@brainervirus/workit-core 1.0.12 → 1.1.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@brainervirus/workit-core",
-  "version": "1.0.12",
+  "version": "1.1.0",
   "private": false,
   "description": "Workit shared core — task, policy, evidence, review, decision, worker, and writer state for agentic coding workflows",
   "keywords": [

package/src/core/authority.ts

@@ -1,6 +1,7 @@
 import { createHash } from "node:crypto";
 import * as fs from "node:fs";
 import path from "node:path";
+import { operationAutoClass, standingApprovalLive } from "./auto-approval";
 import {
   canonicalJson,
   decisionDigest,
@@ -579,6 +580,36 @@ const validateAction = (
     !provenanceMatches(entry.provenance, authority.provenance)
   )
     return failure("permission_denied", "action approval lacks native receipt assurance");
+  // Standing auto-approval receipts carry no live question. They authorize
+  // only while the referenced workspace rule still covers the operation —
+  // verified here, at reserve time, against current config. Question-backed
+  // approvals (host-kind receipts) skip this; anything else was already
+  // denied above.
+  const receipts = entry.provenance.receipts as unknown[];
+  const standing = receipts.filter(
+    (receipt) =>
+      typeof receipt === "object" &&
+      receipt !== null &&
+      (receipt as { kind?: unknown }).kind === "standing",
+  );
+  const questionBacked = receipts.some(
+    (receipt) =>
+      typeof receipt === "object" &&
+      receipt !== null &&
+      (receipt as { kind?: unknown }).kind === "host",
+  );
+  if (!questionBacked && standing.length > 0) {
+    let operation: unknown;
+    try {
+      operation = (JSON.parse(decision.binding.approvedContent) as { operation?: unknown })
+        .operation;
+    } catch {
+      operation = null;
+    }
+    const cls = operationAutoClass(operation);
+    if (!cls || !standing.some((receipt) => standingApprovalLive(store.root, receipt, cls)))
+      return failure("permission_denied", "standing auto-approval is not live for this operation");
+  }
   if (decision.revoked) return failure("permission_denied", "decision is revoked");
   if (decision.digest !== decisionDigest(decision))
     return failure("permission_denied", "decision binding is invalid");

