agent-dealer 1.3.3 → 1.3.5

package/bundle/server/dist/routes/auto-merge-policy.test.js

@@ -0,0 +1,378 @@
+// NOT-490: auto-merge policy changes on queued and in-flight issues — the policy-only
+// PATCH path, its audit event, the frozen-input guard for mixed patches, and the
+// linearization against reviewer-approval routing.
+import { test, before, beforeEach, afterEach } from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { execFileSync } from "node:child_process";
+import Fastify from "fastify";
+process.env.AGENT_DEALER_HOME = fs.mkdtempSync(path.join(os.tmpdir(), "dealer-not490-"));
+const { migrate, getDb } = await import("../db/index.js");
+const { BUILTIN_AGENT_CLAUDE_ID, BUILTIN_AGENT_CODEX_ID, BUILTIN_AGENT_CURSOR_ID } = await import("@agent-dealer/shared");
+const { registerIssueRoutes } = await import("./issues.js");
+const { createIssue, getIssue } = await import("../repository/issues.js");
+const { listHumanActionsForIssue } = await import("../repository/human-actions.js");
+const { listWorkflowEventsForIssue } = await import("../repository/workflow-events.js");
+const { claimWorkItem } = await import("../repository/work-items.js");
+const { enqueueIssue, getQueuedEntryForIssue, listQueuedEntries } = await import("../repository/queue-entries.js");
+const { queueStatusForIssue, setAdmissionHealthCheckerForTests } = await import("../coordinator/admission.js");
+const { startWorkflow, applyCompletion, getTaskSnapshot } = await import("../coordinator/commands.js");
+const { ReviewerResult } = await import("../coordinator/reviewer-result.js");
+const { setMergePrForTests, clearFinalizeInflightForTests } = await import("../coordinator/auto-merge.js");
+let fixtureRepo = "";
+before(() => {
+    migrate();
+    setAdmissionHealthCheckerForTests(async () => ({ ok: true }));
+    // A real local checkout so the auto-merge finalizer resolves its cwd.
+    fixtureRepo = fs.mkdtempSync(path.join(os.tmpdir(), "dealer-not490-repo-"));
+    execFileSync("git", ["init", "-b", "main"], { cwd: fixtureRepo });
+    execFileSync("git", ["config", "user.email", "test@example.com"], { cwd: fixtureRepo });
+    execFileSync("git", ["config", "user.name", "Test"], { cwd: fixtureRepo });
+    fs.writeFileSync(path.join(fixtureRepo, "README.md"), "hi\n");
+    execFileSync("git", ["add", "."], { cwd: fixtureRepo });
+    execFileSync("git", ["commit", "-m", "init"], { cwd: fixtureRepo });
+});
+let mergeCalls = 0;
+beforeEach(() => {
+    getDb().exec(`
+    DELETE FROM work_items;
+    DELETE FROM human_actions;
+    DELETE FROM workflow_events;
+    DELETE FROM findings;
+    DELETE FROM review_publications;
+    DELETE FROM worker_sessions;
+    DELETE FROM artifacts;
+    DELETE FROM usage_events;
+    DELETE FROM workflow_instances;
+    DELETE FROM queue_entries;
+    DELETE FROM issues;
+  `);
+    mergeCalls = 0;
+    clearFinalizeInflightForTests();
+    setMergePrForTests(async () => {
+        mergeCalls++;
+        return { ok: true };
+    });
+});
+afterEach(() => {
+    setMergePrForTests(null);
+    clearFinalizeInflightForTests();
+});
+async function buildApp() {
+    const app = Fastify();
+    await registerIssueRoutes(app);
+    return app;
+}
+function newIssue(opts) {
+    return createIssue({
+        title: opts.title ?? "Policy target",
+        description: "d",
+        acceptanceCriteria: opts.acceptanceCriteria ?? "It works",
+        repo: fixtureRepo,
+        developerAgentId: BUILTIN_AGENT_CLAUDE_ID,
+        reviewerAgentId: BUILTIN_AGENT_CURSOR_ID,
+        baseBranch: "main",
+        maxReviewRounds: opts.maxReviewRounds ?? 3,
+        maxInfraAttempts: 3,
+        source: "manual",
+        autoMerge: opts.autoMerge,
+    }).id;
+}
+async function complete(issueId, outcome) {
+    const item = claimWorkItem(`test-${issueId}`, { leaseMs: 60_000 });
+    assert.ok(item && item.issueId === issueId, "expected to lease this issue's work item");
+    return applyCompletion(item.id, item.leaseToken, outcome);
+}
+const review = (verdict) => ReviewerResult.parse({
+    verdict,
+    baseSha: "b",
+    headSha: "h",
+    acceptanceCriteriaAssessment: "ok",
+    evidenceAssessment: "ok",
+    findings: [],
+    risks: [],
+});
+const cleanHandoff = {
+    kind: "clean_handoff",
+    branch: "issue-490",
+    headSha: "abc123",
