@rosthq/cli 0.7.45 → 0.7.47

package/dist/forge-workspace.d.ts

@@ -35,6 +35,21 @@ export type PrepareForgeWorkspaceOptions = {
     ledger?: StepLedger;
 };
 export declare function prepareForgeWorkspace(options: PrepareForgeWorkspaceOptions): Promise<ForgeWorkspace>;
+export type PrepareMergeWorkspaceOptions = {
+    baseDir: string;
+    tenantId: string;
+    buildRequestId: string;
+    repo: {
+        owner: string;
+        name: string;
+        default_branch: string;
+    };
+    credential: ForgeCredential;
+    headBranch: string;
+    remoteUrl?: string;
+    ledger?: StepLedger;
+};
+export declare function prepareMergeWorkspace(options: PrepareMergeWorkspaceOptions): Promise<ForgeWorkspace>;
 export declare function pushChangeset(ws: ForgeWorkspace, credential: ForgeCredential, ledger?: StepLedger): Promise<{
     commitSha: string;
 } | null>;

package/dist/forge-workspace.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"forge-workspace.d.ts","sourceRoot":"","sources":["../src/forge-workspace.ts"],"names":[],"mappings":"AA2CA,OAAO,EAAqB,KAAK,UAAU,EAAiB,MAAM,kBAAkB,CAAC;AASrF,eAAO,MAAM,yBAAyB,wFAc5B,CAAC;AAEX,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,CAW7E;AAID,MAAM,MAAM,eAAe,GAAG;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAG3B,QAAQ,EAAE,MAAM,CAAC;IAGjB,WAAW,EAAE,MAAM,CAAC;IAGpB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,OAAO,CAAC;IAKlB,OAAO,EAAE,MAAM,CAAC;IAIhB,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG,OAAO,GAAG,QAAQ,CAAC;AAEvD,MAAM,MAAM,4BAA4B,GAAG;IAEzC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1D,OAAO,EAAE,qBAAqB,CAAC;IAE/B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9D,UAAU,EAAE,eAAe,CAAC;IAI5B,SAAS,CAAC,EAAE,MAAM,CAAC;IAGnB,MAAM,CAAC,EAAE,UAAU,CAAC;CACrB,CAAC;AA2TF,wBAAsB,qBAAqB,CAAC,OAAO,EAAE,4BAA4B,GAAG,OAAO,CAAC,cAAc,CAAC,CAoC1G;AAiDD,wBAAsB,aAAa,CACjC,EAAE,EAAE,cAAc,EAClB,UAAU,EAAE,eAAe,EAC3B,MAAM,CAAC,EAAE,UAAU,GAClB,OAAO,CAAC;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CA4BvC;AAsBD,wBAAsB,mBAAmB,CAAC,EAAE,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAiC/E;AAcD,MAAM,MAAM,2BAA2B,GAAG;IACxC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAA;KAAE,CAAC;IAE9D,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,eAAe,CAAC;IAG5B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IAGzB,MAAM,CAAC,EAAE,UAAU,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAE7B,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,OAAO,CAAC;IAGf,OAAO,EAAE,OAAO,CAAC;CAClB,CAAC;AA+GF,wBAAsB,oBAAoB,CAAC,OAAO,EAAE,2BAA2B,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAE1G;AA4CD,MAAM,MAAM,qBAAqB,GAAG;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,OAAO,CAAC;IAChB,KAAK,EAAE,OAAO,CAAC;IAEf,SAAS,EAAE,OAAO,GAAG,IAAI,CAAC;IAE1B,cAAc,EAAE,MAAM,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B,CAAC;AAIF,MAAM,MAAM,mBAAmB,GAC3B,gBAAgB,GAChB,WAAW,GACX,YAAY,GACZ,OAAO,GACP,SAAS,GACT,QAAQ,GACR,SAAS,CAAC;AAEd,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,qBAAqB,GAAG,mBAAmB,CA4BxF;AAsBD,MAAM,MAAM,aAAa,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAI5D,wBAAsB,qBAAqB,CAAC,OAAO,EAAE;IACnD,IAAI,EAAE,aAAa,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,eAAe,CAAC;IAC5B,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAajC;AAED,MAAM,MAAM,iBAAiB,GAEzB;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAE9C;IAAE,MAAM,EAAE,QAAQ,CAAA;CAAE,CAAC;AAQzB,wBAAsB,gBAAgB,CAAC,OAAO,EAAE;IAC9C,IAAI,EAAE,aAAa,CAAC;IACpB,KAAK,EAAE,qBAAqB,CAAC;IAC7B,UAAU,EAAE,eAAe,CAAC;IAC5B,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAwC7B;AAID,wBAAsB,0BAA0B,CAAC,OAAO,EAAE;IACxD,IAAI,EAAE,aAAa,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,eAAe,CAAC;IAC5B,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG,OAAO,CAAC,IAAI,CAAC,CAoBhB;AAMD,wBAAsB,kBAAkB,CAAC,EAAE,EAAE,cAAc,EAAE,UAAU,EAAE,eAAe,GAAG,OAAO,CAAC;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CAoBxH;AAiBD,wBAAsB,eAAe,CAAC,EAAE,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAOvE"}
