSteps(planSteps) : null;
+          if (!chain)
             return failure(
               "invalid_input",
-              "plan_steps must be 1-32 unique non-empty commit messages",
+              "plan_steps must be 1-32 unique non-empty commit messages, branch targets, or pull_request markers",
               {
                 outcome: "not_started",
-                fields: [{ path: "plan_steps", reason: "unique strings" }],
+                fields: [{ path: "plan_steps", reason: "unique steps" }],
               },
             );
-          if (typeof planBranch !== "string" || !planBranch.trim() || planBranch !== branch)
-            return failure("invalid_input", "plan_branch must name the current working branch", {
+          if (typeof planBranch !== "string" || !planBranch.trim())
+            return failure("invalid_input", "plan_branch must name the working branch", {
               outcome: "not_started",
-              fields: [{ path: "plan_branch", reason: "current branch" }],
+              fields: [{ path: "plan_branch", reason: "required" }],
             });
+          // A chain that creates its own branch names that branch; otherwise
+          // the plan runs on the branch already checked out.
+          const first = chain[0];
+          const createsBranch = first?.kind === "branch";
+          if (createsBranch ? planBranch !== first.target : planBranch !== branch)
+            return failure(
+              "invalid_input",
+              createsBranch
+                ? "plan_branch must name the branch the chain creates"
+                : "plan_branch must name the current working branch",
+              {
+                outcome: "not_started",
+                fields: [
+                  {
+                    path: "plan_branch",
+                    reason: createsBranch ? "chain branch" : "current branch",
+                  },
+                ],
+              },
+            );
           if (isProtectedBranch(root, planBranch))
             return failure("invalid_input", "plan_branch must not be a protected branch", {
               outcome: "not_started",
@@ -956,6 +1046,15 @@ export const resolveExternalActionRequest = (
         const target_branch =
           request.payload.target_branch ?? resolveBranchPolicyFor(root).defaultTargetBranch;
         const source_branch = gitValue(root, ["branch", "--show-current"]);
+        if (source_branch && isProtectedBranch(root, source_branch))
+          return failure(
+            "invalid_input",
+            `cannot open a PR from protected branch ${source_branch}`,
+            {
+              outcome: "not_started",
+              fields: [{ path: "source_branch", reason: "protected branch" }],
+            },
+          );
         const source_commit = gitValue(root, ["rev-parse", "HEAD"]);
         const remote = pushRemote(root);
         const identity = remote ? credentialFreeRemote(remote) : null;
@@ -997,6 +1096,56 @@ export const resolveExternalActionRequest = (
           },
         });
       }
+      case "hosting.merge": {
+        const target_branch =
+          request.payload.target_branch ?? resolveBranchPolicyFor(root).defaultTargetBranch;
+        const source_branch =
+          request.payload.source_branch ?? gitValue(root, ["branch", "--show-current"]);
+        if (source_branch && isProtectedBranch(root, source_branch))
+          return failure("invalid_input", `cannot merge protected branch ${source_branch}`, {
+            outcome: "not_started",
+            fields: [{ path: "source_branch", reason: "protected branch" }],
+          });
+        const source_commit = gitValue(root, ["rev-parse", "HEAD"]);
+        const remote = pushRemote(root);
+        const identity = remote ? credentialFreeRemote(remote) : null;
+        if (
+          !source_branch ||
+          !source_commit ||
+          !identity ||
+          (remoteProvider(identity) !== null &&
+            remoteProvider(identity) !== String(vcsConfig("load", root).provider).toLowerCase())
+        )
+          return failure(
+            "capability_unavailable",
+            "hosting target is not bound to the configured remote provider",
+            { capability: "hosting.merge" },
+          );
+        const vcs = vcsConfig("load", root);
+        if (!vcs.ok || !vcs.tokenReady)
+          return failure("capability_unavailable", "hosting credentials are unavailable", {
+            capability: "hosting.merge",
+            outcome: "not_started",
+          });
+        if (!hostingCliAvailable(String(vcs.provider)))
+          return failure("capability_unavailable", "hosting CLI is unavailable", {
+            capability: "hosting.merge",
+            outcome: "not_started",
+          });
+        const normalized = {
+          operation: request.operation,
+          payload: { ...request.payload, target_branch, source_branch },
+        } as ExternalActionRequest;
+        const marker = `<!-- workit-action:${sha256({ operation: request.operation, payload: normalized.payload, source_commit, remote: identity })} -->`;
+        return success(null, null, {
+          request: normalized,
+          marker,
+          descriptorPayload: {
+            ...normalized.payload,
+            resolved: { source_branch, source_commit, remote: identity, target_branch, marker },
+          },
+        });
+      }
       case "changelog.apply": {
         const preview = changelogApplyPreview({ ...request.payload, workspace_root: root });
         if (preview.error) return failure("invalid_input", preview.error);
@@ -1219,6 +1368,19 @@ export const executeConcreteExternalAction = async (
               : {}),
           });
     }
+    case "hosting.merge": {
+      const target = String(request.payload.target_branch ?? "");
+      const source = String(request.payload.source_branch ?? "");
+      if (!target || !source)
+        return failure("invalid_input", "hosting.merge requires target and source branches", {
+          outcome: "not_started",
+          fields: [{ path: "target_branch", reason: "required" }],
+        });
+      const result = mergePr(root, { target, source });
+      return result.error || result.ok === false
+        ? unknown(request.operation)
+        : success(null, null, result);
+    }
     case "changelog.apply": {
       const preview = changelogApplyPreview({ ...request.payload, workspace_root: root });
       if (

