@mutmutco/cli 4.3.19 → 4.3.21

package/dist/main.cjs

@@ -12902,6 +12902,29 @@ async function waitForPrChecks(deps) {
 
 // src/bootstrap-ruleset.ts
 var PRODUCT_RULESET_NAME = "mmi-product-required-checks";
+var PRODUCT_RULESET_PATH = ".github/rulesets/mmi-product-required-checks.json";
+function reseedProductRulesetStrictness(current, seed) {
+  const parse = (raw) => {
+    const policy2 = JSON.parse(raw);
+    if (!policy2 || typeof policy2 !== "object" || Array.isArray(policy2) || policy2.name !== PRODUCT_RULESET_NAME || policy2.target !== "branch" || !Array.isArray(policy2.rules) || policy2.rules.some((r) => !r || typeof r !== "object" || Array.isArray(r) || typeof r.type !== "string")) {
+      throw new Error("product ruleset must be a branch ruleset object with well-formed rules");
+    }
+    const required = policy2.rules.filter((r) => r.type === "required_status_checks");
+    const parameters2 = required[0]?.parameters;
+    if (required.length !== 1 || !parameters2 || typeof parameters2 !== "object" || Array.isArray(parameters2) || !Array.isArray(parameters2.required_status_checks) || !parameters2.required_status_checks.length || parameters2.required_status_checks.some((c) => !c || typeof c !== "object" || Array.isArray(c) || typeof c.context !== "string" || !c.context.trim()) || parameters2.strict_required_status_checks_policy !== void 0 && typeof parameters2.strict_required_status_checks_policy !== "boolean") {
+      throw new Error("product ruleset must carry exactly one well-formed required_status_checks rule");
+    }
+    return { policy: policy2, parameters: parameters2 };
+  };
+  const strict = parse(seed).parameters.strict_required_status_checks_policy;
+  if (typeof strict !== "boolean") throw new Error("canonical product ruleset must declare boolean strictness");
+  if (current === null) return seed;
+  const { policy, parameters } = parse(current);
+  if (parameters.strict_required_status_checks_policy === strict) return current;
+  parameters.strict_required_status_checks_policy = strict;
+  return `${JSON.stringify(policy, null, 2)}
+`;
+}
 function stripRulesetComment(raw) {
   const parsed = JSON.parse(raw);
   delete parsed._comment;
@@ -12921,14 +12944,6 @@ function rulesetStrictPolicy(ruleset) {
   const rules = (ruleset.rules ?? []).filter((rule) => rule.type === "required_status_checks");
   return rules.length > 0 && rules.every((rule) => rule.parameters?.strict_required_status_checks_policy === true);
 }
-function patchRulesetStrictPolicy(body) {
-  const rules = (body.rules ?? []).map((rule) => {
-    const r = rule;
-    if (r.type !== "required_status_checks") return rule;
-    return { ...r, parameters: { ...r.parameters, strict_required_status_checks_policy: true } };
-  });
-  return { ...body, rules };
-}
 function rulesetBranchIncludes(ruleset) {
   const raw = ruleset.conditions?.ref_name?.include;
   return Array.isArray(raw) ? [...new Set(raw.filter((ref) => typeof ref === "string" && ref.length > 0))].sort((a, b) => a.localeCompare(b)) : [];
@@ -12948,8 +12963,7 @@ function patchRulesetRequiredContexts(body, contexts) {
       ...r,
       parameters: {
         ...r.parameters,
-        strict_required_status_checks_policy: true,
-        // #6263: org policy — see patchRulesetStrictPolicy
+        strict_required_status_checks_policy: r.parameters?.strict_required_status_checks_policy ?? false,
         required_status_checks: sorted.map((context) => ({ context }))
       }
     };
@@ -15502,10 +15516,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.3.19",
-    tag: "v4.3.19",
-    commit: "5776052e13af",
-    npm: "@mutmutco/cli@4.3.19"
+    version: "4.3.21",
+    tag: "v4.3.21",
+    commit: "f55fc2217cd3",
+    npm: "@mutmutco/cli@4.3.21"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -15522,14 +15536,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.3.19"
+          v3Target: "v4.3.21"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.3.19 and redeploy the Hub Lambda from tag v4.3.19 (5776052e13af); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.3.19 (@mutmutco/cli@4.3.19, tag commit 5776052e13af \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.3.21 and redeploy the Hub Lambda from tag v4.3.21 (f55fc2217cd3); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.3.21 (@mutmutco/cli@4.3.21, tag commit f55fc2217cd3 \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -23527,12 +23541,12 @@ function parseAuthoritativeRuleset(raw, meta, repo) {
   const contexts = sortedUnique(registryContexts ?? committedContexts);
   const explicitBranches = Array.isArray(meta?.requiredCheckBranches) && meta.requiredCheckBranches.length > 0 ? resolveRequiredCheckBranches(meta, repo) : null;
   const committedStrict = rulesetStrictPolicy(committedPayload);
-  let apiPayload = patchRulesetStrictPolicy(registryContexts == null ? committedPayload : patchRulesetRequiredContexts(committedPayload, contexts));
+  let apiPayload = registryContexts == null ? committedPayload : patchRulesetRequiredContexts(committedPayload, contexts);
   if (explicitBranches) apiPayload = patchRulesetBranchIncludes(apiPayload, explicitBranches);
   const branchIncludes = rulesetBranchIncludes(apiPayload);
   const authoritativeFilePayload = {
     ...filePayload,
-    ...registryContexts == null && committedStrict ? {} : { rules: apiPayload.rules },
+    ...registryContexts == null ? {} : { rules: apiPayload.rules },
     ...explicitBranches == null ? {} : { conditions: apiPayload.conditions }
   };
   return {
@@ -23554,7 +23568,7 @@ function sameContexts(left, right) {
 function resolveProductRulesetReconcilePlan(input) {
   const liveNeedsContextConvergence = !sameContexts(input.liveContexts, input.authorityContexts);
   const liveNeedsBranchConvergence = input.liveBranchIncludes !== void 0 && input.authorityBranchIncludes !== void 0 && !sameContexts(input.liveBranchIncludes, input.authorityBranchIncludes);
-  const liveNeedsStrictConvergence = input.liveStrict === false;
+  const liveNeedsStrictConvergence = input.liveStrict !== void 0 && input.authorityStrict !== void 0 && input.liveStrict !== input.authorityStrict;
   const liveIsActive = input.liveEnforcement === "active";
   if (liveIsActive && !liveNeedsContextConvergence && !liveNeedsBranchConvergence && !liveNeedsStrictConvergence) {
     return { shouldActivate: false, targetEnforcement: "active" };
@@ -23765,12 +23779,12 @@ async function auditRepoCi(repo, deps) {
         const liveContextsAligned = sameContexts(liveContexts, authoritativeRuleset.contexts);
         const fileBranchesAligned = sameContexts(authoritativeRuleset.committedBranchIncludes, authoritativeRuleset.branchIncludes);
         const liveBranchesAligned = sameContexts(liveBranchIncludes, authoritativeRuleset.branchIncludes);
-        const strictAligned = authoritativeRuleset.committedStrict && liveStrict;
+        const strictAligned = authoritativeRuleset.committedStrict === liveStrict;
         const aligned = fileContextsAligned && liveContextsAligned && fileBranchesAligned && liveBranchesAligned && strictAligned;
         checks.push({
           ok: aligned,
           label: RULESET_REFERENCE_MATCH_LABEL,
-          detail: aligned ? `contexts [${authoritativeRuleset.contexts.join(", ")}], branches [${authoritativeRuleset.branchIncludes.join(", ")}] and the up-to-date policy match declared authority` : `${authoritativeRuleset.source} requires contexts [${authoritativeRuleset.contexts.join(", ")}]; ${authoritativeRuleset.branchSource} requires branches [${authoritativeRuleset.branchIncludes.join(", ")}]; ${PRODUCT_RULESET_REF} declares contexts [${authoritativeRuleset.committedContexts.join(", ")}] / branches [${authoritativeRuleset.committedBranchIncludes.join(", ")}] and live ${PRODUCT_RULESET_NAME} has contexts [${liveContexts.join(", ")}] / branches [${liveBranchIncludes.join(", ")}]` + (strictAligned ? "" : `; strict_required_status_checks_policy must be true (require branches to be up to date before merging, #6263) \u2014 ${PRODUCT_RULESET_REF} declares ${authoritativeRuleset.committedStrict}, live ${PRODUCT_RULESET_NAME} has ${liveStrict}`),
+          detail: aligned ? `contexts [${authoritativeRuleset.contexts.join(", ")}], branches [${authoritativeRuleset.branchIncludes.join(", ")}] and the up-to-date policy match declared authority` : `${authoritativeRuleset.source} requires contexts [${authoritativeRuleset.contexts.join(", ")}]; ${authoritativeRuleset.branchSource} requires branches [${authoritativeRuleset.branchIncludes.join(", ")}]; ${PRODUCT_RULESET_REF} declares contexts [${authoritativeRuleset.committedContexts.join(", ")}] / branches [${authoritativeRuleset.committedBranchIncludes.join(", ")}] and live ${PRODUCT_RULESET_NAME} has contexts [${liveContexts.join(", ")}] / branches [${liveBranchIncludes.join(", ")}]` + (strictAligned ? "" : `; strict_required_status_checks_policy differs from committed policy \u2014 ${PRODUCT_RULESET_REF} declares ${authoritativeRuleset.committedStrict}, live ${PRODUCT_RULESET_NAME} has ${liveStrict}`),
           remediation: aligned ? void 0 : `mmi-cli devops ci reconcile --repo ${repo} --apply`
