@brainervirus/workit-core 8.34.0 → 8.35.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@brainervirus/workit-core",
-  "version": "8.34.0",
+  "version": "8.35.2",
   "private": false,
   "description": "Workit shared core — task, policy, evidence, review, decision, worker, and writer state for agentic coding workflows",
   "keywords": [

package/src/core/workspaces.ts

@@ -103,7 +103,11 @@ const releaseTrackSchema = z
       ["requiredChecks", track.requiredChecks ?? []],
     ] as const) {
       if (new Set(values).size !== values.length) {
-        context.addIssue({ code: "custom", path: [field], message: "entries must be unique" });
+        context.addIssue({
+          code: "custom",
+          path: [field],
+          message: "entries must be unique",
+        });
       }
     }
     if (
@@ -192,7 +196,10 @@ const workspaceConfigSchema = z
       .passthrough()
       .optional(),
     youtrack: z
-      .object({ baseUrl: nonBlank.optional(), link_issues: z.boolean().optional() })
+      .object({
+        baseUrl: nonBlank.optional(),
+        link_issues: z.boolean().optional(),
+      })
       .passthrough()
       .optional(),
     /**
@@ -302,9 +309,16 @@ export const workspacesRevision = (contents: string | null): string =>
 
 export const validateWorkspacesDocument = (parsed: unknown, file: string): WorkspacesResult => {
   if (!isConfigObject(parsed)) {
-    return { status: "malformed", path: file, entries: [], error: `${file} is not a JSON object` };
+    return {
+      status: "malformed",
+      path: file,
+      entries: [],
+      error: `${file} is not a JSON object`,
+    };
   }
-  const validated = workspacesFileSchema.safeParse(parsed, { reportInput: true });
+  const validated = workspacesFileSchema.safeParse(parsed, {
+    reportInput: true,
+  });
   if (!validated.success) {
     const detail = validated.error.issues
       .map((issue) => {
@@ -353,7 +367,12 @@ export const readWorkspacesResult = (dir: string = configDir()): WorkspacesResul
     raw = readFileSync(file, "utf8");
   } catch (error) {
     if ((error as NodeJS.ErrnoException).code === "ENOENT")
-      return { status: "missing", path: file, entries: [], revision: workspacesRevision(null) };
+      return {
+        status: "missing",
+        path: file,
+        entries: [],
+        revision: workspacesRevision(null),
+      };
     return {
       status: "malformed",
       path: file,
@@ -373,7 +392,10 @@ export const readWorkspacesResult = (dir: string = configDir()): WorkspacesResul
       error: `${file} is not valid JSON`,
     };
   }
-  return { ...validateWorkspacesDocument(parsed, file), revision: workspacesRevision(raw) };
+  return {
+    ...validateWorkspacesDocument(parsed, file),
+    revision: workspacesRevision(raw),
+  };
 };
 
 /** Parse the workspaces.json list under an explicit config dir; [] when missing/malformed. */
@@ -615,7 +637,7 @@ export const workspaceOverlaps = (
     for (const b of entries.slice(i + 1)) {
       const aInB = matchWorkspace(b.glob, globRoot(a.glob));
       const bInA = matchWorkspace(a.glob, globRoot(b.glob));
-      if (!aInB && !bInA) continue;
+      if (!aInB && !bInA && !globsMayOverlap(a.glob, b.glob)) continue;
       const [inner, outer] =
         aInB && !bInA
           ? [a, b]
@@ -818,7 +840,10 @@ export const resolveRuntimeReleaseTracks = (
 ): { workspace: string; releaseTracks: unknown } | null => {
   const matched = matchRuntimeWorkspace(cwd);
   return matched
-    ? { workspace: matched.selected.name, releaseTracks: matched.selected.releaseTracks }
+    ? {
+        workspace: matched.selected.name,
+        releaseTracks: matched.selected.releaseTracks,
+      }
     : null;
 };
 
@@ -846,7 +871,10 @@ const inheritedSetting = (
   const enclosing = matches
     .filter((entry) => entry !== selected)
     .toSorted((a, b) => globSpecificity(b.glob) - globSpecificity(a.glob));
-  return { workspace: selected.name, source: [selected, ...enclosing].find(has) ?? null };
+  return {
+    workspace: selected.name,
+    source: [selected, ...enclosing].find(has) ?? null,
+  };
 };
 
 /** Whether `pr merge` deletes the head branch by default: true unless a covering entry sets `deleteBranch: false`. */
@@ -906,8 +934,18 @@ export const workspaceDelegation = (cwd: string, dir?: string): DelegationMode =
 export const modelSources = (
   cwd: string,
   dir?: string,
-): Array<{ name: string; global: boolean; models: unknown; tierModels: unknown }> => {
-  const out: Array<{ name: string; global: boolean; models: unknown; tierModels: unknown }> = [];
+): Array<{
+  name: string;
+  global: boolean;
+  models: unknown;
+  tierModels: unknown;
+}> => {
+  const out: Array<{
+    name: string;
+    global: boolean;
+    models: unknown;
+    tierModels: unknown;
+  }> = [];
   try {
     const matched = matchRuntimeWorkspace(cwd, dir);
     if (matched) {
@@ -1099,7 +1137,10 @@ export const resolveWorkspacePolicy = (
         status: "resolved" as const,
         profileName: null,
         workspace: null,
-        provenance: { branchPolicy: "user-default", commitPolicy: "user-default" },
+        provenance: {
+          branchPolicy: "user-default",
+          commitPolicy: "user-default",
+        },
       };
   if (selected.status === "invalid") return selected;
   return {
@@ -1130,7 +1171,11 @@ export const selectReleaseTrack = (
       error: `workspace ${JSON.stringify(workspace.name)} has no release track ${JSON.stringify(requestedTrack)}`,
     };
   }
-  return { status: "selected", name: requestedTrack, track: tracks[requestedTrack] };
+  return {
+    status: "selected",
+    name: requestedTrack,
+    track: tracks[requestedTrack],
+  };
 };
 