package/src/core/external-action.ts

@@ -14,6 +14,7 @@ import {
 } from "./task-contract";
 import { WorkitCore } from "./task-engine";
 import { TaskStore } from "./task-store";
+import { chainStepKey, normalizeChainSteps, type ChainStep } from "./authority";
 import * as z from "zod";
 import { execFileSync } from "node:child_process";
 
@@ -85,6 +86,17 @@ const externalActionSchema = z.discriminatedUnion("operation", [
         .strict(),
     })
     .strict(),
+  z
+    .object({
+      operation: z.literal("hosting.merge"),
+      payload: z
+        .object({
+          target_branch: z.string().min(1).optional(),
+          source_branch: z.string().min(1).optional(),
+        })
+        .strict(),
+    })
+    .strict(),
   z
     .object({
       operation: z.literal("youtrack.update"),
@@ -215,7 +227,7 @@ export const externalActionDescriptor = (operation: string, payload: unknown): s
 
 /** Compact host-facing help for the fixed optional-action surface. */
 export const externalActionHelp =
-  "Fixed actions: git.branch_setup {action?,sdd_dir?,target_branch(required unless reapply_stash; the working branch to create or switch to),stash?}; git.commit {message}; git.push {branch?}; hosting.pull_request {title,body?,draft?,target_branch?,babysit?}; youtrack.update {issueId,markdown,minutes?}; youtrack.time {issueId,minutes,text?,dateMs?}; youtrack.meeting {issueId,minutes,text}; changelog.apply {entries?,path?,normalize_only?}; context.read {kind,range?,issueId?,issueUrl?,issueRef?,mode?,specPath?,planPath?}. context.read is read-only and needs no approval; all other operations require native approval (CLI uses a TTY; caller-unattested MCP cannot mutate).";
+  "Fixed actions: git.branch_setup {action?,sdd_dir?,target_branch(required unless reapply_stash; the working branch to create or switch to),stash?}; git.commit {message}; git.push {branch?}; hosting.pull_request {title,body?,draft?,target_branch?,babysit?}; hosting.merge {target_branch?,source_branch?}; youtrack.update {issueId,markdown,minutes?}; youtrack.time {issueId,minutes,text?,dateMs?}; youtrack.meeting {issueId,minutes,text}; changelog.apply {entries?,path?,normalize_only?}; context.read {kind,range?,issueId?,issueUrl?,issueRef?,mode?,specPath?,planPath?}. context.read is read-only and needs no approval; all other operations require native approval (CLI uses a TTY; caller-unattested MCP cannot mutate).";
 
 export const externalActionRef = (
   host: "opencode" | "pi" | "workit_cli",
@@ -323,33 +335,58 @@ export const priorExternalAction = (
 /** Parse a plan-commit authorization descriptor (one approved list per plan). */
 export const planCommitDescriptor = (
   content: string,
-): { steps: string[]; branch: string } | null => {
+): { steps: ChainStep[]; branch: string; snapshotHead: string | null } | null => {
   try {
     const value = JSON.parse(content) as {
       operation?: unknown;
-      payload?: { plan_steps?: unknown; plan_branch?: unknown };
+      payload?: {
+        plan_steps?: unknown;
+        plan_branch?: unknown;
+        resolved?: { head?: unknown; branch?: unknown };
+      };
     };
     if (value.operation !== "git.commit" || !value.payload) return null;
-    const steps = value.payload.plan_steps;
+    const steps = normalizeChainSteps(value.payload.plan_steps);
     const branch = value.payload.plan_branch;
-    if (
-      !Array.isArray(steps) ||
-      steps.some((step) => typeof step !== "string" || !step) ||
-      typeof branch !== "string" ||
-      !branch
-    )
-      return null;
-    return { steps: steps as string[], branch };
+    if (!steps || typeof branch !== "string" || !branch) return null;
+    const head = value.payload.resolved?.head;
+    return { steps, branch, snapshotHead: typeof head === "string" ? head : null };
   } catch {
     return null;
   }
 };
 