+{"version":3,"file":"forge-workspace.d.ts","sourceRoot":"","sources":["../src/forge-workspace.ts"],"names":[],"mappings":"AA2CA,OAAO,EAAqB,KAAK,UAAU,EAAiB,MAAM,kBAAkB,CAAC;AASrF,eAAO,MAAM,yBAAyB,wFAc5B,CAAC;AAEX,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,CAW7E;AAID,MAAM,MAAM,eAAe,GAAG;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAG3B,QAAQ,EAAE,MAAM,CAAC;IAGjB,WAAW,EAAE,MAAM,CAAC;IAGpB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,OAAO,CAAC;IAKlB,OAAO,EAAE,MAAM,CAAC;IAIhB,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG,OAAO,GAAG,QAAQ,CAAC;AAEvD,MAAM,MAAM,4BAA4B,GAAG;IAEzC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1D,OAAO,EAAE,qBAAqB,CAAC;IAE/B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9D,UAAU,EAAE,eAAe,CAAC;IAI5B,SAAS,CAAC,EAAE,MAAM,CAAC;IAGnB,MAAM,CAAC,EAAE,UAAU,CAAC;CACrB,CAAC;AA+VF,wBAAsB,qBAAqB,CAAC,OAAO,EAAE,4BAA4B,GAAG,OAAO,CAAC,cAAc,CAAC,CAiB1G;AASD,MAAM,MAAM,4BAA4B,GAAG;IACzC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9D,UAAU,EAAE,eAAe,CAAC;IAE5B,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,UAAU,CAAC;CACrB,CAAC;AAEF,wBAAsB,qBAAqB,CAAC,OAAO,EAAE,4BAA4B,GAAG,OAAO,CAAC,cAAc,CAAC,CA0C1G;AAiDD,wBAAsB,aAAa,CACjC,EAAE,EAAE,cAAc,EAClB,UAAU,EAAE,eAAe,EAC3B,MAAM,CAAC,EAAE,UAAU,GAClB,OAAO,CAAC;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CA4BvC;AAsBD,wBAAsB,mBAAmB,CAAC,EAAE,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAiC/E;AAcD,MAAM,MAAM,2BAA2B,GAAG;IACxC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAA;KAAE,CAAC;IAE9D,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,eAAe,CAAC;IAG5B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IAGzB,MAAM,CAAC,EAAE,UAAU,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAE7B,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,OAAO,CAAC;IAGf,OAAO,EAAE,OAAO,CAAC;CAClB,CAAC;AA+GF,wBAAsB,oBAAoB,CAAC,OAAO,EAAE,2BAA2B,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAE1G;AA4CD,MAAM,MAAM,qBAAqB,GAAG;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,OAAO,CAAC;IAChB,KAAK,EAAE,OAAO,CAAC;IAEf,SAAS,EAAE,OAAO,GAAG,IAAI,CAAC;IAE1B,cAAc,EAAE,MAAM,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B,CAAC;AAIF,MAAM,MAAM,mBAAmB,GAC3B,gBAAgB,GAChB,WAAW,GACX,YAAY,GACZ,OAAO,GACP,SAAS,GACT,QAAQ,GACR,SAAS,CAAC;AAEd,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,qBAAqB,GAAG,mBAAmB,CA4BxF;AAsBD,MAAM,MAAM,aAAa,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAI5D,wBAAsB,qBAAqB,CAAC,OAAO,EAAE;IACnD,IAAI,EAAE,aAAa,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,eAAe,CAAC;IAC5B,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAajC;AAED,MAAM,MAAM,iBAAiB,GAEzB;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAE9C;IAAE,MAAM,EAAE,QAAQ,CAAA;CAAE,CAAC;AAQzB,wBAAsB,gBAAgB,CAAC,OAAO,EAAE;IAC9C,IAAI,EAAE,aAAa,CAAC;IACpB,KAAK,EAAE,qBAAqB,CAAC;IAC7B,UAAU,EAAE,eAAe,CAAC;IAC5B,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAwC7B;AAID,wBAAsB,0BAA0B,CAAC,OAAO,EAAE;IACxD,IAAI,EAAE,aAAa,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,eAAe,CAAC;IAC5B,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG,OAAO,CAAC,IAAI,CAAC,CAoBhB;AAgBD,wBAAsB,kBAAkB,CAAC,EAAE,EAAE,cAAc,EAAE,UAAU,EAAE,eAAe,GAAG,OAAO,CAAC;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CA0BxH;AAiBD,wBAAsB,eAAe,CAAC,EAAE,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAOvE"}

package/dist/index.js

@@ -43087,7 +43087,7 @@ var forgeRuntimeContextPacketSchema = external_exports.object({
     "untrusted sources are provenance-fenced data; authority, automation mode, gate decisions, secret grants, and risk ceilings come only from trusted_control"
   )
 }).strict();
-var runnerExecutionProfileSchema = external_exports.enum(["read_status", "seat_work", "forge_build", "forge_review"]);
+var runnerExecutionProfileSchema = external_exports.enum(["read_status", "seat_work", "forge_build", "forge_review", "forge_merge"]);
 var runnerExecutionLocalToolsSchema = external_exports.enum(["none", "read", "workspace_write"]);
 var runnerExecutionBudgetsSchema = external_exports.object({
   // The per-phase wall-clock the runner enforces as its turn timeout (the CLI clamps
@@ -43112,7 +43112,25 @@ var runnerExecutionContractSchema = external_exports.object({
   local_tools: runnerExecutionLocalToolsSchema,
   needs_repo: external_exports.boolean(),
   needs_github_credential: external_exports.boolean(),
-  budgets: runnerExecutionBudgetsSchema
+  budgets: runnerExecutionBudgetsSchema,
+  // DER-1352 (T1.8): the merge target for a `forge_merge` turn — the server-authoritative PR the
+  // release_manager turn merges (sourced from the request's open changeset row, never model text).