+    baseSha: "base1",
+    prNumber: 42,
+    prUrl: "https://gh/pr/42",
+};
+function policyEvents(issueId) {
+    return listWorkflowEventsForIssue(issueId).filter((e) => e.type === "issue.reassigned");
+}
+/** Every issue column except the policy itself and the write timestamp. */
+function frozenView(issueId) {
+    const { autoMerge: _a, updatedAt: _u, ...rest } = getIssue(issueId);
+    return rest;
+}
+/** Drives a fresh autoMerge issue into each eligible pre-decision state. */
+const ELIGIBLE = [
+    {
+        status: "developing",
+        setup: async (autoMerge) => {
+            const id = newIssue({ autoMerge });
+            assert.equal(startWorkflow(id).ok, true);
+            return id;
+        },
+    },
+    {
+        status: "reviewing",
+        setup: async (autoMerge) => {
+            const id = newIssue({ autoMerge });
+            startWorkflow(id);
+            await complete(id, cleanHandoff);
+            return id;
+        },
+    },
+    {
+        status: "repairing",
+        setup: async (autoMerge) => {
+            const id = newIssue({ autoMerge });
+            startWorkflow(id);
+            await complete(id, cleanHandoff);
+            await complete(id, { kind: "verdict", result: review("changes_requested") });
+            return id;
+        },
+    },
+    {
+        status: "needs_human",
+        setup: async (autoMerge) => {
+            // Review-round budget of 1: changes_requested parks at attempts_exhausted, which a
+            // human resume continues in the same workflow.
+            const id = newIssue({ autoMerge, maxReviewRounds: 1 });
+            startWorkflow(id);
+            await complete(id, cleanHandoff);
+            await complete(id, { kind: "verdict", result: review("changes_requested") });
+            return id;
+        },
+    },
+];
+test("NOT-490: a queued ready issue accepts an autoMerge-only update with queue entry, wait reason and other fields untouched", async () => {
+    const app = await buildApp();
+    const first = newIssue({ autoMerge: true, title: "Ahead" });
+    const id = newIssue({ autoMerge: false });
+    const behind = newIssue({ autoMerge: true, title: "Behind" });
+    for (const issueId of [first, id, behind])
+        enqueueIssue(issueId);
+    const queueBefore = listQueuedEntries();
+    const statusBefore = queueStatusForIssue(id);
+    const entryBefore = getQueuedEntryForIssue(id);
+    const issueBefore = frozenView(id);
+    assert.ok(entryBefore, "precondition: queued");
+    const detailBefore = (await app.inject({ method: "GET", url: `/api/issues/${id}` })).json();
+    assert.deepEqual(detailBefore.autoMergePolicy, { editable: true, reason: null });
+    const res = await app.inject({ method: "PATCH", url: `/api/issues/${id}`, payload: { autoMerge: true, updatedBy: "operator-1" } });
+    assert.equal(res.statusCode, 200);
+    assert.equal(res.json().autoMerge, true);
+    assert.equal(getIssue(id).autoMerge, true);
+    assert.equal(getIssue(id).status, "ready");
+    assert.deepEqual(frozenView(id), issueBefore, "every other issue field is unchanged");
+    assert.deepEqual(getQueuedEntryForIssue(id), entryBefore, "same queue entry");
+    assert.deepEqual(listQueuedEntries(), queueBefore, "queue order and entries are untouched");
+    assert.deepEqual(queueStatusForIssue(id), statusBefore, "same position and wait reason");
+    const events = policyEvents(id);
+    assert.equal(events.length, 1);
+    assert.equal(events[0].actorType, "human");
+    assert.deepEqual(JSON.parse(events[0].payloadJson), { fromAutoMerge: false, toAutoMerge: true, actor: "operator-1" });
+    // A queued issue also refuses coordinator-owned fields smuggled beside the policy.
+    for (const mixed of [{ autoMerge: false, branch: "x" }, { autoMerge: false, status: "done" }, { autoMerge: false, headSha: "s" }]) {
+        const refused = await app.inject({ method: "PATCH", url: `/api/issues/${id}`, payload: mixed });
+        assert.equal(refused.statusCode, 409, `mixed ${JSON.stringify(mixed)} must be refused`);
+        assert.equal(getIssue(id).autoMerge, true, "no partial write");
+        assert.equal(policyEvents(id).length, 1);
+        assert.deepEqual(listQueuedEntries(), queueBefore);
+    }
+    // Idempotent no-op: 200, no event.