+/**
+ * Chain lease: the recorded head must still be an ancestor of the current
+ * HEAD — history only moved forward. Rebase/reset underneath an approved
+ * chain invalidates it instead of executing on rewritten history.
+ */
+export const chainLeaseValid = (store: TaskStore, snapshotHead: string | null): boolean => {
+  if (!snapshotHead) return true;
+  try {
+    const head = execFileSync("git", ["rev-parse", "HEAD"], {
+      cwd: store.root,
+      encoding: "utf8",
+      stdio: ["pipe", "pipe", "pipe"],
+    }).trim();
+    if (head === snapshotHead) return true;
+    execFileSync("git", ["merge-base", "--is-ancestor", snapshotHead, head], {
+      cwd: store.root,
+      encoding: "utf8",
+      stdio: ["pipe", "pipe", "pipe"],
+    });
+    return true;
+  } catch {
+    return false;
+  }
+};
+
 export type PlanCommitAuthorization = {
   task: TaskRecord;
   entry: Entry<Decision>;
-  steps: string[];
+  steps: ChainStep[];
   branch: string;
+  snapshotHead: string | null;
   completed: string[];
 };
 
@@ -357,7 +394,10 @@ export type PlanCommitAuthorization = {
  * Find the single active plan-commit authorization whose next unconsumed step
  * is this exact commit message. Consumption order is enforced so each listed
  * commit executes once, in plan order; unlisted or replayed messages find no
- * authorization and require a fresh exact approval.
+ * authorization and require a fresh exact approval. Typed chain positions
+ * never match messages (a pathological message falls through to a fresh
+ * approval instead of consuming the wrong step), and a rewritten history
+ * breaks the lease.
  */
 export const approvedPlanCommit = (
   store: TaskStore,
@@ -395,8 +435,19 @@ export const approvedPlanCommit = (
       const completed =
         task.actionProgress?.find((progress) => progress.decisionId === entry.id)?.completedSteps ??
         [];
-      if (plan.steps[completed.length] !== message) return [];
-      return [{ task, entry, steps: plan.steps, branch: plan.branch, completed: [...completed] }];
+      const next = plan.steps[completed.length];
+      if (!next || next.kind !== "commit" || next.message !== message) return [];
+      if (!chainLeaseValid(store, plan.snapshotHead)) return [];
+      return [
+        {
+          task,
+          entry,
+          steps: plan.steps,
+          branch: plan.branch,
+          snapshotHead: plan.snapshotHead,
+          completed: [...completed],
+        },
+      ];
     });
   });
   if (matches.length !== 1)
@@ -409,6 +460,80 @@ export const approvedPlanCommit = (
   return success(workspace.data.revision, null, matches[0]);
 };
 