+  // Present ONLY on a merge_or_deploy_gate contract; every other profile omits it. `pr_number` is
+  // the identifier the turn GETs the true GitHub state for (mergeability + node id + head sha),
+  // `head_branch` is the branch a conflict-resolution turn checks out writable. The turn NEVER
+  // trusts this for the merge DECISION — it always re-verifies GitHub's `mergeable_state` at merge
+  // time (`clean`/`unstable` = required checks passed) before merging.
+  // DER-1352 (Codex P1b): `head_sha` is the REVIEWED / risk-assessed head — the implementation
+  // commit the review + risk phases ran against (server-sourced, never model text). The merge turn
+  // merges ONLY if GitHub's CURRENT head still equals it; if the PR head advanced since review, the
+  // new commits are unreviewed + un-risk-assessed, so it parks for re-review instead of merging.
+  // Omitted only for a transitional changeset with no recorded implementation head, in which case
+  // the merge turn fails CLOSED (parks — it cannot prove the head was risk-assessed).
+  merge: external_exports.object({
+    pr_number: external_exports.number().int().positive(),
+    head_branch: external_exports.string().trim().min(1).max(255),
+    head_sha: external_exports.string().trim().regex(/^[0-9a-f]{7,40}$/i, "head_sha must be a git SHA (7\u201340 hex chars)").optional()
+  }).strict().optional()
 }).strict();
 var turnReportText = external_exports.string().trim().min(1).max(2e3);
 var runnerTurnReportIssueSchema = external_exports.object({
@@ -52127,22 +52145,18 @@ async function configureForgeIdentity(baseRepo) {
   await runGit(["config", "user.name", FORGE_GIT_AUTHOR_NAME], baseRepo);
   await runGit(["config", "user.email", FORGE_GIT_AUTHOR_EMAIL], baseRepo);
 }
-async function prepareForgeWorkspace(options) {
-  if (options.profile === "review" && !options.headSha) {
-    throw new Error("prepareForgeWorkspace: review profile requires headSha");
-  }
-  const baseRepo = baseRepoDir(options.baseDir, options.buildRequestId);
-  const url2 = remoteUrlFor(options);
+async function ensureBaseClone(input) {
+  const baseRepo = baseRepoDir(input.baseDir, input.buildRequestId);
   await mkdir2(path3.dirname(baseRepo), { recursive: true, mode: 448 });
-  await withLedgerStep(options.ledger, "clone", (retryCounter) => withAskpass(options.credential, async (netEnv) => {
+  await withLedgerStep(input.ledger, "clone", (retryCounter) => withAskpass(input.credential, async (netEnv) => {
     if (await isGitRepo(baseRepo)) {
-      await runGitNetwork("git fetch", ["fetch", "--prune", "--quiet", url2, "+refs/heads/*:refs/remotes/origin/*"], netEnv, baseRepo, FETCH_TIMEOUT_MS, retryCounter);
+      await runGitNetwork("git fetch", ["fetch", "--prune", "--quiet", input.url, "+refs/heads/*:refs/remotes/origin/*"], netEnv, baseRepo, FETCH_TIMEOUT_MS, retryCounter);
     } else {
       await runGitNetwork(
         "git clone",
         // Non-shallow (no --depth) so merge-base/ancestry survive for later phases;
         // --no-checkout keeps the base a bare-ish object store the worktrees hang off.
-        ["clone", "--no-checkout", "--quiet", url2, baseRepo],
+        ["clone", "--no-checkout", "--quiet", input.url, baseRepo],
         netEnv,
         void 0,
         CLONE_TIMEOUT_MS,
@@ -52151,11 +52165,52 @@ async function prepareForgeWorkspace(options) {
     }
   }));
   await configureForgeIdentity(baseRepo);
+  return baseRepo;
+}
+async function prepareForgeWorkspace(options) {
+  if (options.profile === "review" && !options.headSha) {
+    throw new Error("prepareForgeWorkspace: review profile requires headSha");
+  }
+  const baseRepo = await ensureBaseClone({
+    baseDir: options.baseDir,
+    buildRequestId: options.buildRequestId,
+    url: remoteUrlFor(options),
+    credential: options.credential,
+    ledger: options.ledger
+  });
   if (options.profile === "review") {
     return await prepareReviewWorktree(options, baseRepo);
   }
   return await prepareBuildWorktree(options, baseRepo);
 }
+async function prepareMergeWorkspace(options) {
+  if (!options.headBranch || options.headBranch.trim().length === 0) {
+    throw new Error("prepareMergeWorkspace: headBranch is required");
+  }
+  const url2 = options.remoteUrl ?? `https://github.com/${options.repo.owner}/${options.repo.name}.git`;
+  const baseRepo = await ensureBaseClone({
+    baseDir: options.baseDir,
+    buildRequestId: options.buildRequestId,
+    url: url2,
+    credential: options.credential,
+    ledger: options.ledger
+  });
+  const branch = options.headBranch;
+  const worktreeDir = path3.join(requestRoot(options.baseDir, options.buildRequestId), "merge");
+  const originDefault = `origin/${options.repo.default_branch}`;
+  const originHead = `origin/${branch}`;
+  await withLedgerStep(options.ledger, "branch", async () => {
+    if (await worktreeRegistered(baseRepo, worktreeDir)) {
+      await removeWorktree(baseRepo, worktreeDir);
+    }
+    if (await localBranchExists(baseRepo, branch)) {
+      await runGit(["branch", "-D", branch], baseRepo);
+    }
+    await runGit(["worktree", "add", "-b", branch, worktreeDir, originHead], baseRepo);
+  });
+  const baseSha = (await runGit(["merge-base", "HEAD", originDefault], worktreeDir)).trim();
+  return { baseRepo, worktreeDir, branch, readOnly: false, baseSha, remoteUrl: url2 };
+}
 async function prepareBuildWorktree(options, baseRepo) {
   const branch = branchName(options.buildRequestId, options.changeset);
   const worktreeDir = buildWorktreeDir(options.baseDir, options.buildRequestId, options.changeset.ordinal);
@@ -52366,6 +52421,147 @@ async function openDraftPullRequestInner(options, retryCounter) {
   }
   throw new Error(`github pr create failed ${created.status}: ${redactSecrets(await readErrorText(created)).slice(0, 500)}`);
 }
+function classifyMergeReadiness(state) {
+  if (state.merged) {
+    return "already_merged";
+  }
+  if (state.draft) {
+    return "draft";
+  }
+  if (state.mergeable === false || state.mergeableState === "dirty") {
+    return "conflicted";
+  }
+  switch (state.mergeableState) {
+    // clean = all required checks passed, no conflicts. unstable = only NON-required checks are
+    // failing/pending (GitHub still permits the merge) — treat as mergeable.