+    const again = await app.inject({ method: "PATCH", url: `/api/issues/${id}`, payload: { autoMerge: true } });
+    assert.equal(again.statusCode, 200);
+    assert.equal(policyEvents(id).length, 1, "a no-op update records nothing");
+    // And back off, attributed to the default actor.
+    await app.inject({ method: "PATCH", url: `/api/issues/${id}`, payload: { autoMerge: false } });
+    const after = policyEvents(id);
+    assert.equal(after.length, 2);
+    assert.deepEqual(JSON.parse(after[1].payloadJson), { fromAutoMerge: true, toAutoMerge: false, actor: "human" });
+    assert.deepEqual(listQueuedEntries(), queueBefore);
+    await app.close();
+});
+for (const { status, setup } of ELIGIBLE) {
+    test(`NOT-490: an active ${status} issue accepts an autoMerge-only update; a mixed patch is 409 with no partial write`, async () => {
+        const app = await buildApp();
+        const id = await setup(false);
+        assert.equal(getIssue(id).status, status, "precondition");
+        const snapshotBefore = JSON.stringify(getTaskSnapshot(getIssue(id)));
+        const issueBefore = frozenView(id);
+        const eventsBefore = listWorkflowEventsForIssue(id).length;
+        const detail = (await app.inject({ method: "GET", url: `/api/issues/${id}` })).json();
+        assert.equal(detail.autoMergePolicy.editable, true);
+        // Mixed patches that carry a frozen field fail closed and write nothing.
+        for (const mixed of [
+            { autoMerge: true, title: "New title" },
+            { autoMerge: true, repo: "acme/other" },
+            { autoMerge: true, developerAgentId: BUILTIN_AGENT_CODEX_ID },
+            { autoMerge: true, maxReviewRounds: 9 },
+            // Coordinator-owned fields the schema does not declare: a non-strict parse would
+            // strip them, so the route must refuse on the raw body keys.
+            { autoMerge: true, branch: "other" },
+            { autoMerge: true, status: "done" },
+            { autoMerge: true, headSha: "deadbeef" },
+            { autoMerge: true, prNumber: 7 },
+            { autoMerge: true, prUrl: "https://gh/pr/7" },
+            { autoMerge: true, queuePosition: 0 },
+        ]) {
+            const res = await app.inject({ method: "PATCH", url: `/api/issues/${id}`, payload: mixed });
+            assert.equal(res.statusCode, 409, `mixed ${JSON.stringify(mixed)} must be refused`);
+            assert.equal(getIssue(id).autoMerge, false, "no partial write of the policy");
+            assert.deepEqual(frozenView(id), issueBefore);
+            assert.equal(listWorkflowEventsForIssue(id).length, eventsBefore);
+        }
+        const ok = await app.inject({ method: "PATCH", url: `/api/issues/${id}`, payload: { autoMerge: true } });
+        assert.equal(ok.statusCode, 200);
+        assert.equal(getIssue(id).autoMerge, true);
+        assert.equal(getIssue(id).status, status, "status is untouched");
+        assert.deepEqual(frozenView(id), issueBefore, "frozen inputs, branch, PR, rounds untouched");
+        assert.equal(JSON.stringify(getTaskSnapshot(getIssue(id))), snapshotBefore, "frozen task snapshot untouched");
+        const events = policyEvents(id);
+        assert.equal(events.length, 1);
+        assert.deepEqual(JSON.parse(events[0].payloadJson), { fromAutoMerge: false, toAutoMerge: true, actor: "human" });
+        assert.ok(events[0].workflowInstanceId, "the event is scoped to the live workflow");
+        const noop = await app.inject({ method: "PATCH", url: `/api/issues/${id}`, payload: { autoMerge: true } });
+        assert.equal(noop.statusCode, 200);
+        assert.equal(policyEvents(id).length, 1);
+        await app.close();
+    });
+}
+test("NOT-490: a policy update committed before reviewer routing turns approval into the guarded auto-merge", async () => {
+    const app = await buildApp();
+    const id = newIssue({ autoMerge: false });
+    startWorkflow(id);
+    await complete(id, cleanHandoff);
+    assert.equal((await app.inject({ method: "PATCH", url: `/api/issues/${id}`, payload: { autoMerge: true } })).statusCode, 200);
+    await complete(id, { kind: "verdict", result: review("approved") });
+    assert.equal(getIssue(id).status, "done");
+    assert.equal(mergeCalls, 1, "exactly one merge");
+    assert.equal(listHumanActionsForIssue(id).filter((a) => a.actionType === "final_review").length, 0, "no final_review action");
