@brainervirus/workit-core 7.7.0 → 8.0.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@brainervirus/workit-core",
-  "version": "7.7.0",
+  "version": "8.0.0",
   "private": false,
   "description": "Workit shared core — task, policy, evidence, review, decision, worker, and writer state for agentic coding workflows",
   "keywords": [

package/skills/workit-ship/SKILL.md

@@ -51,8 +51,8 @@ the base keeps moving, or after 3 failed fix attempts on the same check.
    flake|infra` per head. Real: reproduce with `workit check`, fix the root
    cause, batch fixes into one push.
 6. **Verified.** After the last push a non-author records a verdict
-   (workit-review). Land only when granted: `workit stack land` (the
-   contiguous verified run from the root) or `workit pr merge`.
+   (workit-review). Land only when granted: `workit stack land` (verified run
+   from the root) or `workit pr merge`; `--unverified --reason` only if user-asked.
 7. **Observe it landed:** `workit verify-delivery pr` or `merge`. After a failed
    verdict or a check red 3+ times, at any endpoint: offer `/wk-retro` in one
    line of the final or stop report; never pause the babysit loop for it.

package/src/autonomy.ts

@@ -17,8 +17,9 @@
 // - Defaults (D4) when a kind is absent: push, pr and rerun are allowed;
 //   merge and release need an explicit grant. The default ceiling is a stack
 //   opened, CI green and independently verified: "verified, ready".
-// - `merge: "verified"` allows a merge only with an accepted independent
-//   verdict (S13); `merge: true` is the only way to merge without one.
+// - Every merge needs an accepted independent verdict (S13). `merge: true`
+//   also allows an explicit, ledger-recorded `--unverified --reason` bypass;
+//   `merge: "verified"` never does.
 // - A legacy `autoApprove: true | [classes]` maps once to grants (its `merge`
 //   class becomes `merge: "verified"`; `branch`/`commit` are local, dropped).
 // - Explicitly configured grants require an account (design §2.0 Identity):
@@ -131,7 +132,8 @@ type EndpointContext = {
  * delivery verbs make (requireGrant): without `push` or `pr` (or without the
  * account explicit grants need) nothing reaches the forge, so anything above
  * `commit` acts as `commit`; without `merge`, `merged` acts as `green`. The
- * reason names the unblock.
+ * reason names the unblock. `merged` stays `merged` under either merge grant;
+ * landing still needs an accepted verdict (forge/pr-ops.ts).
  */
 function effectiveEndpoint(
   endpoint: DefaultEndpoint,
@@ -212,8 +214,8 @@ export type GrantDecision =
       kind: GrantKind;
       /** Where the permission came from. */
       source: AutonomySource;
-      /** A merge must also have an accepted independent verdict (S13). */
-      requireVerdict: boolean;
+      /** `merge: true` only: `--unverified --reason` may bypass the verdict (S13). */
+      allowUnverified: boolean;
       workspace: string | null;
     }
   | {
@@ -373,7 +375,7 @@ export function requireGrant(
     allowed: true,
     kind,
     source: configured ? autonomy.source : "default",
-    requireVerdict: kind === "merge" && value !== true,
+    allowUnverified: kind === "merge" && value === true,
     workspace,
   };
 }