+    case "clean":
+    case "unstable":
+      return "mergeable";
+    case "blocked":
+      return "blocked";
+    case "behind":
+      return "behind";
+    case "unknown":
+    case "":
+      return "unknown";
+    default:
+      return "blocked";
+  }
+}
+function toPullRequestState(json2) {
+  const record2 = json2 && typeof json2 === "object" && !Array.isArray(json2) ? json2 : {};
+  const head2 = record2.head && typeof record2.head === "object" ? record2.head : {};
+  const number4 = typeof record2.number === "number" ? record2.number : Number.NaN;
+  const nodeId = typeof record2.node_id === "string" ? record2.node_id : "";
+  if (!Number.isFinite(number4) || !nodeId) {
+    throw new Error("github pr response missing number or node_id");
+  }
+  return {
+    number: number4,
+    nodeId,
+    merged: record2.merged === true,
+    draft: record2.draft === true,
+    mergeable: typeof record2.mergeable === "boolean" ? record2.mergeable : null,
+    mergeableState: typeof record2.mergeable_state === "string" ? record2.mergeable_state : "unknown",
+    headSha: typeof head2.sha === "string" ? head2.sha : "",
+    mergedSha: typeof record2.merge_commit_sha === "string" && record2.merged === true ? record2.merge_commit_sha : null
+  };
+}
+async function fetchPullRequestState(options) {
+  const baseUrl = (options.apiBaseUrl ?? GITHUB_API_BASE_URL).replace(/\/+$/u, "");
+  const fetchImpl = options.fetchImpl ?? fetch;
+  const response = await withGithubRetries(
+    "github pr get",
+    async () => fetchImpl(`${baseUrl}/repos/${options.repo.owner}/${options.repo.name}/pulls/${options.prNumber}`, {
+      method: "GET",
+      headers: githubHeaders(options.credential)
+    })
+  );
+  if (response.status !== 200) {
+    throw new Error(`github pr get failed ${response.status}: ${redactSecrets(await readErrorText(response)).slice(0, 500)}`);
+  }
+  return toPullRequestState(await response.json());
+}
+async function mergePullRequest(options) {
+  const baseUrl = (options.apiBaseUrl ?? GITHUB_API_BASE_URL).replace(/\/+$/u, "");
+  const fetchImpl = options.fetchImpl ?? fetch;
+  const { owner, name } = options.repo;
+  if (options.state.merged) {
+    return { status: "merged", mergedSha: options.state.mergedSha };
+  }
+  const merge2 = await withGithubRetries(
+    "github pr merge",
+    async () => fetchImpl(`${baseUrl}/repos/${owner}/${name}/pulls/${options.state.number}/merge`, {
+      method: "PUT",
+      headers: githubHeaders(options.credential),
+      // SHA guard: merge ONLY the head we verified — never pass a merge_method (the repo default
+      // wins; a queue owns the strategy). A stale sha → 409, re-checked by the caller.