         });
       }
@@ -24360,6 +24374,7 @@ async function applyCiReconcileRepo(repo, deps) {
     liveBranchIncludes,
     authorityBranchIncludes: authority.branchIncludes,
     liveStrict: live == null ? void 0 : rulesetStrictPolicy(live),
+    authorityStrict: authority.committedStrict,
     gateProvenGreen: await gateIsProvenGreen(repo, deps.client, baseBranch, gateFiles),
     unsafeContexts: unsafe
   });
@@ -27167,11 +27182,6 @@ async function verifyBootstrap(repo, repoClass, deps, releaseTrack) {
       label: "product required-check ruleset enforcement active",
       detail: productRuleset?.enforcement !== "active" ? `${PRODUCT_RULESET_NAME} is ${productRuleset?.enforcement ?? "missing"} \u2014 run mmi-cli devops ci reconcile --apply --repo ${repo} once the gate is green` : void 0
     });
-    checks.push({
-      ok: productRuleset != null && rulesetStrictPolicy(productRuleset),
-      label: "product required-check ruleset requires an up-to-date branch",
-      detail: productRuleset != null && rulesetStrictPolicy(productRuleset) ? void 0 : `${PRODUCT_RULESET_NAME} ${productRuleset == null ? "is missing" : "has strict_required_status_checks_policy=false"} \u2014 run mmi-cli devops ci reconcile --apply --repo ${repo} (#6263)`
-    });
     const statusChecks = rulesetStatusChecks2(rulesets.filter((r) => r.target === "branch" && r.enforcement === "active"));
     const missing = requiredProductStatusChecks.filter((check) => !statusChecks.has(check));
     checks.push({
@@ -27225,6 +27235,100 @@ function renderBootstrapVerifyReport(report) {
   return lines2.join("\n");
 }
 
+// src/bootstrap-seed-delivery.ts
+var import_node_crypto9 = require("node:crypto");
+var SHA = /^[a-f0-9]{40}$/;
+async function readSeedFile(repo, target, ref, client) {
+  try {
+    const file = await client.rest(
+      "GET",
+      `repos/${repo}/contents/${target.split("/").map(encodeURIComponent).join("/")}?ref=${encodeURIComponent(ref)}`
+    );
+    if (!file?.sha || !SHA.test(file.sha) || file.encoding !== "base64" || typeof file.content !== "string") {
+      throw new Error("bootstrap apply: scoped seed file is unreadable");
+    }
+    return { sha: file.sha, content: decodeGitHubContents(file.content) };
+  } catch (e) {
+    if (e instanceof GitHubApiError && e.status === 404) return null;
+    throw e;
+  }
+}
+async function readTargetedSeedFiles(repo, plan, target, ref, client) {
+  const base = await readSeedFile(repo, target, plan.baseSha, client);
+  const candidate = ref === plan.baseSha ? base : await readSeedFile(repo, target, ref, client);
+  return { base, candidate };
+}
+async function targetedSeedPlan(repo, slug, target, baseBranch, sourceSha, client) {
+  const [rules, base] = await Promise.all([
+    client.rest("GET", `repos/${repo}/rules/branches/${encodeURIComponent(baseBranch)}`),
+    client.rest("GET", `repos/${repo}/git/ref/heads/${encodeURIComponent(baseBranch)}`)
+  ]);
+  if (!Array.isArray(rules) || rules.some((rule) => !rule || typeof rule.type !== "string" || !rule.type)) {
+    throw new Error("bootstrap apply: base branch protection is unreadable");
+  }
+  const baseSha = base?.object?.sha;
+  if (!baseSha || !SHA.test(baseSha) || !SHA.test(sourceSha)) throw new Error("bootstrap apply: seed identity is unreadable");
+  const identity = (0, import_node_crypto9.createHash)("sha256").update(JSON.stringify([repo.toLowerCase(), target, baseSha, sourceSha])).digest("hex").slice(0, 24);
+  return { ...planSeedDelivery(rules, slug, baseBranch, `bootstrap-seed-${identity}`), baseSha, baseBranch };
+}
+async function verifyTargetedSeedBranch(repo, plan, target, client, allowMissing = false) {
+  let ref;
+  try {
+    ref = await client.rest("GET", `repos/${repo}/git/ref/heads/${encodeURIComponent(plan.ref)}`);
+  } catch (e) {
+    if (allowMissing && e instanceof GitHubApiError && e.status === 404) return null;
+    throw e;
+  }
+  const head = ref?.object?.sha;
+  if (!head || !SHA.test(head)) throw new Error("bootstrap apply: scoped seed head is unreadable");
+  if (head === plan.baseSha) return head;
+  const diff = await client.rest("GET", `repos/${repo}/compare/${plan.baseSha}...${head}`);
+  if (diff?.status !== "ahead" || diff.merge_base_commit?.sha !== plan.baseSha || !Array.isArray(diff.files) || diff.files.length !== 1 || diff.files[0].filename !== target || diff.files[0].previous_filename !== void 0 || !["added", "modified"].includes(diff.files[0].status ?? "")) {
+    throw new Error("bootstrap apply: scoped seed branch contains changes outside the requested target or base");
+  }
+  return head;
+}
+async function prepareTargetedSeedBranch(repo, plan, target, client, gh) {
+  const candidates = await client.rest(
+    "GET",
+    `repos/${repo}/pulls?state=open&head=${encodeURIComponent(`${repo.split("/")[0]}:${plan.branch}`)}&base=${encodeURIComponent(plan.baseBranch)}&per_page=2`
+  );
+  if (!Array.isArray(candidates) || candidates.length > 1) throw new Error("bootstrap apply: scoped seed PR identity is unreadable");
+  for (const pr of candidates) {
+    if (!Number.isInteger(pr?.number) || pr.number <= 0 || pr.head?.ref !== plan.branch || pr.base?.ref !== plan.baseBranch) {
+      throw new Error("bootstrap apply: scoped seed PR identity is unreadable");
+    }
+    await gh(["pr", "merge", String(pr.number), "--repo", repo, "--disable-auto"]);
+    const after = await client.rest("GET", `repos/${repo}/pulls/${pr.number}`);
+    if (after?.auto_merge !== null) throw new Error("bootstrap apply: scoped seed PR auto-merge was not disabled");
+  }
+  const existing = await verifyTargetedSeedBranch(repo, plan, target, client, true);
+  if (existing) return;
+  try {
+    await client.rest("POST", `repos/${repo}/git/refs`, { body: { ref: `refs/heads/${plan.branch}`, sha: plan.baseSha } });
+  } catch (e) {
+    if (!(e instanceof GitHubApiError) || e.status !== 422) throw e;
+  }
+  await verifyTargetedSeedBranch(repo, plan, target, client);
+}
+async function enableTargetedSeedAutoMerge(repo, number, plan, target, expected, client, gh) {
+  const head = await verifyTargetedSeedBranch(repo, plan, target, client);
+  const pr = await client.rest("GET", `repos/${repo}/pulls/${number}`);
+  if (pr?.state !== "open" || pr.head?.ref !== plan.branch || pr.head?.sha !== head || pr.head.repo?.full_name?.toLowerCase() !== repo.toLowerCase() || pr.base?.ref !== plan.baseBranch || pr.base.sha !== plan.baseSha || pr.base.repo?.full_name?.toLowerCase() !== repo.toLowerCase() || pr.changed_files !== 1) throw new Error("bootstrap apply: scoped seed PR identity or diff changed");
+  const files = await client.rest(
+    "GET",
+    `repos/${repo}/pulls/${number}/files?per_page=2`
+  );
+  if (!Array.isArray(files) || files.length !== 1 || files[0]?.filename !== target || files[0].previous_filename !== void 0) {
+    throw new Error("bootstrap apply: scoped seed PR contains changes outside the requested target");
+  }
+  const file = await readSeedFile(repo, target, head, client);
+  if (file?.content !== expected) {
+    throw new Error("bootstrap apply: scoped seed content differs from this invocation");
+  }
+  await gh(["pr", "merge", String(number), "--repo", repo, "--auto", "--squash", "--match-head-commit", head]);
+}
+
 // src/bootstrap-commands.ts
 var execGitForSeedSource = async (args) => (await execFileP("git", args, { timeout: GIT_TIMEOUT_MS })).stdout;
 function bootstrapTrainDoctorDeps() {
@@ -27632,14 +27736,23 @@ function registerBootstrapCommands(program3) {
       });
     }
     let seedPlan = { mode: "direct", ref: baseBranch, reason: "dry-run (no protection probe)" };
+    let scopedPlan;
+    let scopedContent;
     let seededToBranch = 0;
-    if (o.execute) {
+    if (onlyTarget) {
+      scopedPlan = await targetedSeedPlan(repo, slug, onlyTarget, baseBranch, seedSource.sha, controlClient);
+      seedPlan = scopedPlan;
+      if (o.execute && scopedPlan.branch) {
+        await prepareTargetedSeedBranch(repo, scopedPlan, onlyTarget, controlClient, gh);
+      }
+    } else if (o.execute) {
       let branchRules = [];
       try {
         branchRules = JSON.parse((await gh(["api", `repos/${repo}/rules/branches/${baseBranch}`])).stdout || "[]");
       } catch {
-        branchRules = [];
+        throw new Error("bootstrap apply: base branch protection is unreadable");
       }
+      if (!Array.isArray(branchRules)) throw new Error("bootstrap apply: base branch protection is unreadable");
       seedPlan = planSeedDelivery(branchRules, slug, baseBranch);
       if (seedPlan.branch) {
         const headSha = (await gh(["api", `repos/${repo}/git/ref/heads/${baseBranch}`, "--jq", ".object.sha"])).stdout.trim();
@@ -27651,6 +27764,7 @@ function registerBootstrapCommands(program3) {
       }
     }
     const docsForIndex = [];
+    const seedReadRef = !o.execute && scopedPlan ? scopedPlan.baseSha : seedPlan.ref;
     for (const seed of seedsToApply) {
       if (!seed.classes.includes(o.class)) continue;
       if (!seedMatchesDeployModel(seed, applyDeployModel)) continue;
@@ -27664,8 +27778,20 @@ function registerBootstrapCommands(program3) {