 /**

package/src/forge/github.ts

@@ -29,6 +29,8 @@ export const PR_STATUS_QUERY = `query($owner: String!, $name: String!, $number:
 
 export const FIND_PR_QUERY = `query($owner: String!, $name: String!, $head: String!) { repository(owner: $owner, name: $name) { pullRequests(headRefName: $head, first: 20, orderBy: { field: CREATED_AT, direction: DESC }) { nodes { number url state baseRefName headRefName headRefOid headRepositoryOwner { login } } } } }`;
 
+export const BRANCH_CHECKS_QUERY = `query($owner: String!, $name: String!, $ref: String!, $contexts: String) { repository(owner: $owner, name: $name) { object(expression: $ref) { ... on Commit { oid statusCheckRollup { contexts(first: 100, after: $contexts) { pageInfo { hasNextPage endCursor } nodes { __typename ... on CheckRun { name status conclusion detailsUrl databaseId checkSuite { workflowRun { databaseId workflow { name } } } } ... on StatusContext { context state targetUrl } } } } } } } }`;
+
 const READY_MUTATION = `mutation($id: ID!) { markPullRequestReadyForReview(input: { pullRequestId: $id }) { pullRequest { isDraft } } }`;
 const DRAFT_MUTATION = `mutation($id: ID!) { convertPullRequestToDraft(input: { pullRequestId: $id }) { pullRequest { isDraft } } }`;
 const REPLY_MUTATION = `mutation($thread: ID!, $body: String!) { addPullRequestReviewThreadReply(input: { pullRequestReviewThreadId: $thread, body: $body }) { comment { url } } }`;
@@ -113,6 +115,12 @@ type GqlPr = {
   };
 };
 
+type BranchChecksData = {
+  repository: {
+    object: { oid?: string; statusCheckRollup: { contexts: Page<GqlContext> } | null } | null;
+  } | null;
+};
+
 type GqlResponse<T> = { data?: T; errors?: Array<{ message?: string; type?: string }> };
 
 const prState = (value: string): PrState =>
@@ -451,6 +459,36 @@ export function createGitHubForge(options: {
       return success(status);
     },
 
+    branchChecks(branch) {
+      const contexts: GqlContext[] = [];
+      let sha: string | null = null;
+      let cursor: string | null = null;
+      for (let page = 1; page <= maxPages; page += 1) {
+        const data: ForgeResult<BranchChecksData> = graphql<BranchChecksData>(
+          BRANCH_CHECKS_QUERY,
+          { owner, name, ref: `refs/heads/${branch}`, contexts: cursor },
+          `checks on ${branch}`,
+        );
+        if (!data.ok) return data;
+        const commit: NonNullable<BranchChecksData["repository"]>["object"] =
+          data.data.repository?.object ?? null;
+        if (!commit) return failure("not_found", `branch ${branch} was not found`);
+        sha = commit.oid ?? sha;
+        const rollup: { contexts: Page<GqlContext> } | null = commit.statusCheckRollup;
+        if (!rollup) break;
+        contexts.push(...rollup.contexts.nodes);
+        if (!rollup.contexts.pageInfo.hasNextPage) break;
+        cursor = rollup.contexts.pageInfo.endCursor;
+      }
+      const required = requiredContexts(branch);
+      const checks = latestPerName(
+        contexts.map(checkFromContext).filter((check): check is ForgeCheck => check !== null),
+      ).map((check) =>
+        required ? { ...check, required: required.includes(check.context) } : check,
+      );
+      return success({ sha, checks, requiredKnown: required !== null });
+    },
+
     jobLogTail(job, lines) {
       const text = apiText(
         runner,

package/src/forge/gitlab.ts

@@ -465,6 +465,54 @@ export function createGitLabForge(options: {
       return success(status);
     },
 
+    branchChecks(branch) {
+      const tip = baseTip(branch);
+      if (!tip) return failure("not_found", `branch ${branch} was not found`);
+      const latest = apiJson<
+        Array<{ id: number; project_id?: number; status: string; web_url?: string }>
+      >(
+        runner,
+        "glab",
+        apiHost,
+        api(
+          `${project}/pipelines?ref=${encodeURIComponent(branch)}&sha=${tip}&order_by=id&sort=desc&per_page=1`,
+        ),
+        `pipelines on ${branch}`,
+      );
+      if (!latest.ok) return latest;
+      const pipeline = Array.isArray(latest.data) ? latest.data[0] : undefined;
+      if (!pipeline) return success({ sha: tip, checks: [], requiredKnown: true });
+      const scope = String(pipeline.project_id ?? encodeURIComponent(repo));
+      const jobs = pages(
+        `projects/${scope}/pipelines/${pipeline.id}/jobs`,
+        `pipeline ${pipeline.id} jobs`,
+      );
+      if (!jobs.ok) return jobs;
+      const bridges = pages(
+        `projects/${scope}/pipelines/${pipeline.id}/bridges`,
+        `pipeline ${pipeline.id} bridges`,
+      );
+      if (!bridges.ok) return bridges;
+      const checks = [
+        ...(jobs.data.items as GlJob[]).map((job) => checkFromJob(job, pipeline.id, scope)),
+        ...(bridges.data.items as GlBridge[]).map((bridge) =>
+          checkFromBridge(bridge, pipeline.id, scope),
+        ),
+      ];
+      if (
+        stateOf(pipeline.status, false) === "failing" &&
+        !checks.some((check) => check.state === "failing")
+      )
+        checks.push(
+          pipelineCheck("failing", pipeline.status, {
+            id: pipeline.id,
+            project_id: pipeline.project_id ?? 0,
+            web_url: pipeline.web_url,
+          }),
+        );
+      return success({ sha: tip, checks, requiredKnown: true });
+    },
+
     jobLogTail(job, lines) {
       const scope = job.scope ?? encodeURIComponent(repo);
       const text = apiText(

package/src/forge/pr-ops.ts

@@ -46,7 +46,14 @@ import type { LaneNeed, ReviewLane } from "../core/policy/lane";
 import { laneLabel, prLaneGate } from "../core/policy/pr-lane";
 import { buildStatusDoc, selectPr, type PrStatusDoc } from "./report";
 import type { ResolvedForge } from "./resolve";
-import { failure, success, type ForgeResult, type MergeMethod, type PrRef } from "./types";
+import {
+  failure,
+  success,
+  type ForgeCheck,
+  type ForgeResult,
+  type MergeMethod,
+  type PrRef,
+} from "./types";
 
 export type Sleep = (ms: number) => Promise<void>;
 
