@opengsd/gsd-path 1.6.0 → 1.6.2

package/scripts/model_policy.py

@@ -196,7 +196,14 @@ def task_settings(path):
 
 def native_record(args):
     """The parent owns lifecycle; release requires its recorded terminal-result receipt."""
+    # A relative path would resolve against cwd, which may be the immutable runtime store.
+    if not args.record.is_absolute():
+        raise PolicyError(f'--record must be an absolute path: {args.record}')
     record = args.record.resolve()
+    missing = f'release requires an existing record and terminal-result evidence: {record}'
+    # Check before log_lock creates the record directory and its lock file.
+    if args.action == 'release' and not record.exists():
+        raise PolicyError(missing)
     with log_lock({'log': str(record)}):
         data = read_json(record) if record.exists() else None
         identity = {'repo': str(args.repo.resolve()), 'project_dir': args.project_dir,
@@ -209,7 +216,7 @@ def native_record(args):
             raise PolicyError(f'record belongs to another assignment or milestone/track/cycle ({differing})')
         if args.action == 'release':
             if data is None or not args.terminal_result:
-                raise PolicyError('release requires an existing record and terminal-result evidence')
+                raise PolicyError(missing)
             data.update(active=False, terminal_result=args.terminal_result)
         else:
             if args.capabilities is None:

package/scripts/pipeline_git.py

@@ -484,7 +484,12 @@ def _require_tag_integration_proof(
         "1",
         landing,
     ).stdout.split()
-    if len(parents) != 3 or parents[2] != ship:
+    rebased = (
+        mode == "pull-request"
+        and len(parents) == 2
+        and _common.rebase_landing_problem(repo, ship, landing) is None
+    )
+    if not rebased and (len(parents) != 3 or parents[2] != ship):
         raise PipelineGitError(f"{mode} integration proof has invalid merge topology")
     first_parent = _run_git(repo, "rev-list", "--first-parent", base).stdout.splitlines()
     if landing not in first_parent:
@@ -694,6 +699,7 @@ def retire_previous_branch(
     expected_sha: str,
     *,
     allow_remote_absent: bool = False,
+    rebased: bool = False,
 ) -> None:
     """Delete an integrated previous bound branch, locally and on origin.
 
@@ -741,7 +747,8 @@ def retire_previous_branch(
     if _ref_exists(repo, tracking_ref):
         _run_git(repo, "update-ref", "-d", tracking_ref)
     if _ref_exists(repo, local_ref):
-        _run_git(repo, "branch", "-d", previous_branch)
+        # A rebased ship is not an ancestor of HEAD, so -d would refuse it.
+        _run_git(repo, "branch", "-D" if rebased else "-d", previous_branch)
 
 
 def _retire_members(repo: Path, ship_sha: str) -> None:
@@ -840,9 +847,15 @@ def bind_next_milestone_branch(
         landing_sha,
         check=False,
     )
-    if integrated.returncode == 1:
+    # A forge rebase merge lands copies of the ship commits (#418); the
+    # pull-request milestone tag must then prove the landing.
+    rebased = (
+        integrated.returncode == 1
+        and _common.rebase_landing_problem(repo, ship_sha, landing_sha) is None
+    )
+    if integrated.returncode == 1 and not rebased:
         raise PipelineGitError("milestone landing does not contain the ship commit")
-    if integrated.returncode != 0:
+    if integrated.returncode not in (0, 1):
         detail = integrated.stderr.strip() or integrated.stdout.strip()
         raise PipelineGitError(f"could not verify milestone landing: {detail}")
     landing_integrated = _run_git(
@@ -858,7 +871,7 @@ def bind_next_milestone_branch(
     if landing_integrated.returncode != 0:
         detail = landing_integrated.stderr.strip() or landing_integrated.stdout.strip()
         raise PipelineGitError(f"could not verify integrated branch: {detail}")
-    if allow_remote_absent:
+    if allow_remote_absent or rebased:
         proven_landing = _require_tag_integration_proof(
             repo,
             ship_sha,
@@ -994,6 +1007,7 @@ def bind_next_milestone_branch(
         allow_remote_absent=(
             allow_remote_absent or journal["stage"] in {"switched", "retired"}
         ),
+        rebased=rebased,
     )
     _retire_members(repo, ship_sha)
     journal["stage"] = "retired"