package/src/core/pr-create.ts

@@ -263,99 +263,6 @@ export function prCreate(env: NodeJS.ProcessEnv, cwd: string): Record<string, an
     (env.WORKIT_EXPECTED_SOURCE_COMMIT && env.WORKIT_EXPECTED_SOURCE_COMMIT !== sourceCommit)
   )
     return { error: "approved PR source branch or commit changed before execution" };
-  const mergeBaseResult =
-    policy.integration === "merge"
-      ? spawnSync("git", ["rev-parse", "--verify", `refs/heads/${target}`], {
-          cwd: root,
-          encoding: "utf8",
-        })
-      : null;
-  const mergeBaseCommit =
-    mergeBaseResult?.status === 0 ? (mergeBaseResult.stdout ?? "").trim() : "";
-  if (
-    policy.integration === "merge" &&
-    ((env.WORKIT_EXPECTED_REMOTE && !env.WORKIT_EXPECTED_MERGE_BASE_COMMIT) ||
-      !mergeBaseCommit ||
-      (env.WORKIT_EXPECTED_MERGE_BASE_COMMIT &&
-        env.WORKIT_EXPECTED_MERGE_BASE_COMMIT !== mergeBaseCommit))
-  )
-    return { error: "approved merge target branch changed before execution" };
-
-  if (policy.integration === "merge") {
-    const finish = (): Record<string, any> => {
-      if (!sourceCommit || !mergeBaseCommit)
-        return {
-          error: "merge failed",
-          mode: "merge",
-          targetBranch: target,
-          stderr: "source or target branch commit could not be resolved",
-        };
-      const merge = spawnSync("git", ["merge", "--no-ff", sourceCommit, "-m", title], {
-        cwd: root,
-        encoding: "utf8",
-      });
-      if (merge.status !== 0)
-        return {
-          error: "merge failed",
-          mode: "merge",
-          targetBranch: target,
-          stderr: (merge.stderr ?? "").slice(0, 800),
-        };
-      const mergedCommit = spawnSync("git", ["rev-parse", "HEAD"], {
-        cwd: root,
-        encoding: "utf8",
-      });
-      if (mergedCommit.status !== 0)
-        return { error: "merge commit could not be resolved", mode: "merge" };
-      const updateTarget = spawnSync(
-        "git",
-        ["update-ref", `refs/heads/${target}`, mergedCommit.stdout.trim(), mergeBaseCommit],
-        { cwd: root, encoding: "utf8" },
-      );
-      if (updateTarget.status !== 0)
-        return { error: "merge target branch changed before update", mode: "merge" };
-      const push = spawnSync(
-        "git",
-        ["push", targetUrl, `${mergedCommit.stdout.trim()}:refs/heads/${target}`],
-        { cwd: root, encoding: "utf8", env: { ...process.env, PATH: process.env.PATH ?? "" } },
-      );
-      if (push.status !== 0)
-        return {
-          error: "push failed",
-          mode: "merge",
-          targetBranch: target,
-          stderr: (push.stderr ?? "").slice(0, 800),
-        };
-      return {
-        ok: true,
-        mode: "merge",
-        targetBranch: target,
-        merged: true,
-        pushed: true,
-        output: (push.stdout ?? "").trim(),
-      };
-    };
-    const co = spawnSync("git", ["checkout", "--detach", mergeBaseCommit], {
-      cwd: root,
-      encoding: "utf8",
-    });
-    if (co.status !== 0)
-      return {
-        error: `cannot checkout target ${target}`,
-        mode: "merge",
-        targetBranch: target,
-        stderr: (co.stderr ?? "").slice(0, 800),
-      };
-    // finish() returns error objects, it never throws, so the best-effort
-    // `git checkout branch` restore below runs on ALL outcomes (success,
-    // merge failure, and push failure) — the tree always returns to the
-    // feature branch. Deliberately not a try/finally: the restore is
-    // best-effort and its own failure is not actionable on this path.
-    const result = finish();
-    spawnSync("git", ["checkout", branch], { cwd: root, encoding: "utf8" }); // best-effort return
-    return result;
-  }
-
   const pr = (cfg.pr ?? {}) as Record<string, any>;
   const body = env.WF_PR_BODY ?? "";
   const draft = String(env.WF_PR_DRAFT ?? "false").toLowerCase() === "true";
@@ -510,144 +417,5 @@ export function prCreate(env: NodeJS.ProcessEnv, cwd: string): Record<string, an
   };
 }
 