@@ -358,6 +365,8 @@ export type MergeInput = {
   expect?: { base: string; branch: string };
   /** Merge without a verdict (`merge: true` only); the reason is recorded. */
   unverified?: { reason: string };
+  /** Merge onto a base whose latest CI is red (`--base-red-ok`); the reason is recorded. */
+  baseRedOk?: { reason: string };
   /** Squash commit subject and body (`--subject`, `--body`); unset parts use the defaults. */
   subject?: string;
   body?: string;
@@ -393,6 +402,8 @@ export type MergeOutcome = {
   };
   /** Set when `--unverified` bypassed the verdict: the reason and its ledger row. */
   unverified: { reason: string; recorded: string } | null;
+  /** The base branch's CI at its head: a one-line note when it was not green, and the override used. */
+  baseCi: { note: string | null; override: { reason: string } | null };
   grant: { source: AutonomySource };
   /** `skipped`: the implicit default found a reason to keep the branch; the merge is unaffected. */
   deletedBranch: boolean | { error: string } | { skipped: string };
@@ -454,6 +465,7 @@ export type MergeRefusal = {
     | "closed"
     | "protected_branch"
     | "base_mismatch"
+    | "base_red"
     | "ledger_tampered"
     | "intent_unrecorded";
   next?: string;
@@ -632,6 +644,41 @@ function implicitDeleteSkip(
   return null;
 }
 
+type BaseCi =
+  | { ok: true; note: string | null }
+  | { ok: false; failing: ForgeCheck[]; sha: string | null; requiredKnown: boolean };
+
+/**
+ * The base branch head's CI before a merge lands on it: red (a failing check)
+ * refuses, pending or unreadable proceeds with a note, green or no checks
+ * proceeds quietly. Only a protected target is guarded: a stack's lower
+ * branch is its own PR's business.
+ */
+function baseCiState(cwd: string, resolved: ResolvedForge, base: string): BaseCi {
+  if (!isProtectedTarget(cwd, base)) return { ok: true, note: null };
+  const read = resolved.forge.branchChecks(base);
+  if (!read.ok)
+    return { ok: true, note: `base ${base} CI not read (${read.error}); merging anyway` };
+  // Only checks branch protection requires gate; with the required set
+  // unreadable, count hard failures not known to be optional.
+  const { requiredKnown } = read.data;
+  const failing = read.data.checks.filter(
+    (check) =>
+      check.state === "failing" &&
+      (requiredKnown
+        ? check.required === true
+        : check.required !== false && check.conclusion === "failure"),
+  );
+  if (failing.length) return { ok: false, failing, sha: read.data.sha, requiredKnown };
+  const pending = read.data.checks.filter((check) => check.state === "pending");
+  return {
+    ok: true,
+    note: pending.length
+      ? `base ${base} CI is still running (${pending.map((check) => check.name).join(", ")}); merging without waiting`
+      : null,
+  };
+}
+
 export async function mergePullRequest(
   cwd: string,
   resolved: ResolvedForge,
@@ -650,6 +697,13 @@ export async function mergePullRequest(
       { reason: "unverified_refused" },
     );
 
+  const baseRed = input.baseRedOk ?? null;
+  if (baseRed && !baseRed.reason.trim())
+    return failure(
+      "invalid_input",
+      "--base-red-ok needs --reason <why merging onto a red base is fine>",
+    );
+
   const number = selectPr(cwd, resolved, { pr: input.pr });
   if (!number.ok) return number;
   const status = resolved.forge.prStatus(number.data);
@@ -789,6 +843,20 @@ export async function mergePullRequest(
     );
   }
 
+  const baseCi = baseCiState(cwd, resolved, doc.base);
+  let baseRedOverride: { reason: string } | null = null;
+  if (!baseCi.ok) {
+    const names = baseCi.failing.map((failed) => failed.name).join(", ");
+    const url = baseCi.failing.find((failed) => failed.url)?.url ?? null;
+    if (!baseRed)
+      return refuse(
+        `base_red: ${doc.base} at ${baseCi.sha?.slice(0, 12) ?? "its head"} has failing CI (${names}${baseCi.requiredKnown ? "" : "; the required checks could not be read, so every failed check counts"})${url ? `: ${url}` : ""}; merging ${label} onto it would land on a red base`,
+        `fix ${doc.base} first, or, if the user accepts it: workit pr merge${input.pr ? ` --pr ${doc.number}` : ""} --base-red-ok --reason "<why>"`,
+        { reason: "base_red", blockers: baseCi.failing.map((failed) => failed.name) },
+      );
+    baseRedOverride = baseRed;
+  }
+
   const squashMessage = squashMessageFor(cwd, resolved, input, doc);
   if (squashMessage && !squashMessage.ok) return squashMessage;
   // The intent goes in before the forge write: a merge call that errors after
@@ -806,6 +874,7 @@ export async function mergePullRequest(
     review: verdict.review,
     lane: verdict.lane,
     ...(unverified ? { unverified: unverified.recorded } : {}),
+    ...(baseRedOverride ? { baseRedOk: baseRedOverride.reason } : {}),
     grant: grant.source,
   });
   if (!intent.ok)
@@ -841,6 +910,7 @@ export async function mergePullRequest(
     review: verdict.review,
     lane: verdict.lane,
     ...(unverified ? { unverified: unverified.recorded } : {}),
+    ...(baseRedOverride ? { baseRedOk: baseRedOverride.reason } : {}),
     grant: grant.source,
     intent: intentId,
     verified: false,
@@ -909,6 +979,14 @@ export async function mergePullRequest(
       mergeSha: merged.data.mergeSha,
       verdict,
       unverified,
+      baseCi: {
+        note: baseRedOverride
+          ? `base ${doc.base} CI is red; merged anyway (--base-red-ok: ${baseRedOverride.reason})`
+          : baseCi.ok
+            ? baseCi.note
+            : null,
+        override: baseRedOverride,
+      },
       grant: { source: grant.source },
       deletedBranch,
       recorded,

package/src/forge/types.ts

@@ -110,6 +110,16 @@ export type ForgePrStatus = {
   truncated: boolean;
 };
 
