@homeflare/alchemy 0.28.0 → 0.29.1

package/src/github/repo-policy.ts

@@ -7,8 +7,9 @@
  *       checks: ['ci', 'secret scan'],
  *     });
  *
- * Provide `GitHub.providers()` AND `RepositoryRulesetProvider()`; this subpath adds no GitHub
- * provider of its own.
+ * Provide `repoPolicyProviders()` (repository-ruleset-providers.ts) — the composed
+ * `GitHub.providers()` + `RepositoryRulesetProvider()` layer; this subpath adds no GitHub
+ * provider of its own beyond the ruleset bridge.
  *
  * ★ REWIRED 2026-09-23 onto `GitHub.RepositoryRuleset`, not upstream `GitHub.Ruleset` — the
  *   ADOPT-SAFE bridge documented in repository-ruleset.ts. Only `builds` calls this, and its
@@ -24,11 +25,27 @@
  * ⛔ BOTH RESOURCES RETAIN. `retain` is already the vendor default for each of them; it
  *   is piped anyway so that a vendor change cannot quietly turn "drop this call from the
  *   stack" into "delete the repository" or "unprotect the default branch".
+ *
+ * ⛔ APPLY ORDER: `allowAutoMerge` NEVER GOES LIVE BEFORE THE RULESET IT WAITS ON — see
+ *   repo-auto-merge-gate.ts's header for the mechanism (Alchemy orders by Output references in
+ *   props, not declaration order), the K5 hazard it closes, and why checks/approvals being
+ *   REMOVED needs no matching reverse edge. `assertAutoMergeWaits` (repo-policy-guards.ts)
+ *   already guarantees `policy.repository.allowAutoMerge` is only ever `true` when the ruleset
+ *   carries something outstanding (checks, approvals, or both), so that one flag is the gate.
+ * ⚠️ A REPOSITORY THAT DOES NOT YET EXIST: gating on the ruleset only matters once there are open
+ *   pull requests to prematurely merge, and `GitHub.Repository`'s own `reconcile` sets
+ *   `allowAutoMerge` atomically in the SAME create call that makes the repo — no window where a
+ *   PR could exploit it. This helper's documented use (`builds`, above) is always a repo that
+ *   already converged before its ruleset's first deploy; a caller declaring both fresh in one
+ *   deploy, with checks/approvals from day one, must create the bare repository first (a prior
+ *   deploy, or a separate `GitHub.Repository` call) — GitHub's ruleset API 404s on a repo that
+ *   does not exist yet, and this gate now makes the ruleset apply before the repository.
  */
 import { adopt } from 'alchemy/AdoptPolicy';
 import * as GitHub from 'alchemy/GitHub';
 import * as RemovalPolicy from 'alchemy/RemovalPolicy';
 import * as Effect from 'effect/Effect';
+import { gateAutoMergeOnRuleset } from './repo-auto-merge-gate.ts';
 import { type RepoPolicyOptions, repoPolicy } from './repo-policy-form.ts';
 import { RepositoryRuleset } from './repository-ruleset.ts';
 
@@ -57,9 +74,20 @@ export const declareRepoPolicy = (id: string, options: DeclareRepoPolicyOptions)
       const kept = resource.pipe(RemovalPolicy.retain());
       return options.adopt === undefined ? kept : kept.pipe(adopt(options.adopt));
     };
-    const repository = yield* owned(GitHub.Repository(id, policy.repository));
     // `policy.ruleset` is a plain `RulesetProps` — every field `RepositoryRulesetProps` adds
     // over it is optional, so it needs no translation to satisfy the bridge's props.
+
+    // Auto-merge is turning on (or staying on): declare and apply the ruleset FIRST, so its
+    // rulesetId is available to gate the repository's allowAutoMerge — see the file header.
+    if (policy.repository.allowAutoMerge) {
+      const ruleset = yield* owned(RepositoryRuleset(`${id}-ruleset`, policy.ruleset));
+      const repository = yield* owned(
+        GitHub.Repository(id, gateAutoMergeOnRuleset(policy.repository, ruleset)),
+      );
+      return { policy, repository, ruleset };
+    }
+
+    const repository = yield* owned(GitHub.Repository(id, policy.repository));
     const ruleset = yield* owned(RepositoryRuleset(`${id}-ruleset`, policy.ruleset));
     return { policy, repository, ruleset };
   });

package/src/github/repository-ruleset-errors.ts

@@ -123,8 +123,9 @@ export class RequiredChecksOmitted extends Data.TaggedError('RequiredChecksOmitt
   }
 }
 