-/** Merge the exact approved open PR/MR (squash + delete per pr settings). */
-export function mergePr(
-  cwd: string,
-  opts: {
-    target: string;
-    source: string;
-    sourceCommit: string;
-    remote: string;
-    account: string;
-    apiHost: string;
-  },
-): Record<string, any> {
-  const root = repoRoot(cwd);
-  const cfg = vcsConfig("load", root);
-  if (!cfg.ok) return { error: cfg.error ?? "vcs config missing" };
-  const provider = cfg.provider as string;
-  if (provider !== "gitlab" && provider !== "github")
-    return { error: `unsupported provider: ${provider}` };
-  const identity = vcsCliIdentity(root);
-  if (!identity.ok) return { error: identity.error };
-  if (opts.apiHost !== identity.host)
-    return { error: "approved hosting API host changed before execution" };
-  const remote = pushRemote(root);
-  const remoteIdentity = remote ? pushRemoteIdentity(remote) : null;
-  if (
-    !remote ||
-    !remoteIdentity ||
-    !pushTargetIsStable(root, remote) ||
-    opts.remote !== remoteIdentity
-  )
-    return { error: "approved merge destination changed before execution" };
-  if (!hostingApiHostMatches(remote, identity.host))
-    return { error: "hosting API host does not match the merge destination" };
-  if (identity.username?.toLowerCase() !== opts.account.toLowerCase())
-    return { error: "approved hosting account changed before execution" };
-  if (!/^[a-f0-9]{40,64}$/i.test(opts.sourceCommit))
-    return { error: "approved merge source commit is invalid" };
-  const currentCommit = spawnSync("git", ["rev-parse", "--verify", `refs/heads/${opts.source}`], {
-    cwd: root,
-    encoding: "utf8",
-  });
-  if (currentCommit.status !== 0 || currentCommit.stdout.trim() !== opts.sourceCommit)
-    return { error: "approved merge source commit changed before execution" };
-  const repository = cliRepository(remote, provider, cfg);
-  const repoPath = remoteRepoPath(remote)?.path;
-  if (!repository || !repoPath?.includes("/"))
-    return { error: "hosting repository could not be resolved" };
-  if (!hostingCliAvailable(provider))
-    return { error: `workflow CLI missing (required for ${provider})` };
-  const owner = repoPath.split("/")[0];
-  const endpoint =
-    provider === "github"
-      ? `repos/${repository.replace(/^[^/]+\//u, "")}/pulls?state=open&head=${encodeURIComponent(`${owner}:${opts.source}`)}&base=${encodeURIComponent(opts.target)}&per_page=100`
-      : `projects/${encodeURIComponent(repoPath)}/merge_requests?state=opened&source_branch=${encodeURIComponent(opts.source)}&target_branch=${encodeURIComponent(opts.target)}&per_page=100`;
-  const listOpen = () =>
-    spawnSync(provider === "github" ? "gh" : "glab", ["api", endpoint], {
-      cwd: root,
-      encoding: "utf8",
-      env: {
-        ...process.env,
-        PATH: process.env.PATH ?? "",
-        ...(provider === "github" ? { GH_HOST: identity.host } : { GITLAB_HOST: identity.host }),
-      },
-    });
-  const listedId = (stdout: string): string | null => {
-    try {
-      const records = JSON.parse(stdout) as Array<Record<string, any>>;
-      if (!Array.isArray(records) || records.length >= 100) return null;
-      const matches = records.filter((record) =>
-        provider === "github"
-          ? record.state === "open" &&
-            record.head?.ref === opts.source &&
-            record.head?.sha === opts.sourceCommit &&
-            record.base?.ref === opts.target
-          : record.state === "opened" &&
-            record.source_branch === opts.source &&
-            record.sha === opts.sourceCommit &&
-            record.target_branch === opts.target,
-      );
-      if (matches.length !== 1) return null;
-      const id = provider === "github" ? matches[0].number : matches[0].iid;
-      return typeof id === "number" ? String(id) : null;
-    } catch {
-      return null;
-    }
-  };
-  const list = listOpen();
-  if (list.status !== 0) return { error: "approved merge request could not be resolved" };
-  const mergeId = listedId(list.stdout ?? "");
-  if (!mergeId) return { error: "exact approved merge request is not open" };
-  // The PR/MR target can change after the first lookup. Re-resolve the
-  // target-filtered request immediately before calling the provider merge CLI.
-  const current = listOpen();
-  if (current.status !== 0 || listedId(current.stdout ?? "") !== mergeId)
-    return { error: "approved merge target or source changed before merge" };
-  const pr = (cfg.pr ?? {}) as Record<string, any>;
-  const squash = pr.squashOnMerge !== false;
-  const removeBranch = pr.removeSourceBranch !== false;
-  let cmd: string[];
-  let cmdEnv: NodeJS.ProcessEnv;
-  if (provider === "gitlab") {
-    cmd = ["glab", "mr", "merge", mergeId, "--repo", repository, "--sha", opts.sourceCommit];
-    cmd.push(squash ? "--squash" : "--squash=false");
-    if (removeBranch) cmd.push("--remove-source-branch");
-    cmd.push("--yes");
-    cmdEnv = { ...process.env, PATH: process.env.PATH ?? "", GITLAB_HOST: identity.host };
-  } else {
-    cmd = [
-      "gh",
-      "pr",
-      "merge",
-      mergeId,
-      "--repo",
-      repository,
-      "--match-head-commit",
-      opts.sourceCommit,
-    ];
-    cmd.push(squash ? "--squash" : "--merge");
-    if (removeBranch) cmd.push("--delete-branch");
-    // NOTE: gh pr merge has no --yes flag; fully-specified flags merge
-    // non-interactively on their own.
-    cmdEnv = { ...process.env, PATH: process.env.PATH ?? "", GH_HOST: identity.host };
-  }
-  const result = spawnSync(cmd[0], cmd.slice(1), { cwd: root, encoding: "utf8", env: cmdEnv });
-  if (result.status !== 0)
-    return {
-      error: "merge failed",
-      provider,
-      stderr: (result.stderr ?? result.stdout ?? "").trim().slice(0, 800),
-    };
-  return {
-    ok: true,
-    provider,
-    targetBranch: opts.target,
-    sourceBranch: opts.source,
-    output: (result.stdout ?? "").trim(),
-  };
-}
-
 // Moved to forge/pr-body.ts (S11); re-exported for the managed action path until S16.
 export { buildBody, parseGhRepo, parseGhIssue };