+export type ChainStepQuery =
+  | { operation: "git.branch_setup"; target: string }
+  | { operation: "hosting.pull_request" };
+
+/**
+ * Match one branch or PR step of a chain authorization: same session-bound
+ * search as plan commits, next unconsumed step of the right kind, lease
+ * intact. Commit steps stay on the plan path; this covers the steps plans
+ * could never express.
+ */
+export const approvedChainStep = (
+  store: TaskStore,
+  host: string,
+  actor: string,
+  query: ChainStepQuery,
+): Result<PlanCommitAuthorization> => {
+  const listed = store.listTasks();
+  const workspace = store.readWorkspace();
+  if (!listed.ok || !workspace.ok)
+    return failure("storage_error", "external action state is unavailable");
+  if (!workspace.data) return failure("not_found", "workspace not found");
+  const matches = listed.data.flatMap((task) => {
+    if (task.status !== "active" || task.workspaceId !== workspace.data!.id) return [];
+    if (
+      task.intent.provenance.session?.kind !== "host" ||
+      task.intent.provenance.session.host !== host ||
+      task.intent.provenance.session.handle !== actor
+    )
+      return [];
+    return task.decisions.flatMap((entry) => {
+      const decision = entry.data;
+      if (
+        decision.purpose !== "action" ||
+        decision.response !== "approved" ||
+        decision.revoked !== null
+      )
+        return [];
+      if (entry.provenance.kind !== "host_observed" || entry.provenance.receipts.length === 0)
+        return [];
+      const plan = planCommitDescriptor(decision.binding.approvedContent);
+      if (!plan) return [];
+      const completed =
+        task.actionProgress?.find((progress) => progress.decisionId === entry.id)?.completedSteps ??
+        [];
+      const next = plan.steps[completed.length];
+      if (!next) return [];
+      if (query.operation === "git.branch_setup") {
+        if (next.kind !== "branch" || next.target !== query.target) return [];
+      } else if (next.kind !== "pr") {
+        return [];
+      }
+      if (!chainLeaseValid(store, plan.snapshotHead)) return [];
+      return [
+        {
+          task,
+          entry,
+          steps: plan.steps,
+          branch: plan.branch,
+          snapshotHead: plan.snapshotHead,
+          completed: [...completed],
+        },
+      ];
+    });
+  });
+  if (matches.length !== 1)
+    return failure(
+      "permission_denied",
+      matches.length === 0
+        ? "no chain authorization matches this step"
+        : "multiple chain authorizations match this step",
+    );
+  return success(workspace.data.revision, null, matches[0]);
+};
+
 export const commitMessageFromDescriptor = (operation: string): string | undefined => {
   try {
     const descriptor = JSON.parse(operation) as {
@@ -423,6 +548,69 @@ export const commitMessageFromDescriptor = (operation: string): string | undefin
   }
 };
 
+/** Resolve a chain authorization into the exact binding an adapter needs
+ * to run one branch or PR step under the approved chain. Commit steps stay
+ * on the plan path; this covers the steps plans could never express. */
+export const chainStepBinding = (
+  store: TaskStore,
+  host: string,
+  actor: string,
+  operation: string,
+): {
+  taskId: Id;
+  decisionId: Id;
+  binding: Decision["binding"];
+  expectedRevision: Revision;
+  expectedWorkspaceRevision: Revision;
+  step: string;
+} | null => {
+  let descriptor: { operation?: unknown; payload?: Record<string, unknown> };
+  try {
+    descriptor = JSON.parse(operation) as {
+      operation?: unknown;
+      payload?: Record<string, unknown>;
+    };
+  } catch {
+    return null;
+  }
+  const query: ChainStepQuery | null =
+    descriptor.operation === "git.branch_setup" &&
+    typeof descriptor.payload?.target_branch === "string"
+      ? { operation: "git.branch_setup", target: descriptor.payload.target_branch as string }
+      : descriptor.operation === "hosting.pull_request"
+        ? { operation: "hosting.pull_request" }
+        : null;
+  if (!query) return null;
+  const chain = approvedChainStep(store, host, actor, query);
+  if (!chain.ok) return null;
+  // PR steps run on the chain branch; the branch step itself creates it.
+  if (query.operation === "hosting.pull_request") {
+    let branch: string;
+    try {
+      branch = execFileSync("git", ["branch", "--show-current"], {
+        cwd: store.root,
+        encoding: "utf8",
+        stdio: ["pipe", "pipe", "pipe"],
+      }).trim();
+    } catch {
+      return null;
+    }
+    if (!branch || branch !== chain.data.branch) return null;
+  }
+  const workspace = store.readWorkspace();
+  if (!workspace.ok || !workspace.data) return null;
+  const next = chain.data.steps[chain.data.completed.length];
+  if (!next) return null;
+  return {
+    taskId: chain.data.task.id,
+    decisionId: chain.data.entry.id,
+    binding: chain.data.entry.data.binding,
+    expectedRevision: chain.data.task.revision,
+    expectedWorkspaceRevision: workspace.data.revision,
+    step: chainStepKey(next),
+  };
+};
+
 /** Resolve a plan-commit authorization into the exact binding an adapter needs
  * to run one listed commit under the approved list. */
 export const planCommitBinding = (