-/** A context being ADDED to `requiredStatusChecks` has never reported success on the default
- * branch. Requiring it would leave every future pull request pending forever. */
+/** A context being ADDED to `requiredStatusChecks` has never reported success anywhere this
+ * family looks (the default branch's tip, then recent merged PR heads — K2, bounded, not full
+ * history). Requiring it would leave every future pull request pending forever. */
 export class NeverReportedContext extends Data.TaggedError('NeverReportedContext')<{
   readonly owner: string;
   readonly repository: string;
@@ -133,8 +134,9 @@ export class NeverReportedContext extends Data.TaggedError('NeverReportedContext
   override get message(): string {
     return (
       `GitHub.RepositoryRuleset: "${this.context}" has never reported success on ` +
-      `${this.owner}/${this.repository}'s default branch. Requiring it now would leave every ` +
-      'pull request waiting on a check that has never once reported — refused before any write.'
+      `${this.owner}/${this.repository}'s default branch tip or any of its recent merged pull ` +
+      'requests. Requiring it now would leave every pull request waiting on a check that has ' +
+      'never once reported — refused before any write.'
     );
   }
 }

package/src/github/repository-ruleset-exact-adopt-k1.test.ts

@@ -0,0 +1,109 @@
+/**
+ * K1 (2026-09-23): `extraApprovalForUnattributedChanges` now declares `true`, not only `false`
+ * — split out of repository-ruleset-exact-adopt.test.ts purely to keep that file under the
+ * 250-line cap, not because the case is unrelated: this is the exact gap that file's own header
+ * named as blocking a true zero-write adopt for aop/magictransit/loggarr/
+ * doesthishelp-workeropen (all four carry `require_extra_approval_for_unattributed_changes:
+ * true` live).
+ *
+ * `gh api repos/taslabs-net/aop/rulesets/14572279`, re-read 2026-09-23 for this PR — the FULL
+ * record (not H15's own caution about paraphrasing was heeded the hard way: an earlier revision
+ * of this fixture hand-typed only the fields the design doc had quoted, which omitted
+ * `dismiss_stale_reviews_on_push: true` and `required_reviewers: []` — both of which
+ * `buildPullRequestRule` always sends, so a fixture missing them can never truly noop; the "zero
+ * writes" assertion below caught it): `bypass_actors: [{actor_id: 5, actor_type:
+ * "RepositoryRole", bypass_mode: "always"}]`, `rules: [deletion, non_fast_forward, pull_request]`,
+ * and the full `pull_request` parameters are `required_approving_review_count: 0`,
+ * `dismiss_stale_reviews_on_push: true`, `required_reviewers: []`, `require_code_owner_review:
+ * false`, `require_last_push_approval: false`, `required_review_thread_resolution: false`,
+ * `require_extra_approval_for_unattributed_changes: true`,
+ * `allowed_merge_methods: [merge, squash, rebase]`.
+ */
+import { describe, expect, test } from 'bun:test';
+import { makeRecordingFake } from './repository-ruleset-fake-octokit.ts';
+import {
+  BASE_PULL_REQUEST,
+  props,
+  reconcileWithOctokit,
+  run,
+} from './repository-ruleset-test-helpers.ts';
+
+const AOP_LIVE = {
+  id: 14572279,
+  name: 'main',
+  target: 'branch',
+  enforcement: 'active',
+  bypass_actors: [{ actor_id: 5, actor_type: 'RepositoryRole', bypass_mode: 'always' }],
+  conditions: { ref_name: { include: ['~DEFAULT_BRANCH'], exclude: [] } },
+  rules: [
+    { type: 'deletion' },
+    { type: 'non_fast_forward' },
+    {
+      type: 'pull_request',
+      parameters: {
+        required_approving_review_count: 0,
+        dismiss_stale_reviews_on_push: true,
+        required_reviewers: [],
+        require_code_owner_review: false,
+        require_last_push_approval: false,
+        required_review_thread_resolution: false,
+        require_extra_approval_for_unattributed_changes: true,
+        allowed_merge_methods: ['merge', 'squash', 'rebase'],
+      },
+    },
+  ],
+};
+
+describe('K1: extraApprovalForUnattributedChanges completes exact-adopt', () => {
+  // Unlike repository-ruleset-exact-adopt.test.ts's bypass-only fixture (which deliberately
+  // keeps `BASE_PULL_REQUEST`'s `false`/`[squash]` to prove bypass round-trips on its own), this
+  // declares aop's FULL live `pull_request` shape — methods AND the extra-approval flag — so
+  // the whole ruleset, not just `bypassActors`, is now a genuine zero-write adopt.