package/src/forge/pr-ops.ts

@@ -9,13 +9,19 @@
 // merge: three independent gates, all required:
 //   1. the S10 status document reads READY (required checks green, no
 //      conflicts, threads, review or draft blockers);
-//   2. an accepted S13 verdict for that exact head (fresh or carried), unless
-//      the workspace grants `merge: true`;
+//   2. an accepted S13 verdict for that exact head (fresh or carried). Under
+//      `merge: true` only, `--unverified --reason` bypasses it, and the bypass
+//      is recorded (`merge.unverified`) before the merge call;
 //   3. the `merge` grant (autonomy.ts `requireGrant`; S16 fills the defaults).
 // The merge call carries the head SHA (GitHub `sha=`, GitLab `sha=`), so a
 // head that moves after the gates refuses instead of merging unverified code.
 // --delete-branch deletes with a lease on that same SHA.
-import { requireGrant, type AutonomySource } from "../autonomy";
+import {
+  requireGrant,
+  resolveAutonomy,
+  type AutonomySource,
+  type DefaultEndpoint,
+} from "../autonomy";
 import { isProtectedTarget } from "../core/branch";
 import { vcsConfig } from "../core/vcs-config";
 import { workspaceReleaseTracks } from "../core/release-tracks";
@@ -64,6 +70,20 @@ export type CreateOutcome = {
   created: boolean;
   draft: boolean;
   recorded: { id: string } | { error: string };
+  /** The review step and what the effective endpoint does after it. */
+  next: string;
+};
+
+const AFTER_REVIEW: Record<DefaultEndpoint, string> = {
+  commit: "stop here; review comes when the user asks",
+  pr: "stop here; review comes when the user asks",
+  green: "babysit it to merge-ready, never merging",
+  merged: "babysit it, then land it after verification",
+};
+
+const createNext = (cwd: string): string => {
+  const endpoint = resolveAutonomy(cwd).effectiveEndpoint;
+  return `a non-author verifies the head (workit-review); the endpoint is ${endpoint}, so ${AFTER_REVIEW[endpoint]}`;
 };
 
 /**
@@ -231,6 +251,7 @@ export async function createPullRequest(
     created,
     draft: input.draft,
     recorded: row.ok ? { id: String(row.value.id) } : { error: row.error },
+    next: createNext(cwd),
   });
 }
 
@@ -247,6 +268,8 @@ export type MergeInput = {
    * comes from this branch, re-checked right before the merge call.
    */
   expect?: { base: string; branch: string };
+  /** Merge without a verdict (`merge: true` only); the reason is recorded. */
+  unverified?: { reason: string };
 };
 
 export type MergeOutcome = {
@@ -258,6 +281,8 @@ export type MergeOutcome = {
   method: MergeMethod;
   mergeSha: string | null;
   verdict: { required: boolean; accepted: boolean; verdictId: string | null };
+  /** Set when `--unverified` bypassed the verdict: the reason and its ledger row. */
+  unverified: { reason: string; recorded: string } | null;
   grant: { source: AutonomySource };
   deletedBranch: boolean | { error: string };
   recorded: { id: string } | { error: string };
@@ -294,6 +319,8 @@ const mergeBackFor = (cwd: string, base: string): { track: string | null; branch
 export type MergeRefusal = {
   reason:
     | "grant_required"
+    | "unverified_refused"
+    | "failed_verdict"
     | "not_ready"
     | "needs_verdict"
     | "head_mismatch"
@@ -346,6 +373,15 @@ export async function mergePullRequest(
 ): Promise<MergeResult> {
   const grant = requireGrant(cwd, "merge");
   if (!grant.allowed) return refuse(grant.error, grant.unblock, { reason: "grant_required" });
+  const bypass = input.unverified ?? null;
+  if (bypass && !bypass.reason.trim())
+    return failure("invalid_input", "--unverified needs --reason <why the user asked for it>");
+  if (bypass && !grant.allowUnverified)
+    return refuse(
+      `unverified_refused: workspace ${grant.workspace ? `"${grant.workspace}"` : "(none)"} grants merge: "verified", which never merges without an accepted independent verdict`,
+      "a non-author session verifies the head (workit-review), then merge without --unverified",
+      { reason: "unverified_refused" },
+    );
 