package/src/core/auto-approval.ts

@@ -0,0 +1,326 @@
+import { createHash } from "node:crypto";
+import { readFileSync } from "node:fs";
+import { resolveWorkspaceFrom, type WorkspaceConfig } from "./workspaces";
+import { configDir } from "./config";
+import { verifyPushIdentity } from "./branch";
+import {
+  failure,
+  success,
+  type Caller,
+  type Id,
+  type Provenance,
+  type Result,
+  type Revision,
+  type TaskRecord,
+} from "./task-contract";
+import type { TaskStore } from "./task-store";
+import type { WorkitCore } from "./task-engine";
+import type { Decision } from "./task-contract";
+
+/** Action classes auto-approval can cover. Unknown classes never match. */
+export const AUTO_CLASSES = ["branch", "commit", "push", "pr", "merge"] as const;
+export type AutoClass = (typeof AUTO_CLASSES)[number];
+
+export type AutoApproval =
+  | { status: "off" }
+  | {
+      status: "on";
+      workspace: string;
+      classes: AutoClass[];
+      account: string | null;
+      configDigest: string | null;
+    };
+
+export type StandingReceipt = {
+  kind: "standing";
+  workspace: string;
+  class: string;
+  configDigest: string | null;
+};
+
+const OPERATION_CLASS: Record<string, AutoClass> = {
+  "git.branch_setup": "branch",
+  "git.commit": "commit",
+  "git.push": "push",
+  "hosting.pull_request": "pr",
+  "hosting.merge": "merge",
+};
+
+/** Map an external-action operation to its auto-approval class, if any. */
+export const operationAutoClass = (operation: unknown): AutoClass | null =>
+  typeof operation === "string" ? (OPERATION_CLASS[operation] ?? null) : null;
+
+const digestOf = (configDirPath: string): string | null => {
+  try {
+    const raw = readFileSync(`${configDirPath}/workspaces.json`, "utf8");
+    return createHash("sha256").update(raw).digest("hex");
+  } catch {
+    return null;
+  }
+};
+
+const normalizeClasses = (value: unknown): AutoClass[] => {
+  if (value === true) return [...AUTO_CLASSES];
+  if (!Array.isArray(value)) return [];
+  const seen = new Set<AutoClass>();
+  for (const item of value) {
+    if (typeof item === "string" && (AUTO_CLASSES as readonly string[]).includes(item))
+      seen.add(item as AutoClass);
+  }
+  return [...seen];
+};
+
+/** Resolve the auto-approval rule for a checkout root (live read, never cached). */
+export const resolveAutoApproval = (root: string, dir: string = configDir()): AutoApproval => {
+  let match: WorkspaceConfig | null;
+  try {
+    match = resolveWorkspaceFrom(root, dir);
+  } catch {
+    return { status: "off" };
+  }
+  if (!match) return { status: "off" };
+  const classes = normalizeClasses(match.autoApprove);
+  if (classes.length === 0) return { status: "off" };
+  return {
+    status: "on",
+    workspace: match.name,
+    classes,
+    account: typeof match.vcs?.account === "string" && match.vcs.account ? match.vcs.account : null,
+    configDigest: digestOf(dir),
+  };
+};
+
+/** True when the workspace rule covers the class right now. */
+export const autoApproves = (root: string, cls: unknown, dir?: string): boolean => {
+  if (typeof cls !== "string" || !(AUTO_CLASSES as readonly string[]).includes(cls)) return false;
+  const resolved = resolveAutoApproval(root, dir);
+  return resolved.status === "on" && resolved.classes.includes(cls as AutoClass);
+};
+
+const isStandingReceipt = (value: unknown): value is StandingReceipt =>
+  typeof value === "object" && value !== null && (value as { kind?: unknown }).kind === "standing";
+
+/**
+ * A standing receipt authorizes only while the referenced workspace rule
+ * still covers the class. Removing the flag (or narrowing the list) fails
+ * closed on the very next reserve — no revocation step needed.
+ */
+export const standingApprovalLive = (
+  root: string,
+  receipt: unknown,
+  cls: unknown,
+  dir?: string,
+): boolean => {
+  if (!isStandingReceipt(receipt)) return false;
+  if (typeof cls !== "string" || !(AUTO_CLASSES as readonly string[]).includes(cls)) return false;
+  if (receipt.class !== cls) return false;
+  const resolved = resolveAutoApproval(root, dir);
+  if (resolved.status !== "on") return false;
+  if (resolved.workspace !== receipt.workspace) return false;
+  return resolved.classes.includes(cls as AutoClass);
+};
+
+/** Build the receipt an auto-recorded decision carries (current digest). */
+export const standingReceiptFor = (
+  root: string,
+  workspace: string,
+  cls: AutoClass,
+  dir?: string,
+): StandingReceipt => {
+  const resolved = resolveAutoApproval(root, dir);
+  return {
+    kind: "standing",
+    workspace,
+    class: cls,
+    configDigest:
+      resolved.status === "on" && resolved.workspace === workspace ? resolved.configDigest : null,
+  };
+};
+
+/**
+ * Verify a standing approval record request: active task, lead session
+ * match (helpers never auto-approve), operation class equals the claimed
+ * class, rule live right now, push identity enforced for push.
+ * Returns the host-observed provenance the entry carries on success.
+ */
+export const verifyStandingApproval = (
+  root: string,
+  task: TaskRecord,
+  caller: Caller,
+  binding: {
+    standing?: { workspace?: unknown; class?: unknown };
+    approvedContent?: unknown;
+  },
+): Result<Provenance> => {
+  if (task.status !== "active")
+    return failure("invalid_transition", "only active tasks can authorize actions");
+  const session = task.intent?.provenance?.session;
+  if (
+    !session ||
+    session.kind !== "host" ||
+    session.host !== caller.host ||
+    session.handle !== caller.actor
+  )
+    return failure("permission_denied", "standing approval requires the lead session");