+  test('aop: full live shape, extra-approval flag included, makes zero writes', async () => {
+    const fake = makeRecordingFake({ aop: AOP_LIVE });
+    const declaration = props({
+      repository: 'aop',
+      bypassActors: [{ actorType: 'RepositoryRole', actorId: 5, bypassMode: 'always' }],
+      rules: {
+        deletion: true,
+        nonFastForward: true,
+        pullRequest: {
+          ...BASE_PULL_REQUEST,
+          dismissStaleReviewsOnPush: true,
+          allowedMergeMethods: ['merge', 'squash', 'rebase'],
+          extraApprovalForUnattributedChanges: true,
+        },
+      },
+    });
+    await run(reconcileWithOctokit(fake.octokit, declaration, { rulesetId: 14572279 }));
+    expect(fake.writes).toHaveLength(0);
+  });
+
+  // The counterpart failure mode: declaring `false` against a live `true` is real drift (not a
+  // narrowing/widening question — that guard family is about `bypassActors` and rule presence,
+  // not this field's value) and must still produce exactly one `update`, never a silent noop.
+  test('aop: declaring false against a live true is drift, not a noop', async () => {
+    const fake = makeRecordingFake({ aop: AOP_LIVE });
+    const declaration = props({
+      repository: 'aop',
+      bypassActors: [{ actorType: 'RepositoryRole', actorId: 5, bypassMode: 'always' }],
+      rules: {
+        deletion: true,
+        nonFastForward: true,
+        pullRequest: {
+          ...BASE_PULL_REQUEST,
+          dismissStaleReviewsOnPush: true,
+          allowedMergeMethods: ['merge', 'squash', 'rebase'],
+          extraApprovalForUnattributedChanges: false,
+        },
+      },
+    });
+    await run(reconcileWithOctokit(fake.octokit, declaration, { rulesetId: 14572279 }));
+    expect(fake.writes).toHaveLength(1);
+    const pr = fake.writes[0]?.body?.rules?.find((r) => r.type === 'pull_request');
+    expect(
+      (pr as { parameters: Record<string, unknown> } | undefined)?.parameters
+        .require_extra_approval_for_unattributed_changes,
+    ).toBe(false);
+  });
+});

package/src/github/repository-ruleset-exact-adopt.test.ts

@@ -14,15 +14,20 @@
  *   Integration 29110 is `always`, not the reverse) — see repository-ruleset-narrowing-guards.ts
  *   for the guard these fixtures exercise.
  *
- * `taslabs-net` is the only one of the 5 whose FULL ruleset (bypass AND rules) is provable as a
- * true zero-write adopt today: its live `pull_request` rules (aop/magictransit/loggarr/
- * doesthishelp-workeropen) all carry `require_extra_approval_for_unattributed_changes: true`,
- * which this resource cannot yet declare (K1 — a separate, later PR; H15's comment on
- * `extraApprovalForUnattributedChanges` explains why only `false` is modeled today). The other
- * 4 fixtures below prove the narrower claim K1 does not gate: that this resource's `bypassActors`
- * round-trips an arbitrary `actor_id`/`actor_type`/`bypass_mode` combination — single-actor by
- * role, single-actor by integration, and multi-actor with mixed modes — onto the wire exactly as
- * declared, with neither `BypassActorWidened` nor `BypassActorNarrowed` firing on a match.
+ * ★ K1 LANDED 2026-09-23: `extraApprovalForUnattributedChanges` now declares `true`, not only
+ *   `false` — the gap this file's earlier revision named as blocking a true zero-write adopt for
+ *   aop/magictransit/loggarr/doesthishelp-workeropen (all four carry
+ *   `require_extra_approval_for_unattributed_changes: true` live). The 4 fixtures below still
+ *   prove the narrower claim: that `bypassActors` round-trips an arbitrary
+ *   `actor_id`/`actor_type`/`bypass_mode` combination — single-actor by role, single-actor by
+ *   integration, and multi-actor with mixed modes — onto the wire exactly as declared, with
+ *   neither `BypassActorWidened` nor `BypassActorNarrowed` firing on a match; their declarations
+ *   still use `BASE_PULL_REQUEST` (`extraApprovalForUnattributedChanges: false`), so each is
+ *   still a genuine `update`, not a noop — that keeps this file's original point (bypass alone
+ *   round-trips) legible on its own. The case K1 unblocks — `aop`'s FULL live shape, extra-
+ *   approval flag included, as a true zero-write adopt — is proven in
+ *   repository-ruleset-exact-adopt-k1.test.ts, split out purely to keep this file under the
+ *   250-line cap.
  */
 import { describe, expect, test } from 'bun:test';
 import { makeGetOnlyFake, makeRecordingFake } from './repository-ruleset-fake-octokit.ts';