+    assert.equal(listWorkflowEventsForIssue(id).filter((e) => e.type === "final_review.requested").length, 0);
+    await app.close();
+});
+test("NOT-490: a committed false policy routes approval to final_review and never merges", async () => {
+    const app = await buildApp();
+    const id = newIssue({ autoMerge: true });
+    startWorkflow(id);
+    await complete(id, cleanHandoff);
+    assert.equal((await app.inject({ method: "PATCH", url: `/api/issues/${id}`, payload: { autoMerge: false } })).statusCode, 200);
+    await complete(id, { kind: "verdict", result: review("approved") });
+    assert.equal(getIssue(id).status, "final_review");
+    assert.equal(getIssue(id).currentOwner, "human");
+    assert.equal(mergeCalls, 0);
+    assert.equal(listHumanActionsForIssue(id).filter((a) => a.actionType === "final_review").length, 1);
+    await app.close();
+});
+test("NOT-490: a reviewer decision committed first wins — the later update is 409 and creates no second effect", async () => {
+    const app = await buildApp();
+    const id = newIssue({ autoMerge: false });
+    startWorkflow(id);
+    await complete(id, cleanHandoff);
+    await complete(id, { kind: "verdict", result: review("approved") });
+    assert.equal(getIssue(id).status, "final_review");
+    const eventsBefore = listWorkflowEventsForIssue(id).length;
+    const detail = (await app.inject({ method: "GET", url: `/api/issues/${id}` })).json();
+    assert.equal(detail.autoMergePolicy.editable, false);
+    assert.match(detail.autoMergePolicy.reason ?? "", /Merge/);
+    const res = await app.inject({ method: "PATCH", url: `/api/issues/${id}`, payload: { autoMerge: true } });
+    assert.equal(res.statusCode, 409);
+    assert.match(res.json().error, /no longer be changed/);
+    assert.equal(getIssue(id).autoMerge, false);
+    assert.equal(getIssue(id).status, "final_review");
+    assert.equal(mergeCalls, 0, "no auto-merge effect");
+    assert.equal(listHumanActionsForIssue(id).filter((a) => a.actionType === "final_review").length, 1, "one final_review action");
+    assert.equal(listWorkflowEventsForIssue(id).length, eventsBefore, "no audit event for the losing update");
+    await app.close();
+});
+test("NOT-490: while auto-merge finalization is in flight the policy is locked; the merge completes once", async () => {
+    const app = await buildApp();
+    let releaseMerge;
+    const mergeGate = new Promise((resolve) => (releaseMerge = resolve));
+    setMergePrForTests(async () => {
+        mergeCalls++;
+        await mergeGate;
+        return { ok: true };
+    });
+    const id = newIssue({ autoMerge: true });
+    startWorkflow(id);
+    await complete(id, cleanHandoff);
+    const approval = complete(id, { kind: "verdict", result: review("approved") });
+    // The routing transaction commits before the async merge — wait for the park.
+    for (let i = 0; i < 200 && getIssue(id).status !== "final_review"; i++) {
+        await new Promise((r) => setImmediate(r));
+    }
+    assert.equal(getIssue(id).status, "final_review");
+    assert.equal(getIssue(id).currentOwner, "system");
+    const detail = (await app.inject({ method: "GET", url: `/api/issues/${id}` })).json();
+    assert.equal(detail.autoMergePolicy.editable, false);
+    assert.match(detail.autoMergePolicy.reason ?? "", /in flight/);
+    const res = await app.inject({ method: "PATCH", url: `/api/issues/${id}`, payload: { autoMerge: false } });
+    assert.equal(res.statusCode, 409);
+    assert.equal(getIssue(id).autoMerge, true);
+    releaseMerge();
+    await approval;
+    assert.equal(getIssue(id).status, "done");
+    assert.equal(mergeCalls, 1);
+    assert.equal(listHumanActionsForIssue(id).length, 0, "no human action created");
+    assert.equal(policyEvents(id).length, 0);
+    await app.close();
+});
+test("NOT-490: an operator-verification park after approval keeps the committed policy locked", async () => {
+    const app = await buildApp();
+    const id = newIssue({
+        autoMerge: true,
+        acceptanceCriteria: "- [ ] Operator signs in with SSO [operator]",
+    });
+    startWorkflow(id);
+    await complete(id, cleanHandoff);
+    await complete(id, { kind: "verdict", result: review("approved") });
+    assert.equal(getIssue(id).status, "needs_human");
+    const gate = listHumanActionsForIssue(id).filter((a) => a.status === "open");
