@iowarp/clio-coder 0.3.6 → 0.3.8

package/src/interactive/view/artifacts.ts

@@ -2,13 +2,16 @@ import { createReadStream, readFileSync, statSync } from "node:fs";
 import { readFile, realpath, stat } from "node:fs/promises";
 import { basename, isAbsolute, join, relative, resolve, sep } from "node:path";
 import type { DispatchContract } from "../../domains/dispatch/contract.js";
-import {
-	isReceiptIntegrity,
-	type ReceiptIntegrityResult,
-	verifyReceiptIntegrity,
-} from "../../domains/dispatch/receipt-integrity.js";
+import { isReceiptIntegrity, verifyReceiptIntegrity } from "../../domains/dispatch/receipt-integrity.js";
 import type { RunEnvelope, RunReceipt } from "../../domains/dispatch/types.js";
 import { evidenceDirectory, inspectEvidence, listEvidenceOverviews } from "../../domains/evidence/store.js";
+import { formatTrustSummaryLine } from "../../domains/evidence/trust-projection.js";
+import {
+	inspectRunReceiptTrustStatus,
+	type ReceiptIntegrityOutcome,
+	retiredReceiptIntegrity,
+	retiredReceiptIntegrityReason,
+} from "../../domains/evidence/trust-status.js";
 import type { EvidenceFinding, EvidenceOverview, EvidenceSource } from "../../domains/evidence/types.js";
 import { type AccountabilitySummary, readAccountabilitySummary } from "../../domains/observability/index.js";
 import type {
@@ -72,7 +75,7 @@ export interface ViewArtifact {
 	toolName?: string;
 	searchText?: readonly string[];
 	load(): Promise<ViewArtifactLoadResult>;
-	verify?(): Promise<{ ok: boolean; detail: string }>;
+	verify?(): Promise<ViewArtifactVerification>;
 }
 
 export interface ArtifactProvider {
@@ -108,7 +111,14 @@ const ACCOUNTABILITY_TOP_CAUSES = 8;
 export const VIEW_ARTIFACT_LINE_CAP = 50_000;
 const JSON_PRETTY_MAX_BYTES = 10 * 1024 * 1024;
 
-export type ReceiptVerifyResult = ReceiptIntegrityResult;
+export type ReceiptVerifyResult = ReceiptIntegrityOutcome;
+
+/**
+ * What a verify action reports. `retired` marks a seal this build does not
+ * verify because its integrity version was retired: not a pass, and not the
+ * failure a tampered receipt reports.
+ */
+export type ViewArtifactVerification = { ok: true; detail: string } | { ok: false; detail: string; retired?: true };
 
 const RECEIPT_REQUIRED_KEYS = [
 	"runId",
@@ -286,6 +296,21 @@ function validateToolStats(value: unknown): ReceiptVerifyResult {
 
 type ReadLedgerResult = { ok: true; envelope: RunEnvelope } | { ok: false; reason: string };
 
+/**
+ * The canonical trust line for a receipt the integrity verifier just accepted:
+ * the same file and ledger row, projected through the shared boundary so the
+ * receipt view spells its verdict exactly as the board and the CLI do.
+ */
+export function receiptTrustDetail(stateDir: string, runId: string): string {
+	try {
+		const receipt = JSON.parse(readFileSync(receiptFilePath(stateDir, runId), "utf8")) as RunReceipt;
+		const ledger = readRunEnvelope(stateDir, runId);
+		return formatTrustSummaryLine(inspectRunReceiptTrustStatus(receipt, ledger.ok ? ledger.envelope : null).status);
+	} catch {
+		return "integrity verified; trust status unreadable";
+	}
+}
+
 function readRunEnvelope(stateDir: string, runId: string): ReadLedgerResult {
 	const runs = readRunLedger(stateDir);
 	for (const entry of runs) {
@@ -398,6 +423,10 @@ export function verifyReceiptFile(stateDir: string, runId: string): ReceiptVerif
 	if (!isNullableString(r.sessionId)) {
 		return { ok: false, reason: `sessionId invalid: ${String(r.sessionId)}` };
 	}
+	// A retired seal is diagnosed ahead of the shape check, which would
+	// otherwise report the older version as an invalid integrity block.
+	const retired = retiredReceiptIntegrity(r.integrity);
+	if (retired !== null) return { ok: false, reason: retiredReceiptIntegrityReason(retired), retired };
 	if (!isReceiptIntegrity(r.integrity)) {
 		return { ok: false, reason: "integrity invalid" };
 	}
@@ -673,8 +702,12 @@ export class ReceiptArtifactProvider implements ArtifactProvider {
 					load: () => loadJsonFileLines(path),
 					verify: async () => {
 						const result = verifyReceiptFile(this.deps.stateDir, env.id);
-						if (!result.ok) return { ok: false, detail: result.reason };
-						return { ok: true, detail: "integrity verified" };
+						if (!result.ok) {
+							return { ok: false, detail: result.reason, ...(result.retired !== undefined ? { retired: true } : {}) };
+						}
+						// "integrity verified" alone read as a verified result. The
+						// canonical line says what the seal proves and what it does not.
+						return { ok: true, detail: receiptTrustDetail(this.deps.stateDir, env.id) };
 					},
 				};
 			});