+/** The checks on the latest commit of a branch (the merge guard reads the base's). */
+export type RefChecks = {
+  /** The commit the checks belong to; null when the forge did not say. */
+  sha: string | null;
+  /** `required` is set from branch protection when `requiredKnown`; else it is null on GitHub. */
+  checks: ForgeCheck[];
+  /** True when the branch's required checks could be read (GitLab gates on the whole pipeline). */
+  requiredKnown: boolean;
+};
+
 export type JobRef = { jobId: number; scope: string | null };
 
 export type RerunTarget =
@@ -196,6 +206,8 @@ export interface Forge {
   repoInfo(repo: string): ForgeResult<RepoInfo>;
   findPr(head: string, match: PrMatch): ForgeResult<PrRef | null>;
   prStatus(n: number): ForgeResult<ForgePrStatus>;
+  /** The checks on the head commit of branch `branch`; empty when CI has not reported for it. */
+  branchChecks(branch: string): ForgeResult<RefChecks>;
   jobLogTail(job: JobRef, lines: number): ForgeResult<string[]>;
   rerun(target: RerunTarget): ForgeResult<void>;
   /** Open a PR/MR; `headSha` is the head the forge reports right after creation. */

package/src/hooks/context.ts

@@ -223,7 +223,10 @@ function entryCompactContext(
     return hit.value;
   const task = entry ? store.readTask(entry.id) : null;
   if (task && !task.ok) return null;
-  const freshness: Freshness = { mode: "signal", current: () => recentSignal(store.root) };
+  const freshness: Freshness = {
+    mode: "signal",
+    current: () => recentSignal(store.root),
+  };
   const observed = task?.data.evidence.some(isObservedCheck) ?? false;
   const files = (task?.data.decisions ?? []).flatMap((decision) =>
     decision.data.binding.contentRefs.flatMap((ref) =>
@@ -298,7 +301,6 @@ export const sessionContextText = (
   return `<workit-contract>\n${invariantBootstrap()}${compact}${offer ? `\n${offer}` : ""}${options.addendum ? `\n${options.addendum}` : ""}\n</workit-contract>`;
 };
 
-/** Per-turn task context only (no bootstrap or offer), or null when none applies. */
 /** The checkout holding `cwd` and its branch, read from the git dir (no spawn). */
 const checkoutAt = (cwd: string): { root: string; branch: string | null } | null => {
   for (let dir = path.resolve(cwd); ; dir = path.dirname(dir)) {
@@ -311,7 +313,10 @@ const checkoutAt = (cwd: string): { root: string; branch: string | null } | null
           )
         : dotGit;
       const head = fs.readFileSync(path.join(admin, "HEAD"), "utf8").trim();
-      return { root: dir, branch: /^ref: refs\/heads\/(.+)$/u.exec(head)?.[1] ?? null };
+      return {
+        root: dir,
+        branch: /^ref: refs\/heads\/(.+)$/u.exec(head)?.[1] ?? null,
+      };
     }
     if (path.dirname(dir) === dir) return null;
   }
@@ -333,6 +338,7 @@ export const whereLine = (cwd: string): string | null => {
   }
 };
 
+/** Per-turn task context only (no bootstrap or offer), or null when none applies. */
 export const turnContextText = (input: HookInput, descriptor: HostDescriptor): string | null => {
   try {
     const text = sessionCompactContext(
@@ -422,7 +428,9 @@ export const changedTurnContext = (input: HookInput, text: string | null): strin
   if (!file) return text;
   const digest = digestOf(text);
   try {
-    const previous = JSON.parse(fs.readFileSync(file, "utf8")) as { digest?: unknown };
+    const previous = JSON.parse(fs.readFileSync(file, "utf8")) as {
+      digest?: unknown;
+    };
     if (previous.digest === digest) return null;
   } catch {
     // Missing or unreadable digest: treat as changed.

package/src/ledger.ts

@@ -110,7 +110,11 @@ export const PR_ROW_TYPES: ReadonlySet<string> = new Set([
 ]);
 
 /** Who wrote a row. Unverified: the environment says so (D18). */
-export type LedgerActor = { host: string; session: string | null; agentId: string | null };
+export type LedgerActor = {
+  host: string;
+  session: string | null;
+  agentId: string | null;
+};
 
 /** The code state a row was recorded against (§2.2). */
 export type CodeKey = {
@@ -180,7 +184,11 @@ export type VerdictRow = RowCommon & {
   untracked?: string[];
   untrackedCount?: number;
 };
-export type HandoffRow = RowCommon & { type: "handoff"; note: string | null; next: string };
+export type HandoffRow = RowCommon & {
+  type: "handoff";
+  note: string | null;
+  next: string;
+};
 /**
  * A lead's standing order for every worker of a fanout ("no new dependencies").
  * `stop` marks the stop line: running workers stop and report.
@@ -801,7 +809,11 @@ export type UnverifiedRow = {
   reason: UnverifiedReason;
 };
 /** The hash chain over the file: rows the CLI wrote, rows from before the chain, and the rest. */
-export type LedgerIntegrity = { chained: number; legacy: number; unverified: UnverifiedRow[] };
+export type LedgerIntegrity = {
+  chained: number;
+  legacy: number;
+  unverified: UnverifiedRow[];
+};
 export type LedgerRead = {
   path: string;
   rows: ReadRow[];
@@ -950,7 +962,12 @@ export function readLedger(
     });
   return {
     ok: true,
-    value: { path: file.value, rows, skipped, integrity: options.integrity ? integrity : null },
+    value: {
+      path: file.value,
+      rows,
+      skipped,
+      integrity: options.integrity ? integrity : null,
+    },
   };
 }
 