+  const standing = binding.standing;
+  if (!standing || typeof standing.workspace !== "string" || typeof standing.class !== "string")
+    return failure("invalid_input", "standing approval needs a workspace and class");
+  let operation: unknown;
+  try {
+    operation =
+      typeof binding.approvedContent === "string"
+        ? (JSON.parse(binding.approvedContent) as { operation?: unknown }).operation
+        : null;
+  } catch {
+    operation = null;
+  }
+  const cls = operationAutoClass(operation);
+  if (!cls || cls !== standing.class)
+    return failure("permission_denied", "standing approval does not cover this operation");
+  const resolved = resolveAutoApproval(root);
+  if (
+    resolved.status !== "on" ||
+    resolved.workspace !== standing.workspace ||
+    !resolved.classes.includes(cls)
+  )
+    return failure("permission_denied", "standing auto-approval is not live for this operation");
+  if (cls === "push") {
+    const workspace = resolveWorkspaceFrom(root, configDir());
+    const provider = workspace?.vcs?.provider;
+    const account = resolved.account;
+    if (!provider || !account)
+      return failure(
+        "permission_denied",
+        "auto-push requires a workspace provider and area account",
+      );
+    const identity = verifyPushIdentity(root, provider, account);
+    if (!identity.ok) return failure("permission_denied", identity.error);
+  }
+  return success(null, null, {
+    kind: "host_observed",
+    host: caller.host,
+    session: { kind: "host", host: caller.host, handle: caller.actor },
+    workerId: null,
+    receipts: [standingReceiptFor(root, standing.workspace, cls)],
+  } as Provenance);
+};
+
+export type StandingAutoBinding = {
+  taskId: Id;
+  decisionId: Id;
+  binding: Decision["binding"];
+  expectedRevision: Revision;
+  expectedWorkspaceRevision: Revision;
+  step?: string;
+};
+
+type StandingMatch = {
+  task: TaskRecord;
+  workspaceId: Id;
+  workspaceRevision: Revision;
+  cls: AutoClass;
+  workspaceName: string;
+};
+
+/**
+ * Dry-run half of standingAutoBinding: same matching, no recording. Tool
+ * gates use this to decide between executing and asking; the runner records.
+ */
+export const standingAutoApplies = (
+  store: TaskStore,
+  host: string,
+  actor: string,
+  operation: string,
+): StandingMatch | null => {
+  let descriptor: { operation?: unknown };
+  try {
+    descriptor = JSON.parse(operation) as { operation?: unknown };
+  } catch {
+    return null;
+  }
+  const cls = operationAutoClass(descriptor.operation);
+  if (!cls || !autoApproves(store.root, cls)) return null;
+  const listed = store.listTasks();
+  const workspace = store.readWorkspace();
+  if (!listed.ok || !workspace.ok || !workspace.data) return null;
+  const matches = listed.data.filter(
+    (task) =>
+      task.status === "active" &&
+      task.workspaceId === workspace.data!.id &&
+      task.intent?.provenance?.session?.kind === "host" &&
+      (task.intent.provenance.session as { host?: unknown; handle?: unknown }).host === host &&
+      (task.intent.provenance.session as { host?: unknown; handle?: unknown }).handle === actor,
+  );
+  if (matches.length !== 1) return null;
+  const resolved = resolveAutoApproval(store.root);
+  if (resolved.status !== "on") return null;
+  return {
+    task: matches[0],
+    workspaceId: workspace.data.id,
+    workspaceRevision: workspace.data.revision,
+    cls,
+    workspaceName: resolved.workspace,
+  };
+};
+
+/**
+ * Shared adapter path: resolve one gated operation under the workspace
+ * standing rule without asking. Returns the exact binding the runner needs
+ * for reserve/settle, or null when anything is uncovered, ambiguous, or
+ * unresolvable — callers fall through to the question proposal.
+ *
+ * Single active task per session (ambiguity asks), plan-before-mutation
+ * (no task asks), guardrails enforced at record time, revocation instant.
+ */
+export const standingAutoBinding = (
+  core: WorkitCore,
+  store: TaskStore,
+  host: string,
+  actor: string,
+  operation: string,
+): StandingAutoBinding | null => {
+  let descriptor: { operation?: unknown };
+  try {
+    descriptor = JSON.parse(operation) as { operation?: unknown };
+  } catch {
+    return null;
+  }
+  const cls = operationAutoClass(descriptor.operation);
+  if (!cls || !autoApproves(store.root, cls)) return null;
+  const applies = standingAutoApplies(store, host, actor, operation);
+  if (!applies) return null;
+  const { task } = applies;
+  const resolved = resolveAutoApproval(store.root);
+  if (resolved.status !== "on") return null;
+  const presented =
+    `Workit decision: action — auto-approved ${String(descriptor.operation)} ` +
+    `under workspace rule "${resolved.workspace}" (no question asked).`;
+  const recorded = core.observeStandingDecision({
+    schemaVersion: 1,
+    action: "record",
+    taskId: task.id,
+    expectedRevision: task.revision,
+    purpose: "action",
+    binding: {
+      taskId: task.id,
+      workspaceId: applies.workspaceId,
+      scope: task.intent.data.scope,
+      presented,
+      approvedContent: operation,
+      contentRefs: [],
+      standing: { workspace: resolved.workspace, class: cls },
+    },
+    response: "approved",
+    requirementIds: [],
+  });
+  if (!recorded.ok) return null;
+  const fresh = store.readTask(task.id);
+  if (!fresh.ok) return null;
+  return {
+    taskId: task.id,
+    decisionId: recorded.data.id,
+    binding: recorded.data.data.binding,
+    expectedRevision: fresh.data.revision,
+    expectedWorkspaceRevision: applies.workspaceRevision,
+  };
+};