+      body: JSON.stringify({ sha: options.state.headSha })
+    })
+  );
+  if (merge2.status === 405) {
+    const detail = await readErrorText(merge2);
+    if (/merge queue/i.test(detail)) {
+      await enablePullRequestAutoMerge({ repo: options.repo, nodeId: options.state.nodeId, credential: options.credential, fetchImpl, apiBaseUrl: baseUrl });
+      return { status: "queued" };
+    }
+    throw new Error(`github pr merge failed 405: ${redactSecrets(detail).slice(0, 500)}`);
+  }
+  if (merge2.status !== 200) {
+    throw new Error(`github pr merge failed ${merge2.status}: ${redactSecrets(await readErrorText(merge2)).slice(0, 500)}`);
+  }
+  const confirmed = await fetchPullRequestState({ repo: options.repo, prNumber: options.state.number, credential: options.credential, fetchImpl, apiBaseUrl: baseUrl });
+  if (!confirmed.merged) {
+    throw new Error("github pr merge postcondition failed: PR is not merged after the merge call");
+  }
+  return { status: "merged", mergedSha: confirmed.mergedSha };
+}
+async function enablePullRequestAutoMerge(options) {
+  const baseUrl = (options.apiBaseUrl ?? GITHUB_API_BASE_URL).replace(/\/+$/u, "");
+  const fetchImpl = options.fetchImpl ?? fetch;
+  const response = await withGithubRetries(
+    "github enable auto-merge",
+    async () => fetchImpl(`${baseUrl}/graphql`, {
+      method: "POST",
+      headers: githubHeaders(options.credential),
+      body: JSON.stringify({
+        query: "mutation($id:ID!){enablePullRequestAutoMerge(input:{pullRequestId:$id}){clientMutationId}}",
+        variables: { id: options.nodeId }
+      })
+    })
+  );
+  if (response.status !== 200) {
+    throw new Error(`github enable auto-merge failed ${response.status}: ${redactSecrets(await readErrorText(response)).slice(0, 500)}`);
+  }
+  const body = await response.json();
+  if (Array.isArray(body.errors) && body.errors.length > 0) {
+    throw new Error("github enable auto-merge returned errors");
+  }
+}
+async function forcePushWithLease(ws, credential) {
+  if (ws.readOnly || ws.branch.length === 0) {
+    throw new Error("force-push requires a writable build worktree on a branch");
+  }
+  const head2 = (await runGit(["rev-parse", "HEAD"], ws.worktreeDir)).trim();
+  await withAskpass(credential, async (netEnv) => {
+    const before = await runGitNetwork("git ls-remote", ["ls-remote", ws.remoteUrl, `refs/heads/${ws.branch}`], netEnv, ws.worktreeDir, FETCH_TIMEOUT_MS);
+    const beforeSha = before.split(/\s+/)[0]?.trim() ?? "";
+    const forceArg = beforeSha ? `--force-with-lease=refs/heads/${ws.branch}:${beforeSha}` : null;
+    await runGitNetwork(
+      "git push --force-with-lease",
+      ["push", ...forceArg ? [forceArg] : [], "--quiet", ws.remoteUrl, `HEAD:refs/heads/${ws.branch}`],
+      netEnv,
+      ws.worktreeDir,
+      PUSH_TIMEOUT_MS
+    );
+    const remote = await runGitNetwork("git ls-remote", ["ls-remote", ws.remoteUrl, `refs/heads/${ws.branch}`], netEnv, ws.worktreeDir, FETCH_TIMEOUT_MS);
+    const remoteSha = remote.split(/\s+/)[0]?.trim() ?? "";
+    if (remoteSha !== head2) {
+      throw new Error(`git force-push postcondition failed: remote ${ws.branch} is ${remoteSha || "absent"}, expected ${head2}`);
+    }
+  });
+  return { commitSha: head2 };
+}
 async function removeWorktree(baseRepo, worktreeDir) {
   try {
     await runGit(["worktree", "remove", "--force", worktreeDir], baseRepo);
@@ -52548,6 +52744,9 @@ function isSandboxExecAvailable() {
     return false;
   }
 }
+function claudeBashTempRoot(uid) {
+  return `/private/tmp/claude-${uid}`;
+}
 function resolveSandboxSpec(options) {
   if (options.mode === "off") {
     return { kind: "none", reason: "RUNNER_SANDBOX=off (loosened fallback - OS confinement disabled)" };
@@ -52570,12 +52769,17 @@ function resolveSandboxSpec(options) {
   const denyWritePaths = (options.denyWritePaths ?? []).map(
     (p) => p.endsWith("/") ? `${canonical(p.replace(/\/+$/, ""))}/` : canonicalFile(p)
   );
+  const uid = typeof process.getuid === "function" ? process.getuid() : null;
+  const allowWritePaths = [
+    ...(options.allowWritePaths ?? []).map(canonical),
+    ...uid !== null ? [canonicalFile(claudeBashTempRoot(uid))] : []
+  ];
   const profile = buildSeatbeltProfile({
     workspaceDir,
     tmpDir,
     homeDir,
     denyReadPaths,
-    allowWritePaths: (options.allowWritePaths ?? []).map(canonical),
+    allowWritePaths,
     denyWritePaths,
     allowNetwork,
     strict: options.mode === "strict"
@@ -52993,7 +53197,7 @@ async function detectCapabilities(cliVersion, env, homeDir) {
     claude: { ...claude, account_alias: accountAlias, rate_limited_until: null },
     codex: { ...codex, account_alias: accountAlias, rate_limited_until: null },
     turn_executions: { report_supported: true },
-    ...cliVersion ? { forge_build: cliVersion, seat_work: cliVersion } : {},
+    ...cliVersion ? { forge_build: cliVersion, seat_work: cliVersion, forge_merge: cliVersion } : {},
     git,
     gh,
     scheduler: { max_parallel_sessions_estimate: null },
@@ -53149,6 +53353,11 @@ async function executeClaimedUnit(fetchImpl, appUrl2, state, config2, io, runtim
     ...result.commitSha ? { commit_sha: result.commitSha } : {},
     ...result.evidence && result.evidence.length > 0 ? { evidence: result.evidence } : {},
     ...result.changedPaths && result.changedPaths.length > 0 ? { changed_paths: result.changedPaths } : {},
+    // DER-1352 (T1.8): the merge-turn postcondition. Only sent when the harness GET-verified the PR
+    // merged on GitHub — the driver's completion writer marks the changeset merged + writes the
+    // decisions row ONLY on this. Gated on result.ok so a failed turn can never carry it.
+    ...result.ok && result.merged === true ? { merged: true } : {},
+    ...result.ok && result.merged === true && result.mergedCommitSha ? { merged_commit_sha: result.mergedCommitSha } : {},
     // DER-1331 (T1.9): the step ledger + the model's (already redacted, bounded) transcript.