       let exists = false;
       let sha;
       let remoteContent = null;
-      try {
-        const r = await gh(["api", `repos/${repo}/contents/${enc(resolved.target)}?ref=${seedPlan.ref}`]);
+      let baseContent = null;
+      const preserveRuleset = onlyTarget === PRODUCT_RULESET_PATH;
+      if (scopedPlan) {
+        try {
+          const files = await readTargetedSeedFiles(repo, scopedPlan, resolved.target, seedReadRef, controlClient);
+          baseContent = files.base?.content ?? null;
+          exists = files.candidate !== null;
+          sha = files.candidate?.sha;
+          remoteContent = files.candidate?.content ?? null;
+        } catch (e) {
+          return failGraceful(`bootstrap apply: cannot read scoped seed file; no replacement made: ${e.message}`);
+        }
+      } else try {
+        const r = await gh(["api", `repos/${repo}/contents/${enc(resolved.target)}?ref=${seedReadRef}`]);
         exists = true;
         try {
           const parsed = JSON.parse(r.stdout);
@@ -27678,23 +27804,34 @@ function registerBootstrapCommands(program3) {
       } catch {
         exists = false;
       }
-      const planned = planSeedAction(resolved, exists);
+      const planned = planSeedAction(resolved, scopedPlan ? baseContent !== null : exists);
+      if (scopedPlan && planned.action !== "skip") planned.action = exists ? "update" : "create";
       const isLegacyBlock = resolved.source === "managed-block";
       let content = null;
       let isManaged = isLegacyBlock || resolved.managedBlock != null;
+      const preservedContent = scopedPlan ? baseContent : remoteContent;
       if (planned.action === "create" || planned.action === "update") {
         if (isLegacyBlock) {
-          content = upsertManagedGitignoreBlock(remoteContent).content;
+          content = upsertManagedGitignoreBlock(preservedContent).content;
         } else {
-          const writeContent = resolveSeedWriteContent(resolved, vars, readFile9, remoteContent);
+          const writeContent = resolveSeedWriteContent(resolved, vars, readFile9, preservedContent);
           if (!writeContent.ok) {
             return fail(`bootstrap apply: ${resolved.target}: ${writeContent.reason} \u2014 refusing to overwrite repo-owned content`);
           }
           content = writeContent.content;
+          if (preserveRuleset) {
+            if (content === null) return fail("bootstrap apply: canonical product ruleset seed is unreadable");
+            try {
+              content = reseedProductRulesetStrictness(baseContent, content);
+            } catch (e) {
+              return fail(`bootstrap apply: product ruleset preservation refused: ${e.message}`);
+            }
+          }
           isManaged = writeContent.managed;
         }
       }
       const action = reconcileSeedAction(planned, content, isManaged, remoteContent);
+      if (onlyTarget && content !== null) scopedContent = content;
       actions.push(action);
       const docBody = content ?? remoteContent;
       if (resolved.target.startsWith("docs/") && resolved.target.endsWith(".md") && docBody !== null) {
@@ -27729,7 +27866,8 @@ function registerBootstrapCommands(program3) {
       }
     }
     let seedPrUrl;
-    if (o.execute && seedPlan.mode === "pr" && seedPlan.branch && seededToBranch > 0) {
+    const scopedHead = o.execute && scopedPlan?.branch ? await verifyTargetedSeedBranch(repo, scopedPlan, onlyTarget, controlClient) : null;
+    if (o.execute && seedPlan.mode === "pr" && seedPlan.branch && (seededToBranch > 0 || scopedContent !== void 0 && scopedHead !== null && scopedHead !== scopedPlan?.baseSha)) {
       await gh(["api", "-X", "PATCH", `repos/${repo}`, "-f", "allow_auto_merge=true", "-f", "allow_squash_merge=true", "-F", `delete_branch_on_merge=${MANAGED_DELETE_BRANCH_ON_MERGE}`]).catch(() => {
       });
       const openPrs = await gh(["pr", "list", "--repo", repo, "--head", seedPlan.branch, "--base", baseBranch, "--state", "open", "--json", "number,url"]);
@@ -27758,7 +27896,12 @@ ${onlyManagedBlock ? `Only the marker-bounded Hub-managed block inside repo-owne
         seedPrUrl = created.url;
       }
       let autoMergeEnabled = true;
-      await gh(["pr", "merge", seedPrUrl, "--repo", repo, "--auto", "--squash"]).catch((e) => {
+      if (scopedPlan) {
+        if (scopedContent === void 0) throw new Error("bootstrap apply: scoped seed content is unresolved");
+        const number = Number(seedPrUrl.split("/").pop());
+        if (!Number.isInteger(number) || number <= 0) throw new Error("bootstrap apply: scoped seed PR number is unreadable");
+        await enableTargetedSeedAutoMerge(repo, number, scopedPlan, onlyTarget, scopedContent, controlClient, gh);
+      } else await gh(["pr", "merge", seedPrUrl, "--repo", repo, "--auto", "--squash"]).catch((e) => {
         const message2 = String(e.message ?? "");
         if (/already/i.test(message2)) return;
         if (/clean status|enablePullRequestAutoMerge/i.test(message2)) {
@@ -27941,7 +28084,7 @@ ${onlyManagedBlock ? `Only the marker-bounded Hub-managed block inside repo-owne
         deployFactsRead: controlDeployFacts !== null
       });
     }
-    if (o.json) console.log(JSON.stringify({ repo, class: o.class, sourceSha: seedSource.sha, only: onlyTarget || null, execute: o.execute, seedDelivery: seedPlan.mode, seedPrUrl, actions, controlPlane: controlRows, applied, ddbWrites }, null, 2));
+    if (o.json) console.log(JSON.stringify({ repo, class: o.class, sourceSha: seedSource.sha, only: onlyTarget || null, execute: o.execute, seedDelivery: seedPlan.mode, seedBranch: seedPlan.branch, seedBaseSha: scopedPlan?.baseSha, seedPrUrl, actions, controlPlane: controlRows, applied, ddbWrites }, null, 2));
     else {
       console.log(renderSeedPlan(actions));
       if (controlRows.length) console.log(`
@@ -27968,7 +28111,7 @@ LIVE apply to ${repo}:
   ${propagatable.map((s) => s.target).join("\n  ")}`);
     if (!seed.managedBlock && !(0, import_node_fs26.existsSync)(seed.target)) return fail(`bootstrap propagate: the Hub's own copy of '${seed.target}' is missing \u2014 nothing to propagate`);
     const hubContent = seed.managedBlock ? null : (0, import_node_fs26.readFileSync)(seed.target, "utf8");
-    const readSeedFile = (path2) => (0, import_node_fs26.existsSync)(path2) ? (0, import_node_fs26.readFileSync)(path2, "utf8") : null;
+    const readSeedFile2 = (path2) => (0, import_node_fs26.existsSync)(path2) ? (0, import_node_fs26.readFileSync)(path2, "utf8") : null;
     const isWorkflowSeed = seed.target.startsWith(".github/workflows/");
     const cfg = await loadConfig();
     const projects = await fetchProjectsList(registryClientDeps(cfg));
@@ -28045,14 +28188,14 @@ LIVE apply to ${repo}:
         const project2 = projects.find((p) => (p.repos ?? []).some((repo) => repo.toLowerCase() === r.repo.toLowerCase()));
         const track = resolveReleaseTrack(project2, void 0, r.repo);
         const vars = withDerivedRepoVars({}, parseOwnerRepo(r.repo), repoClass, track, project2?.requiredCheckBranches);
-        const resolved = resolveSeedWriteContent(seed, vars, readSeedFile, content);
+        const resolved = resolveSeedWriteContent(seed, vars, readSeedFile2, content);
         if (!resolved.ok || resolved.content == null) {
           return fail(`bootstrap propagate: ${r.repo} ${seed.target}: ${resolved.ok ? "rendered no content" : resolved.reason} \u2014 refusing an incomplete per-repo render`);
         }
         desired = resolved.content;
       } else if (seed.managedBlock) {
         const vars = withDerivedRepoVars({}, parseOwnerRepo(r.repo), repoClass);
-        const resolved = resolveSeedWriteContent(seed, vars, readSeedFile, content);
+        const resolved = resolveSeedWriteContent(seed, vars, readSeedFile2, content);
         if (!resolved.ok) {
           return fail(`bootstrap propagate: ${r.repo} ${seed.target}: ${resolved.reason} \u2014 refusing to overwrite repo-owned content`);
         }
@@ -31891,8 +32034,7 @@ var LOOP_PLAYBOOKS = {
       { label: "Apply the repository test policy, then build the touched package", command: "mmi-cli tests policy --base origin/development && npm run build" },
       { label: "Publish the branch", command: "git push origin <branch>:<branch>" },
       { label: "Open the development-base PR", command: 'mmi-cli devops pr create --title "<title>" --body-file .jerv/PR_BODY.md --base development' },
-      { label: "Post the review verdict (pr merge / pr land refuse an unreviewed PR, #6255)", command: 'mmi-cli devops pr review-verdict <PR-number> --repo <owner/repo> --verdict PROCEED --scope "<one line>" --risk "<one line>" --reviewer <seat-or-model-id>' },
-      { label: "Land to development (waits for checks itself and demands the review verdict)", command: "mmi-cli devops pr land <PR-number>" },
+      { label: "Land to development (waits for checks itself)", command: "mmi-cli devops pr land <PR-number>" },
       { label: "Release only after the gated train is authorized", command: "mmi-cli devops release --apply" },
       // #5552: learning-tagged filings are cloud-agent owned — file and return to the current task.