+    assert.deepEqual(gate.map((a) => a.actionType), ["operator_verification"], "precondition: parked at the gate");
+    assert.equal(mergeCalls, 0);
+    const eventsBefore = listWorkflowEventsForIssue(id).length;
+    const detail = (await app.inject({ method: "GET", url: `/api/issues/${id}` })).json();
+    assert.equal(detail.autoMergePolicy.editable, false);
+    assert.match(detail.autoMergePolicy.reason ?? "", /operator verification/);
+    const res = await app.inject({ method: "PATCH", url: `/api/issues/${id}`, payload: { autoMerge: false } });
+    assert.equal(res.statusCode, 409);
+    assert.match(res.json().error, /no longer be changed/);
+    assert.equal(getIssue(id).autoMerge, true, "committed policy is unchanged");
+    assert.equal(listWorkflowEventsForIssue(id).length, eventsBefore, "no audit event for the refused update");
+    assert.equal(policyEvents(id).length, 0);
+    await app.close();
+});
+test("NOT-490: a merge-failure park and terminal issues are read-only with an explanation", async () => {
+    const app = await buildApp();
+    setMergePrForTests(async () => ({ ok: false, reason: "protected branch" }));
+    const id = newIssue({ autoMerge: true });
+    startWorkflow(id);
+    await complete(id, cleanHandoff);
+    await complete(id, { kind: "verdict", result: review("approved") });
+    assert.equal(getIssue(id).status, "needs_human");
+    const parked = (await app.inject({ method: "GET", url: `/api/issues/${id}` })).json();
+    assert.equal(parked.autoMergePolicy.editable, false);
+    assert.match(parked.autoMergePolicy.reason ?? "", /merge/);
+    assert.equal((await app.inject({ method: "PATCH", url: `/api/issues/${id}`, payload: { autoMerge: false } })).statusCode, 409);
+    assert.equal(getIssue(id).autoMerge, true);
+    setMergePrForTests(async () => ({ ok: true }));
+    const done = newIssue({ autoMerge: true, title: "Done" });
+    startWorkflow(done);
+    await complete(done, cleanHandoff);
+    await complete(done, { kind: "verdict", result: review("approved") });
+    assert.equal(getIssue(done).status, "done");
+    const doneDetail = (await app.inject({ method: "GET", url: `/api/issues/${done}` })).json();
+    assert.deepEqual(doneDetail.autoMergePolicy, { editable: false, reason: "The issue is done." });
+    assert.equal((await app.inject({ method: "PATCH", url: `/api/issues/${done}`, payload: { autoMerge: false } })).statusCode, 409);
+    assert.equal(policyEvents(done).length, 0);
+    await app.close();
+});

package/bundle/server/dist/routes/human-actions.test.js

@@ -36,7 +36,7 @@ async function buildApp() {
     return app;
 }
 function seedIssueAwaitingFinalReview() {
-    const issue = createIssue({ title: "Awaiting review", repo: "acme/app", baseBranch: "main", developerAgentId: BUILTIN_AGENT_CLAUDE_ID, reviewerAgentId: BUILTIN_AGENT_CURSOR_ID, maxReviewRounds: 3, maxInfraAttempts: 3, source: "manual" });
+    const issue = createIssue({ title: "Awaiting review", repo: "acme/app", baseBranch: "main", developerAgentId: BUILTIN_AGENT_CLAUDE_ID, reviewerAgentId: BUILTIN_AGENT_CURSOR_ID, maxReviewRounds: 3, maxInfraAttempts: 3, autoMerge: false, source: "manual" });
     transitionIssue(issue.id, "developing");
     transitionIssue(issue.id, "reviewing");
     transitionIssue(issue.id, "final_review", { currentOwner: "human" });
@@ -48,7 +48,7 @@ function seedIssueAwaitingFinalReview() {
  * (unlike seedIssueAwaitingFinalReview's hand-crafted transitions) — needed to exercise
  * resolveHumanActionAndAdvance's actual transactional path through the route. */
 async function seedRealIssueAwaitingFinalReview() {
-    const issue = createIssue({ title: "Real workflow", repo: "acme/app", baseBranch: "main", developerAgentId: BUILTIN_AGENT_CLAUDE_ID, reviewerAgentId: BUILTIN_AGENT_CURSOR_ID, acceptanceCriteria: "Works", maxReviewRounds: 3, maxInfraAttempts: 3, source: "manual" });
+    const issue = createIssue({ title: "Real workflow", repo: "acme/app", baseBranch: "main", developerAgentId: BUILTIN_AGENT_CLAUDE_ID, reviewerAgentId: BUILTIN_AGENT_CURSOR_ID, acceptanceCriteria: "Works", maxReviewRounds: 3, maxInfraAttempts: 3, autoMerge: false, source: "manual" });
     const start = startWorkflow(issue.id);
     assert.equal(start.ok, true);
     const devItem = claimWorkItem(`route-test-${issue.id}-dev`, { leaseMs: 60_000 });
@@ -286,7 +286,7 @@ test("POST resolve 400s on a choice not valid for reflection_interaction_require
 });
 // NOT-272: seeds.