     // Only the work-orders result route accepts these today (turn-executions is a separate,
     // narrower endpoint — T1.9 scope); its Zod schema strips unrecognized keys on a non-strict
@@ -53492,6 +53701,9 @@ function buildTurnPrompt(input) {
 }
 async function spawnRunnerTurn(ctx, workOrder, runtime, kind) {
   const execution = parseRunnerExecutionContract(workOrder);
+  if (execution?.profile === "forge_merge") {
+    return runForgeMergeTurn(ctx, workOrder, execution, runtime);
+  }
   let forgePrep = null;
   if (execution?.needs_repo) {
     const prepared = await prepareForgeTurn(ctx, workOrder, execution);
@@ -53574,6 +53786,271 @@ async function spawnRunnerTurn(ctx, workOrder, runtime, kind) {
   }
   return result;
 }
+var MERGE_MERGEABILITY_POLLS = 5;
+var MERGE_MERGEABILITY_POLL_MS = 2e3;
+var MERGE_QUEUE_POLLS = 10;
+var MERGE_QUEUE_POLL_MS = 3e3;
+var MERGE_CONFLICT_SUMMARY_MAX = 12e3;
+function mergeParkResult(note, extra) {
+  return { ok: true, summary: `[forge-merge] ${note}`.slice(0, MERGE_CONFLICT_SUMMARY_MAX), ...extra };
+}
+function mergeMergedResult(mergedSha, note) {
+  return {
+    ok: true,
+    merged: true,
+    ...mergedSha ? { mergedCommitSha: mergedSha } : {},
+    summary: `[forge-merge] ${note}${mergedSha ? ` (${mergedSha})` : ""}`.slice(0, MERGE_CONFLICT_SUMMARY_MAX)
+  };
+}
+async function brokerForgeMergeCredential(ctx, workOrder) {
+  const workOrderId = typeof workOrder.id === "string" ? workOrder.id : "";
+  const forge = typeof workOrder.forge === "object" && workOrder.forge !== null ? workOrder.forge : null;
+  const buildRequestId = typeof forge?.build_request_id === "string" ? forge.build_request_id : "";
+  if (!workOrderId || !buildRequestId) {
+    return { ok: false, summary: "[forge-merge] work order missing id or build request id" };
+  }
+  const credentialMintStartedAt = (/* @__PURE__ */ new Date()).toISOString();
+  const brokered = await post2(
+    ctx.fetchImpl,
+    ctx.appUrl,
+    `/api/runner/work-orders/${encodeURIComponent(workOrderId)}/github-credential`,
+    {},
+    ctx.state.runner_secret
+  );
+  ctx.ledger.record({
+    step: "credential_mint",
+    started_at: credentialMintStartedAt,
+    ended_at: (/* @__PURE__ */ new Date()).toISOString(),
+    ok: brokered.status === 200,
+    retry_count: 0,
+    ...brokered.status === 200 ? {} : { error_class: classifyHttpStatus(brokered.status) }
+  });
+  if (brokered.status !== 200) {
+    return { ok: false, summary: `[forge-merge] credential broker failed ${brokered.status}: ${redactForLog(JSON.stringify(brokered.json))}` };
+  }
+  const repoRaw = typeof brokered.json.repo === "object" && brokered.json.repo !== null ? brokered.json.repo : null;
+  const token = typeof brokered.json.token === "string" ? brokered.json.token : "";
+  const expiresAt = typeof brokered.json.expires_at === "string" ? brokered.json.expires_at : "";
+  const owner = typeof repoRaw?.owner === "string" ? repoRaw.owner : "";
+  const name = typeof repoRaw?.name === "string" ? repoRaw.name : "";
+  const defaultBranch = typeof repoRaw?.default_branch === "string" ? repoRaw.default_branch : "";
+  if (!token || !expiresAt || !owner || !name || !defaultBranch) {
+    return { ok: false, summary: "[forge-merge] credential broker returned an incomplete credential" };
+  }
+  return { ok: true, credential: { token, expiresAt }, repo: { owner, name, default_branch: defaultBranch }, buildRequestId };
+}
+async function fetchSettledPullRequestState(ctx, input) {
+  let state = await fetchPullRequestState({ repo: input.repo, prNumber: input.prNumber, credential: input.credential, fetchImpl: ctx.fetchImpl });
+  for (let attempt = 0; attempt < MERGE_MERGEABILITY_POLLS && state.mergeable === null && !state.merged; attempt += 1) {
+    await sleep3(MERGE_MERGEABILITY_POLL_MS);
+    state = await fetchPullRequestState({ repo: input.repo, prNumber: input.prNumber, credential: input.credential, fetchImpl: ctx.fetchImpl });
+  }
+  return state;
+}
+async function pollForQueueMerge(ctx, input) {
+  for (let attempt = 0; attempt < MERGE_QUEUE_POLLS; attempt += 1) {
+    await sleep3(MERGE_QUEUE_POLL_MS);
+    const state = await fetchPullRequestState({ repo: input.repo, prNumber: input.prNumber, credential: input.credential, fetchImpl: ctx.fetchImpl });
+    if (state.merged) {
+      return { mergedSha: state.mergedSha };
+    }
+  }
+  return null;
+}
+async function resolveMergeConflictTurn(ctx, input) {
+  const tenantId = typeof input.workOrder.tenant_id === "string" ? input.workOrder.tenant_id : ctx.state.tenant_id ?? "runner";
+  let workspace;
+  try {
+    workspace = await prepareMergeWorkspace({
+      baseDir: path5.join(ctx.config.homeDir, ".rost", "forge", ctx.state.runner_id),
+      tenantId,
+      buildRequestId: input.buildRequestId,