       { label: "Learning reports are fire-and-forget (file, then return to the current task \u2014 never claim/poll/duplicate the learning issue)", command: 'mmi-cli learning report --title "<one-line>" --body "<what hurt>"' }
@@ -31913,14 +32055,14 @@ var LOOP_PLAYBOOKS = {
     steps: [
       { label: "Publish the branch", command: "git push origin <branch>:<branch>" },
       { label: "Open the development-base PR", command: 'mmi-cli devops pr create --title "<title>" --body-file .jerv/PR_BODY.md --base development' },
-      { label: "Land the PR (merge to development \u2014 waits for checks itself and demands the review verdict)", command: "mmi-cli devops pr land <PR-number>" }
+      { label: "Land the PR (merge to development \u2014 waits for checks itself)", command: "mmi-cli devops pr land <PR-number>" }
     ]
   },
   "hotfix": {
     title: "Hotfix",
     steps: [
       { label: "Create the main-base hotfix PR from every already-merged fix this cycle carries", command: "mmi-cli devops hotfix start --from <pr#|sha>[,<pr#|sha>...]" },
-      { label: "Merge the main-base PR (waits for checks itself and demands the review verdict)", command: "mmi-cli devops pr merge <PR-number> --squash" },
+      { label: "Merge the main-base PR (waits for checks itself)", command: "mmi-cli devops pr merge <PR-number> --squash" },
       { label: "After the PR is merged, run the gated release", command: "mmi-cli devops hotfix release <vX.Y.Z> --carries <pr#|sha>[,<pr#|sha>...]" }
     ]
   }
@@ -32193,7 +32335,7 @@ function parseOriginRepo(remoteUrl) {
 
 // src/issue-commands.ts
 var import_node_fs31 = require("node:fs");
-var import_node_crypto9 = require("node:crypto");
+var import_node_crypto10 = require("node:crypto");
 
 // src/issue-body.ts
 var import_node_os16 = require("node:os");
@@ -32723,7 +32865,7 @@ function rowIdempotencyKey(batchKey, spec) {
   const identity = `${spec.type}
 ${spec.title.trim()}
 ${spec.body ?? ""}`;
-  const hash = (0, import_node_crypto9.createHash)("sha256").update(identity).digest("hex").slice(0, 16);
+  const hash = (0, import_node_crypto10.createHash)("sha256").update(identity).digest("hex").slice(0, 16);
   return `${batchKey}:${hash}`;
 }
 var BATCH_SPEC_KEYS = /* @__PURE__ */ new Set(["type", "title", "body", "priority", "labels", "label", "parent", "repo", "surface"]);
@@ -35768,14 +35910,14 @@ function registerStageCommands(program3) {
 }
 
 // src/tenant-artifact.ts
-var import_node_crypto10 = require("node:crypto");
+var import_node_crypto11 = require("node:crypto");
 var import_node_fs35 = require("node:fs");
 var import_promises6 = require("node:fs/promises");
 var import_node_path32 = require("node:path");
 var ARTIFACT_ID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
 var MAX_BYTES = 5 * 1024 * 1024 * 1024;
 async function sha256File(path2) {
-  const hash = (0, import_node_crypto10.createHash)("sha256");
+  const hash = (0, import_node_crypto11.createHash)("sha256");
   for await (const chunk of (0, import_node_fs35.createReadStream)(path2)) hash.update(chunk);
   return hash.digest("hex");
 }
@@ -36145,6 +36287,14 @@ async function runPrLand(prNumber, options, deps) {
       };
     }
   }
+  const queue = await deps.queueMerge?.(prNumber, repo);
+  if (queue) return {
+    ...base,
+    queue,
+    status: queue.state === "merged" ? "merged" : "failed",
+    mergeStatus: queue.state === "merged" ? "merged" : "failed",
+    ...queue.state === "merged" ? {} : { error: queue.detail }
+  };
   const ciPolicy = await deps.resolveCiPolicy(repo);
   base.ciPolicy = ciPolicy;
   const checksWaitError = (checksWait) => {
@@ -37454,9 +37604,287 @@ async function deleteMergedRemoteBranch(options) {
   };
 }
 
-// src/post-merge-recon.ts
+// src/review-verdict.ts
+var import_node_child_process14 = require("node:child_process");
 var import_node_fs38 = require("node:fs");
+var import_node_os19 = require("node:os");
 var import_node_path35 = require("node:path");
+var REVIEW_VERDICT_MARKER = "<!-- zeroci-review v1 -->";
+var REVIEW_VERDICTS = ["PROCEED", "CORRECT", "ESCALATE"];
+function isReviewVerdict(value) {
+  return typeof value === "string" && REVIEW_VERDICTS.includes(value);
+}
+function renderReviewVerdictComment(input) {
+  const payload = {
+    v: 1,
+    patch: input.patch,
+    head: input.head,
+    verdict: input.verdict,
+    scope: input.scope,
+    risk: input.risk,
+    unverified: input.unverified,
+    reviewer: input.reviewer
+  };
+  const findings = input.findings?.trim();
+  return `${REVIEW_VERDICT_MARKER}
+\`\`\`json
+${JSON.stringify(payload, null, 2)}
+\`\`\`
+${findings ? `
+${findings}
+` : ""}`;
+}
+function isReviewVerdictComment(body) {
+  return body.trimStart().startsWith(REVIEW_VERDICT_MARKER);
+}
+var FENCE_RE = /^(?:`{3,}|~{3,})[^\n]*\n([\s\S]*?)\n(?:`{3,}|~{3,})\s*$/m;
+function parseReviewVerdictComment(body) {
+  if (!isReviewVerdictComment(body)) return void 0;
+  const rest = body.trimStart().slice(REVIEW_VERDICT_MARKER.length);
+  const fence = FENCE_RE.exec(rest);
+  if (!fence) return void 0;
+  let parsed;
+  try {
+    parsed = JSON.parse(fence[1]);
+  } catch {
+    return void 0;
+  }
+  if (!parsed || typeof parsed !== "object") return void 0;
+  const p = parsed;
+  if (p.v !== 1 || !isReviewVerdict(p.verdict)) return void 0;
+  if (typeof p.patch !== "string" || !/^[0-9a-f]{40}$/.test(p.patch)) return void 0;
+  if (typeof p.head !== "string" || typeof p.scope !== "string" || typeof p.risk !== "string" || typeof p.reviewer !== "string") return void 0;
+  const unverified = Array.isArray(p.unverified) ? p.unverified.filter((u) => typeof u === "string") : [];
+  return { v: 1, patch: p.patch, head: p.head, verdict: p.verdict, scope: p.scope, risk: p.risk, unverified, reviewer: p.reviewer };
+}
+function latestReviewComment(comments) {
+  let latest;
+  for (const c of comments) {
+    if (!isReviewVerdictComment(c.body)) continue;
+    if (!latest || c.createdAt > latest.createdAt || c.createdAt === latest.createdAt && (c.id ?? 0) >= (latest.id ?? 0)) latest = c;
+  }
+  return latest;
+}
+function evaluateReviewVerdict(comments, currentPatchId) {
+  const latest = latestReviewComment(comments);
+  if (!latest) return { ok: false, reason: "none" };
+  const payload = parseReviewVerdictComment(latest.body);
+  if (!payload) return { ok: false, reason: "malformed" };
+  if (payload.verdict !== "PROCEED") return { ok: false, reason: "not-proceed", verdict: payload.verdict, patch: payload.patch };
+  if (payload.patch !== currentPatchId) return { ok: false, reason: "stale", verdict: payload.verdict, patch: payload.patch };
+  return { ok: true, reason: "proceed", verdict: payload.verdict, patch: payload.patch };
+}
+function evaluateTrustedReviewVerdict(comments, patch, head) {
+  const latest = latestReviewComment(comments);
+  if (!latest) return { ok: false, reason: "none" };
+  const identity = { commentId: latest.id, commentCreatedAt: latest.createdAt };
+  if (latest.author?.toLowerCase() !== "jervaise") return { ...identity, ok: false, reason: "untrusted-author" };
+  const evaluation = evaluateReviewVerdict([latest], patch);
+  if (!evaluation.ok) return { ...identity, ok: false, reason: evaluation.reason };
+  if (parseReviewVerdictComment(latest.body)?.head !== head) return { ...identity, ok: false, reason: "stale-head" };
+  return { ...identity, ok: true, reason: "proceed" };
+}
+async function checkPrReview(number, repo, head, deps = {
+  readHead: readPrHeadSha,
+  readComments: readPrIssueComments,
+  computePatch: computePrPatchId
+}) {
+  const base = { repo, number, head };
+  if (!/^[1-9][0-9]*$/.test(number) || !/^[\w.-]+\/[\w.-]+$/.test(repo) || !/^[0-9a-f]{40}$/.test(head)) {
+    return { ...base, ok: false, reason: "invalid-input", detail: "expected a PR number, owner/repo and exact lowercase 40-character head SHA" };
+  }
+  try {
+    if (await deps.readHead(number, repo) !== head) return { ...base, ok: false, reason: "stale-head" };
+    const [comments, patch] = await Promise.all([deps.readComments(number, repo), deps.computePatch(number, repo)]);
+    if (await deps.readHead(number, repo) !== head) return { ...base, ok: false, reason: "stale-head" };
+    return { ...base, patch, ...evaluateTrustedReviewVerdict(comments, patch, head) };
+  } catch (e) {
+    return { ...base, ok: false, reason: "unreadable", detail: e.message };
+  }
+}
+function computePrPatchId(number, repo) {
+  return new Promise((resolve7, reject) => {
+    const gh = (0, import_node_child_process14.spawn)("gh", ["pr", "diff", number, "--repo", repo], { windowsHide: true, stdio: ["ignore", "pipe", "pipe"] });
+    const git3 = (0, import_node_child_process14.spawn)("git", ["patch-id", "--stable"], { windowsHide: true, stdio: ["pipe", "pipe", "pipe"] });
+    let out = "";
+    let ghErr = "";
+    let gitErr = "";
+    const timer = setTimeout(() => {
+      gh.kill();
+      git3.kill();
+      reject(new Error(`patch-id: timed out after ${GC_GH_TIMEOUT_MS4}ms`));
+    }, GC_GH_TIMEOUT_MS4);
+    gh.stdout.pipe(git3.stdin);
+    gh.stderr.on("data", (d) => {
+      ghErr += d.toString();
+    });
+    git3.stderr.on("data", (d) => {
+      gitErr += d.toString();
+    });
+    git3.stdout.on("data", (d) => {
+      out += d.toString();
+    });
+    gh.on("error", (e) => {
+      clearTimeout(timer);
+      reject(e);
+    });
+    git3.on("error", (e) => {
+      clearTimeout(timer);
+      reject(e);
+    });
+    let ghCode;
+    let gitCode;
+    const finish = () => {
+      if (ghCode === void 0 || gitCode === void 0) return;
+      clearTimeout(timer);
+      if (ghCode !== 0) return reject(Object.assign(new Error(`gh pr diff ${number} --repo ${repo} exited ${ghCode}: ${ghErr.trim()}`), { stderr: ghErr }));
+      if (gitCode !== 0) return reject(new Error(`git patch-id --stable exited ${gitCode}: ${gitErr.trim()}`));