package/src/github/repository-ruleset-form.ts

@@ -50,11 +50,15 @@ function buildPullRequestRule(rule: RepositoryRulesetPullRequestRule): WireRule
         minimum_approvals: r.minimumApprovals,
         reviewer: { id: r.reviewer.actorId, type: r.reviewer.actorType },
       })),
-      // ⛔ Only ever sent as `false` (H15) — see repository-ruleset.ts for why this exists at
-      //   all and repository-ruleset-wire.test.ts for whether Octokit forwards it untyped.
+      // Sent as declared, `true` or `false` (K1, 2026-09-23) — see repository-ruleset.ts's H15
+      // for why this field exists here at all (Octokit, not distilled) and
+      // repository-ruleset-wire.test.ts for whether Octokit forwards it untyped for both values.
       ...(rule.extraApprovalForUnattributedChanges === undefined
         ? {}
-        : { require_extra_approval_for_unattributed_changes: false }),
+        : {
+            require_extra_approval_for_unattributed_changes:
+              rule.extraApprovalForUnattributedChanges,
+          }),
     },
     // The extension field above has no home in Octokit's own rule union (H15) — the cast is
     // the only place that gap is bridged.

package/src/github/repository-ruleset-guards.ts

@@ -182,8 +182,9 @@ export const newlyRequiredContexts = (
     .filter((c) => !liveContexts.has(c));
 };
 
-/** Fails on the first newly-required context that has never reported success on the default
- * branch — checked once here (reconcile's observe step) and again by the standalone checker. */
+/** Fails on the first newly-required context that has never reported success anywhere this
+ * family looks (the default branch's tip, then recent merged PR heads — K2) — checked once here
+ * (reconcile's observe step) and again by the standalone checker. */
 export const refuseUnreportedContexts = <R = never>(
   octokit: RulesetOctokit<R>,
   owner: string,