@@ -997,7 +1014,12 @@ const tamperedWarning = (cwd: string, breaks: readonly UnverifiedRow[]): string
       ", ",
     )}${breaks.length > 3 ? ", …" : ""}): no verdict is accepted until it is repaired. ${tamperedUnblock(cwd)}`;
 
-export type RowFilter = { branch?: string; pr?: number; type?: string; last?: number };
+export type RowFilter = {
+  branch?: string;
+  pr?: number;
+  type?: string;
+  last?: number;
+};
 
 export function filterRows(rows: readonly ReadRow[], filter: RowFilter): ReadRow[] {
   const matched = rows.filter(
@@ -1088,7 +1110,11 @@ export function codeKey(
 
 export type VerdictBasis = "fresh" | "carried" | "stale" | "none";
 
-type Keyed = { head: string | null; patchId: string | null; diffHash: string | null };
+type Keyed = {
+  head: string | null;
+  patchId: string | null;
+  diffHash: string | null;
+};
 
 /** fresh: same head · carried: same non-null patch-id AND exact diff · stale: otherwise. */
 export function verdictBasis(verdict: Keyed, current: Keyed): Exclude<VerdictBasis, "none"> {
@@ -1170,7 +1196,11 @@ export type VerdictCheck = {
    * What merge gates read: an accepted strong (`verified`/`tests-verified`)
    * verdict and no current independent failure. `type-check-only` never counts.
    */
-  accepted: { accepted: boolean; verdict: ReadRow | null; reasons: RejectReason[] };
+  accepted: {
+    accepted: boolean;
+    verdict: ReadRow | null;
+    reasons: RejectReason[];
+  };
   review: ReviewLabel;
   /** The newest current, strong, self verdict when `review` is self-reviewed. */
   selfVerdict: ReadRow | null;
@@ -1269,7 +1299,10 @@ export function authorSessions(
   cwd: string,
   rows: readonly ReadRow[],
   branch: string,
-  range: { base: string | null; head: string | null } = { base: null, head: null },
+  range: { base: string | null; head: string | null } = {
+    base: null,
+    head: null,
+  },
   scope: BranchScope = branchScope(cwd, branch),
 ): Set<string> {
   const sessions = new Set<string>();
@@ -1437,7 +1470,7 @@ function effectiveOf(
  * head to the current head. With `exactIn` (the checkout), each link is
  * re-read with exact blobs (sameOwnChange, #334), so a row recorded before
  * that check carries a pass only when the branch's own files are identical
- * across the restack. Null keeps every observed link: a failure keeps
+ * across the restack or the head is the judged head cleanly rebased (#468). Null keeps every observed link: a failure keeps
  * applying through them (failing closed the other way).
  */
 const restackExact = new WeakMap<ReadRow, boolean>();
@@ -1454,15 +1487,18 @@ function restackCarries(
     const cwd = exactIn;
     let known = restackExact.get(row);
     if (known === undefined) {
-      known =
-        typeof row.fromBase === "string" &&
-        typeof row.toBase === "string" &&
-        sameOwnChange(cwd, {
-          from: fromHead,
-          to: head,
-          fromBase: row.fromBase,
-          toBase: row.toBase,
-        });
+      // Identical own blobs, or the head is exactly the judged head cleanly
+      // rebased onto the moved base (#468): a base edit elsewhere in a shared file.
+      const range =
+        typeof row.fromBase === "string" && typeof row.toBase === "string"
+          ? {
+              from: fromHead,
+              to: head,
+              fromBase: row.fromBase,
+              toBase: row.toBase,
+            }
+          : null;
+      known = range !== null && (sameOwnChange(cwd, range) || cleanRebase(cwd, range));
       restackExact.set(row, known);
     }
     return known;
@@ -1510,7 +1546,10 @@ export function checkVerdicts(
     const cacheKey = `${base}\0${at}`;
     let key = keyCache.get(cacheKey);
     if (!key) {
-      key = { patchId: patchId(cwd, base, at), diffHash: diffHash(cwd, base, at) };
+      key = {
+        patchId: patchId(cwd, base, at),
+        diffHash: diffHash(cwd, base, at),
+      };
       keyCache.set(cacheKey, key);
     }
     return key;
@@ -1575,7 +1614,10 @@ export function checkVerdicts(
   const exactCarry = (row: ReadRow): boolean =>
     FAILING.has(String(row.result)) || exactMatch(row) !== null;
   const keyBasis = (row: ReadRow): Exclude<VerdictBasis, "none"> => {
-    const basis = verdictBasis(row, { head, ...keyFor(row.base ?? fallbackBase) });
+    const basis = verdictBasis(row, {
+      head,
+      ...keyFor(row.base ?? fallbackBase),
+    });
     return basis === "carried" && !exactCarry(row) ? "stale" : basis;
   };
   /** A pass the exact keys carry only through a clean rebase (the base also edited a branch file). */
@@ -1736,7 +1778,11 @@ export function checkVerdicts(
       (entry) => entry.accepted && STRONG_RESULTS.has(String(entry.verdict.result)),
     ) ?? null;
   const accepted = tampered.length
-    ? { accepted: false, verdict: null, reasons: ["ledger_tampered"] as RejectReason[] }
+    ? {
+        accepted: false,
+        verdict: null,
+        reasons: ["ledger_tampered"] as RejectReason[],
+      }
     : newestAccepted && !failing
       ? { accepted: true, verdict: newestAccepted.verdict, reasons: [] }
       : {
@@ -1789,7 +1835,10 @@ export function checkVerdicts(
     selfVerdict: accepted.accepted ? null : (selfEntry?.verdict ?? null),
     base: newestCurrent?.verdict.base ?? fallbackBase,
     patchId: keyFor(newestCurrent?.verdict.base ?? fallbackBase).patchId,
-    current: { basis: newestCurrent?.basis ?? "none", verdict: newestCurrent?.verdict ?? null },
+    current: {
+      basis: newestCurrent?.basis ?? "none",
+      verdict: newestCurrent?.verdict ?? null,
+    },
     carry: carryEntry?.carry ?? null,
     reverify,
     accepted,
@@ -1868,7 +1917,13 @@ function checkSupersede(
 