+      const id = out.trim().split(/\s+/)[0];
+      if (!/^[0-9a-f]{40}$/.test(id ?? "")) return reject(new Error(`patch-id: PR #${number} diff is empty or unreadable (gh: ${ghErr.trim() || "no stderr"})`));
+      resolve7(id);
+    };
+    gh.on("close", (code) => {
+      ghCode = code;
+      finish();
+    });
+    git3.on("close", (code) => {
+      gitCode = code;
+      finish();
+    });
+    git3.stdin.on("error", (e) => {
+      clearTimeout(timer);
+      gh.kill();
+      git3.kill();
+      reject(e);
+    });
+  });
+}
+async function readPrHeadSha(number, repo) {
+  const { stdout } = await execFileP("gh", ["api", `repos/${repo}/pulls/${number}`, "--jq", ".head.sha"], { timeout: GC_GH_TIMEOUT_MS4 });
+  const sha = stdout.trim();
+  if (!/^[0-9a-f]{40}$/.test(sha)) throw new Error(`could not read PR #${number} head sha`);
+  return sha;
+}
+async function readPrIssueComments(number, repo) {
+  const { stdout } = await execFileP("gh", ["api", "--paginate", `repos/${repo}/issues/${number}/comments?per_page=100`, "--jq", ".[] | {id, body, createdAt: .created_at, author: .user.login}"], { timeout: GC_GH_TIMEOUT_MS4 });
+  const comments = parseNdjsonLines(stdout);
+  if (comments.some((c) => !c || !Number.isSafeInteger(c.id) || c.id <= 0 || typeof c.body !== "string" || typeof c.createdAt !== "string" || !Number.isFinite(Date.parse(c.createdAt)) || c.author !== null && typeof c.author !== "string")) throw new Error("unreadable PR comment identity");
+  return comments;
+}
+async function postPrCommentFromFile(number, repo, body) {
+  const dir = (0, import_node_fs38.mkdtempSync)((0, import_node_path35.join)((0, import_node_os19.tmpdir)(), "mmi-review-verdict-"));
+  const path2 = (0, import_node_path35.join)(dir, "body.md");
+  try {
+    (0, import_node_fs38.writeFileSync)(path2, body, "utf8");
+    const { stdout } = await execFileP("gh", ["pr", "comment", number, "--repo", repo, "--body-file", path2], { timeout: GH_MUTATION_TIMEOUT_MS });
+    return stdout.trim();
+  } finally {
+    try {
+      (0, import_node_fs38.rmSync)(dir, { recursive: true, force: true });
+    } catch {
+    }
+  }
+}
+
+// src/pr-mergify-queue.ts
+var MERGIFY_PILOT_REPO = "mutmutco/Jerv-JervCode";
+var MERGIFY_PILOT_VARIABLE = "JERV_BATCH_QUEUE_PILOT";
+var MERGIFY_READY_LABEL = "ready-to-merge";
+async function ghJson(args) {
+  return JSON.parse((await execFileP("gh", ["api", ...args], { timeout: GC_GH_TIMEOUT_MS4 })).stdout);
+}
+async function usesMergifyPilot(repo, base, readVariable = async () => ghJson([`repos/${repo}/actions/variables/${MERGIFY_PILOT_VARIABLE}`])) {
+  if (repo.toLowerCase() !== MERGIFY_PILOT_REPO.toLowerCase() || base !== "development") return false;
+  const variable = await readVariable();
+  if (variable?.value === "true") return true;
+  if (variable?.value === "false") return false;
+  throw new Error(`Mergify pilot activation is missing or malformed on ${repo}; refusing native merge`);
+}
+function queueCheckState(checks, head) {
+  const check = checks.filter((c) => c.name === "Mergify Merge Queue" && c.head_sha === head && c.app?.id === 10562 && c.app.slug === "mergify").sort((a, b) => b.id - a.id)[0];
+  if (!check) return "refused";
+  if (check.conclusion && !["success", "neutral"].includes(check.conclusion)) return "refused";
+  if (["In merge queue", "Running merge queue checks"].includes(check.output?.title ?? "")) return "pending";
+  return "requested";
+}
+async function requestMergifyMerge(number, repo, guardedText, expectedHead, deps = {
+  readPull: () => ghJson([`repos/${repo}/pulls/${number}`]),
+  readChecks: async (head) => parseNdjsonLines((await execFileP("gh", [
+    "api",
+    "--paginate",
+    `repos/${repo}/commits/${head}/check-runs?per_page=100`,
+    "--jq",
+    ".check_runs[]"
+  ], { timeout: GC_GH_TIMEOUT_MS4 })).stdout),
+  addLabel: async () => {
+    await ghJson([`repos/${repo}/issues/${number}/labels`, "--method", "POST", "-f", `labels[]=${MERGIFY_READY_LABEL}`]);
+  },
+  review: (head) => checkPrReview(number, repo, head),
+  now: () => Date.now(),
+  sleep: (ms) => new Promise((resolve7) => setTimeout(resolve7, ms))
+}, timeoutMs = 6e5) {
+  let head = expectedHead ?? "";
+  let state = "refused";
+  const receipt = (detail) => ({ provider: "mergify", state, head, detail });
+  try {
+    if (repo.toLowerCase() !== MERGIFY_PILOT_REPO.toLowerCase()) return receipt("repository is outside the Mergify pilot");
+    const initial = await deps.readPull();
+    head = expectedHead ?? initial.head.sha;
+    const sameTarget = (pr) => /^[0-9a-f]{40}$/.test(head) && pr.head.sha === head && pr.base.ref === "development";
+    if (!sameTarget(initial)) return receipt("PR head or target base changed");
+    if (initial.merged === true) {
+      state = "merged";
+      return receipt("GitHub confirms the PR merged");
+    }
+    const validate = (pr) => pr.state === "open" && sameTarget(pr) && `${pr.title}
+${pr.body ?? ""}` === guardedText;
+    if (!validate(initial)) return receipt("PR state, head, base or guarded title/body changed");
+    const initialState = queueCheckState(await deps.readChecks(head), head);
+    if (initialState === "refused") return receipt("trusted current-head Mergify check is absent or failed");
+    if (!(await deps.review(head)).ok) return receipt("current trusted review verdict does not permit queue admission");
+    if (!validate(await deps.readPull())) return receipt("PR changed before queue request");
+    let mutationDetail = "";
+    if (!initial.labels.some((label) => label.name === MERGIFY_READY_LABEL)) {
+      try {
+        await deps.addLabel();
+      } catch {
+        mutationDetail = "Label response was ambiguous; no replay was attempted. ";
+      }
+    }
+    state = "requested";
+    const deadline = deps.now() + timeoutMs;
+    while (true) {
+      const pr = await deps.readPull();
+      if (!sameTarget(pr)) {
+        state = "refused";
+        return receipt("PR head or target base changed while queued");
+      }
+      if (pr.merged === true) {
+        state = "merged";
+        return receipt("GitHub confirms the PR merged");
+      }
+      if (!validate(pr)) {
+        state = "refused";
+        return receipt("PR state, head, base or guarded title/body changed while queued");
+      }
+      state = queueCheckState(await deps.readChecks(head), head);
+      if (state === "refused") return receipt("trusted current-head Mergify check is absent or failed");
+      if (!pr.labels.some((label) => label.name === MERGIFY_READY_LABEL)) {
+        state = "refused";
+        return receipt(`${mutationDetail}Queue request label is absent`);
+      }
+      if (deps.now() >= deadline) return receipt(`${mutationDetail}${state === "pending" ? "Mergify confirms queue admission" : "Queue requested; Mergify has not confirmed admission"}; PR has not merged within the wait window`);
+      await deps.sleep(3e4);
+    }
+  } catch {
+    state = "refused";
+    return receipt("Mergify or GitHub state is unreadable; no native merge was attempted");
+  }
+}
+
+// src/post-merge-recon.ts
+var import_node_fs39 = require("node:fs");
+var import_node_path36 = require("node:path");
 
 // src/cross-repo-filing-issue.ts
 function crossRepoFilingRetryCommand(prRepo, prNumber) {
@@ -37622,16 +38050,16 @@ function buildPostMergeReconRecovery(input) {
 }
 function writePostMergeReconRecovery(cwd, recovery) {
   const path2 = postMergeReconStatePath(cwd, recovery.repo, recovery.pr);
-  (0, import_node_fs38.mkdirSync)((0, import_node_path35.dirname)(path2), { recursive: true });
-  (0, import_node_fs38.writeFileSync)(path2, `${JSON.stringify(recovery, null, 2)}
+  (0, import_node_fs39.mkdirSync)((0, import_node_path36.dirname)(path2), { recursive: true });
+  (0, import_node_fs39.writeFileSync)(path2, `${JSON.stringify(recovery, null, 2)}
 `, "utf8");
   return path2;
 }
 function clearPostMergeReconRecovery(cwd, repo, pr) {
   const path2 = postMergeReconStatePath(cwd, repo, pr);
-  if (!(0, import_node_fs38.existsSync)(path2)) return;
+  if (!(0, import_node_fs39.existsSync)(path2)) return;
   try {
-    (0, import_node_fs38.unlinkSync)(path2);
+    (0, import_node_fs39.unlinkSync)(path2);
   } catch {
   }
 }
@@ -37661,184 +38089,6 @@ function postMergeReconWarnings(input) {
   return lines2;
 }
 
-// src/review-verdict.ts
-var import_node_child_process14 = require("node:child_process");
-var import_node_fs39 = require("node:fs");
-var import_node_os19 = require("node:os");
-var import_node_path36 = require("node:path");
-var REVIEW_VERDICT_MARKER = "<!-- zeroci-review v1 -->";
-var REVIEW_WAIVER_MARKER = "<!-- zeroci-review-waived v1 -->";
-var REVIEW_VERDICTS = ["PROCEED", "CORRECT", "ESCALATE"];
-function isReviewVerdict(value) {
-  return typeof value === "string" && REVIEW_VERDICTS.includes(value);
-}
-function renderReviewVerdictComment(input) {
-  const payload = {
-    v: 1,
-    patch: input.patch,
-    head: input.head,
-    verdict: input.verdict,
-    scope: input.scope,
-    risk: input.risk,
-    unverified: input.unverified,
-    reviewer: input.reviewer
-  };
-  const findings = input.findings?.trim();
-  return `${REVIEW_VERDICT_MARKER}
-\`\`\`json
-${JSON.stringify(payload, null, 2)}
-\`\`\`
-${findings ? `
-${findings}
-` : ""}`;
-}
-function isReviewVerdictComment(body) {
-  return body.trimStart().startsWith(REVIEW_VERDICT_MARKER);
-}
-var FENCE_RE = /^(?:`{3,}|~{3,})[^\n]*\n([\s\S]*?)\n(?:`{3,}|~{3,})\s*$/m;
-function parseReviewVerdictComment(body) {
-  if (!isReviewVerdictComment(body)) return void 0;
-  const rest = body.trimStart().slice(REVIEW_VERDICT_MARKER.length);
-  const fence = FENCE_RE.exec(rest);
-  if (!fence) return void 0;
-  let parsed;
-  try {
-    parsed = JSON.parse(fence[1]);
-  } catch {
-    return void 0;
-  }