package/src/github/repository-ruleset-octokit.test.ts

@@ -0,0 +1,141 @@
+/**
+ * K2 (2026-09-24): MEASURES `contextReportedSuccess` (repository-ruleset-octokit.ts) against a
+ * real `@octokit/rest` instance with a fetch shim (no network) — the same pattern
+ * repository-ruleset-wire.test.ts uses for H15, applied here to the "which ref did we check"
+ * question instead of "did the wire field survive". The shim routes by URL path, not by call
+ * order, so these tests exercise the SAME sequencing the real implementation performs: default
+ * branch tip first, then (only if the tip has nothing) recent merged PR heads, bounded.
+ *
+ * Both sides the guard exists to hold: accept a context that reports only on a recent merged PR
+ * head (the case K2 fixes — CI runs on `pull_request` only, never the tip), and still refuse one
+ * that reports nowhere, tip or any recent merged head, INCLUDING one whose only success is
+ * older than `RECENT_MERGED_PR_LIMIT` merges ago (the bound is real, not decorative).
+ */
+import { describe, expect, test } from 'bun:test';
+import { Octokit } from '@octokit/rest';
+import * as Effect from 'effect/Effect';
+import { RECENT_MERGED_PR_LIMIT, contextReportedSuccess } from './repository-ruleset-octokit.ts';
+
+interface CheckRun {
+  readonly name: string;
+  readonly conclusion: string | null;
+}
+interface Status {
+  readonly context: string;
+  readonly state: string;
+}
+interface MergedPull {
+  readonly merged_at: string | null;
+  readonly head: { readonly sha: string };
+}
+
+interface Fixture {
+  readonly defaultBranch: string;
+  readonly checkRuns?: Readonly<Record<string, readonly CheckRun[]>>;
+  readonly statuses?: Readonly<Record<string, readonly Status[]>>;
+  /** Already in the order GitHub's `sort: updated, direction: desc` would return — most
+   * recently updated first. */
+  readonly closedPulls?: readonly MergedPull[];
+}
+
+/** Routes by URL path, not call order — GET .../pulls, GET .../commits/{ref}/check-runs, GET
+ * .../commits/{ref}/statuses, else the bare repo GET (`default_branch`). `captured` records
+ * every URL so a test can assert a ref was — or, for boundedness, was NEVER — looked up. */
+function makeServingFetch(fx: Fixture, captured: string[]): typeof fetch {
+  const respond = (body: unknown) =>
+    new Response(JSON.stringify(body), {
+      status: 200,
+      headers: { 'content-type': 'application/json' },
+    });
+  return (async (input: Parameters<typeof fetch>[0]) => {
+    const url = String(input);
+    captured.push(url);
+    if (/\/pulls(\?|$)/.test(url)) return respond(fx.closedPulls ?? []);
+    const commits = /\/commits\/([^/?]+)\/(check-runs|statuses)/.exec(url);
+    if (commits) {
+      const [, ref, kind] = commits;
+      if (kind === 'check-runs') {
+        const runs = fx.checkRuns?.[ref as string] ?? [];
+        return respond({ total_count: runs.length, check_runs: runs });
+      }
+      return respond(fx.statuses?.[ref as string] ?? []);
+    }
+    return respond({ default_branch: fx.defaultBranch });
+  }) as typeof fetch;
+}
+
+const octokitOver = (fx: Fixture, captured: string[] = []) =>
+  new Octokit({
+    auth: 'fake-token-not-a-real-credential',
+    request: { fetch: makeServingFetch(fx, captured) },
+  });
+
+const run = (eff: Effect.Effect<boolean, Error>): Promise<boolean> => Effect.runPromise(eff);
+
+describe('contextReportedSuccess', () => {
+  test('accepts a context that reports only on a recent merged PR head, not the tip', async () => {
+    const octokit = octokitOver({
+      defaultBranch: 'main',
+      checkRuns: { sha2: [{ name: 'ci', conclusion: 'success' }] },
+      closedPulls: [
+        { merged_at: '2026-09-20T00:00:00Z', head: { sha: 'sha3' } },
+        { merged_at: '2026-09-19T00:00:00Z', head: { sha: 'sha2' } },
+        { merged_at: '2026-09-18T00:00:00Z', head: { sha: 'sha1' } },
+      ],
+    });
+    const reported = await run(
+      contextReportedSuccess(octokit, 'taslabs-net', 'homeflare-builds', 'ci'),
+    );
+    expect(reported).toBe(true);
+  });
+
+  test('refuses a context that reports nowhere — tip or any recent merged head', async () => {
+    const octokit = octokitOver({
+      defaultBranch: 'main',
+      closedPulls: [
+        { merged_at: '2026-09-20T00:00:00Z', head: { sha: 'sha3' } },
+        { merged_at: '2026-09-19T00:00:00Z', head: { sha: 'sha2' } },
+      ],
+    });
+    const reported = await run(
+      contextReportedSuccess(octokit, 'taslabs-net', 'homeflare-builds', 'ci'),
+    );
+    expect(reported).toBe(false);
+  });
+
+  test('a success older than RECENT_MERGED_PR_LIMIT merges ago is still refused — the bound is real', async () => {
+    // RECENT_MERGED_PR_LIMIT (10) merged PRs report nothing; only the 11th (oldest returned,
+    // outside the bound) reports `ci` — proves the function stops at the limit rather than
+    // scanning everything the list call happened to return.
+    const closedPulls: MergedPull[] = Array.from({ length: RECENT_MERGED_PR_LIMIT }, (_, i) => ({
+      merged_at: `2026-09-${String(20 - i)}T00:00:00Z`,
+      head: { sha: `within-bound-${String(i)}` },
+    }));
+    closedPulls.push({ merged_at: '2026-08-01T00:00:00Z', head: { sha: 'beyond-bound' } });
+    const captured: string[] = [];
+    const octokit = octokitOver(
+      {
+        defaultBranch: 'main',
+        checkRuns: { 'beyond-bound': [{ name: 'ci', conclusion: 'success' }] },
+        closedPulls,
+      },
+      captured,
+    );
+    const reported = await run(
+      contextReportedSuccess(octokit, 'taslabs-net', 'homeflare-builds', 'ci'),
+    );
+    expect(reported).toBe(false);
+    expect(captured.some((url) => url.includes('/commits/beyond-bound/'))).toBe(false);
+  });
+
+  test('the default branch tip alone is still enough — no fallback needed', async () => {
+    const octokit = octokitOver({
+      defaultBranch: 'main',
+      statuses: { main: [{ context: 'secret scan', state: 'success' }] },
+    });
+    const reported = await run(
+      contextReportedSuccess(octokit, 'taslabs-net', 'homeflare-kit', 'secret scan'),
+    );
+    expect(reported).toBe(true);
+  });
+});