 function seedPreStartScopeDecision() {
-    const issue = createIssue({ title: "Scope gated", repo: "acme/app", baseBranch: "main", developerAgentId: BUILTIN_AGENT_CLAUDE_ID, reviewerAgentId: BUILTIN_AGENT_CURSOR_ID, acceptanceCriteria: "Works", maxReviewRounds: 3, maxInfraAttempts: 3, source: "manual" });
+    const issue = createIssue({ title: "Scope gated", repo: "acme/app", baseBranch: "main", developerAgentId: BUILTIN_AGENT_CLAUDE_ID, reviewerAgentId: BUILTIN_AGENT_CURSOR_ID, acceptanceCriteria: "Works", maxReviewRounds: 3, maxInfraAttempts: 3, autoMerge: false, source: "manual" });
     const action = createHumanAction({
         issueId: issue.id,
         actionType: "product_scope_decision",
@@ -299,7 +299,7 @@ function seedPreStartScopeDecision() {
 /** Drives a real issue to a mid-workflow product_scope_decision via a reviewer
  * escalate verdict carrying a productScopeQuestion (NOT-150 routing). */
 async function seedMidWorkflowScopeDecision() {
-    const issue = createIssue({ title: "Scope escalated", repo: "acme/app", baseBranch: "main", developerAgentId: BUILTIN_AGENT_CLAUDE_ID, reviewerAgentId: BUILTIN_AGENT_CURSOR_ID, acceptanceCriteria: "Works", maxReviewRounds: 3, maxInfraAttempts: 3, source: "manual" });
+    const issue = createIssue({ title: "Scope escalated", repo: "acme/app", baseBranch: "main", developerAgentId: BUILTIN_AGENT_CLAUDE_ID, reviewerAgentId: BUILTIN_AGENT_CURSOR_ID, acceptanceCriteria: "Works", maxReviewRounds: 3, maxInfraAttempts: 3, autoMerge: false, source: "manual" });
     const start = startWorkflow(issue.id);
     assert.equal(start.ok, true);
     const devItem = claimWorkItem(`scope-note-test-${issue.id}-dev`, { leaseMs: 60_000 });

package/bundle/server/dist/routes/issues-execution-contract.test.js

@@ -379,8 +379,8 @@ const LINEAR_ISSUE_PAYLOAD = {
     externalUrl: "https://linear.app/not-so-fat/issue/NOT-123/stale",
     ...BASE_AGENTS,
 };
-async function createLinearIssue(app) {
-    const res = await app.inject({ method: "POST", url: "/api/issues", payload: LINEAR_ISSUE_PAYLOAD });
+async function createLinearIssue(app, overrides = {}) {
+    const res = await app.inject({ method: "POST", url: "/api/issues", payload: { ...LINEAR_ISSUE_PAYLOAD, ...overrides } });
     assert.equal(res.statusCode, 200, res.body);
     return res.json();
 }
@@ -743,7 +743,8 @@ test("NOT-422: PATCH at a scope pause fails closed on pending/leased work, runni
     assert.equal(swapRes.statusCode, 409);
     assert.match(swapRes.json().error, /Only title, description and acceptanceCriteria/);
     // A final_review pause is a different park — still 409 on an active workflow.
-    const { id: finalId } = await createLinearIssue(app);
+    // NOT-489: auto-merge is the default; opt out so approval parks at final_review.