-  if (!parsed || typeof parsed !== "object") return void 0;
-  const p = parsed;
-  if (p.v !== 1 || !isReviewVerdict(p.verdict)) return void 0;
-  if (typeof p.patch !== "string" || !/^[0-9a-f]{40}$/.test(p.patch)) return void 0;
-  if (typeof p.head !== "string" || typeof p.scope !== "string" || typeof p.risk !== "string" || typeof p.reviewer !== "string") return void 0;
-  const unverified = Array.isArray(p.unverified) ? p.unverified.filter((u) => typeof u === "string") : [];
-  return { v: 1, patch: p.patch, head: p.head, verdict: p.verdict, scope: p.scope, risk: p.risk, unverified, reviewer: p.reviewer };
-}
-function evaluateReviewVerdict(comments, currentPatchId) {
-  let latest;
-  for (const c of comments) {
-    if (!isReviewVerdictComment(c.body)) continue;
-    if (!latest || c.createdAt >= latest.createdAt) latest = c;
-  }
-  if (!latest) return { ok: false, reason: "none" };
-  const payload = parseReviewVerdictComment(latest.body);
-  if (!payload) return { ok: false, reason: "malformed" };
-  if (payload.verdict !== "PROCEED") return { ok: false, reason: "not-proceed", verdict: payload.verdict, patch: payload.patch };
-  if (payload.patch !== currentPatchId) return { ok: false, reason: "stale", verdict: payload.verdict, patch: payload.patch };
-  return { ok: true, reason: "proceed", verdict: payload.verdict, patch: payload.patch };
-}
-function reviewVerdictRemedyCommand(number, repo) {
-  return `mmi-cli devops pr review-verdict ${number} --repo ${repo} --verdict PROCEED --scope "<one line>" --risk "<one line>" --reviewer <seat-or-model-id>`;
-}
-function reviewVerdictRefusalMessage(context, number, repo, evaluation, currentPatchId) {
-  const why = {
-    none: "no review verdict comment on the PR",
-    stale: `the latest verdict is bound to patch ${evaluation.patch} but the PR's current diff is ${currentPatchId} \u2014 the content changed since the review`,
-    "not-proceed": `the latest verdict is ${evaluation.verdict}, not PROCEED`,
-    malformed: "the latest verdict comment is malformed (marker present, JSON block unreadable or wrong shape)",
-    proceed: "proceed"
-  }[evaluation.reason];
-  return `${context}: REVIEW VERDICT REQUIRED (#6255) \u2014 ${why}. Review PR #${number} and post the verdict, then rerun:
-  ${reviewVerdictRemedyCommand(number, repo)}
-To land without a review, pass --without-review "<reason>" \u2014 it posts a waiver comment on the PR.`;
-}
-function renderReviewWaiverComment(reason, actor) {
-  return `${REVIEW_WAIVER_MARKER}
-Review gate waived by @${actor}: ${reason.trim()}
-`;
-}
-function computePrPatchId(number, repo) {
-  return new Promise((resolve7, reject) => {
-    const gh = (0, import_node_child_process14.spawn)("gh", ["pr", "diff", number, "--repo", repo], { windowsHide: true, stdio: ["ignore", "pipe", "pipe"] });
-    const git3 = (0, import_node_child_process14.spawn)("git", ["patch-id", "--stable"], { windowsHide: true, stdio: ["pipe", "pipe", "pipe"] });
-    let out = "";
-    let ghErr = "";
-    let gitErr = "";
-    const timer = setTimeout(() => {
-      gh.kill();
-      git3.kill();
-      reject(new Error(`patch-id: timed out after ${GC_GH_TIMEOUT_MS4}ms`));
-    }, GC_GH_TIMEOUT_MS4);
-    gh.stdout.pipe(git3.stdin);
-    gh.stderr.on("data", (d) => {
-      ghErr += d.toString();
-    });
-    git3.stderr.on("data", (d) => {
-      gitErr += d.toString();
-    });
-    git3.stdout.on("data", (d) => {
-      out += d.toString();
-    });
-    gh.on("error", (e) => {
-      clearTimeout(timer);
-      reject(e);
-    });
-    git3.on("error", (e) => {
-      clearTimeout(timer);
-      reject(e);
-    });
-    let ghCode;
-    gh.on("close", (code) => {
-      ghCode = code;
-    });
-    git3.on("close", (code) => {
-      clearTimeout(timer);
-      if (ghCode) return reject(Object.assign(new Error(`gh pr diff ${number} --repo ${repo} exited ${ghCode}: ${ghErr.trim()}`), { stderr: ghErr }));
-      if (code) return reject(new Error(`git patch-id --stable exited ${code}: ${gitErr.trim()}`));
-      const id = out.trim().split(/\s+/)[0];
-      if (!/^[0-9a-f]{40}$/.test(id ?? "")) return reject(new Error(`patch-id: PR #${number} diff is empty or unreadable (gh: ${ghErr.trim() || "no stderr"})`));
-      resolve7(id);
-    });
-  });
-}
-async function readPrHeadSha(number, repo) {
-  const { stdout } = await execFileP("gh", ["api", `repos/${repo}/pulls/${number}`, "--jq", ".head.sha"], { timeout: GC_GH_TIMEOUT_MS4 });
-  const sha = stdout.trim();
-  if (!/^[0-9a-f]{40}$/.test(sha)) throw new Error(`could not read PR #${number} head sha`);
-  return sha;
-}
-async function readPrIssueComments(number, repo) {
-  const { stdout } = await execFileP("gh", ["api", "--paginate", `repos/${repo}/issues/${number}/comments?per_page=100`, "--jq", ".[] | {body, createdAt: .created_at}"], { timeout: GC_GH_TIMEOUT_MS4 });
-  return parseNdjsonLines(stdout);
-}
-async function postPrCommentFromFile(number, repo, body) {
-  const dir = (0, import_node_fs39.mkdtempSync)((0, import_node_path36.join)((0, import_node_os19.tmpdir)(), "mmi-review-verdict-"));
-  const path2 = (0, import_node_path36.join)(dir, "body.md");
-  try {
-    (0, import_node_fs39.writeFileSync)(path2, body, "utf8");
-    const { stdout } = await execFileP("gh", ["pr", "comment", number, "--repo", repo, "--body-file", path2], { timeout: GH_MUTATION_TIMEOUT_MS });
-    return stdout.trim();
-  } finally {
-    try {
-      (0, import_node_fs39.rmSync)(dir, { recursive: true, force: true });
-    } catch {
-    }
-  }
-}
-async function requireReviewVerdict(context, number, repo, opts) {
-  if (opts.withoutReview !== void 0) {
-    const reason = opts.withoutReview.trim();
-    if (!reason) throw new Error(`${context}: --without-review needs a non-empty reason`);
-    const actor = await execFileP("gh", ["api", "user", "--jq", ".login"], { timeout: GC_GH_TIMEOUT_MS4 }).then((r) => r.stdout.trim()).catch(() => "") || "unknown";
-    await postPrCommentFromFile(number, repo, renderReviewWaiverComment(reason, actor));
-    console.warn(`${context}: review gate WAIVED by @${actor} \u2014 ${reason} (waiver comment posted on PR #${number})`);
-    return void 0;
-  }
-  let comments;
-  let currentPatchId;
-  try {
-    [comments, currentPatchId] = await Promise.all([readPrIssueComments(number, repo), computePrPatchId(number, repo)]);
-  } catch (e) {
-    const detail = e.message || String(e);
-    const limited = isGitHubRateLimitError(e) ? " (gh rate-limited \u2014 retry after the pool resets)" : "";
-    throw new Error(`${context}: cannot read PR #${number}'s review verdict${limited} \u2014 ${detail}. Refusing to merge WITHOUT the review gate (#6255).`);
-  }
-  const evaluation = evaluateReviewVerdict(comments, currentPatchId);
-  if (evaluation.ok) return void 0;
-  return reviewVerdictRefusalMessage(context, number, repo, evaluation, currentPatchId);
-}
-
 // src/pr-create-docs-check.ts
 var import_node_child_process15 = require("node:child_process");
 var GIT_TIMEOUT_MS2 = 15e3;
@@ -38963,7 +39213,7 @@ function ciAuditDeps() {
     }
   };
 }
-async function ghJson(args, timeout = 1e4) {
+async function ghJson2(args, timeout = 1e4) {
   const { stdout } = await execFileP("gh", args, { timeout });
   return JSON.parse(stdout);
 }
@@ -39250,7 +39500,7 @@ function registerCollaborationCommands(program3) {
   async function readParentField(number, repo) {
     let payload;
     try {
-      payload = await ghJson(["api", `repos/${repo}/issues/${number}`]);
+      payload = await ghJson2(["api", `repos/${repo}/issues/${number}`]);
     } catch (e) {
       const err = e;
       return { parentReadError: (err.stderr || err.message || String(e)).trim() };
@@ -39282,7 +39532,7 @@ function registerCollaborationCommands(program3) {
         emit(data2, await readParentField(n, repo));
         return;
       }
-      const data = await ghJson(["issue", "view", String(n), "--repo", repo, "--json", gh.ghFields]);
+      const data = await ghJson2(["issue", "view", String(n), "--repo", repo, "--json", gh.ghFields]);
       emit(data, await readParentField(n, repo));
     } catch (e) {
       const err = e;
@@ -39297,7 +39547,7 @@ function registerCollaborationCommands(program3) {
     const repo = await resolveRepo(o.repo);
     if (!repo) return fail("issue discover-related: could not resolve repo");
     try {
-      const issues = await ghJson([
+      const issues = await ghJson2([
         "issue",
         "list",
         "--repo",
@@ -39312,7 +39562,7 @@ function registerCollaborationCommands(program3) {
       const candidates = findRelatedIssues({ number, title: o.title, body: o.body }, issues);
       if (o.json) return console.log(JSON.stringify({ number, repo, candidates }, null, 2));
       if (!candidates.length) return;
-      const viewed = await ghJson([
+      const viewed = await ghJson2([
         "issue",
         "view",
         String(number),
@@ -39386,7 +39636,7 @@ function registerCollaborationCommands(program3) {
     const checked = o.off !== true;
     let body;
     try {
-      const viewed = await ghJson(["issue", "view", String(parsed.number), "--repo", repo, "--json", "body"]);
+      const viewed = await ghJson2(["issue", "view", String(parsed.number), "--repo", repo, "--json", "body"]);
       body = viewed.body ?? "";
     } catch (e) {
       return fail(`issue check: could not read ${repo}#${parsed.number}: ${e.message}`);
@@ -39488,7 +39738,7 @@ ${list}`);
     if (!o.force) {
       let openLessons = [];
       try {
-        openLessons = await ghJson([
+        openLessons = await ghJson2([
           "issue",
           "list",
           "--repo",
@@ -39534,7 +39784,7 @@ ${list}`);
     console.log(JSON.stringify({ ...created, projectItemId, onBoard }));
   });
   const pr = program3.command("pr").description("pull requests \u2014 reliable create with structured output");