package/src/interactive/view/view-overlay.ts

@@ -51,7 +51,9 @@ export type ViewVerificationState =
 	| { status: "idle" }
 	| { status: "running" }
 	| { status: "ok"; detail: string }
-	| { status: "fail"; detail: string };
+	| { status: "fail"; detail: string }
+	/** A seal this build does not verify because its version was retired: neither a pass nor a tampered-receipt failure. */
+	| { status: "retired"; detail: string };
 
 export type ViewScrollAction =
 	| "line-up"
@@ -327,6 +329,7 @@ function verificationText(state: ViewVerificationState | undefined): string {
 	if (!state || state.status === "idle") return "";
 	if (state.status === "running") return `${GLYPH.running} verify running`;
 	if (state.status === "ok") return `${GLYPH.ok} verify ok ${state.detail}`;
+	if (state.status === "retired") return `${GLYPH.warn} verify retired ${state.detail}`;
 	return `${GLYPH.error} verify fail ${state.detail}`;
 }
 
@@ -343,7 +346,14 @@ export function buildArtifactHeader(
 	if (size.length > 0) parts.push(theme.fg("dim", size));
 	const verify = verificationText(verification);
 	if (verify.length > 0) {
-		const token = verification?.status === "ok" ? "success" : verification?.status === "fail" ? "error" : "info";
+		const token =
+			verification?.status === "ok"
+				? "success"
+				: verification?.status === "fail"
+					? "error"
+					: verification?.status === "retired"
+						? "warning"
+						: "info";
 		parts.push(theme.fg(token, verify));
 	}
 	return padAnsi(parts.join("  "), width, ELLIPSIS);
@@ -689,7 +699,9 @@ export class ViewOverlayView implements Component {
 			.then((result) => {
 				this.verifications.set(
 					key,
-					result.ok ? { status: "ok", detail: result.detail } : { status: "fail", detail: result.detail },
+					result.ok
+						? { status: "ok", detail: result.detail }
+						: { status: result.retired === true ? "retired" : "fail", detail: result.detail },
 				);
 			})
 			.catch((err) => {