   const number = selectPr(cwd, resolved, { pr: input.pr });
   if (!number.ok) return number;
@@ -404,34 +440,57 @@ export async function mergePullRequest(
         { reason: "protected_branch" },
       );
   }
+  const ledger = readLedger(cwd);
+  if (!ledger.ok) return ledger;
+  const check = checkVerdicts(cwd, branch, ledger.value.rows);
+  const summary = { head: check.head, accepted: check.accepted, authors: check.authors };
+  const covered = check.head === head && check.accepted.accepted;
   let verdict: MergeOutcome["verdict"] = {
-    required: grant.requireVerdict,
-    accepted: false,
-    verdictId: null,
+    required: true,
+    accepted: covered,
+    verdictId:
+      covered && typeof check.accepted.verdict?.id === "string" ? check.accepted.verdict.id : null,
   };
-  if (grant.requireVerdict) {
-    const ledger = readLedger(cwd);
-    if (!ledger.ok) return ledger;
-    const check = checkVerdicts(cwd, branch, ledger.value.rows);
-    const summary = { head: check.head, accepted: check.accepted, authors: check.authors };
-    if (check.head !== head)
-      return refuse(
-        `head_mismatch: the verdict check reads ${branch} at ${check.head?.slice(0, 12) ?? "(missing)"} but ${label} is at ${head.slice(0, 12)}`,
-        `git fetch && git switch ${branch} && git merge --ff-only @{u}  # then re-verify that head`,
-        { reason: "head_mismatch", verdict: summary },
-      );
-    if (!check.accepted.accepted)
-      return refuse(
-        `NEEDS_VERDICT: ${label} has no accepted independent verdict for ${head.slice(0, 12)} (${check.accepted.reasons.join(", ")})`,
-        `an independent session verifies the head and runs: workit ledger verdict verified --how "<what was exercised>" --branch ${branch}`,
-        { reason: "needs_verdict", verdict: summary },
+  let unverified: MergeOutcome["unverified"] = null;
+  // The bypass covers a missing verdict, never a rejection.
+  if (!covered && bypass && check.accepted.reasons.includes("failing_verdict"))
+    return refuse(
+      `failed_verdict: ${label} has a current independent failed verdict${typeof check.accepted.verdict?.id === "string" ? ` (${check.accepted.verdict.id})` : ""}; --unverified never merges over a rejection`,
+      "a new independent verdict on the head supersedes it",
+      { reason: "failed_verdict", verdict: summary },
+    );
+  if (!covered && bypass) {
+    // Recorded before the merge call: a bypass that cannot be audited never merges.
+    const reason = bypass.reason.trim();
+    const recorded = appendObserved(cwd, {
+      type: "merge.unverified",
+      actor: input.actor,
+      branch,
+      head,
+      pr: doc.number,
+      base: doc.base,
+      reason,
+      grant: grant.source,
+    });
+    if (!recorded.ok)
+      return failure(
+        "failed",
+        `unverified_unrecorded: the --unverified bypass could not be recorded (${recorded.error}); nothing was merged`,
       );
-    verdict = {
-      required: true,
-      accepted: true,
-      verdictId: typeof check.accepted.verdict?.id === "string" ? check.accepted.verdict.id : null,
-    };
-  }
+    verdict = { required: false, accepted: false, verdictId: null };
+    unverified = { reason, recorded: String(recorded.value.id) };
+  } else if (check.head !== head)
+    return refuse(
+      `head_mismatch: the verdict check reads ${branch} at ${check.head?.slice(0, 12) ?? "(missing)"} but ${label} is at ${head.slice(0, 12)}`,
+      `git fetch && git switch ${branch} && git merge --ff-only @{u}  # then re-verify that head`,
+      { reason: "head_mismatch", verdict: summary },
+    );
+  else if (!covered)
+    return refuse(
+      `NEEDS_VERDICT: ${label} has no accepted independent verdict for ${head.slice(0, 12)} (${check.accepted.reasons.join(", ")})`,
+      `an independent session verifies the head and runs: workit ledger verdict verified --how "<what was exercised>" --branch ${branch}${grant.allowUnverified ? `; or, only if the user asks to merge unverified: workit pr merge --unverified --reason "<why>"` : ""}`,
+      { reason: "needs_verdict", verdict: summary },
+    );
 