+      repo: input.repo,
+      credential: input.credential,
+      headBranch: input.headBranch,
+      ledger: ctx.ledger
+    });
+  } catch (error51) {
+    return { pushed: false, result: { ok: false, summary: `[forge-merge] conflict workspace preparation failed: ${redactForLog(error51 instanceof Error ? error51.message : String(error51))}`.slice(0, MERGE_CONFLICT_SUMMARY_MAX) } };
+  }
+  const sandbox = resolveSandboxSpec({
+    mode: ctx.config.sandboxMode,
+    platform: process.platform,
+    workspaceDir: workspace.worktreeDir,
+    tmpDir: tmpdir2(),
+    homeDir: ctx.config.homeDir,
+    stateFile: ctx.config.stateFile,
+    runnerBaseDir: path5.join(ctx.config.homeDir, ".rost"),
+    allowWritePaths: [workspace.baseRepo],
+    denyWritePaths: [
+      `${path5.join(workspace.baseRepo, ".git", "hooks")}/`,
+      path5.join(workspace.baseRepo, ".git", "config"),
+      path5.join(workspace.worktreeDir, ".git")
+    ],
+    allowNetwork: ctx.config.sandboxAllowNetwork
+  });
+  const modelResult = await spawnMergeConflictModel(ctx, {
+    workOrder: input.workOrder,
+    execution: input.execution,
+    runtime: input.runtime,
+    workspace,
+    sandbox,
+    defaultBranch: input.repo.default_branch
+  });
+  if (!modelResult.ok) {
+    await removeWorkspace(workspace).catch(() => void 0);
+    return { pushed: false, result: mergeParkResult(`could not resolve the merge conflict (${modelResult.summary.slice(0, 400)}); parking for a human.`) };
+  }
+  try {
+    const pushed = await forcePushWithLease(workspace, input.credential);
+    await removeWorkspace(workspace).catch(() => void 0);
+    return { pushed: true, result: mergeParkResult(`resolved the conflict and force-pushed ${pushed.commitSha}`, { commitSha: pushed.commitSha }) };
+  } catch (error51) {
+    await removeWorkspace(workspace).catch(() => void 0);
+    return { pushed: false, result: { ok: false, summary: `[forge-merge] conflict resolution force-push failed: ${redactForLog(error51 instanceof Error ? error51.message : String(error51))}`.slice(0, MERGE_CONFLICT_SUMMARY_MAX) } };
+  }
+}
+async function spawnMergeConflictModel(ctx, input) {
+  const mcp = typeof input.workOrder.mcp === "object" && input.workOrder.mcp !== null ? input.workOrder.mcp : {};
+  const token = typeof mcp.token === "string" ? mcp.token : "";
+  const url2 = typeof mcp.url === "string" ? `${ctx.appUrl.replace(/\/+$/, "")}${mcp.url}` : `${ctx.appUrl.replace(/\/+$/, "")}/mcp`;
+  const mcpConfig = JSON.stringify({ mcpServers: { rost: { type: "http", url: url2, headers: { Authorization: `Bearer ${token}` } } } });
+  const configPath = path5.join(tmpdir2(), `rost-runner-mcp-${createHash2("sha256").update(`${url2}:${Date.now()}:${Math.random()}`).digest("hex").slice(0, 16)}.json`);
+  await writeFile3(configPath, `${mcpConfig}
+`, { mode: 384 });
+  await chmod2(configPath, 384);
+  const plan = resolveTurnPlan({ kind: "work_order", execution: input.execution, repoDir: input.workspace.worktreeDir });
+  const prompt = [
+    "You are resolving a merge conflict on a pull request branch so it can merge into the base branch.",
+    `A WRITABLE checkout of the PR's head branch is at your current working directory. Run \`git merge origin/${input.defaultBranch}\` to merge the base branch in, resolve EVERY conflict so the result is correct and builds, then \`git add\` the resolved files and \`git commit\` the merge. If the project has a fast build or test, run it to confirm the resolution.`,
+    "Do NOT run git push, git remote, or any network git command, and never request or handle GitHub tokens \u2014 the harness pushes and merges after you finish. If the conflict cannot be resolved safely, do NOT force a bad merge: leave the branch uncommitted and stop with a short explanation.",
+    "End with a single concise final message summarizing exactly what you resolved."
+  ].join("\n");
+  let sandboxProfilePath = null;
+  if (input.sandbox.kind === "seatbelt") {
+    sandboxProfilePath = path5.join(tmpdir2(), `rost-runner-sandbox-${createHash2("sha256").update(`${configPath}:${Math.random()}`).digest("hex").slice(0, 16)}.sb`);
+    await writeFile3(sandboxProfilePath, input.sandbox.profile, { mode: 384 });
+    await chmod2(sandboxProfilePath, 384);
+  }
+  const built = buildTurnCommand({ runtime: input.runtime, prompt, configPath, plan });
+  const { command, args } = wrapCommandWithSandbox(input.sandbox, built.command, built.args, sandboxProfilePath);
+  const spawnStartedAt = (/* @__PURE__ */ new Date()).toISOString();
+  const result = await runModelProcess({
+    command,
+    args,
+    cwd: input.workspace.worktreeDir,
+    timeoutMs: plan.timeoutMs,
+    // The model gets the EXPLICIT allowlist env — never the merge token, GIT_ASKPASS, or the bearer.