package/src/core/branch.ts

@@ -18,6 +18,50 @@ const policy = (root: string) => resolveBranchPolicyFor(root);
 const allowedBranch = (root: string, name: string) =>
   policy(root).allowed.some((r) => r.test(name));
 const isProtected = (root: string, name: string) => policy(root).protected.has(name.toLowerCase());
+
+/** Public guardrail: protected refs fail closed anywhere, never ask. */
+export const isProtectedTarget = (root: string, name: string): boolean => {
+  try {
+    return isProtected(root, name);
+  } catch {
+    return true;
+  }
+};
+
+/**
+ * Push identity check as code: the credential actually used must belong to
+ * the workspace area account. Anything unresolvable fails closed — an
+ * unreachable host never reads as a match.
+ */
+export const verifyPushIdentity = (
+  root: string,
+  provider: string,
+  account: string,
+): { ok: true } | { ok: false; error: string } => {
+  if (!account || typeof account !== "string")
+    return { ok: false, error: "push identity requires a configured area account" };
+  const probe =
+    provider === "gitlab"
+      ? (["api", "user", "--jq", ".username"] as const)
+      : (["api", "user", "--jq", ".login"] as const);
+  const bin = provider === "gitlab" ? "glab" : "gh";
+  let login: string;
+  try {
+    login = execFileSync(bin, [...probe], {
+      cwd: root,
+      encoding: "utf8",
+      stdio: ["pipe", "pipe", "pipe"],
+    }).trim();
+  } catch {
+    return { ok: false, error: `${bin} identity could not be resolved` };
+  }
+  if (!login || login.toLowerCase() !== account.toLowerCase())
+    return {
+      ok: false,
+      error: `push identity ${login || "(unknown)"} does not match area account ${account}`,
+    };
+  return { ok: true };
+};
 // RL-01: malformed vcs.json blocks branch resolution with an exact-path error.
 const baseBranch = (cwd: string): { base: string } | { error: string } => {
   const resolved = vcsConfig("resolve", cwd);