package/src/interactive/watchdog-run.ts

@@ -0,0 +1,75 @@
+/**
+ * The watchdog's run: one read-only verifier dispatch, one transcript notice.
+ *
+ * The middleware registration decides when to fire and what the turn changed;
+ * this decides nothing. It dispatches through the ordinary path so admission,
+ * the receipt, and the Fleet Runs island treat a watchdog run exactly as they
+ * treat any other, reads the failed checks out of the `verifier-report`
+ * contract, and hands the operator one line. A passing report produces nothing
+ * at all.
+ */
+
+import { BusChannels } from "../core/bus-events.js";
+import type { SafeEventBus } from "../core/event-bus.js";
+import { parseVerifierResult } from "../domains/agents/index.js";
+import type { DispatchContract, DispatchRequest } from "../domains/dispatch/contract.js";
+import { type AgentRoleFactsResolver, requestExecutionRole } from "../domains/dispatch/execution-role.js";
+import { WATCHDOG_TASK, type WatchdogTrigger, watchdogBriefing } from "../domains/middleware/index.js";
+import { watchdogBlockersNotice } from "./bus-notices.js";
+
+/** The builtin recipe the watchdog reviews with. */
+export const WATCHDOG_AGENT_ID = "verifier";
+
+export interface WatchdogRunDeps {
+	dispatch: DispatchContract;
+	bus?: SafeEventBus;
+	getAgentRoleFacts?: AgentRoleFactsResolver;
+	/** `watchdog.target` when the operator set one; the session's active target otherwise. */
+	target?: string | undefined;
+	/** One transcript line for the operator. Absent means the finding has nowhere to go and the run is skipped. */
+	emitNotice?: (text: string) => void;
+}
+
+/**
+ * Dispatch one watchdog review and report what it found.
+ *
+ * Resolves when the run has settled, whatever the outcome. A watchdog that
+ * failed is not a turn that failed: the review is advisory, so a broken run
+ * stays silent rather than raising an alarm about itself in the middle of the
+ * operator's work.
+ */
+export async function runWatchdogReview(trigger: WatchdogTrigger, deps: WatchdogRunDeps): Promise<void> {
+	if (!deps.emitNotice) return;
+	const request: DispatchRequest = {
+		agentId: WATCHDOG_AGENT_ID,
+		task: WATCHDOG_TASK,
+		briefing: watchdogBriefing(trigger),
+		executionRole: requestExecutionRole({
+			agentId: WATCHDOG_AGENT_ID,
+			...(deps.getAgentRoleFacts ? { resolveFacts: deps.getAgentRoleFacts } : {}),
+		}),
+		requestOrigin: "internal",
+		// Narrowed below whatever the session holds. A reviewer that could write
+		// would be a second builder nobody admitted.
+		autonomy: "read-only",
+		...(deps.target ? { target: deps.target } : {}),
+	};
+	const progressBus = deps.dispatch.ownsProgressBus?.(deps.bus) === true ? undefined : deps.bus;
+	try {
+		const handle = await deps.dispatch.dispatch(request);
+		for await (const event of handle.events) {
+			const typed = event as { type?: string };
+			if (!typed.type || typed.type === "heartbeat") continue;
+			progressBus?.emit(BusChannels.DispatchProgress, { runId: handle.runId, agentId: WATCHDOG_AGENT_ID, event });
+		}
+		const receipt = await handle.finalPromise;
+		const report = parseVerifierResult(receipt.output?.text ?? null);
+		if (report === null) return;
+		const notice = watchdogBlockersNotice(report.checks);
+		if (notice === null) return;
+		deps.emitNotice(notice.text);
+	} catch {
+		// An advisory review that could not run says nothing. The receipt, if one
+		// was written at all, is in the dispatch board like every other run.
+	}
+}

package/src/interactive/worker-receipts.ts

@@ -16,6 +16,8 @@
 import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 import { clioStateDir } from "../core/xdg.js";
+import type { RunEnvelope, RunReceipt } from "../domains/dispatch/types.js";
+import { inspectRunReceiptTrustStatus } from "../domains/evidence/trust-status.js";
 import { receiptFilePath } from "./view/artifacts.js";
 import type { WorkerReceiptFacts, WorkerResultContract } from "./worker-stream.js";
 
@@ -86,12 +88,22 @@ export function workerReceiptFacts(receipt: Record<string, unknown>): WorkerRece
 
 /** Read and project `<state>/receipts/<runId>.json` alone; null when it is absent or unreadable. */
 function readReceiptFileFacts(runId: string, stateDir: string): WorkerReceiptFacts | null {
+	let parsed: unknown;
 	try {
-		const parsed: unknown = JSON.parse(readFileSync(receiptFilePath(stateDir, runId), "utf8"));
-		return isRecord(parsed) ? workerReceiptFacts(parsed) : null;
+		parsed = JSON.parse(readFileSync(receiptFilePath(stateDir, runId), "utf8"));
 	} catch {
 		return null;
 	}
+	if (!isRecord(parsed)) return null;
+	const facts = workerReceiptFacts(parsed);
+	if (facts === null) return null;
+	// The trust verdict is an authenticated read-back: the receipt file
+	// against the ledger row it was sealed from. Without the row there is no
+	// authentication, and no verdict is better than a guessed one.
+	const row = findRunRow(runId, stateDir);
+	if (row === null) return facts;
+	const trust = inspectRunReceiptTrustStatus(parsed as unknown as RunReceipt, row as unknown as RunEnvelope).status;
+	return { ...facts, trust };
 }
 