-  withExamples(pr.command("create").description("create a PR and print {number,url} JSON").option("--title <title>", "PR title").option("--title-file <path|->", "read the PR title from a UTF-8 file, or from stdin with -").option("--body <body>", "PR body (markdown)").option("--body-file <path|->", "read PR body from a UTF-8 file, or from stdin with -").option("--base <branch>", "base branch (defaults to the repo default)").option("--head <branch>", "head branch (defaults to the current branch)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--draft", "open the PR in draft state (#2667)").option("--json", "machine-readable output (default; accepted for parity)").action(async (o) => {
+  withExamples(pr.command("create").description("create a PR and print {number,url} JSON").option("--title <title>", "PR title").option("--title-file <path|->", "read the PR title from a UTF-8 file, or from stdin with -").option("--body <body>", "PR body (markdown)").option("--body-file <path|->", "read PR body from a UTF-8 file, or from stdin with -").option("--base <branch>", "base branch (defaults to the repo default)").option("--head <branch>", "head branch (defaults to the current branch)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--draft", "open the PR in draft state (#2667)").option("--no-zeroci", "compatibility option; pr create does not mint receipts").option("--json", "machine-readable output (default; accepted for parity)").action(async (o) => {
     let body;
     let title;
     try {
@@ -39594,7 +39844,7 @@ ${list}`);
         console.log(JSON.stringify(data2));
         return;
       }
-      const data = await ghJson(["pr", "view", String(n), "--repo", repo, "--json", effective]);
+      const data = await ghJson2(["pr", "view", String(n), "--repo", repo, "--json", effective]);
       console.log(JSON.stringify(data));
     } catch (e) {
       const err = e;
@@ -39794,7 +40044,12 @@ ${list}`);
     if (result.status === "failure" || result.status === "conflicting") process.exitCode = 1;
     if (result.status === "timeout" || result.status === "rate-limited") process.exitCode = PR_CHECKS_TIMEOUT_EXIT_CODE;
   });
-  jsonParity(pr.command("review-verdict <number>").description("post the ZeroCI review verdict comment the merge helper requires (#6255): computes the PR diff patch-id and head sha itself, renders the v1 contract body, posts it as a PR comment. Only a PROCEED bound to the CURRENT diff lets `pr merge` / `pr land` merge").requiredOption("--repo <owner/repo>", "target repo").requiredOption("--verdict <verdict>", `one of ${REVIEW_VERDICTS.join("|")}`).requiredOption("--scope <text>", "one line: what was reviewed").requiredOption("--risk <text>", "one line: the residual risk").option("--unverified <text>", "a claim the reviewer could not verify (repeatable)", (v, acc) => [...acc, v], []).requiredOption("--reviewer <id>", "reviewer seat or model id").option("--findings-file <path>", "Markdown findings appended after the JSON block")).action(async (number, o) => {
+  pr.command("review-check <number>").description("read-only trusted review verdict check for an exact PR head").requiredOption("--repo <owner/repo>", "target repository").requiredOption("--head <sha>", "exact expected head SHA").option("--json", "machine-readable output").action(async (number, o) => {
+    const result = await checkPrReview(number, o.repo, o.head);
+    console.log(o.json ? JSON.stringify(result) : `pr review-check: ${result.reason}`);
+    if (!result.ok) process.exitCode = 1;
+  });
+  jsonParity(pr.command("review-verdict <number>").description("post an explicit review verdict comment: computes the PR diff patch-id and head sha, renders the v1 contract body, and posts it as a PR comment").requiredOption("--repo <owner/repo>", "target repo").requiredOption("--verdict <verdict>", `one of ${REVIEW_VERDICTS.join("|")}`).requiredOption("--scope <text>", "one line: what was reviewed").requiredOption("--risk <text>", "one line: the residual risk").option("--unverified <text>", "a claim the reviewer could not verify (repeatable)", (v, acc) => [...acc, v], []).requiredOption("--reviewer <id>", "reviewer seat or model id").option("--findings-file <path>", "Markdown findings appended after the JSON block")).action(async (number, o) => {
     if (!isReviewVerdict(o.verdict)) return fail(`pr review-verdict: --verdict must be one of ${REVIEW_VERDICTS.join("|")} (got ${o.verdict})`);
     const verdict = o.verdict;
     const findings = o.findingsFile ? (0, import_node_fs43.readFileSync)(o.findingsFile, "utf8") : void 0;
@@ -39836,7 +40091,7 @@ ${list}`);
   }
   class PrHeadBehindBaseError extends Error {
   }
-  pr.command("land <number>").description("agent merge path (#1440): train probe \u2014 checks-wait \u2014 merge --auto \u2014 poll enqueued \u2014 development PRs only").option("--json", "machine-readable output").option("--repo <owner/repo>", "target repo (defaults to the PR repo)").option("--no-require-train", "skip train-authority preflight (not recommended for autonomous agents)").option("--force", "acknowledge and land past a remaining prunable/severe scratch housekeeping block (advisory kept plans/ never blocks, #3012) or a negated-closing-keyword (#3718) or ambiguous-cross-repo-closing (#4279) refusal").option("--without-review <reason>", "land without a review verdict (#6255): posts a `zeroci-review-waived` comment carrying the reason and actor, then proceeds").action(async (number, o) => {
+  pr.command("land <number>").description("agent merge path (#1440): train probe \u2014 checks-wait \u2014 merge --auto \u2014 poll enqueued \u2014 development PRs only").option("--json", "machine-readable output").option("--repo <owner/repo>", "target repo (defaults to the PR repo)").option("--no-require-train", "skip train-authority preflight (not recommended for autonomous agents)").option("--force", "acknowledge and land past a remaining prunable/severe scratch housekeeping block (advisory kept plans/ never blocks, #3012) or a negated-closing-keyword (#3718) or ambiguous-cross-repo-closing (#4279) refusal").option("--without-review <reason>", "compatibility option; shared merge helpers do not require a review verdict").action(async (number, o) => {
     if (/^(?:[^/]+\/[^/]+)?#\d+$/.test(number.trim())) {
       try {
         const parsed = parseIssueRef(number, o.repo);
@@ -39854,7 +40109,7 @@ ${list}`);
       await readClosingGuardInput(number, repoArgs, landRepoForGuard, "pr land"),
       async (n) => {
         if (!landRepoForGuard) return void 0;
-        const viewed = await ghJson(["issue", "view", String(n), "--repo", landRepoForGuard, "--json", "state"]);
+        const viewed = await ghJson2(["issue", "view", String(n), "--repo", landRepoForGuard, "--json", "state"]);
         return typeof viewed.state === "string" ? viewed.state : void 0;
       }
     );
@@ -39871,16 +40126,15 @@ ${list}`);
       return;
     }
     if (landClosingGuardVerdict.message) console.warn(landClosingGuardVerdict.message);
-    {
-      const gateRepo = landRepoForGuard ?? await requireRepo(o.repo);
-      const refusal = await requireReviewVerdict("pr land", number, gateRepo, { withoutReview: o.withoutReview });
-      if (refusal) {
-        console.error(refusal);
-        process.exitCode = 1;
-        return;
-      }
-    }
     const result = await runPrLand(number, { repo: o.repo, requireTrain: o.requireTrain !== false }, {
+      queueMerge: async (prNumber, repo) => {
+        const meta = await ghJson2(["pr", "view", prNumber, "--repo", repo, "--json", "baseRefName,headRefOid"]);
+        if (!await usesMergifyPilot(repo, meta.baseRefName)) return void 0;
+        if (!landClosingGuardInput) throw new Error("pr land: Mergify requires a readable closing-keyword guard");
+        const guard = evaluateClosingGuard(landClosingGuardInput, { force: o.force, context: "pr land", squashBodyText: landClosingGuardInput.text });
+        if (guard.blocked) throw new Error(guard.message);
+        return requestMergifyMerge(prNumber, repo, landClosingGuardInput.text, meta.headRefOid);
+      },
       resolveRepo: async (prNumber, repoOpt) => {
         const args = repoOpt ? ["--repo", repoOpt] : repoArgs;
         const viewed = (await execFileP("gh", ["pr", "view", prNumber, ...args, "--json", "headRepository,baseRefName", "--jq", '.headRepository.nameWithOwner + " " + .baseRefName'], { timeout: GC_GH_TIMEOUT_MS4 })).stdout.trim();
@@ -40015,7 +40269,7 @@ ${list}`);
     else printLine(`pr land: ${result.status}${result.error ? ` \u2014 ${result.error}` : ""}`);
     if (result.status === "failed") process.exitCode = 1;
   });
-  jsonParity(pr.command("merge <number>").description("merge a PR (squash by default); archives gitignored tmp/** before worktree teardown; on no-ci repos run pr ci-policy / checks-wait first (#1432, #5679)").option("--squash", "squash merge (default)").option("--merge", "create a merge commit").option("--rebase", "rebase merge").option("--repo <owner/repo>", "target repo (defaults to the current repo); from a foreign checkout the remote probe/delete address this repo and local cleanup runs only in the verified sibling checkout ../<repo>, else localBranch reports skipped-foreign-cwd and the receipt carries foreignCwd: true (#6148)").option("--auto", "enable auto-merge \u2014 merge once the base-branch policy is satisfied (use for policy-gated repos)").addOption(new Option("--disable-auto", "disable a queued auto-merge without merging").conflicts(["auto", "wait", "squash", "merge", "rebase", "preserveWorktree", "gc", "squashBodyFile", "force"])).option("--wait", `wait for checks to reach a terminal passing verdict before merging (default budget ${PR_CHECKS_TIMEOUT_MS / 6e4}m) \u2014 run as a background/monitor task or under a shell timeout above that budget; a short foreground timeout (e.g. 120s) kills it after checks pass and leaves the PR open (#6027)`).option("--preserve-worktree", "after merge, keep the local PR worktree/branch for an active batch (#1888); also the merge settings-proof bypass when delete_branch_on_merge cannot be proven (#6210)").option("--gc", "acknowledge deleting unarchived gitignored tmp/** evidence newer than the branch base (#5679)").option("--squash-body-file <path>", "squash commit body (overrides GitHub COMMIT_MESSAGES); use when a pushed commit mentions close/fix/resolve + #N that must not close (#5723)").option("--force", "acknowledge and merge past a remaining prunable/severe scratch housekeeping block (advisory kept plans/ never blocks, #3012) or a negated-closing-keyword (#3718) or ambiguous-cross-repo-closing (#4279) refusal").option("--without-review <reason>", "merge without a review verdict (#6255): posts a `zeroci-review-waived` comment carrying the reason and actor, then proceeds")).action(async (number, o) => {