package/src/core/external-action-effects.ts

@@ -4,7 +4,7 @@ import {
   resolveBranchPolicyFor,
   resolveCommitPolicyFor,
 } from "./branch";
-import { hostingCliAvailable, prCreate } from "./pr-create";
+import { hostingCliAvailable, mergePr, prCreate } from "./pr-create";
 import {
   changelogContext,
   docsRefreshContext,
@@ -356,6 +356,11 @@ export const actionProposalQuestion = (
         presented: `Workit decision: action — Open a PR from \`${String(resolved.source_branch ?? "")}\` to \`${payloadTarget}\` titled "${String(request.payload.title)}"?`,
         approvedText: `Open the PR: ${String(resolved.source_branch ?? "")} → ${payloadTarget}, "${String(request.payload.title)}".`,
       };
+    case "hosting.merge":
+      return {
+        presented: `Workit decision: action — Merge \`${String(resolved.source_branch ?? "")}\` into \`${payloadTarget}\` (squash, delete branch)?`,
+        approvedText: `Merge ${String(resolved.source_branch ?? "")} → ${payloadTarget}.`,
+      };
     case "changelog.apply":
       return {
         presented: `Workit decision: action — Apply changelog changes at \`${String(payload.path ?? "CHANGELOG.md")}\`?`,
@@ -404,6 +409,7 @@ export const approvedResolvedExternalAction = (content: string): Result<Resolved
     const value = JSON.parse(content) as { operation?: unknown; payload?: unknown };
     if (
       value.operation !== "hosting.pull_request" &&
+      value.operation !== "hosting.merge" &&
       value.operation !== "changelog.apply" &&
       value.operation !== "youtrack.update" &&
       value.operation !== "youtrack.time" &&
@@ -428,6 +434,15 @@ export const approvedResolvedExternalAction = (content: string): Result<Resolved
         typeof payload.target_branch !== "string")
     )
       return failure("invalid_input", "approved hosting target is incomplete");
+    if (
+      value.operation === "hosting.merge" &&
+      (typeof target.marker !== "string" ||
+        typeof target.source_branch !== "string" ||
+        typeof target.source_commit !== "string" ||
+        typeof target.remote !== "string" ||
+        typeof payload.target_branch !== "string")
+    )
+      return failure("invalid_input", "approved hosting target is incomplete");
     if (
       value.operation === "changelog.apply" &&
       (typeof target.target !== "string" ||
@@ -910,6 +925,11 @@ export const resolveExternalActionRequest = (
       }
       case "git.push": {
         const branch = request.payload.branch ?? gitValue(root, ["branch", "--show-current"]);
+        if (branch && isProtectedBranch(root, branch))
+          return failure("invalid_input", `cannot push protected branch ${branch}`, {
+            outcome: "not_started",
+            fields: [{ path: "branch", reason: "protected branch" }],
+          });
         const commit = branch ? gitValue(root, ["rev-parse", branch]) : null;
         const remote = pushRemote(root);
         const identity = remote ? credentialFreeRemote(remote) : null;
@@ -1026,6 +1046,15 @@ export const resolveExternalActionRequest = (
         const target_branch =
           request.payload.target_branch ?? resolveBranchPolicyFor(root).defaultTargetBranch;
         const source_branch = gitValue(root, ["branch", "--show-current"]);
+        if (source_branch && isProtectedBranch(root, source_branch))
+          return failure(
+            "invalid_input",
+            `cannot open a PR from protected branch ${source_branch}`,
+            {
+              outcome: "not_started",
+              fields: [{ path: "source_branch", reason: "protected branch" }],
+            },
+          );
         const source_commit = gitValue(root, ["rev-parse", "HEAD"]);
         const remote = pushRemote(root);
         const identity = remote ? credentialFreeRemote(remote) : null;
@@ -1067,6 +1096,56 @@ export const resolveExternalActionRequest = (
           },
         });
       }
+      case "hosting.merge": {
+        const target_branch =
+          request.payload.target_branch ?? resolveBranchPolicyFor(root).defaultTargetBranch;
+        const source_branch =
+          request.payload.source_branch ?? gitValue(root, ["branch", "--show-current"]);
+        if (source_branch && isProtectedBranch(root, source_branch))
+          return failure("invalid_input", `cannot merge protected branch ${source_branch}`, {
+            outcome: "not_started",
+            fields: [{ path: "source_branch", reason: "protected branch" }],
+          });
+        const source_commit = gitValue(root, ["rev-parse", "HEAD"]);
+        const remote = pushRemote(root);
+        const identity = remote ? credentialFreeRemote(remote) : null;
+        if (
+          !source_branch ||
+          !source_commit ||
+          !identity ||
+          (remoteProvider(identity) !== null &&
+            remoteProvider(identity) !== String(vcsConfig("load", root).provider).toLowerCase())
+        )
+          return failure(
+            "capability_unavailable",
+            "hosting target is not bound to the configured remote provider",
+            { capability: "hosting.merge" },
+          );
+        const vcs = vcsConfig("load", root);
+        if (!vcs.ok || !vcs.tokenReady)
+          return failure("capability_unavailable", "hosting credentials are unavailable", {
+            capability: "hosting.merge",
+            outcome: "not_started",
+          });
+        if (!hostingCliAvailable(String(vcs.provider)))
+          return failure("capability_unavailable", "hosting CLI is unavailable", {
+            capability: "hosting.merge",
+            outcome: "not_started",
+          });
+        const normalized = {
+          operation: request.operation,
+          payload: { ...request.payload, target_branch, source_branch },
+        } as ExternalActionRequest;
+        const marker = `<!-- workit-action:${sha256({ operation: request.operation, payload: normalized.payload, source_commit, remote: identity })} -->`;
+        return success(null, null, {
+          request: normalized,
+          marker,
+          descriptorPayload: {
+            ...normalized.payload,
+            resolved: { source_branch, source_commit, remote: identity, target_branch, marker },
+          },
+        });
+      }
       case "changelog.apply": {
         const preview = changelogApplyPreview({ ...request.payload, workspace_root: root });
         if (preview.error) return failure("invalid_input", preview.error);
@@ -1289,6 +1368,19 @@ export const executeConcreteExternalAction = async (
               : {}),
           });
     }
+    case "hosting.merge": {
+      const target = String(request.payload.target_branch ?? "");
+      const source = String(request.payload.source_branch ?? "");
+      if (!target || !source)
+        return failure("invalid_input", "hosting.merge requires target and source branches", {
+          outcome: "not_started",
+          fields: [{ path: "target_branch", reason: "required" }],
+        });
+      const result = mergePr(root, { target, source });
+      return result.error || result.ok === false
+        ? unknown(request.operation)
+        : success(null, null, result);
+    }
     case "changelog.apply": {
       const preview = changelogApplyPreview({ ...request.payload, workspace_root: root });
       if (