 /** Read and project `<state>/receipts/<runId>.json`; null when it is absent or unreadable. */

package/src/interactive/worker-share.ts

@@ -11,6 +11,7 @@
  * Pure: no I/O, no bus, no session.
  */
 
+import type { CouncilReport } from "../domains/agents/result-contract.js";
 import { WORKER_OUTPUT_MAX_BYTES } from "../domains/dispatch/event-pump.js";
 import { truncateUtf8 } from "../tools/truncate-utf8.js";
 import { type WorkerEntryState, workerAskedByModel } from "./worker-stream.js";
@@ -56,12 +57,66 @@ export const WORKER_SHARE_ORIGIN = "shared by the operator";
  * produced no text is not worth a turn.
  */
 export function formatWorkerShareNote(facts: WorkerShareFacts): string | null {
-	const text = facts.text.trim();
+	return shareNote(facts, facts.text);
+}
+
+/** The header every shared note carries, plus one bounded body under it. */
+function shareNote(facts: WorkerShareFacts, body: string): string | null {
+	const text = body.trim();
 	if (text.length === 0) return null;
 	const header = `${WORKER_SHARE_NOTE_PREFIX} ${facts.agentId} · run ${facts.runId} · ${outcomeWord(facts.outcome)} · ${WORKER_SHARE_ORIGIN}`;
 	return `${header}\n${truncateUtf8(text, WORKER_SHARE_MAX_BYTES, SHARE_TRUNCATION_MARKER)}`;
 }
 
+/** One member's answer under its roster label, or its failure when it produced none. */
+function councilMemberLine(member: CouncilReport["members"][number]): string {
+	if (member.failed !== undefined) return `[${member.label}] failed: ${member.failed.reason}`;
+	const verdict = member.verdict === undefined ? "" : ` (verdict ${member.verdict})`;
+	return `[${member.label}]${verdict} ${member.answer.trim()}`;
+}
+
+/** The synthesis line: what the council concluded, and how it concluded it. */
+function councilSynthesisLines(synthesis: CouncilReport["synthesis"]): string[] {
+	if (synthesis.kind === "none") return ["[synthesis none] the members answered separately; no synthesis was run."];
+	const facts = [
+		...(synthesis.verdict !== undefined ? [`verdict ${synthesis.verdict}`] : []),
+		...(synthesis.tally !== undefined
+			? [
+					`tally ${Object.entries(synthesis.tally)
+						.map(([key, count]) => `${key}=${count}`)
+						.join(" ")}`,
+				]
+			: []),
+		...(synthesis.judgeRunId !== undefined ? [`judge run ${synthesis.judgeRunId}`] : []),
+	];
+	const head = `[synthesis ${synthesis.kind}]${facts.length > 0 ? ` ${facts.join(" · ")}` : ""}`;
+	const text = synthesis.text?.trim() ?? "";
+	return text.length > 0 ? [head, text] : [head];
+}
+
+/**
+ * A whole council as one operator note: every member's labelled answer, in the
+ * order the report seals them, then the synthesis. Sharing a synthesis run id
+ * means sharing what the council decided, and the members' answers are what it
+ * decided from, so they travel together in one bounded block rather than as
+ * several notes the main agent would have to reassemble.
+ */
+export function formatCouncilShareNote(facts: WorkerShareFacts, report: CouncilReport): string | null {
+	const finalRound = report.members.reduce((highest, member) => Math.max(highest, member.round), 1);
+	const body = [
+		...report.members.filter((member) => member.round === finalRound).map(councilMemberLine),
+		...councilSynthesisLines(report.synthesis),
+	].join("\n\n");
+	return shareNote(facts, body);
+}
+
+/** One council member's answer, labelled with the roster label the operator watched it under. */
+export function formatCouncilMemberShareNote(facts: WorkerShareFacts, label: string): string | null {
+	const text = facts.text.trim();
+	if (text.length === 0) return null;
+	return shareNote(facts, `[${label}] ${text}`);
+}
+
 /**
  * Whether operator text is a shared worker note. The header is the first line,
  * so the chat loop can tell the honesty rail a worker result entered the turn

package/src/interactive/worker-stream.ts

@@ -42,6 +42,7 @@ import type {
 	RunAbortedPayload,
 } from "../core/bus-events.js";
 import type { RunKind } from "../domains/dispatch/types.js";
+import type { CanonicalTrustStatus } from "../domains/evidence/trust-status.js";
 import type { WorkerRunOrigin, WorkerRunRuntime, WorkerRunRuntimeKind } from "../domains/session/index.js";
 import { createWorkerProgressFold, type WorkerProgressFold, type WorkerProgressSnapshot } from "./worker-progress.js";
 