package/scripts/pipeline_state.py

@@ -1024,7 +1024,9 @@ def _bind_next_journal_recovery(
     )
     if resolved_landing.returncode != 0 or resolved_landing.stdout.strip() != landing:
         raise PipelineStateError("bind-next journal landing is not an existing full SHA")
-    if not _is_ancestor(repo, ship, landing):
+    if not _is_ancestor(repo, ship, landing) and _common.rebase_landing_problem(
+        repo, ship, landing
+    ) is not None:
         raise PipelineStateError("bind-next journal landing does not contain ship")
     if not _is_ancestor(repo, landing, base):
         raise PipelineStateError("bind-next journal landing is not an ancestor of base")

package/scripts/state_promote.py

@@ -343,6 +343,67 @@ def _completed_promotion(
     }
 
 
+def _ruling_rows(text: str) -> dict[str, list[str]]:
+    """Map Queue # to the cells of each `## User rulings` table row."""
+    rows: dict[str, list[str]] = {}
+    in_rulings = False
+    for line in text.splitlines():
+        if line == "## User rulings":
+            in_rulings = True
+            continue
+        if in_rulings and line.startswith("## "):
+            break
+        if in_rulings and line.lstrip().startswith("|"):
+            cells = [cell.strip() for cell in line.strip().strip("|").split("|")]
+            if len(cells) == 4 and cells[0].isdigit():
+                rows[cells[0]] = cells
+    return rows
+
+
+def _superseded_carry_forward(
+    repo: Path,
+    active_state: PipelineState,
+    source: Path,
+    destination: Path,
+) -> bool:
+    """True when active research is only the shipped DOCS-AUDIT carry-forward
+    and the lookahead audit keeps every one of its rulings."""
+    if not active_state.archive or destination.is_symlink() or not destination.is_dir():
+        return False
+    archived = repo / active_state.archive / "research" / "DOCS-AUDIT.md"
+    active = destination / "DOCS-AUDIT.md"
+    lookahead = source / "DOCS-AUDIT.md"
+    entries = [
+        path for path in destination.iterdir() if not state_checkpoint._is_junk_file(path)
+    ]
+    if entries != [active] or any(
+        path.is_symlink() or not path.is_file() for path in (archived, active, lookahead)
+    ):
+        return False
+    carried = active.read_bytes()
+    if carried != archived.read_bytes():
+        return False
+    rulings = _ruling_rows(carried.decode("utf-8"))
+    if not any(cells[3] == "no" for cells in rulings.values()):
+        return False
+    kept = _ruling_rows(lookahead.read_text(encoding="utf-8"))
+    for number, cells in rulings.items():
+        other = kept.get(number)
+        # Plan may record a T### for a pending ruling; nothing else may change.
+        if (
+            other is None
+            or other[:3] != cells[:3]
+            or (
+                other[3] != cells[3]
+                and not (cells[3] == "no" and re.fullmatch(r"T\d{3}", other[3]))
+            )
+        ):
+            raise PipelineStateError(
+                f"lookahead DOCS-AUDIT.md does not keep carry-forward ruling #{number}"
+            )
+    return True
+
+
 def _prepare_promotion(
     repo: Path,
     project: Path,
@@ -475,12 +536,17 @@ def _prepare_promotion(
         raise PipelineStateError("lookahead STATE branch and archive must be null")
 