package/src/core/external-action.ts

@@ -86,6 +86,17 @@ const externalActionSchema = z.discriminatedUnion("operation", [
         .strict(),
     })
     .strict(),
+  z
+    .object({
+      operation: z.literal("hosting.merge"),
+      payload: z
+        .object({
+          target_branch: z.string().min(1).optional(),
+          source_branch: z.string().min(1).optional(),
+        })
+        .strict(),
+    })
+    .strict(),
   z
     .object({
       operation: z.literal("youtrack.update"),
@@ -216,7 +227,7 @@ export const externalActionDescriptor = (operation: string, payload: unknown): s
 
 /** Compact host-facing help for the fixed optional-action surface. */
 export const externalActionHelp =
-  "Fixed actions: git.branch_setup {action?,sdd_dir?,target_branch(required unless reapply_stash; the working branch to create or switch to),stash?}; git.commit {message}; git.push {branch?}; hosting.pull_request {title,body?,draft?,target_branch?,babysit?}; youtrack.update {issueId,markdown,minutes?}; youtrack.time {issueId,minutes,text?,dateMs?}; youtrack.meeting {issueId,minutes,text}; changelog.apply {entries?,path?,normalize_only?}; context.read {kind,range?,issueId?,issueUrl?,issueRef?,mode?,specPath?,planPath?}. context.read is read-only and needs no approval; all other operations require native approval (CLI uses a TTY; caller-unattested MCP cannot mutate).";
+  "Fixed actions: git.branch_setup {action?,sdd_dir?,target_branch(required unless reapply_stash; the working branch to create or switch to),stash?}; git.commit {message}; git.push {branch?}; hosting.pull_request {title,body?,draft?,target_branch?,babysit?}; hosting.merge {target_branch?,source_branch?}; youtrack.update {issueId,markdown,minutes?}; youtrack.time {issueId,minutes,text?,dateMs?}; youtrack.meeting {issueId,minutes,text}; changelog.apply {entries?,path?,normalize_only?}; context.read {kind,range?,issueId?,issueUrl?,issueRef?,mode?,specPath?,planPath?}. context.read is read-only and needs no approval; all other operations require native approval (CLI uses a TTY; caller-unattested MCP cannot mutate).";
 
 export const externalActionRef = (
   host: "opencode" | "pi" | "workit_cli",

package/src/core/pr-create.ts

@@ -373,4 +373,54 @@ export function prCreate(env: NodeJS.ProcessEnv, cwd: string): Record<string, an
   };
 }
 
+/** Merge the open PR/MR for a source branch (squash + delete per pr settings). */
+export function mergePr(
+  cwd: string,
+  opts: { target: string; source: string },
+): Record<string, any> {
+  const root = repoRoot(cwd);
+  const cfg = vcsConfig("load", root);
+  if (!cfg.ok) return { error: cfg.error ?? "vcs config missing" };
+  if (!cfg.tokenReady)
+    return { error: "VCS token not ready — run /wk-init and edit token file locally" };
+  const provider = cfg.provider as string;
+  if (provider !== "gitlab" && provider !== "github")
+    return { error: `unsupported provider: ${provider}` };
+  if (!hostingCliAvailable(provider))
+    return { error: `workflow CLI missing (required for ${provider})` };
+  const pr = (cfg.pr ?? {}) as Record<string, any>;
+  const token = fs.readFileSync(cfg.tokenPath as string, "utf8").trim();
+  const squash = pr.squashOnMerge !== false;
+  const removeBranch = pr.removeSourceBranch !== false;
+  let cmd: string[];
+  let cmdEnv: NodeJS.ProcessEnv;
+  if (provider === "gitlab") {
+    cmd = ["glab", "mr", "merge", opts.source];
+    cmd.push(squash ? "--squash" : "--squash=false");
+    if (removeBranch) cmd.push("--remove-source-branch");
+    cmd.push("--yes");
+    cmdEnv = { ...process.env, PATH: process.env.PATH ?? "", GITLAB_TOKEN: token };
+  } else {
+    cmd = ["gh", "pr", "merge", opts.source];
+    cmd.push(squash ? "--squash" : "--merge");
+    if (removeBranch) cmd.push("--delete-branch");
+    cmd.push("--yes");
+    cmdEnv = { ...process.env, PATH: process.env.PATH ?? "", GH_TOKEN: token };
+  }
+  const result = spawnSync(cmd[0], cmd.slice(1), { cwd: root, encoding: "utf8", env: cmdEnv });
+  if (result.status !== 0)
+    return {
+      error: "merge failed",
+      provider,
+      stderr: (result.stderr ?? result.stdout ?? "").trim().slice(0, 800),
+    };
+  return {
+    ok: true,
+    provider,
+    targetBranch: opts.target,
+    sourceBranch: opts.source,
+    output: (result.stdout ?? "").trim(),
+  };
+}
+
 export { buildBody, parseGhRepo, parseGhIssue };