   const merged = resolved.forge.merge(doc.number, { sha: head, method: input.method });
   if (!merged.ok) return merged;
@@ -470,6 +529,7 @@ export async function mergePullRequest(
     mergeSha: merged.data.mergeSha,
     method: input.method,
     verdictId: verdict.verdictId,
+    ...(unverified ? { unverified: unverified.recorded } : {}),
     grant: grant.source,
   });
   return {
@@ -483,6 +543,7 @@ export async function mergePullRequest(
       method: input.method,
       mergeSha: merged.data.mergeSha,
       verdict,
+      unverified,
       grant: { source: grant.source },
       deletedBranch,
       recorded: row.ok ? { id: String(row.value.id) } : { error: row.error },

package/src/ledger.ts

@@ -761,6 +761,8 @@ export type RejectReason =
   | "no_session"
   | "author_session"
   | "failing_verdict"
+  /** The only passing current verdict is `type-check-only`, which proves no behavior. */
+  | "type_check_only"
   | "no_verdict";
 
 export type VerdictEntry = {
@@ -783,7 +785,10 @@ export type VerdictCheck = {
   patchId: string | null;
   /** Newest current verdict (else newest verdict): does it still apply? */
   current: { basis: VerdictBasis; verdict: ReadRow | null };
-  /** What merge gates read: an accepted verdict and no current independent failure. */
+  /**
+   * What merge gates read: an accepted strong (`verified`/`tests-verified`)
+   * verdict and no current independent failure. `type-check-only` never counts.
+   */
   accepted: { accepted: boolean; verdict: ReadRow | null; reasons: RejectReason[] };
   review: ReviewLabel;
   /** The newest current, strong, self verdict when `review` is self-reviewed. */
@@ -843,10 +848,17 @@ const independenceReasons = (row: ReadRow, authors: Set<string>): RejectReason[]
 /**
  * The effective verdict of one kind, walking rows in order: a self verdict
  * never displaces an independent one, and an independent failed/blocked
- * verdict sticks until an independent verdict from a different session (or
- * its own session's supersede) replaces it.
+ * verdict sticks, for the code it judged, until an independent verdict from a
+ * different session (or its own session's supersede) replaces it. A verdict
+ * from the same session on different code (`sameCode` false: a real change,
+ * not a carry or restack of the failed code) is a re-review of the fix and
+ * replaces it.
  */
-function effectiveOf(rows: readonly ReadRow[], authors: Set<string>): ReadRow | null {
+function effectiveOf(
+  rows: readonly ReadRow[],
+  authors: Set<string>,
+  sameCode: (failed: ReadRow, row: ReadRow) => boolean,
+): ReadRow | null {
   let effective: ReadRow | null = null;
   for (const row of rows) {
     if (!effective) {
@@ -859,7 +871,8 @@ function effectiveOf(rows: readonly ReadRow[], authors: Set<string>): ReadRow |
     if (
       effIndependent &&
       FAILING.has(String(effective.result)) &&
-      row.actor.session === effective.actor.session
+      row.actor.session === effective.actor.session &&
+      sameCode(effective, row)
     )
       continue;
     effective = row;
@@ -913,15 +926,24 @@ export function checkVerdicts(cwd: string, branch: string, rows: readonly ReadRo
   const head = branchHead(cwd, branch);
   const fallbackBase = defaultBase(cwd);
   const keyCache = new Map<string, { patchId: string | null; diffHash: string | null }>();
-  const keyFor = (base: string | null) => {
-    if (!base || !head) return { patchId: null, diffHash: null };
-    let key = keyCache.get(base);
+  const keysAt = (base: string | null, at: string | null) => {
+    if (!base || !at) return { patchId: null, diffHash: null };
+    const cacheKey = `${base}\0${at}`;
+    let key = keyCache.get(cacheKey);
     if (!key) {
-      key = { patchId: patchId(cwd, base, head), diffHash: diffHash(cwd, base, head) };
-      keyCache.set(base, key);
+      key = { patchId: patchId(cwd, base, at), diffHash: diffHash(cwd, base, at) };
+      keyCache.set(cacheKey, key);
     }
     return key;
   };
+  const keyFor = (base: string | null) => keysAt(base, head);
+  // A newer row is judged under the failure's own base, so a row recorded
+  // with a different --base cannot make unchanged code look changed.
+  const sameCode = (failed: ReadRow, row: ReadRow): boolean =>
+    verdictBasis(failed, {
+      head: row.head,
+      ...keysAt(failed.base ?? fallbackBase, row.head),
+    }) !== "stale" || restackCarries(rows, branch, failed.head, row.head);
   const authors = authorSessions(cwd, rows, branch, { base: fallbackBase, head });
   const byKind = new Map<string, ReadRow[]>();
   for (const row of rows)
@@ -931,7 +953,7 @@ export function checkVerdicts(cwd: string, branch: string, rows: readonly ReadRo
     }
   const verdicts: VerdictEntry[] = [];
   for (const [kind, list] of byKind) {
-    const row = effectiveOf(list, authors);
+    const row = effectiveOf(list, authors, sameCode);
     if (!row) continue;
     let basis = verdictBasis(row, { head, ...keyFor(row.base ?? fallbackBase) });
     if (basis === "stale" && restackCarries(rows, branch, row.head, head)) basis = "carried";
@@ -957,7 +979,10 @@ export function checkVerdicts(cwd: string, branch: string, rows: readonly ReadRo
   const failing = verdicts.find(
     (entry) => entry.current && entry.independent && FAILING.has(String(entry.verdict.result)),
   );
-  const newestAccepted = verdicts.findLast((entry) => entry.accepted) ?? null;
+  const newestAccepted =
+    verdicts.findLast(
+      (entry) => entry.accepted && STRONG_RESULTS.has(String(entry.verdict.result)),
+    ) ?? null;
   const accepted =
     newestAccepted && !failing
       ? { accepted: true, verdict: newestAccepted.verdict, reasons: [] }
@@ -966,7 +991,11 @@ export function checkVerdicts(cwd: string, branch: string, rows: readonly ReadRo
           verdict: failing?.verdict ?? null,
           reasons: failing
             ? (["failing_verdict"] as RejectReason[])
-            : (newestCurrent?.reasons ?? (["no_verdict"] as RejectReason[])),
+            : !newestCurrent
+              ? (["no_verdict"] as RejectReason[])
+              : newestCurrent.reasons.length
+                ? newestCurrent.reasons
+                : (["type_check_only"] as RejectReason[]),
         };
   const selfEntry = failing
     ? undefined
@@ -1344,7 +1373,7 @@ export type RowSummary = {
 };
 