package/src/github/repository-ruleset-octokit.ts

@@ -8,14 +8,22 @@
  * should reach the wire. repository-ruleset-wire.test.ts MEASURES this against a real Octokit
  * instance with a fetch shim rather than asserting it from reading the source.
  *
- * ⚠️ "Reported success" is checked at the default branch's CURRENT TIP only, not its full
- *   history — a context that reported success three merges ago and has since started failing
- *   reads as reported (true), and one that has only ever run on a branch nobody has merged
- *   since reads as never-reported (false) until the next merge updates the tip. A full-history
- *   search is disproportionate to what this guard protects against (adding a context that
- *   plainly cannot report), and GitHub's check-runs/statuses APIs are themselves scoped to a
- *   single ref, not "ever, anywhere" — there is no cheaper vendor call that answers the wider
- *   question.
+ * ★ K2 (2026-09-24): "REPORTED SUCCESS" IS THE DEFAULT BRANCH'S TIP, THEN RECENT MERGED PR
+ *   HEADS — NOT FULL HISTORY. The rendered CI (`packages/config/src/repo-shape/ci.ts`) triggers
+ *   on `pull_request` ONLY, deliberately (measured 2026-09-15..22: 613 of 619 main-push runs
+ *   duplicated an already-green PR run, ~41% of the mini's CI load) — so `ci`/`secret scan`/
+ *   `CodeQL` NEVER report on the default branch's tip itself, only on PR heads. Checking the tip
+ *   alone therefore refused adding any of them everywhere, including homeflare-builds' pending
+ *   first ruleset. `contextReportedSuccess` now falls back to `recentMergedHeadShas` — bounded
+ *   (`RECENT_MERGED_PR_LIMIT` heads, from one `per_page`-bounded list call, never the repo's
+ *   full PR history) — so a context that only ever reports on PR heads is no longer refused
+ *   everywhere, while a context that has never reported ANYWHERE (not the tip, not any recent
+ *   merged head) still is: `NeverReportedContext`'s whole purpose survives unchanged.
+ * ⚠️ Still not full history: a context whose only successful run predates
+ *   `RECENT_MERGED_PR_LIMIT` merges ago reads as never-reported until it runs again. Widening
+ *   the bound trades this guard's cost (more vendor calls per newly-required context) against
+ *   its reach; `RECENT_MERGED_PR_LIMIT` is a deliberate, named number for exactly that reason,
+ *   not a magic constant.
  */
 import type { Octokit as OctokitClient } from '@octokit/rest';
 import { GitHubCredentials } from 'alchemy/GitHub';
@@ -37,6 +45,110 @@ const octokitFor = (
 
 const is404 = (e: unknown): boolean => (e as { status?: number } | undefined)?.status === 404;
 