package/src/core/route-intent.ts

@@ -1,7 +1,7 @@
 import { TaskStore } from "./task-store";
 
 export type ShellRouteIntent = {
-  route: "git.branch_setup" | "hosting.pull_request";
+  route: "git.branch_setup" | "hosting.pull_request" | "hosting.merge";
   guidance: string;
 };
 
@@ -10,6 +10,8 @@ const GUIDANCE: Record<ShellRouteIntent["route"], string> = {
     "use the Workit git.branch_setup action (workit_external_action in hosts, or `workit action git.branch_setup --payload '{}' --confirm --json` in the CLI)",
   "hosting.pull_request":
     "use the Workit hosting.pull_request action (workit_external_action in hosts, or `workit action hosting.pull_request --payload '{...}' --confirm --json` in the CLI), then drive the created PR through workit-babysit",
+  "hosting.merge":
+    "use the Workit hosting.merge action (workit_external_action in hosts, or `workit action hosting.merge --payload '{...}' --confirm --json` in the CLI)",
 };
 
 const unbalancedQuotes = (segment: string): boolean => {
@@ -48,6 +50,10 @@ export function shellRouteIntent(command: string): ShellRouteIntent | null {
       return { route: "hosting.pull_request", guidance: GUIDANCE["hosting.pull_request"] };
     if (head === "glab" && second === "mr" && third === "create")
       return { route: "hosting.pull_request", guidance: GUIDANCE["hosting.pull_request"] };
+    if (head === "gh" && second === "pr" && third === "merge")
+      return { route: "hosting.merge", guidance: GUIDANCE["hosting.merge"] };
+    if (head === "glab" && second === "mr" && third === "merge")
+      return { route: "hosting.merge", guidance: GUIDANCE["hosting.merge"] };
   }
   return null;
 }

package/src/core/task-contract.ts

@@ -144,6 +144,19 @@ export const refSchema = z.discriminatedUnion("kind", [
     .strict(),
   z.object({ kind: z.literal("host"), host: hostSchema, handle: nonEmpty }).strict(),
   z.object({ kind: z.literal("external"), url: text.url() }).strict(),
+  // Standing auto-approval receipt: authorizes without a live question while
+  // the referenced workspace rule covers the operation class. Verified live
+  // at reserve time against current config; dropped on export/import (a rule
+  // from another machine must never authorize here). Scalar-only shape keeps
+  // advertised operation schemas within provider depth limits.
+  z
+    .object({
+      kind: z.literal("standing"),
+      workspace: nonEmpty,
+      class: nonEmpty,
+      configDigest: nullableDigest,
+    })
+    .strict(),
 ]);
 export type Ref = z.infer<typeof refSchema>;
 
@@ -563,6 +576,7 @@ export const decisionSchema = z
         displayed: text.optional(),
         contentRefs: z.array(refSchema),
         statedChoice: z.object({ ref: text, text: text }).strict().optional(),
+        standing: z.object({ workspace: nonEmpty, class: nonEmpty }).strict().optional(),
       })
       .strict(),
     digest,

package/src/core/task-engine.ts

@@ -56,6 +56,7 @@ import {
   type ReconcileActionInput,
 } from "./authority";
 import { diffPolicy, resolvePolicy } from "./policy-resolver";
+import { verifyStandingApproval } from "./auto-approval";
 import { TaskStore, type MetadataLock, type ProcessEvidence } from "./task-store";
 import {
   exportDigest,
@@ -1087,10 +1088,21 @@ export class WorkitCore {
     return this.recordDecision(request, observation, true);
   }
 