     tracks: dict[str, str] = {}
+    carry_forward: Optional[str] = None
     for name in PROMOTION_TRACKS:
         source = next_root / name
         destination = project / name
         if source.exists() or source.is_symlink():
             if destination.exists() or destination.is_symlink():
-                raise PipelineStateError(f"promotion destination already exists: {destination}")
+                if name != "research" or not _superseded_carry_forward(
+                    repo, active_state, source, destination
+                ):
+                    raise PipelineStateError(f"promotion destination already exists: {destination}")
+                carry_forward = state_checkpoint._tree_digest(destination)
             tracks[name] = state_checkpoint._tree_digest(source)
     if not tracks:
         raise PipelineStateError("lookahead track has no promotable artifacts")
@@ -507,6 +573,7 @@ def _prepare_promotion(
         "landing": landing,
         "base": base,
         "tracks": tracks,
+        "carry_forward_sha256": carry_forward,
         "residual_sha256": state_checkpoint._tree_digest(next_root, tuple(tracks)),
         "next_state_sha256": state_checkpoint._sha256(next_text),
         "active_state_sha256": state_checkpoint._sha256(active_text),
@@ -559,6 +626,15 @@ def _resume_track_moves(project: Path, journal: dict[str, object], path: Path) -
         destination = project / name
         source_exists = source.exists() or source.is_symlink()
         destination_exists = destination.exists() or destination.is_symlink()
+        carry_forward = journal.get("carry_forward_sha256")
+        if name == "research" and source_exists and destination_exists and carry_forward:
+            if state_checkpoint._tree_digest(destination) != carry_forward:
+                raise PipelineStateError("DOCS-AUDIT carry-forward drifted during promotion")
+            # The archive and the ship commit keep the carry-forward copy.
+            shutil.rmtree(destination)
+            journal["stage"] = "removed:carry-forward"
+            pipeline_state._write_json(path, journal)
+            destination_exists = False
         if source_exists and destination_exists:
             raise PipelineStateError(f"promotion has both source and destination: {name}")
         if not source_exists and not destination_exists:

package/skills/gsd-path/BUILD.md

@@ -130,7 +130,9 @@ STATE.md-only "finalize" checkpoint for work already checkpointed. The helper
 refuses a `build:` checkpoint that deletes or renames a `.project/tasks/`
 brief unless the canonical `build: abandon milestone <slug>` checkpoint moves
 that same brief into `.project/archive/`; build adds fix tasks and repairs
-briefs, it never replans.
+briefs, it never replans. It also refuses a `build:` checkpoint while the
+committed STATE is `ship/active`: final-review outputs stay uncommitted until
+the ship commit.
 
 ## Execute from runtime receipts
 

package/skills/gsd-path/PLAN.md

@@ -263,8 +263,9 @@ as stated in Lookahead mode.
 
    Before approval, the helper validates the task graph and brief paths.
    Pending briefs may reference files supplied by transitive dependencies.
-   Landed briefs use their recorded historical base, with no dependency-file
-   allowance, so later file changes do not invalidate immutable briefs.
+   A landed brief is immutable history: the helper checks its `files` scope
+   at the recorded historical base and does not check the paths that its
+   prose and Verify name.
    This applies to plan re-approval too; the dispatch CLI remains HEAD-only
    with no overrides.
 