@@ -88,6 +89,13 @@ export interface WorkerReceiptSummary {
 /** A receipt's projection: the summary plus the answer it sealed. */
 export interface WorkerReceiptFacts extends WorkerReceiptSummary {
 	text?: string;
+	/**
+	 * The canonical trust status of the persisted receipt, authenticated
+	 * against the persisted ledger row it was sealed from. Present only when
+	 * both could be read back, so a surface that shows it shows an
+	 * authenticated verdict and never the sealing process's own claim.
+	 */
+	trust?: CanonicalTrustStatus;
 }
 
 /** Reads `receipts/<runId>.json` and projects it; null when it is absent or unreadable. */
@@ -113,6 +121,12 @@ export interface WorkerEntryState {
 	/** Every attempt of this assignment, oldest first. */
 	attempts: WorkerAttempt[];
 	pending: boolean;
+	/**
+	 * Council provenance, present only on a run of a council group. `/share`
+	 * reads it so a member's answer reaches the main agent under the roster label
+	 * the operator watched it under, rather than as one unattributed voice.
+	 */
+	council?: { group: string; label: string; color?: string; round: number };
 	receipt?: WorkerReceiptSummary;
 	/** Agent origin: the tool call whose execution spawned this run. */
 	parentToolCallId?: string;
@@ -323,6 +337,7 @@ export function createWorkerStream(options: WorkerStreamOptions = {}): WorkerStr
 				progress: progress.snapshot(),
 				attempts: [{ runId, targetLabel: workerTargetLabel(runtime) }],
 				pending: true,
+				...(payload.council !== undefined ? { council: { ...payload.council } } : {}),
 				...(payload.parentToolCallId !== undefined ? { parentToolCallId: payload.parentToolCallId } : {}),
 			};
 			byAssignment.set(assignmentId, entry);

package/src/tools/bootstrap.ts

@@ -1,3 +1,4 @@
+import type { WorkerRosters } from "../core/defaults.js";
 import type { SafeEventBus } from "../core/event-bus.js";
 import type { AgentSpec } from "../domains/agents/spec.js";
 import type { DispatchContract } from "../domains/dispatch/contract.js";
@@ -22,6 +23,7 @@ export interface ToolBootstrapDeps extends CoreToolBootstrapDeps {
 	getAgentRoleFacts?: AgentRoleFactsResolver;
 	getAutonomy?: () => AutonomyLevel;
 	getCostCeilingUsd?: () => number;
+	getWorkerRosters?: () => WorkerRosters;
 	dispatchBackground?: DispatchBackgroundRegistry;
 }
 
@@ -44,6 +46,7 @@ export function registerAllTools(registry: ToolRegistry, deps: ToolBootstrapDeps
 			...(deps.getAgentRoleFacts ? { getAgentRoleFacts: deps.getAgentRoleFacts } : {}),
 			...(deps.getAutonomy ? { getAutonomy: deps.getAutonomy } : {}),
 			...(deps.getCostCeilingUsd ? { getCostCeilingUsd: deps.getCostCeilingUsd } : {}),
+			...(deps.getWorkerRosters ? { getWorkerRosters: deps.getWorkerRosters } : {}),
 			...(deps.dispatchBackground ? { background: deps.dispatchBackground } : {}),
 		};
 		registry.register({

package/src/tools/compete-worktrees.ts

@@ -33,8 +33,15 @@ import {
 	writeFileSync,
 } from "node:fs";
 import { hostname } from "node:os";
-import { isAbsolute, join, relative, resolve, sep } from "node:path";
+import { join, relative, resolve } from "node:path";
 import type { RunKind } from "../domains/dispatch/types.js";
+import {
+	commitWorktreePath,
+	isCanonicalWorktreePathInside,
+	mergeWorktreeBranch,
+	protectedPathsChangedByWorktreeBranch,
+	worktreeBranchDiffStat,
+} from "./task-worktree.js";
 