+  jsonParity(pr.command("merge <number>").description("merge a PR (squash by default); archives gitignored tmp/** before worktree teardown; on no-ci repos run pr ci-policy / checks-wait first (#1432, #5679)").option("--squash", "squash merge (default)").option("--merge", "create a merge commit").option("--rebase", "rebase merge").option("--repo <owner/repo>", "target repo (defaults to the current repo); from a foreign checkout the remote probe/delete address this repo and local cleanup runs only in the verified sibling checkout ../<repo>, else localBranch reports skipped-foreign-cwd and the receipt carries foreignCwd: true (#6148)").option("--auto", "enable auto-merge \u2014 merge once the base-branch policy is satisfied (use for policy-gated repos)").addOption(new Option("--disable-auto", "disable a queued auto-merge without merging").conflicts(["auto", "wait", "squash", "merge", "rebase", "preserveWorktree", "gc", "squashBodyFile", "force"])).option("--wait", `wait for checks to reach a terminal passing verdict before merging (default budget ${PR_CHECKS_TIMEOUT_MS / 6e4}m) \u2014 run as a background/monitor task or under a shell timeout above that budget; a short foreground timeout (e.g. 120s) kills it after checks pass and leaves the PR open (#6027)`).option("--preserve-worktree", "after merge, keep the local PR worktree/branch for an active batch (#1888); also the merge settings-proof bypass when delete_branch_on_merge cannot be proven (#6210)").option("--gc", "acknowledge deleting unarchived gitignored tmp/** evidence newer than the branch base (#5679)").option("--squash-body-file <path>", "squash commit body (overrides GitHub COMMIT_MESSAGES); use when a pushed commit mentions close/fix/resolve + #N that must not close (#5723)").option("--force", "acknowledge and merge past a remaining prunable/severe scratch housekeeping block (advisory kept plans/ never blocks, #3012) or a negated-closing-keyword (#3718) or ambiguous-cross-repo-closing (#4279) refusal").option("--without-review <reason>", "compatibility option; shared merge helpers do not require a review verdict")).action(async (number, o) => {
     const method = o.rebase ? "--rebase" : o.merge ? "--merge" : "--squash";
     const repoArgs = o.repo ? ["--repo", o.repo] : [];
     if (o.disableAuto) {
@@ -40037,20 +40291,24 @@ ${list}`);
     const headRef = prMeta.head;
     const baseRef = prMeta.base;
     const headRefOid = (prMeta.oid ?? "").trim() || void 0;
+    if (!repoForPostCleanup) throw new Error("pr merge: cannot resolve target repository");
+    const mergifyPilot = await usesMergifyPilot(repoForPostCleanup, baseRef);
+    if (mergifyPilot && (method !== "--squash" || o.squashBodyFile)) throw new Error("pr merge: Mergify pilot uses the protected squash title/body policy; custom merge methods and body files are unsupported");
     const devDeployDeps = repoForPostCleanup ? registryClientDeps(await loadConfig()) : void 0;
     const devDeployPlan = repoForPostCleanup && devDeployDeps ? await planDevDeployOnDevelopmentMerge(repoForPostCleanup, baseRef, devDeployDeps).catch(() => ({ applicable: false, reason: "unreadable" })) : { applicable: false, reason: "unreadable" };
     const closingGuardInput = await withAlreadyClosedCommitTargets(
       await readClosingGuardInput(number, repoArgs, repoForPostCleanup, "pr merge"),
       async (n) => {
         if (!repoForPostCleanup) return void 0;
-        const viewed = await ghJson(["issue", "view", String(n), "--repo", repoForPostCleanup, "--json", "state"]);
+        const viewed = await ghJson2(["issue", "view", String(n), "--repo", repoForPostCleanup, "--json", "state"]);
         return typeof viewed.state === "string" ? viewed.state : void 0;
       }
     );
     if (o.squashBodyFile && method !== "--squash") {
       throw new Error("pr merge: --squash-body-file applies only to squash merges");
     }
-    const mergeSquashBody = squashBodyTextForMerge(
+    if (mergifyPilot && !closingGuardInput) throw new Error("pr merge: Mergify requires a readable closing-keyword guard");
+    const mergeSquashBody = mergifyPilot ? closingGuardInput.text : squashBodyTextForMerge(
       closingGuardInput,
       method === "--squash",
       o.squashBodyFile ? (0, import_node_fs43.readFileSync)(o.squashBodyFile, "utf8") : void 0
@@ -40067,15 +40325,6 @@ ${list}`);
       return;
     }
     if (closingGuardVerdict.message) console.warn(closingGuardVerdict.message);
-    if (prMeta.state !== "MERGED") {
-      const gateRepo = repoForPostCleanup ?? await requireRepo(o.repo);
-      const refusal = await requireReviewVerdict("pr merge", number, gateRepo, { withoutReview: o.withoutReview });
-      if (refusal) {
-        console.error(refusal);
-        process.exitCode = 1;
-        return;
-      }
-    }
     if (prMeta.state !== "MERGED" && !o.preserveWorktree) {
       if (!repoForPostCleanup) throw new Error("pr merge: repository is unreadable; cannot prove remote branch preservation");
       const repoSettings = await fetchRestRepoMergeSettings(repoForPostCleanup);
@@ -40157,7 +40406,7 @@ ${list}`);
       }
       return true;
     };
-    if (o.wait && !await runWaitGate()) return;
+    if (!mergifyPilot && o.wait && !await runWaitGate()) return;
     if (ciPolicy.policy === "no-ci") {
       const guard = decidePrMergeNoCiGuard(await pollGhPrChecks(number, repoArgs), ciPolicy.reason);
       if (guard.action === "refuse") throw new Error(`gh pr merge ${number}: ${guard.message}`);
@@ -40166,7 +40415,7 @@ ${list}`);
     const remoteBefore = await remoteBranchExists2(headRef, { remote });
     let upgradedToAuto = false;
     let remoteNotAttemptedReason = "preserved-delayed-cleanup";
-    const overrideBody = mergeSquashBody ? { ...writeSquashBodyFile(mergeSquashBody), text: mergeSquashBody } : await composeOverrideBodyFile(
+    const overrideBody = mergifyPilot ? void 0 : mergeSquashBody ? { ...writeSquashBodyFile(mergeSquashBody), text: mergeSquashBody } : await composeOverrideBodyFile(
       number,
       repoArgs,
       async (a, t) => (await execFileP("gh", a, { timeout: t })).stdout,
@@ -40246,7 +40495,15 @@ ${list}`);
     });
     try {
       try {
-        await mergeOnce();
+        if (mergifyPilot) {
+          const queue = await requestMergifyMerge(number, repoForPostCleanup, closingGuardInput.text, headRefOid);
+          if (queue.state !== "merged") {
+            console.log(JSON.stringify({ mergeStatus: "failed", pr: number, repo: repoForPostCleanup, queue }));
+            process.exitCode = queue.state === "refused" ? 1 : PR_CHECKS_TIMEOUT_EXIT_CODE;
+            return;
+          }
+          remoteNotAttemptedReason = "pr-already-merged";
+        } else await mergeOnce();
       } catch (e) {
         if (!(e instanceof PrHeadBehindBaseError)) throw e;
         const localCheckedOut = !foreignCwd && await prHeadCheckedOutHere(headRef, targetRepo2, Boolean(o.repo));
@@ -40718,13 +40975,13 @@ ${SSH_RECIPE_AGENT_NOTE}`);
 
 // src/dist-drift.ts
 var import_node_child_process17 = require("node:child_process");
-var import_node_crypto12 = require("node:crypto");
+var import_node_crypto13 = require("node:crypto");
 var import_node_fs46 = require("node:fs");
 var import_node_os21 = require("node:os");
 var import_node_path42 = require("node:path");
 
 // ../scripts/distribution-digest.mjs
-var import_node_crypto11 = require("node:crypto");
+var import_node_crypto12 = require("node:crypto");
 var import_node_fs45 = require("node:fs");
 var import_node_path41 = require("node:path");
 var slash = (value) => value.replaceAll("\\", "/");
@@ -40737,7 +40994,7 @@ function repoPath(root, declaredPath, label) {
   return target;
 }
 function digestFiles(files) {
-  const hash = (0, import_node_crypto11.createHash)("sha256");
+  const hash = (0, import_node_crypto12.createHash)("sha256");
   for (const file of [...files].sort((a, b) => a.relative.localeCompare(b.relative))) {
     const content = file.stat.isSymbolicLink() ? Buffer.from((0, import_node_fs45.readlinkSync)(file.absolute), "utf8") : (0, import_node_fs45.readFileSync)(file.absolute);
     hash.update(file.relative, "utf8");
@@ -40767,7 +41024,7 @@ var DIST_ARTIFACTS = [
 ];
 var BOM_DIST_TREE_ID = "mmi-cli-dist";
 var ABSENT = "absent";
-var sha256 = (bytes) => `sha256:${(0, import_node_crypto12.createHash)("sha256").update(bytes).digest("hex")}`;
+var sha256 = (bytes) => `sha256:${(0, import_node_crypto13.createHash)("sha256").update(bytes).digest("hex")}`;
 function artifactDrift(path2, committedBytes, rebuiltBytes) {
   const committed = committedBytes ? sha256(committedBytes) : ABSENT;
   const rebuiltExpected = rebuiltBytes ? sha256(rebuiltBytes) : ABSENT;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "4.3.19",
+  "version": "4.3.21",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",