package/skills/gsd-path/SHIP.md

@@ -69,7 +69,8 @@ so the position is unchanged. Then:
    task logs prove it is the immediately preceding `ship/blocked` finding
    set, the approved patch tasks copied every finding verbatim, and those tasks
    are now done; otherwise it blocks. Git history preserves the superseded
-   finding, while final review itself still creates no pre-ship commit.
+   finding, while final review itself still creates no pre-ship commit
+   (`isolation.py checkpoint` refuses a `build:` checkpoint at `ship/active`).
 2. Derive a stable numbered list of cross-wave integration risks from
    interfaces and flows that span waves. List only genuine risks that could
    plausibly fail; never pad the list. Include PLAN.md's project Verify as
@@ -341,13 +342,18 @@ The persisted `STATE.archive` field is the transaction identity.
      PR is open, the helper returns `status: awaiting-merge`. Present
      **Outcome**, link
      the returned PR as **Review**, and state in **Next** that the user must
-     merge it with GitHub's merge-commit method. Stop this ship invocation;
-     Path never enables auto-merge or merges the PR. On rerun after a human
-     GitHub user merges it, the helper requires the PR head to remain the ship
-     commit and its landing to be a two-parent merge with that ship commit as
-     second parent on `origin/main` first-parent history. It then writes and
-     pushes the annotated milestone tag containing the PR URL, ship SHA, and
-     landing SHA. A closed unmerged PR, squash, rebase, merge queue, moved
+     merge it with GitHub's merge-commit or rebase method. Stop this ship
+     invocation; Path never enables auto-merge or merges the PR. On rerun after
+     a human GitHub user merges it, the helper requires the PR head to remain
+     the ship commit and its landing to be on `origin/main` first-parent
+     history as either a two-parent merge with that ship commit as second
+     parent, or a rebase merge: the last of a first-parent run of single-parent
+     commits whose `git patch-id --stable` values match, in order, the
+     non-merge commits from the landing to the ship commit (with equal trees
+     when `main` did not move). It then writes and pushes the annotated
+     milestone tag containing the PR URL, ship SHA, and landing SHA. A
+     milestone that was rebase-merged before this support existed recovers by
+     rerunning ship. A closed unmerged PR, squash, merge queue, moved
      head, duplicate PR, or non-GitHub.com origin blocks. The remote bound
      branch may be absent after a valid merge because GitHub may auto-delete it.
    - `external-landing` is for an origin where Path cannot open the review