 export interface CandidateWorktree {
 	index: number;
@@ -300,20 +307,7 @@ function isCanonicalDirectoryAt(path: string): boolean {
  * be mistaken for a child of `/group-a` as it can with textual startsWith.
  */
 export function isCanonicalPathInside(parent: string, candidate: string): boolean {
-	let canonicalParent: string;
-	let canonicalCandidate: string;
-	try {
-		canonicalParent = realpathSync(parent);
-	} catch {
-		canonicalParent = resolve(parent);
-	}
-	try {
-		canonicalCandidate = realpathSync(candidate);
-	} catch {
-		canonicalCandidate = resolve(candidate);
-	}
-	const rel = relative(canonicalParent, canonicalCandidate);
-	return rel.length > 0 && rel !== ".." && !rel.startsWith(`..${sep}`) && !isAbsolute(rel);
+	return isCanonicalWorktreePathInside(parent, candidate);
 }
 
 function manifestFromUnknown(value: unknown): CompeteGroupManifest | null {
@@ -557,29 +551,12 @@ export function createCandidateWorktree(
  * builder changed nothing (an empty candidate is a legitimate ranking fact).
  */
 export function commitCandidateWork(worktree: CandidateWorktree, message: string): boolean {
-	git(worktree.path, ["add", "-A"]);
-	const staged = git(worktree.path, ["status", "--porcelain"]);
-	if (staged.length === 0) return false;
-	git(worktree.path, [
-		"-c",
-		`user.name=${COMPETE_COMMIT_IDENTITY}`,
-		"-c",
-		`user.email=${COMPETE_COMMIT_IDENTITY}@local`,
-		"commit",
-		"-m",
-		message,
-		"--no-verify",
-	]);
-	return true;
+	return commitWorktreePath(worktree.path, COMPETE_COMMIT_IDENTITY, message);
 }
 
 /** One-line stat summary of what a candidate branch changed relative to HEAD. */
 export function candidateDiffStat(root: string, branch: string): string {
-	try {
-		return git(root, ["diff", "--shortstat", `HEAD...${branch}`]) || "no changes";
-	} catch {
-		return "diff unavailable";
-	}
+	return worktreeBranchDiffStat(root, branch);
 }
 
 /**
@@ -592,31 +569,7 @@ export function protectedPathsChangedByCompeteBranch(
 	branch: string,
 	protectedPaths: ReadonlyArray<string>,
 ): string[] {
-	const canonical = canonicalRoot(root);
-	const protectedInside = protectedPaths
-		.map((path) => resolve(path))
-		.filter((path) => {
-			const rel = relative(canonical, path);
-			return rel.length > 0 && rel !== ".." && !rel.startsWith(`..${sep}`) && !isAbsolute(rel);
-		});
-	if (protectedInside.length === 0) return [];
-	const changed = git(canonical, ["diff", "--name-only", "-z", "--no-renames", `HEAD...${branch}`])
-		.split("\0")
-		.filter((path) => path.length > 0)
-		.map((path) => resolve(canonical, path));
-	const blocked = new Set<string>();
-	for (const candidate of changed) {
-		for (const protectedPath of protectedInside) {
-			const rel = relative(protectedPath, candidate);
-			if (
-				candidate === protectedPath ||
-				(rel.length > 0 && rel !== ".." && !rel.startsWith(`..${sep}`) && !isAbsolute(rel))
-			) {
-				blocked.add(protectedPath);
-			}
-		}
-	}
-	return [...blocked].sort();
+	return protectedPathsChangedByWorktreeBranch(root, branch, protectedPaths);
 }
 
 function registeredWorktreePaths(root: string): string[] {
@@ -687,26 +640,7 @@ export function removeCandidateWorktree(
  * the merge and reports failure so the operator decides.
  */
 export function mergeWinnerBranch(root: string, branch: string): { ok: true } | { ok: false; reason: string } {
-	try {
-		git(root, [
-			"-c",
-			`user.name=${COMPETE_COMMIT_IDENTITY}`,
-			"-c",
-			`user.email=${COMPETE_COMMIT_IDENTITY}@local`,
-			"merge",
-			"--no-edit",
-			"--no-verify",
-			branch,
-		]);
-		return { ok: true };
-	} catch (err) {
-		try {
-			git(root, ["merge", "--abort"]);
-		} catch {
-			// No merge in progress; nothing to abort.
-		}
-		return { ok: false, reason: err instanceof Error ? (err.message.split("\n")[0] ?? "merge failed") : String(err) };
-	}
+	return mergeWorktreeBranch(root, branch, COMPETE_COMMIT_IDENTITY);
 }
 
 /**