+/** How many of the most-recently-updated MERGED pull requests' head SHAs to check, once the
+ * default branch's own tip has no reported success — see the file header (K2). */
+export const RECENT_MERGED_PR_LIMIT = 10;
+/** How many closed PRs to list (in one bounded call) to find up to `RECENT_MERGED_PR_LIMIT`
+ * merged ones among them — larger than the limit because `state: 'closed'` also returns PRs
+ * closed without merging, sorted by `updated_at`, not `merged_at` (the REST API has no
+ * merged-only list). A GitHub API list call has no `merged` filter, so this is `100` — GitHub's
+ * own per-page maximum, not a smaller round number — to keep unmerged churn (e.g. Dependabot
+ * PRs closed without merging, which still bump `updated_at`) from crowding out real merges in a
+ * repo with heavy PR traffic (2026-09-24 review finding: a smaller page risked under-reaching in
+ * exactly the kind of repo this fix targets). Still bounded, still one call, still never the
+ * repo's full history — a repo whose last `RECENT_MERGED_PR_LIMIT` merges don't even fit in the
+ * last 100 closed PRs is treated the same as one with too little history: fewer heads found,
+ * same "still refused" fallback. */
+const RECENT_CLOSED_PR_PAGE_SIZE = 100;
+
+/** Whether `context` reported success for a single ref — a branch tip or a PR head SHA, both
+ * checked the same way (checks + statuses, exactly as GitHub's own UI does). Takes a plain
+ * `OctokitClient`, not an Effect service, so it and its caller below are testable directly
+ * against a real `@octokit/rest` instance with a fetch shim (repository-ruleset-octokit.test.ts)
+ * — no `GitHubCredentials` layer needed, mirroring `desiredWireRuleset`'s pure-function seam. */
+export const hasRefReportedSuccess = (
+  octokit: OctokitClient,
+  owner: string,
+  repo: string,
+  ref: string,
+  context: string,
+): Effect.Effect<boolean, Error> =>
+  Effect.gen(function* () {
+    const [checkRuns, statuses] = yield* Effect.all([
+      Effect.tryPromise({
+        try: () => octokit.rest.checks.listForRef({ owner, repo, ref, check_name: context }),
+        catch: asError,
+      }),
+      Effect.tryPromise({
+        try: () => octokit.rest.repos.listCommitStatusesForRef({ owner, repo, ref }),
+        catch: asError,
+      }),
+    ]);
+    const checkReported = checkRuns.data.check_runs.some(
+      (run) => run.name === context && run.conclusion === 'success',
+    );
+    const statusReported = statuses.data.some(
+      (status) => status.context === context && status.state === 'success',
+    );
+    return checkReported || statusReported;
+  });
+
+/** The head SHAs of up to `RECENT_MERGED_PR_LIMIT` most-recently-updated MERGED pull requests
+ * against `base` — one bounded list call (`RECENT_CLOSED_PR_PAGE_SIZE` closed PRs), filtered to
+ * merged, then capped. Never paginates further: a repo whose last `RECENT_MERGED_PR_LIMIT`
+ * merges are all older than its last `RECENT_CLOSED_PR_PAGE_SIZE` closed PRs simply yields fewer
+ * than the limit, same as a repo with too little history — both are the "still refused" case. */
+export const recentMergedHeadShas = (
+  octokit: OctokitClient,
+  owner: string,
+  repo: string,
+  base: string,
+): Effect.Effect<readonly string[], Error> =>
+  Effect.gen(function* () {
+    const closed = yield* Effect.tryPromise({
+      try: () =>
+        octokit.rest.pulls.list({
+          owner,
+          repo,
+          state: 'closed',
+          base,
+          sort: 'updated',
+          direction: 'desc',
+          per_page: RECENT_CLOSED_PR_PAGE_SIZE,
+        }),
+      catch: asError,
+    });
+    return closed.data
+      .filter((pr) => pr.merged_at !== null)
+      .slice(0, RECENT_MERGED_PR_LIMIT)
+      .map((pr) => pr.head.sha);
+  });
+
+/** The full K2 answer: the default branch's tip, then (only if the tip has no success) up to
+ * `RECENT_MERGED_PR_LIMIT` recent merged PR heads, short-circuiting on the first success. `false`
+ * only once every one of those has been checked and none reported — the case
+ * `NeverReportedContext` exists to refuse. */
+export const contextReportedSuccess = (
+  octokit: OctokitClient,
+  owner: string,
+  repo: string,
+  context: string,
+): Effect.Effect<boolean, Error> =>
+  Effect.gen(function* () {
+    const repository = yield* Effect.tryPromise({
+      try: () => octokit.rest.repos.get({ owner, repo }),
+      catch: asError,
+    });
+    const ref = repository.data.default_branch;
+    if (yield* hasRefReportedSuccess(octokit, owner, repo, ref, context)) return true;
+
+    const heads = yield* recentMergedHeadShas(octokit, owner, repo, ref);
+    for (const sha of heads) {
+      if (yield* hasRefReportedSuccess(octokit, owner, repo, sha, context)) return true;
+    }
+    return false;
+  });
+
 export const makeRulesetOctokit = (baseUrl: string | undefined): RealRulesetOctokit => ({
   list: ({ owner, repo }) =>
     Effect.gen(function* () {
@@ -114,27 +226,6 @@ export const makeRulesetOctokit = (baseUrl: string | undefined): RealRulesetOcto
   hasContextReportedSuccess: ({ owner, repo, context }) =>
     Effect.gen(function* () {
       const octokit = yield* octokitFor(baseUrl);
-      const repository = yield* Effect.tryPromise({
-        try: () => octokit.rest.repos.get({ owner, repo }),
-        catch: asError,
-      });
-      const ref = repository.data.default_branch;
-      const [checkRuns, statuses] = yield* Effect.all([
-        Effect.tryPromise({
-          try: () => octokit.rest.checks.listForRef({ owner, repo, ref, check_name: context }),
-          catch: asError,
-        }),
-        Effect.tryPromise({
-          try: () => octokit.rest.repos.listCommitStatusesForRef({ owner, repo, ref }),
-          catch: asError,
-        }),
-      ]);
-      const checkReported = checkRuns.data.check_runs.some(
-        (run) => run.name === context && run.conclusion === 'success',
-      );
-      const statusReported = statuses.data.some(
-        (status) => status.context === context && status.state === 'success',
-      );
-      return checkReported || statusReported;
+      return yield* contextReportedSuccess(octokit, owner, repo, context);
     }),
 });