 /** Row types that count only when an observing verb wrote them. */
-const OBSERVED_ONLY: ReadonlySet<string> = new Set(["check", ...PR_ROW_TYPES]);
+const OBSERVED_ONLY: ReadonlySet<string> = new Set(["check", "merge.unverified", ...PR_ROW_TYPES]);
 
 export function rowLabels(row: ReadRow): RowSummary["labels"] {
   const labels: RowSummary["labels"] = [];
@@ -1390,6 +1419,9 @@ export function summarizeRow(row: ReadRow): RowSummary {
     case "pr.merged":
       summary = `#${row.pr ?? "?"} ${text("method")} at ${(row.head ?? "?").slice(0, 12)}${text("mergeSha") ? ` -> ${text("mergeSha").slice(0, 12)}` : ""}`;
       break;
+    case "merge.unverified":
+      summary = `#${row.pr ?? "?"} unverified merge requested at ${(row.head ?? "?").slice(0, 12)} (reason: ${text("reason")})`;
+      break;
     case "delivery.verified":
       summary = `${text("expect")} delivered at ${(row.head ?? "?").slice(0, 12)}`;
       break;

package/src/stack.ts

@@ -996,6 +996,7 @@ export type StopReason =
   | "not_ready"
   | "no_verdict"
   | "needs_verdict"
+  | "failed_verdict"
   | "grant_required"
   | "max_reached"
   | "merge_refused"
@@ -1096,8 +1097,9 @@ const verdictOf = (cwd: string, branch: string, rows: readonly ReadRow[]) => {
 /**
  * Does the root-most open PR qualify to land? Order: a PR exists and is
  * open, it targets the trunk, the forge says READY, an accepted verdict
- * covers the head (unless the grant is `merge: true`), and the grant allows
- * merging. `ready` says everything but the grant holds ("verified, ready").
+ * covers the head (unless `bypass`: `--unverified` under `merge: true`), and
+ * the grant allows merging. `ready` says everything but the grant holds
+ * ("verified, ready").
  */
 export function qualify(
   ctx: Pick<Ctx, "cwd" | "resolved">,
@@ -1108,6 +1110,8 @@ export function qualify(
   grant: GrantDecision,
   /** Why the PR number no longer belongs to this branch (null: it does). */
   binding: string | null = null,
+  /** `stack land --unverified`: skip the verdict where the grant allows it. */
+  bypass = false,
 ): Qualification {
   const label = entry.pr ? noun(ctx.resolved, entry.pr) : entry.branch;
   const stop = (reason: StopReason, detail: string, unblock: string, ready = false) => ({
@@ -1149,12 +1153,19 @@ export function qualify(
         ? `workit ci wait --pr ${entry.pr}`
         : `workit pr status --pr ${entry.pr}`,
     );
-  const requireVerdict = grant.allowed ? grant.requireVerdict : true;
-  if (requireVerdict && !verdict.accepted)
+  const allowUnverified = grant.allowed && grant.allowUnverified;
+  // The bypass covers a missing verdict, never a rejection.
+  if (bypass && allowUnverified && verdict.reasons.includes("failing_verdict"))
+    return stop(
+      "failed_verdict",
+      `${label} has a current independent failed verdict for ${doc.head.sha.slice(0, 12)}; --unverified never lands over a rejection`,
+      "a new independent verdict on the head supersedes it",
+    );
+  if (!(bypass && allowUnverified) && !verdict.accepted)
     return stop(
       verdict.reasons.includes("no_verdict") ? "no_verdict" : "needs_verdict",
       `${label} has no accepted independent verdict for ${doc.head.sha.slice(0, 12)} (${verdict.reasons.join(", ") || "none"})`,