 export function recordDecision(
   context: RecordContext,
-  input: { what?: string; why?: string; refs?: string[]; by?: string; views?: string[] },
+  input: {
+    what?: string;
+    why?: string;
+    refs?: string[];
+    by?: string;
+    views?: string[];
+  },
 ): LedgerResult<DecisionRow> {
   if (input.by !== undefined && input.by !== "decider")
     return err("invalid_input", `--by takes "decider", got "${input.by}"`);
@@ -2081,7 +2136,11 @@ export function clearStanding(
 /** Lift the stop line: clear each stop order in force and keep the others; lead only. */
 export function liftStop(
   context: RecordContext,
-  input: { fanout: string; lead: string | null; leads?: readonly string[] | null },
+  input: {
+    fanout: string;
+    lead: string | null;
+    leads?: readonly string[] | null;
+  },
 ): LedgerResult<StandingClearedRow[]> {
   const lead = leadOnly(context, input.lead);
   if (!lead.ok) return lead;
@@ -2242,10 +2301,16 @@ export function recordVerdict(
   );
 }
 
-function untrackedField(cwd: string): { untracked?: string[]; untrackedCount?: number } {
+function untrackedField(cwd: string): {
+  untracked?: string[];
+  untrackedCount?: number;
+} {
   const files = untrackedFiles(cwd);
   return files.length
-    ? { untracked: files.slice(0, MAX_UNTRACKED_LISTED), untrackedCount: files.length }
+    ? {
+        untracked: files.slice(0, MAX_UNTRACKED_LISTED),
+        untrackedCount: files.length,
+      }
     : {};
 }
 
@@ -2255,7 +2320,12 @@ export function recordHandoff(
 ): LedgerResult<HandoffRow> {
   return appendRow<HandoffRow>(
     context.cwd,
-    { ...common(context, noteKey(context)), type: "handoff", note: input.note, next: input.next },
+    {
+      ...common(context, noteKey(context)),
+      type: "handoff",
+      note: input.note,
+      next: input.next,
+    },
     { now: context.now },
   );
 }
@@ -2404,7 +2474,12 @@ export function stackPosition(root: string, branch: string): StackPosition | nul
   return null;
 }
 
-export type CheckFreshness = { name: string; result: string | null; fresh: boolean; at: string };
+export type CheckFreshness = {
+  name: string;
+  result: string | null;
+  fresh: boolean;
+  at: string;
+};
 
 type VerdictSummary = Omit<VerdictEntry, "verdict"> & { summary: string };
 
@@ -2453,7 +2528,11 @@ const dirtyState = (cwd: string): HandoffBrief["dirty"] => {
     // Renames and copies carry the source path as the next entry.
     if (entry[0] === "R" || entry[0] === "C") index += 1;
   }
-  return { dirty: paths.length > 0, files: paths.length, paths: paths.slice(0, MAX_DIRTY_PATHS) };
+  return {
+    dirty: paths.length > 0,
+    files: paths.length,
+    paths: paths.slice(0, MAX_DIRTY_PATHS),
+  };
 };
 
 const nextCommandFor = (brief: Omit<HandoffBrief, "nextCommand" | "next">): string => {
@@ -2521,7 +2600,11 @@ export function buildHandoff(
   }));
   const lastHandoffRow = mine.findLast((row) => row.type === "handoff");
   const partial: Omit<HandoffBrief, "nextCommand" | "next"> = {
-    store: { root: store.value.root, shared: store.value.shared, ledger: ledger.path },
+    store: {
+      root: store.value.root,
+      shared: store.value.shared,
+      ledger: ledger.path,
+    },
     branch,
     head,
     subject: head ? git(cwd, ["log", "-1", "--format=%s", head]) : null,
@@ -2559,6 +2642,10 @@ export function buildHandoff(
   const nextCommand = nextCommandFor(partial);
   return {
     ok: true,
-    value: { ...partial, nextCommand, next: options.next?.trim() || nextCommand },
+    value: {
+      ...partial,
+      nextCommand,
+      next: options.next?.trim() || nextCommand,
+    },
   };
 }

package/src/stack.ts

@@ -160,7 +160,12 @@ export const stackDeps: {
 // ---------------------------------------------------------------------------
 // git plumbing
 
-type GitRun = { ok: boolean; stdout: string; stderr: string; timedOut: boolean };
+type GitRun = {
+  ok: boolean;
+  stdout: string;
+  stderr: string;
+  timedOut: boolean;
+};
 
 const gitRun = (cwd: string, args: string[], timeoutMs: number = GIT_TIMEOUTS.local): GitRun => {
   const run = spawnSync("git", args, {
@@ -245,7 +250,13 @@ const trackedDirt = (dir: string): boolean => {
 
 export type RestackOutcome =
   | { ok: true; head: string }
-  | { ok: false; conflict: boolean; timedOut?: boolean; worktree: string; error: string };
+  | {
+      ok: false;
+      conflict: boolean;
+      timedOut?: boolean;
+      worktree: string;
+      error: string;
+    };
 