package/skills/gsd-path/references/model-policy.md

@@ -70,7 +70,9 @@ settings block; their default inheritance remains usable.
 Resolve the bundled helper to an absolute path. Use one record under the Git
 common directory's `gsd-path/model-selection/` directory per assignment. Scope
 the path and `--scope` to the milestone, active/lookahead track, and review cycle
-where applicable; later work must not reuse an earlier record.
+where applicable; later work must not reuse an earlier record. The helper
+refuses a relative `--record`, and `release` of a missing record names the
+path and creates nothing.
 
 ```text
 python3 -B <helper> resolve --repo <primary> --scope <milestone/track/cycle> --assignment <logical-name> --role <role> --record <absolute-record> --capabilities <advertised-json>

package/skills/gsd-path/references/operating-rules.md

@@ -136,8 +136,9 @@ bundles this file; spawned agents follow their role brief instead.
   for the current STATE.branch milestone must be an ancestor of origin/main;
   if it is not, that milestone's integration is incomplete and control routes
   to ship, not build. Direct mode requires the matching canonical `integrate:`
-  commit; PR mode requires tag metadata and a two-parent merge whose second
-  parent is the ship commit. A null branch returns
+  commit; PR mode requires tag metadata and either a two-parent merge whose
+  second parent is the ship commit or a proven rebase merge of the ship
+  commits. A null branch returns
   to the router; build never creates, selects, switches, or rebinds it.
 - The ship phase makes exactly one commit on the bound branch — the
   `.project/`-only ship commit recording

package/skills/gsd-path/references/runtime-selection.md

@@ -27,7 +27,8 @@ helper: run the bundled copy until the project runtime is upgraded.
 `dispatch_driver.py` and `workflow_run.py` always run from the installed skill
 bundle, because they read role briefs and templates from it; a skill update
 replaces them, a runtime upgrade does not. The driver reloads the helper modules
-that it imports from the selected runtime.
+that it imports from the selected runtime, and runs the subprocess helpers that
+the runtime lists (such as the fix-task brief lint) from it.
 
 With no declaration, retain the legacy helper lookup. An existing
 `.gsd-path/runtime/` requires the explicit `--runtime-migrate --project PATH`

package/skills/gsd-path/scripts/_common.py

@@ -361,6 +361,49 @@ def run_git(
     return _run_exact(git_command(repo, *arguments), input=input)
 
 
+def _patch_ids(repo: Path, commits: Sequence[str]) -> list[Optional[str]]:
+    """`git patch-id --stable` per commit, in order; None for an empty commit."""
+    log = run_git(repo, "log", "--no-walk=unsorted", "-p", "--binary", "--no-color",
+                  "--no-ext-diff", *commits)
+    if log.returncode != 0:
+        raise ValueError("could not read commit patches")
+    ids = run_git(repo, "patch-id", "--stable", input=log.stdout)
+    if ids.returncode != 0:
+        raise ValueError("could not compute patch ids")
+    by_commit = {commit: patch for patch, commit in (line.split() for line in ids.stdout.splitlines())}
+    return [by_commit.get(commit) for commit in commits]
+
+
+def rebase_landing_problem(repo: Path, ship: str, landing: str) -> Optional[str]:
+    """Why landing is not a forge rebase merge of ship, or None when it is (#418).
+
+    A rebase merge replays ship's own commits onto the default branch. Proof:
+    the first-parent run that ends at landing has one non-merge commit per
+    non-merge commit of landing..ship, with equal patch ids in the same order;
+    when that run starts at ship's fork point, landing's tree equals ship's.
+    """
+    listed = run_git(repo, "rev-list", "--reverse", "--topo-order", "--no-merges", f"{landing}..{ship}")
+    if listed.returncode != 0:
+        return "could not list the ship commits"
+    originals = listed.stdout.split()
+    if not originals:
+        return "landing already contains the ship commit"
+    walked = run_git(repo, "rev-list", "--first-parent", "--parents", "-n", str(len(originals)), landing)
+    rows = [line.split() for line in walked.stdout.splitlines()][::-1]
+    if walked.returncode != 0 or len(rows) != len(originals) or any(len(row) != 2 for row in rows):
+        return "landing is not a linear run of rebased commits"
+    try:
+        if _patch_ids(repo, originals) != _patch_ids(repo, [row[0] for row in rows]):
+            return "rebased commits do not replay the ship commits in order"
+    except ValueError as error:
+        return str(error)
+    fork = run_git(repo, "merge-base", ship, landing).stdout.strip()
+    trees = run_git(repo, "rev-parse", f"{ship}^{{tree}}", f"{landing}^{{tree}}").stdout.split()
+    if rows[0][1] == fork and (len(trees) != 2 or trees[0] != trees[1]):
+        return "rebased tree differs from the ship tree"
+    return None
+
+
 def git_command(repo: Path, *arguments: str) -> tuple[str, ...]:
     """Git argv for repo, including WSL drvfs workarounds when needed."""
     return ("git", "-C", str(repo), *git_drvfs_config_flags(repo), *arguments)

package/skills/gsd-path/scripts/check_task_briefs.py

@@ -387,7 +387,9 @@ def _lint_task(
                     )
                     break
 
-    for name in PROSE_SECTIONS:
+    # A landed brief is history that nobody can edit: only an unlanded brief must name present paths.
+    landed = task_id in (landed_bases or {})
+    for name in () if landed else PROSE_SECTIONS:
         body = sections.get(name)
         if body is None or not _clean(body):
             continue
@@ -400,8 +402,6 @@ def _lint_task(
                 and token not in supplied
                 and not _supplied_contract(repo, path, token)
                 and not _pipeline_workspace_file(repo, path, token)
-                # A landed brief is history: the pipeline moves its own files (build recovery, archive) later.
-                and not (task_id in (landed_bases or {}) and _pipeline_workspace_path(repo, path, token))
                 and not _base_exists(git_root, base, token)
             ):
                 problems.append(f"## {name} names a path missing at the layer base: {token}")
@@ -411,7 +411,7 @@ def _lint_task(
         block = VERIFY_BLOCK_PATTERN.search(verify_body)
         if block is None or not block.group("block").strip():
             problems.append("## Verify must contain a non-empty fenced bash block")
-        else:
+        elif not landed:
             for token in _verify_tokens(
                 block.group("block"),
                 repo=repo,
@@ -448,9 +448,10 @@ def validate_task_briefs(
 
     Plain lint uses the layer base without overrides. Plan approval and dispatch
     supply transitive dependency files for unlanded tasks and resolved historical
-    bases for landed tasks, whose immutable briefs must survive later file changes.
+    bases for landed tasks. A landed brief is immutable: its `files` scope is
+    checked at that base, and the paths its prose and Verify name are not checked.
     The caller validates the task graph and landed metadata before supplying
-    these mappings; landed tasks receive no dependency-file allowance.
+    these mappings.
     """
 
     resolved_base = _resolve_base(root, base)
@@ -481,6 +482,9 @@ def validate_task_briefs(
     for shape, task_ids in contracts.items():
         if len(task_ids) == 1:
             task_id = next(iter(task_ids))
+            # A landed brief is history: a later repair may reword the bullet in its partner.
+            if task_id in (landed_bases or {}):
+                continue
             problems.append(
                 f"{task_id}: interface contract is not shared by any other task: {shape}"
             )
@@ -592,7 +596,6 @@ def plan_validation_bases(
                 )
             except IsolationError as error:
                 raise BriefError(f"{task_id} landed task has invalid historical base: {error}") from error
-            dependency_files[task_id] = set()
     except check_handoffs.HandoffError as error:
         raise BriefError(str(error)) from error
     return tasks, dependency_files, landed_bases

package/skills/gsd-path/scripts/dispatch_driver.py

@@ -117,9 +117,21 @@ def _refresh_stop_errors() -> None:
                    model_policy.PolicyError)
 
 
+# The selected Project runtime directory once _reload_pinned_modules ran; None keeps bundled helpers.
+_RUNTIME_ROOT: Optional[Path] = None
+
+
+def helper_script(name: str) -> Path:
+    """A subprocess helper from the selected runtime when it ships one, else the bundled sibling."""
+    if _RUNTIME_ROOT is not None and (_RUNTIME_ROOT / name).is_file():
+        return _RUNTIME_ROOT / name
+    return Path(__file__).resolve().parent / name
+
+
 def _reload_pinned_modules(runtime_root: Path) -> None:
     global isolation, build_state, task_context, contracts, pipeline_state
-    global archive_milestone, review_findings, model_policy
+    global archive_milestone, review_findings, model_policy, _RUNTIME_ROOT
+    _RUNTIME_ROOT = runtime_root
     if _bundled_helpers():
         path = str(runtime_root)
         if path not in sys.path:
@@ -981,7 +993,7 @@ class Round:
                 diagnose = shlex.join([
                     sys.executable,
                     "-B",
-                    str(Path(__file__).with_name("pipeline_diagnose.py")),
+                    str(helper_script("pipeline_diagnose.py")),
                     "diagnose",
                     "--repo",
                     str(self.primary),
@@ -1677,8 +1689,8 @@ class Review:
 
 
 def helper_json(receipt: Dict[str, object], script: str, *arguments: str, cwd: Path) -> Dict[str, object]:
-    """Run a bundled helper and return its JSON stdout; a non-zero exit is a typed stop."""
-    command = [sys.executable, "-B", str(Path(__file__).resolve().parent / script), *arguments]
+    """Run a helper (runtime-selected, else bundled) and return its JSON stdout; a non-zero exit is a typed stop."""