+    const { id: finalId } = await createLinearIssue(app, { autoMerge: false });
     assert.equal(startWorkflow(finalId).ok, true);
     const finalDev = claimWorkItem("route-test", { leaseMs: 60_000 });
     await applyCompletion(finalDev.id, finalDev.leaseToken, {

package/bundle/server/dist/routes/issues.js

@@ -10,7 +10,7 @@ import { listUsageEventsForIssue, summarizeIssueUsage } from "../repository/usag
 import { listWorkflowEventsForIssue, appendWorkflowEvent, listWorkflowInstancesForIssue, getActiveWorkflowInstance, } from "../repository/workflow-events.js";
 import { listHumanActionsForIssue, listOpenHumanActions } from "../repository/human-actions.js";
 import { listFindingsForIssue } from "../repository/findings.js";
-import { abortIssueAsync, applyParkedEdit, canEditParkedIssue, capWaitForIssue, checkIssueReadiness, closeReadyIssue, diffTaskSnapshotFromLive, parkCapWait, parkedEditableFields, parkedEditableFieldsLabel } from "../coordinator/commands.js";
+import { abortIssueAsync, applyAutoMergePolicyUpdate, applyParkedEdit, autoMergePolicyEditability, canEditParkedIssue, capWaitForIssue, checkIssueReadiness, closeReadyIssue, diffTaskSnapshotFromLive, parkCapWait, parkedEditableFields, parkedEditableFieldsLabel } from "../coordinator/commands.js";
 import { deleteDealerIssue } from "../coordinator/delete-issue.js";
 import { getAgent } from "../repository/agents.js";
 import { executeIssueNow, isStartable, queueStatusForIssue, refreshQueueWaitReasonForIssue, startIssueViaQueue, } from "../coordinator/admission.js";
@@ -163,6 +163,9 @@ export async function registerIssueRoutes(app) {
             // re-freeze into a new task snapshot (empty = in sync, or pre-freeze).
             // Issue Detail renders the pending-snapshot notice off this.
             pendingSnapshotChangedFields: diffTaskSnapshotFromLive(issue),
+            // NOT-490: whether the auto-merge policy may still change (queued or active,
+            // before the reviewer decision commits) — Issue Detail gates its toggle on this.
+            autoMergePolicy: autoMergePolicyEditability(issue),
         };
     });
     /** NOT-173: stable issue-level execution read model. The existing
@@ -338,6 +341,29 @@ export async function registerIssueRoutes(app) {
         const parsed = UpdateIssueInput.safeParse(req.body);
         if (!parsed.success)
             return reply.status(400).send({ error: parsed.error.message });
+        // NOT-490: an `autoMerge`-only patch is the policy command — allowed while queued or
+        // active until the reviewer decision commits, race-safe against `applyReviewer`.
+        // Any other key (even alongside autoMerge) falls through to the frozen-input guard
+        // below, so a mixed patch on a live issue still fails closed with no partial write.
+        //
+        // The discriminator reads the RAW body keys, not `parsed.data`: the schema is
+        // non-strict and strips unknown properties, so `{autoMerge, branch}` would otherwise
+        // parse to `{autoMerge}` and slip into the policy path. Any key outside the editable
+        // schema (branch, status, SHA, PR, queue fields, …) — other than the `updatedBy`
+        // actor metadata — names a coordinator-owned field and fails closed before any write.
+        const body = (req.body ?? {});
+        const rawKeys = Object.keys(body).filter((k) => k !== "updatedBy");
+        const ownedKeys = rawKeys.filter((k) => !Object.prototype.hasOwnProperty.call(UpdateIssueInput.shape, k));
+        if (ownedKeys.length > 0) {
+            return reply.status(409).send({ error: `Cannot edit coordinator-owned field(s): ${ownedKeys.join(", ")}` });
+        }
+        if (rawKeys.length === 1 && rawKeys[0] === "autoMerge" && parsed.data.autoMerge !== undefined) {
+            const actor = typeof body.updatedBy === "string" && body.updatedBy.trim() ? body.updatedBy.trim() : "human";
+            const result = applyAutoMergePolicyUpdate(id, parsed.data.autoMerge, actor);
+            if (!result.ok)
+                return reply.status(result.code).send({ error: result.error });
+            return result.issue;
+        }
         // Editable only pre-start or parked back on needs_human — the same statuses
         // startWorkflow itself accepts (commands.ts). A running workflow owns the frozen
         // task snapshot (freezeTaskSnapshot), so an edit must never race or diverge from
@@ -419,9 +445,12 @@ export async function registerIssueRoutes(app) {
                 // is attributed exactly. Repository changes ride the same `issue.reassigned`
                 // event (extended with from/to repo) rather than silently changing where the
                 // issue will run.
+                // NOT-490: a pre-start auto-merge change in a mixed edit rides the same event.