 /** Where sync checks out branches nobody has checked out (never the user's checkout). */
 const scratchDir = (cwd: string): string | null => {
@@ -269,14 +280,26 @@ function gitRestack(
   let dir = owner;
   if (!dir) {
     const scratch = scratchDir(cwd);
-    if (!scratch) return { ok: false, conflict: false, worktree: cwd, error: "no store root" };
+    if (!scratch)
+      return {
+        ok: false,
+        conflict: false,
+        worktree: cwd,
+        error: "no store root",
+      };
     fs.mkdirSync(scratch, { recursive: true });
     dir = path.join(
       scratch,
       `${input.branch.replace(/[^A-Za-z0-9._-]+/gu, "_").slice(0, 40)}-${randomBytes(4).toString("hex")}`,
     );
     const added = gitRun(cwd, ["worktree", "add", "-q", dir, input.branch], GIT_TIMEOUTS.worktree);
-    if (!added.ok) return { ok: false, conflict: false, worktree: cwd, error: firstLine(added) };
+    if (!added.ok)
+      return {
+        ok: false,
+        conflict: false,
+        worktree: cwd,
+        error: firstLine(added),
+      };
   }
   const run = gitRun(
     dir,
@@ -304,7 +327,12 @@ function gitRestack(
         error: `git rebase did not finish within ${stackDeps.rebaseTimeoutMs} ms`,
       };
     if (rebaseInProgress(dir))
-      return { ok: false, conflict: true, worktree: dir, error: firstLine(run) };
+      return {
+        ok: false,
+        conflict: true,
+        worktree: dir,
+        error: firstLine(run),
+      };
     if (!owner) gitRun(cwd, ["worktree", "remove", "--force", dir]);
     return { ok: false, conflict: false, worktree: dir, error: firstLine(run) };
   }
@@ -312,7 +340,12 @@ function gitRestack(
   const head = branchTip(cwd, input.branch);
   return head
     ? { ok: true, head }
-    : { ok: false, conflict: false, worktree: dir, error: `${input.branch} vanished` };
+    : {
+        ok: false,
+        conflict: false,
+        worktree: dir,
+        error: `${input.branch} vanished`,
+      };
 }
 
 /** Remove temporary sync worktrees that are clean and not mid-rebase. */
@@ -489,7 +522,10 @@ export function listStacks(cwd: string): StackResult<StackFile[]> {
     // Only files at the name's own path count (a renamed copy is ignored).
     if (parsed && fileFor(parsed.name) === name) out.push(parsed);
   }
-  return { ok: true, data: out.toSorted((a, b) => a.name.localeCompare(b.name)) };
+  return {
+    ok: true,
+    data: out.toSorted((a, b) => a.name.localeCompare(b.name)),
+  };
 }
 
 /** The stack `name`, else the one holding the current branch, else the only one. */
@@ -539,7 +575,12 @@ const OWNERLESS_STALE_MS = 30_000;
 
 const OWNER = "owner";
 
-type LockOwner = { pid: number; processStart: string | null; host: string; nonce: string };
+type LockOwner = {
+  pid: number;
+  processStart: string | null;
+  host: string;
+  nonce: string;
+};
 
 const readOwner = (lock: string): { raw: string | null; age: number | null } => {
   let raw: string | null = null;
@@ -1039,7 +1080,13 @@ export type BranchStatus = {
 
 export type Qualification =
   | { ok: true }
-  | { ok: false; reason: StopReason; detail: string; unblock: string; ready: boolean };
+  | {
+      ok: false;
+      reason: StopReason;
+      detail: string;
+      unblock: string;
+      ready: boolean;
+    };
 
 export type StatusOutcome = {
   name: string;
@@ -1063,7 +1110,10 @@ const noun = (resolved: ResolvedForge, pr: number): string =>
 function statusDoc(ctx: Ctx, pr: number): ForgeResult<PrStatusDoc> {
   const status = ctx.resolved.forge.prStatus(pr);
   if (!status.ok) return status;
-  return buildStatusDoc(ctx.cwd, ctx.resolved, status.data, { logLines: 0, behind: false });
+  return buildStatusDoc(ctx.cwd, ctx.resolved, status.data, {
+    logLines: 0,
+    behind: false,
+  });
 }
 
 /**
@@ -1094,7 +1144,10 @@ export function repoMismatch(ctx: Pick<Ctx, "resolved">, stack: StackFile): Stac
       "blocked",
       `repo_mismatch: stack ${stack.name} was planned on ${stack.forge ?? "?"} ${stack.repo ?? "?"}, but this checkout resolves to ${kind} ${repo}`,
       `workit stack plan --name ${stack.name} <branch…>  # re-plan it here, or run from the right checkout`,
-      { planned: { forge: stack.forge, repo: stack.repo }, resolved: { forge: kind, repo } },
+      {
+        planned: { forge: stack.forge, repo: stack.repo },
+        resolved: { forge: kind, repo },
+      },
     );
   return null;
 }
@@ -1332,7 +1385,12 @@ export type SyncStep = {
   pr: number | null;
   parent: string;
   /** null: already on its parent. */
-  restack: { from: string; onto: string; head: string | null; carried: boolean | null } | null;
+  restack: {
+    from: string;
+    onto: string;
+    head: string | null;
+    carried: boolean | null;
+  } | null;
   push: { pushed: boolean; forced: boolean; sha: string } | null;
   retarget: { from: string; to: string } | null;
 };
@@ -1383,7 +1441,11 @@ function detectMerged(
         isAncestor(cwd, tip, trunkSha);
     }
     if (merged) {
-      entry.merged = { pr: entry.pr, mergeSha: null, at: new Date().toISOString() };
+      entry.merged = {
+        pr: entry.pr,
+        mergeSha: null,
+        at: new Date().toISOString(),
+      };
       newly.push({ branch: entry.branch, pr: entry.pr });
     }
   }
@@ -1407,21 +1469,34 @@ function pushBranch(
   const remote = remoteRefTip(cwd, plan.data.rawUrl, `refs/heads/${branch}`);
   if (!remote.ok) return stackFail(remote.code, remote.error);
   if (remote.sha === plan.data.sha)
-    return { ok: true, data: { pushed: false, forced: false, sha: plan.data.sha } };
+    return {
+      ok: true,
+      data: { pushed: false, forced: false, sha: plan.data.sha },
+    };
   const grant = requireGrant(cwd, "push", { forge: !plan.data.local });
   if (!grant.allowed)
-    return stackFail("blocked", grant.error, grant.unblock, { reason: grant.reason });
+    return stackFail("blocked", grant.error, grant.unblock, {
+      reason: grant.reason,
+    });
   const force = remote.sha !== null && !isAncestor(cwd, remote.sha, plan.data.sha);
   const expect = !force
     ? null
     : remote.sha === priorTip
       ? priorTip
       : (recordedRemoteTip(cwd, plan.data) ?? null);
-  const pushed = executePush(cwd, plan.data, { forceWithLease: force, expect, actor });
+  const pushed = executePush(cwd, plan.data, {
+    forceWithLease: force,
+    expect,
+    actor,
+  });
   if (!pushed.ok) return { ...fromForge(pushed), data: { branch } };
   return {
     ok: true,
-    data: { pushed: pushed.data.pushed, forced: pushed.data.forced, sha: plan.data.sha },
+    data: {
+      pushed: pushed.data.pushed,
+      forced: pushed.data.forced,
+      sha: plan.data.sha,
+    },
   };
 }
 