package/src/core/methods.ts

@@ -17,12 +17,14 @@ type MethodDefinition = {
 
 export const METHODS: Readonly<Record<MethodId, MethodDefinition>> = {
   "workit-challenge": { dimensions: ["challenge", "decisions"] },
-  "workit-behavioral-tdd": { dimensions: ["testing"] },
-  "workit-review": { dimensions: ["review"], ruleIds: ["fresh-context-review"] },
+  "workit-behavioral-tdd": { dimensions: ["testing"], ruleIds: ["mechanical-existing-checks"] },
+  "workit-review": { dimensions: ["review"], ruleIds: ["fresh-context-review", "self-review"] },
   "workit-plan": { dimensions: ["artifacts", "continuity"] },
   "workit-implement": { dimensions: ["delegation"] },
-  "workit-debug": { ruleIds: ["root-cause-investigation"] },
-  "workit-handoff": { ruleIds: ["durable-handoff"] },
+  // workit-debug and workit-handoff stay slash-invoked: no generated rule
+  // routes to them, so they never appear spuriously in method selection.
+  "workit-debug": {},
+  "workit-handoff": {},
   "workit-deslop": { ruleIds: ["pre-pr-cleanup"] },
 };
 
@@ -33,12 +35,10 @@ export type SelectedMethod = {
 };
 
 const methodMatches = (
-  id: MethodId,
   definition: MethodDefinition,
   requirement: Policy["requirements"][number],
 ): boolean =>
-  (definition.dimensions?.includes(requirement.dimension) === true &&
-    !(id === "workit-review" && requirement.ruleId === "self-review")) ||
+  definition.dimensions?.includes(requirement.dimension) === true ||
   definition.ruleIds?.includes(requirement.ruleId) === true;
 
 const assuranceFor = (
@@ -71,7 +71,7 @@ const assuranceFor = (
 export function selectMethods(policy: Policy, capabilities: Capability[]): SelectedMethod[] {
   return (Object.entries(METHODS) as [MethodId, MethodDefinition][]).flatMap(([id, definition]) => {
     const requirements = policy.requirements.filter((requirement) =>
-      methodMatches(id, definition, requirement),
+      methodMatches(definition, requirement),
     );
     if (requirements.length === 0) return [];
     const capability = assuranceFor(id, definition, capabilities);

package/src/core/pr-create.ts

@@ -373,4 +373,54 @@ export function prCreate(env: NodeJS.ProcessEnv, cwd: string): Record<string, an
   };
 }
 
+/** Merge the open PR/MR for a source branch (squash + delete per pr settings). */
+export function mergePr(
+  cwd: string,
+  opts: { target: string; source: string },
+): Record<string, any> {
+  const root = repoRoot(cwd);
+  const cfg = vcsConfig("load", root);
+  if (!cfg.ok) return { error: cfg.error ?? "vcs config missing" };
+  if (!cfg.tokenReady)
+    return { error: "VCS token not ready — run /wk-init and edit token file locally" };
+  const provider = cfg.provider as string;
+  if (provider !== "gitlab" && provider !== "github")
+    return { error: `unsupported provider: ${provider}` };
+  if (!hostingCliAvailable(provider))
+    return { error: `workflow CLI missing (required for ${provider})` };
+  const pr = (cfg.pr ?? {}) as Record<string, any>;
+  const token = fs.readFileSync(cfg.tokenPath as string, "utf8").trim();
+  const squash = pr.squashOnMerge !== false;
+  const removeBranch = pr.removeSourceBranch !== false;
+  let cmd: string[];
+  let cmdEnv: NodeJS.ProcessEnv;
+  if (provider === "gitlab") {
+    cmd = ["glab", "mr", "merge", opts.source];
+    cmd.push(squash ? "--squash" : "--squash=false");
+    if (removeBranch) cmd.push("--remove-source-branch");
+    cmd.push("--yes");
+    cmdEnv = { ...process.env, PATH: process.env.PATH ?? "", GITLAB_TOKEN: token };
+  } else {
+    cmd = ["gh", "pr", "merge", opts.source];
+    cmd.push(squash ? "--squash" : "--merge");
+    if (removeBranch) cmd.push("--delete-branch");
+    cmd.push("--yes");
+    cmdEnv = { ...process.env, PATH: process.env.PATH ?? "", GH_TOKEN: token };
+  }
+  const result = spawnSync(cmd[0], cmd.slice(1), { cwd: root, encoding: "utf8", env: cmdEnv });
+  if (result.status !== 0)
+    return {
+      error: "merge failed",
+      provider,
+      stderr: (result.stderr ?? result.stdout ?? "").trim().slice(0, 800),
+    };
+  return {
+    ok: true,
+    provider,
+    targetBranch: opts.target,
+    sourceBranch: opts.source,
+    output: (result.stdout ?? "").trim(),
+  };
+}
+
 export { buildBody, parseGhRepo, parseGhIssue };