+    env: buildModelSpawnEnv(process.env),
+    expectSessionEnvelope: false
+  });
+  const exitClass = classifyModelExit(result);
+  ctx.ledger.record({
+    step: "model_exit",
+    started_at: spawnStartedAt,
+    ended_at: (/* @__PURE__ */ new Date()).toISOString(),
+    ok: result.ok,
+    retry_count: 0,
+    ...exitClass.errorClass ? { error_class: exitClass.errorClass } : {}
+  });
+  void rm4(configPath, { force: true });
+  if (sandboxProfilePath) {
+    void rm4(sandboxProfilePath, { force: true });
+  }
+  return result;
+}
+async function runForgeMergeTurn(ctx, workOrder, execution, runtime) {
+  const merge2 = execution.merge;
+  if (!merge2) {
+    return mergeParkResult("no merge target bound on the execution contract; parking for a human.");
+  }
+  const prepared = await brokerForgeMergeCredential(ctx, workOrder);
+  if (!prepared.ok) {
+    return { ok: false, summary: prepared.summary };
+  }
+  const { credential, repo, buildRequestId } = prepared;
+  const mergeStartedAt = (/* @__PURE__ */ new Date()).toISOString();
+  try {
+    const outcome = await executeForgeMerge(ctx, {
+      workOrder,
+      execution,
+      runtime,
+      repo,
+      credential,
+      buildRequestId,
+      prNumber: merge2.pr_number,
+      headBranch: merge2.head_branch
+    });
+    ctx.ledger.record({
+      step: "merge",
+      started_at: mergeStartedAt,
+      ended_at: (/* @__PURE__ */ new Date()).toISOString(),
+      ok: outcome.ok,
+      retry_count: 0,
+      ...outcome.ok ? {} : { error_class: "conflict" }
+    });
+    return outcome;
+  } catch (error51) {
+    ctx.ledger.record({
+      step: "merge",
+      started_at: mergeStartedAt,
+      ended_at: (/* @__PURE__ */ new Date()).toISOString(),
+      ok: false,
+      retry_count: 0,
+      error_class: "server_error"
+    });
+    return { ok: false, summary: `[forge-merge] merge turn failed: ${redactForLog(error51 instanceof Error ? error51.message : String(error51))}`.slice(0, MERGE_CONFLICT_SUMMARY_MAX) };
+  }
+}
+async function executeForgeMerge(ctx, input) {
+  const { repo, credential, prNumber } = input;
+  let state = await fetchSettledPullRequestState(ctx, { repo, prNumber, credential });
+  let readiness = classifyMergeReadiness(state);
+  if (readiness === "already_merged") {
+    return mergeMergedResult(state.mergedSha, "PR already merged on GitHub");
+  }
+  const reviewedHeadSha = input.execution.merge?.head_sha;
+  if (!reviewedHeadSha) {
+    return mergeParkResult("no reviewed head SHA bound on the merge contract; parking for a human (cannot verify the PR head was risk-assessed).");
+  }
+  if (state.headSha !== reviewedHeadSha) {
+    return mergeParkResult(`PR head advanced since review (reviewed ${reviewedHeadSha.slice(0, 12)}, GitHub now ${state.headSha.slice(0, 12) || "unknown"}); the new commits need re-review/re-risk \u2014 parking.`);
+  }
+  if (readiness === "blocked" || readiness === "draft" || readiness === "unknown") {
+    return mergeParkResult(`PR is not ready to merge (state=${state.mergeableState}); parking for a human.`);
+  }
+  if (readiness === "conflicted" || readiness === "behind") {
+    const resolved = await resolveMergeConflictTurn(ctx, {
+      workOrder: input.workOrder,
+      execution: input.execution,
+      runtime: input.runtime,
+      repo: input.repo,
+      credential: input.credential,
+      buildRequestId: input.buildRequestId,
+      headBranch: input.headBranch
+    });
+    if (!resolved.pushed) {
+      return resolved.result ?? mergeParkResult("could not resolve the merge conflict; parking for a human.");
+    }
+    state = await fetchSettledPullRequestState(ctx, { repo, prNumber, credential });
+    readiness = classifyMergeReadiness(state);
+    if (readiness === "already_merged") {
+      return mergeMergedResult(state.mergedSha, "PR merged during conflict resolution");
+    }
+    if (readiness !== "mergeable") {
+      return mergeParkResult(`conflict resolved and pushed, but the PR is not yet mergeable (state=${state.mergeableState}); parking for a re-check.`, resolved.result?.commitSha ? { commitSha: resolved.result.commitSha } : void 0);
+    }
+  }
+  const outcome = await mergePullRequest({ repo, state, credential, fetchImpl: ctx.fetchImpl });
+  if (outcome.status === "merged") {
+    return mergeMergedResult(outcome.mergedSha, "PR merged");
+  }
+  const merged = await pollForQueueMerge(ctx, { repo, prNumber, credential });
+  if (merged) {
+    return mergeMergedResult(merged.mergedSha, "PR merged via the merge queue");
+  }
+  return mergeParkResult("auto-merge enabled (merge queue); the merge was not confirmed within the turn \u2014 parking for a re-check.");
+}
 function scrubTranscriptSessionIds(value) {
   return value.replace(/("?(?:session_id|sessionId)"?\s*[:=]\s*"?)[A-Za-z0-9._-]+("?)/gi, "$1[redacted]$2");
 }