+  /**
+   * Record a standing auto-approval: no live question, authorized by the
+   * workspace rule named in binding.standing while it covers the operation.
+   * Lead-only, task-scoped, verified live here — revocation is config
+   * removal, which fails the next reserve closed.
+   */
+  observeStandingDecision(request: unknown): Result<Entry<Decision>> {
+    return this.recordDecision(request, undefined, true, true);
+  }
+
   private recordDecision(
     request: unknown,
     nativeObservation?: unknown,
     nativeRequired = false,
+    standing = false,
   ): Result<Entry<Decision>> {
     const root = this.contextRootError();
     if (!root.ok) return root as Result<never>;
@@ -1110,8 +1122,16 @@ export class WorkitCore {
       return failure("permission_denied", "stated choices cannot authorize mutating actions");
     if (stated && !input.binding?.statedChoice)
       return failure("invalid_input", "stated choices require binding.statedChoice");
-    if (nativeRequired && nativeObservation === undefined && !stated)
+    if (nativeRequired && nativeObservation === undefined && !stated && !standing)
       return failure("permission_denied", "native decision observation is required");
+    if (
+      standing &&
+      (!input.binding?.standing || input.purpose !== "action" || input.response !== "approved")
+    )
+      return failure(
+        "invalid_input",
+        "standing approvals need an approved action binding with a standing rule",
+      );
     const task = this.store.readTask(input.taskId);
     if (!task.ok) return task as Result<never>;
     if ((this.context.workerId ?? null) !== null)
@@ -1141,8 +1161,13 @@ export class WorkitCore {
         consumption: null,
       } satisfies Omit<Decision, "digest">;
       const data: Decision = { ...base, digest: decisionDigest(base) };
+      const standingApproval =
+        standing && !stated
+          ? verifyStandingApproval(this.store.root, task.data, this.context.caller, input.binding)
+          : null;
+      if (standingApproval && !standingApproval.ok) return standingApproval as Result<never>;
       const native =
-        nativeRequired && !stated
+        nativeRequired && !stated && !standingApproval
           ? verifyNativeDecision(
               this.context.nativeAuthority,
               {
@@ -1189,7 +1214,10 @@ export class WorkitCore {
           const entry: Entry<Decision> = {
             id: newId(),
             recordedAt: mutation.now,
-            provenance: nativeProvenance ?? provenance(this.context, "agent_reported"),
+            provenance:
+              standingApproval?.ok === true
+                ? standingApproval.data
+                : (nativeProvenance ?? provenance(this.context, "agent_reported")),
             data,
           };
           return success(mutation.revision, null, {

package/src/core/workspaces.ts

@@ -19,7 +19,13 @@ export type WorkspaceBranchPolicy = {
 export type WorkspaceConfig = {
   name: string;
   glob: string;
-  vcs?: { provider: VcsProvider; defaultTargetBranch?: string; tokenFile?: string };
+  vcs?: {
+    provider: VcsProvider;
+    defaultTargetBranch?: string;
+    tokenFile?: string;
+    account?: string;
+  };
+  autoApprove?: boolean | string[];
   youtrack?: { baseUrl?: string; link_issues?: boolean };
   issues?: { provider?: "github"; link_on_pr?: boolean };
   branchPolicy?: WorkspaceBranchPolicy;

package/src/core.ts

@@ -73,6 +73,23 @@ export type { MethodId, SelectedMethod } from "./core/methods";
 export { hasLiveWorkitTask, shellRouteIntent, shouldDenyShellRoute } from "./core/route-intent";
 export { classifyBranchDirt } from "./core/branch";
 export type { BranchDirt } from "./core/branch";
+export {
+  AUTO_CLASSES,
+  autoApproves,
+  operationAutoClass,
+  resolveAutoApproval,
+  standingApprovalLive,
+  standingAutoApplies,
+  standingAutoBinding,
+  standingReceiptFor,
+  verifyStandingApproval,
+} from "./core/auto-approval";
+export type {
+  AutoApproval,
+  AutoClass,
+  StandingAutoBinding,
+  StandingReceipt,
+} from "./core/auto-approval";
 export { bundleHashOfFile, isEphemeralCachePath, sha256Hex } from "./core/runtime-identity";
 export type { ShellRouteIntent } from "./core/route-intent";
 export { applicableDecision, reserveAction, settleAction, reconcileAction } from "./core/authority";