+    command = [sys.executable, "-B", str(helper_script(script)), *arguments]
     completed = subprocess.run(command, cwd=cwd, capture_output=True, encoding="utf-8", errors="replace")
     step = {"script": script, "command": command, "exit_code": completed.returncode,
             "stdout": completed.stdout, "stderr": completed.stderr}
@@ -2290,7 +2302,7 @@ Heavy: {'yes' if heavy else 'no'}
         if plan_changed:
             _common.atomic_write(plan_path, updated)
         receipt["plan_wave"] = fix_wave
-        lint = subprocess.run([sys.executable, "-B", str(Path(__file__).resolve().parent / "check_task_briefs.py"),
+        lint = subprocess.run([sys.executable, "-B", str(helper_script("check_task_briefs.py")),
                                "--repo", str(primary), "--base", isolation.current_sha(primary),
                                "--tasks-dir", f"{options.project_dir}/tasks",
                                "--project-dir", options.project_dir], capture_output=True, encoding="utf-8", errors="replace")

package/skills/gsd-path/scripts/git_guard.py

@@ -69,6 +69,11 @@ PUBLICATION_HINT = (
     "(STATE shipped/done) through archive_milestone.py integrate; findings during "
     "ship reopen through the patch plan (see SHIP.md)"
 )
+AUTHORIZED_PUSH_HINT = (
+    "an owner-approved push of one exact commit to a branch other than the bound "
+    "or default branch needs refs/gsd-path/authorizations/<project>/push/<ref> "
+    "at that commit (see HOOKS.md)"
+)
 LEGACY_STATE_FIELDS = {
     "pipeline",
     "project",
@@ -621,14 +626,25 @@ def pre_push_violations(lines):
             continue
         state = state_at(local_sha)
         owed = unshipped_bound_branch(state) if state is not None else None
-        if owed is not None:
+        if owed is not None and not authorized_publication(state, remote_ref, local_sha):
             found.append(
                 f"{remote_ref} <- {local_sha[:12]} carries unshipped {owed} work "
-                f"({state.get('phase')}/{state.get('status')}); {PUBLICATION_HINT}"
+                f"({state.get('phase')}/{state.get('status')}); {PUBLICATION_HINT}; "
+                f"{AUTHORIZED_PUSH_HINT}"
             )
     return found
 
 
+def authorized_publication(state, remote_ref, sha):
+    """The owner authorized this exact commit on this one non-default branch."""
+    project = state.get("project")
+    if not isinstance(project, str) or not members.NAME_RE.fullmatch(project):
+        return False
+    if not remote_ref.startswith("refs/heads/") or remote_ref == f"refs/heads/{default_branch()}":
+        return False
+    return members.authorized(repo_root(), project, "push", remote_ref, sha)
+
+
 def is_ship_commit(subject):
     return bool(subject and subject.strip().casefold().startswith("ship:"))
 

package/skills/gsd-path/scripts/integration.py

@@ -845,6 +845,8 @@ def require_pull_request_merge(
     merge_commit: str,
     ship_commit: str,
     remote_default: str,
+    *,
+    allow_rebase: bool = False,
 ) -> None:
     resolved = optional_ref(project, merge_commit)
     if resolved != merge_commit:
@@ -853,9 +855,16 @@ def require_pull_request_merge(
         run_git(project, "rev-list", "--parents", "-n", "1", merge_commit),
         "inspect pull-request merge parents",
     ).split()
-    if len(parents) != 3:
+    if allow_rebase and len(parents) == 2:
+        problem = _common.rebase_landing_problem(project, ship_commit, merge_commit)
+        if problem is not None:
+            raise ArchiveError(
+                "pull-request integration must use a two-parent merge commit "
+                f"or a rebase merge of the ship commits: {problem}"
+            )
+    elif len(parents) != 3:
         raise ArchiveError("pull-request integration must use a two-parent merge commit")
-    if parents[2] != ship_commit:
+    elif parents[2] != ship_commit:
         raise ArchiveError("pull-request merge second parent is not the ship commit")
     first_parent = archive_milestone.require_git_success(
         run_git(project, "rev-list", "--first-parent", remote_default),
@@ -1026,7 +1035,9 @@ def integrate_pull_request(
         merge_commit,
     )
     remote_default = refresh_origin(project)["remote_default"]
-    require_pull_request_merge(project, merge_commit, ship_commit, remote_default)
+    require_pull_request_merge(
+        project, merge_commit, ship_commit, remote_default, allow_rebase=True
+    )
     pull = update_pull_request_body(
         repository,
         pull,
@@ -1473,7 +1484,9 @@ def validate_integrated(
             pull["number"],
             merge_commit,
         )
-        require_pull_request_merge(project, merge_commit, ship_commit, remote_default)
+        require_pull_request_merge(
+            project, merge_commit, ship_commit, remote_default, allow_rebase=True
+        )
         require_annotated_tag(
             project,
             tag_ref,