-      `an independent session verifies ${entry.branch} and runs: workit ledger verdict verified --how "<what was exercised>" --branch ${entry.branch}`,
+      `an independent session verifies ${entry.branch} and runs: workit ledger verdict verified --how "<what was exercised>" --branch ${entry.branch}${allowUnverified ? `; or, only if the user asks to land unverified: workit stack land --unverified --reason "<why>"` : ""}`,
     );
   if (!grant.allowed)
     return stop(
@@ -1701,6 +1712,8 @@ export type LandOptions = {
   dryRun: boolean;
   max: number | null;
   method: MergeMethod;
+  /** Land without verdicts (`merge: true` only); each bypass is recorded. */
+  unverified?: { reason: string } | null;
   /** How long to wait for CI on a PR that was just restacked. */
   timeoutMs: number;
   intervalMs: number;
@@ -1709,7 +1722,8 @@ export type LandOptions = {
 export type LandOutcome = {
   name: string;
   dryRun: boolean;
-  landed: Array<{ pr: number; branch: string; mergeSha: string | null }>;
+  /** `unverified`: the ledger row of an `--unverified` bypass, else null. */
+  landed: Array<{ pr: number; branch: string; mergeSha: string | null; unverified: string | null }>;
   /** Dry run: the PRs that qualify now, in order (later ones assume a clean restack). */
   wouldLand: Array<{ pr: number; branch: string }>;
   stoppedAt: {
@@ -1778,6 +1792,23 @@ export async function landStack(
   });
   const mismatch = repoMismatch(ctx, stack);
   if (mismatch) return failWith(mismatch);
+  const bypass = options.unverified ?? null;
+  if (bypass) {
+    const grant = requireGrant(ctx.cwd, "merge");
+    if (!grant.allowed)
+      return failWith(
+        stackFail("blocked", grant.error, grant.unblock, { reason: "grant_required" }),
+      );
+    if (!grant.allowUnverified)
+      return failWith(
+        stackFail(
+          "blocked",
+          `unverified_refused: workspace ${grant.workspace ? `"${grant.workspace}"` : "(none)"} grants merge: "verified", which never lands without an accepted independent verdict`,
+          "a non-author session verifies each head (workit-review), then land without --unverified",
+          { reason: "unverified_refused" },
+        ),
+      );
+  }
 
   // Catch up first: a parent merged elsewhere leaves the rest to restack.
   if (!options.dryRun) {
@@ -1847,6 +1878,7 @@ export async function landStack(
       verdict,
       grant,
       doc ? prBinding(ctx, entry, doc) : null,
+      bypass !== null,
     );
     if (!q.ok) {
       outcome.stoppedAt = {
@@ -1874,6 +1906,7 @@ export async function landStack(
         deleteBranch: false,
         actor: ctx.actor,
         expect: { base: stack.trunk, branch: entry.branch },
+        ...(bypass && !verdict.accepted ? { unverified: bypass } : {}),
       },
       ctx.sleep,
     );
@@ -1891,7 +1924,12 @@ export async function landStack(
       }
       return failWith(stackFail(merged.code, merged.error, merged.unblock));
     }
-    outcome.landed.push({ pr, branch: entry.branch, mergeSha: merged.data.mergeSha });
+    outcome.landed.push({
+      pr,
+      branch: entry.branch,
+      mergeSha: merged.data.mergeSha,
+      unverified: merged.data.unverified?.recorded ?? null,
+    });
     entry.merged = { pr, mergeSha: merged.data.mergeSha, at: new Date().toISOString() };
     const written = writeStack(ctx.cwd, stack);
     if (!written.ok) return failWith(written);