package/src/github/repository-ruleset-probe.ts

@@ -71,7 +71,8 @@ export interface RulesetOctokit<R = never> {
     readonly repo: string;
     readonly rulesetId: number;
   }) => Effect.Effect<void, Error, R>;
-  /** Whether `context` has ever reported success against the repository's default branch —
+  /** Whether `context` has reported success against the repository's default branch tip OR a
+   * recent merged PR head (K2, bounded — see repository-ruleset-octokit.ts's file header) —
    * backs the `NeverReportedContext` guard. */
   readonly hasContextReportedSuccess: (input: {
     readonly owner: string;

package/src/github/repository-ruleset-props.ts

@@ -18,10 +18,13 @@ export interface RepositoryRulesetPullRequestRule extends NonNullable<
   /** @default every method GitHub allows — the house baseline always pins `['squash']`. */
   readonly allowedMergeMethods?: readonly ('merge' | 'squash' | 'rebase')[];
   readonly requiredReviewers?: readonly RepositoryRulesetReviewerRule[];
-  /** `require_extra_approval_for_unattributed_changes` — see repository-ruleset.ts's H15. Only
-   * `false` is modeled: sending `true` has no house use, and GitHub already defaults absent to
-   * `true`. */
-  readonly extraApprovalForUnattributedChanges?: false;
+  /** `require_extra_approval_for_unattributed_changes` — see repository-ruleset.ts's H15.
+   * Both values are modeled (K1, 2026-09-23): 8 live rulesets carry `true` (aop, cloudflareforms,
+   * doesthishelp-workeropen, homeflare-anyauth, homeflare-desktop, loggarr, magictransit,
+   * proxmox-tb4 — re-read live via `gh api repos/taslabs-net/<repo>/rulesets/<id>`,
+   * 2026-09-23), and this resource declares exactly what is live or it cannot adopt them —
+   * `undefined` stays "no opinion" (GitHub defaults an absent key to `true`). */
+  readonly extraApprovalForUnattributedChanges?: boolean;
 }
 
 export interface RepositoryRulesetStatusChecksRule extends NonNullable<