+                const autoMergeChanged = fresh.autoMerge !== next.autoMerge;
                 if (fresh.repo !== next.repo ||
                     fresh.developerAgentId !== next.developerAgentId ||
-                    fresh.reviewerAgentId !== next.reviewerAgentId) {
+                    fresh.reviewerAgentId !== next.reviewerAgentId ||
+                    autoMergeChanged) {
                     appendWorkflowEvent({
                         issueId: id,
                         type: "issue.reassigned",
@@ -434,6 +463,7 @@ export async function registerIssueRoutes(app) {
                             toDeveloperAgentId: next.developerAgentId,
                             fromReviewerAgentId: fresh.reviewerAgentId,
                             toReviewerAgentId: next.reviewerAgentId,
+                            ...(autoMergeChanged ? { fromAutoMerge: fresh.autoMerge, toAutoMerge: next.autoMerge } : {}),
                         },
                     });
                 }

package/bundle/server/dist/routes/issues.test.js

@@ -109,6 +109,27 @@ test("NOT-118: POST /api/issues with enqueue:false creates a draft that is not q
     assert.equal(listQueuedEntries().length, 0);
     await app.close();
 });
+test("NOT-489: POST /api/issues without autoMerge persists true; an explicit false persists false; both still enqueue", async () => {
+    const app = await buildApp();
+    const payload = { title: "Agent-created", repo: "acme/app", baseBranch: "main", developerAgentId: BUILTIN_AGENT_CLAUDE_ID, reviewerAgentId: BUILTIN_AGENT_CURSOR_ID, acceptanceCriteria: "It works" };
+    const omittedRes = await app.inject({ method: "POST", url: "/api/issues", payload });
+    assert.equal(omittedRes.statusCode, 200);
+    const omitted = omittedRes.json();
+    assert.equal(omitted.autoMerge, true);
+    assert.equal(getIssue(omitted.id).autoMerge, true);
+    assert.equal(getDb().prepare("SELECT auto_merge FROM issues WHERE id = ?").get(omitted.id).auto_merge, 1);
+    assert.equal(omitted.queue, "enqueued");
+    assert.equal(getQueuedEntryForIssue(omitted.id)?.state, "queued");
+    const optedOutRes = await app.inject({ method: "POST", url: "/api/issues", payload: { ...payload, title: "Final review please", autoMerge: false } });
+    assert.equal(optedOutRes.statusCode, 200);
+    const optedOut = optedOutRes.json();
+    assert.equal(optedOut.autoMerge, false);
+    assert.equal(getIssue(optedOut.id).autoMerge, false);
+    assert.equal(getDb().prepare("SELECT auto_merge FROM issues WHERE id = ?").get(optedOut.id).auto_merge, 0);
+    assert.equal(optedOut.queue, "enqueued");
+    assert.equal(getQueuedEntryForIssue(optedOut.id)?.state, "queued");
+    await app.close();
+});
 test("POST /api/issues matches a live (source, externalId) instead of duplicating it, and reports the queue it did not change", async () => {
     const app = await buildApp();
     const payload = { title: "Linear task", repo: "acme/app", baseBranch: "main", developerAgentId: BUILTIN_AGENT_CLAUDE_ID, reviewerAgentId: BUILTIN_AGENT_CURSOR_ID, source: "linear", externalId: "LIN-1" };
@@ -284,13 +305,15 @@ test("NOT-185: PATCH /api/issues/:id succeeds while parked at attempts_exhausted
     });
     // Non-task, non-agent fields stay frozen at the park — notably the review budget
     // (a non-goal). Agent profiles are swappable at the park (NOT-358, covered below),
-    // so they are no longer in this blocked list.
+    // so they are no longer in this blocked list. NOT-490: an autoMerge-only patch is the
+    // policy command (allowed until the review decision), but mixed into a parked edit it
+    // is still refused.
     for (const payload of [
         { maxReviewRounds: 5 },
         { maxInfraAttempts: 3 },
         { repo: "acme/other" },
         { baseBranch: "develop" },
-        { autoMerge: true },
+        { autoMerge: true, title: "Mixed" },
         { title: "Mixed", maxReviewRounds: 5 },
     ]) {
         assert.equal((await patch(payload)).statusCode, 409, JSON.stringify(payload));

package/bundle/server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-dealer/server",
-  "version": "1.3.3",
+  "version": "1.3.5",
   "type": "module",
   "main": "dist/index.js",
   "files": [
@@ -23,7 +23,7 @@
     "test": "AGENT_DEALER_SKIP_GITHUB_HEALTH=1 AGENT_DEALER_SKIP_AGENT_HEALTH=1 npm run build -w @agent-dealer/shared && AGENT_DEALER_SKIP_GITHUB_HEALTH=1 AGENT_DEALER_SKIP_AGENT_HEALTH=1 node ../../scripts/run-workspace-tests.mjs"
   },
   "dependencies": {
-    "@agent-dealer/shared": "1.3.3",
+    "@agent-dealer/shared": "1.3.5",
     "@fastify/cors": "^11.0.1",
     "@fastify/static": "^8.2.0",
     "@modelcontextprotocol/sdk": "^1.29.0",