@@ -1584,7 +1659,11 @@ export function syncStack(
                 "blocked",
                 `conflict restacking ${entry.branch} onto ${parent.name}: ${rebased.error}`,
                 `resolve the conflicts in ${rebased.worktree}, git rebase --continue, then workit stack sync  # or git rebase --abort`,
-                { conflict: entry.branch, worktree: rebased.worktree, progress: outcome },
+                {
+                  conflict: entry.branch,
+                  worktree: rebased.worktree,
+                  progress: outcome,
+                },
               )
             : stackFail(
                 "failed",
@@ -1670,13 +1749,21 @@ export function syncStack(
           p: patchId(cwd, fromBase, fromHead),
           d: diffHash(cwd, fromBase, fromHead),
         };
-        const after = { p: patchId(cwd, parentTip, newTip), d: diffHash(cwd, parentTip, newTip) };
+        const after = {
+          p: patchId(cwd, parentTip, newTip),
+          d: diffHash(cwd, parentTip, newTip),
+        };
         const equal =
           before.d !== null &&
           before.d === after.d &&
           before.p !== null &&
           before.p === after.p &&
-          sameOwnChange(cwd, { from: fromHead, to: newTip, fromBase, toBase: parentTip });
+          sameOwnChange(cwd, {
+            from: fromHead,
+            to: newTip,
+            fromBase,
+            toBase: parentTip,
+          });
         appendObserved(cwd, {
           type: "stack.restacked",
           actor,
@@ -1692,7 +1779,13 @@ export function syncStack(
           forced,
         });
         if (step.restack) step.restack.carried = equal;
-        else step.restack = { from: fromBase, onto: parentTip, head: newTip, carried: equal };
+        else
+          step.restack = {
+            from: fromBase,
+            onto: parentTip,
+            head: newTip,
+            carried: equal,
+          };
       }
       if (options.publish) {
         touchStackLock();
@@ -1721,7 +1814,10 @@ export function syncStack(
             });
           const updated = ctx.resolved.forge.updateBase(entry.pr, parent.name);
           if (!updated.ok)
-            return { ...fromForge(updated), data: { branch: entry.branch, progress: outcome } };
+            return {
+              ...fromForge(updated),
+              data: { branch: entry.branch, progress: outcome },
+            };
           appendObserved(cwd, {
             type: "pr.retargeted",
             actor,
@@ -1766,6 +1862,8 @@ export type LandOptions = {
   method: MergeMethod;
   /** Land without verdicts (`merge: true` only); each bypass is recorded. */
   unverified?: { reason: string } | null;
+  /** Merge onto a red base (`--base-red-ok`); each merge records the reason. */
+  baseRedOk?: { reason: string } | null;
   /** How long to wait for CI on a PR that was just restacked. */
   timeoutMs: number;
   intervalMs: number;
@@ -1775,7 +1873,12 @@ export type LandOutcome = {
   name: string;
   dryRun: boolean;
   /** `unverified`: the ledger row of an `--unverified` bypass, else null. */
-  landed: Array<{ pr: number; branch: string; mergeSha: string | null; unverified: string | null }>;
+  landed: Array<{
+    pr: number;
+    branch: string;
+    mergeSha: string | null;
+    unverified: string | null;
+  }>;
   /** Dry run: the PRs that qualify now, in order (later ones assume a clean restack). */
   wouldLand: Array<{ pr: number; branch: string }>;
   stoppedAt: {
@@ -1849,7 +1952,9 @@ export async function landStack(
     const grant = requireGrant(ctx.cwd, "merge");
     if (!grant.allowed)
       return failWith(
-        stackFail("blocked", grant.error, grant.unblock, { reason: "grant_required" }),
+        stackFail("blocked", grant.error, grant.unblock, {
+          reason: "grant_required",
+        }),
       );
     if (!grant.allowUnverified)
       return failWith(
@@ -1959,6 +2064,7 @@ export async function landStack(
         actor: ctx.actor,
         expect: { base: stack.trunk, branch: entry.branch },
         ...(bypass && !verdict.satisfied ? { unverified: bypass } : {}),
+        ...(options.baseRedOk ? { baseRedOk: options.baseRedOk } : {}),
       },
       ctx.sleep,
     );
@@ -1982,7 +2088,11 @@ export async function landStack(
       mergeSha: merged.data.mergeSha,
       unverified: merged.data.unverified?.recorded ?? null,
     });
-    entry.merged = { pr, mergeSha: merged.data.mergeSha, at: new Date().toISOString() };
+    entry.merged = {
+      pr,
+      mergeSha: merged.data.mergeSha,
+      at: new Date().toISOString(),
+    };
     const written = writeStack(ctx.cwd, stack);
     if (!written.ok) return failWith(written);
     // Move the next PR onto the trunk: restack, lease push, retarget. The