pdurlej/patchwarden

Fork 0

bug: surface invalid automerge merge-bot token as blocked state #243

New issue

Closed

opened 2026-06-25 21:54:15 +02:00 by codex · 1 comment

codex commented

2026-06-25 21:54:15 +02:00

Collaborator

Bug

Patchwarden's W6d/automerge integration can report a PR as clean and ready, but the final controller merge still fails because the runner-local merge-bot token is invalid. The failure currently appears only inside the automerge-pilot Actions log, after Patchwarden has already produced green evidence.

Platform Case

Repo: pdurlej/platform

Observed

After #827 was merged, automerge-pilot run #5944 progressed correctly through the earlier blocker:

Collect Forgejo facts: passed via token_env=GITHUB_TOKEN
automerge_readiness.py: ready_for_controller_merge, ready=true
Required contexts were green:
- base-is-main / guard (pull_request)
- patchwarden-pr-sanity / sanity (pull_request)
- patchwarden-client-dry-run / dry-run (pull_request)
Iskra Matrix approval returned approved=true for the exact PR/head SHA.

The run then failed in the final merge actor while validating PLATFORM_AUTOMERGE_BOT_TOKEN:

File "control-plane/platformctl/ci/automerge_actor.py", line 253, in _load_ready_context
  actor = _token_login(args.forgejo_host, token)
...
urllib.error.HTTPError: HTTP Error 401: Unauthorized

No secret value was printed in logs. The failing token name is runner-local PLATFORM_AUTOMERGE_BOT_TOKEN.

Expected

Patchwarden/merge-safety should surface this as a first-class blocked state before the operator has to inspect raw Actions logs, for example:

verdict: blocked_merge_actor_credential or equivalent
reason: merge actor token invalid/unusable for /api/v1/user
repair: refresh runner-local PLATFORM_AUTOMERGE_BOT_TOKEN for the non-cousin merge-bot identity, then rerun the same PR/head
explicit note that PR readiness and Patchwarden checks are clean, but final merge authority is unavailable

This should not weaken the W6d contract. GITHUB_TOKEN and cousin tokens must not become merge actors.

Why This Belongs In Patchwarden

Patchwarden is the operator-facing safety layer for PR/automerge state. In this case, the PR was clean and the controller path reached final approval, but the operator-facing state still required log spelunking to distinguish:

bad PR readiness,
failed Matrix approval,
stale read token,
invalid merge-bot credential.

The actual result was the fourth case.

Acceptance Criteria

Patchwarden or its platform integration can classify invalid merge-bot credentials as a distinct blocked state.
The state names the failed capability without exposing token values.
Repair instructions are specific enough: refresh/restore runner-local PLATFORM_AUTOMERGE_BOT_TOKEN, then rerun automerge-pilot for the same PR/head.
The implementation does not allow codex, claude, glm, pdurlej, GITHUB_TOKEN, or the PR author to act as merge actor.

Labels Suggested

bug, client:platform, domain:ci, domain:forgejo, dependency/cross-repo, agent/codex

## Bug Patchwarden's W6d/automerge integration can report a PR as clean and ready, but the final controller merge still fails because the runner-local merge-bot token is invalid. The failure currently appears only inside the `automerge-pilot` Actions log, after Patchwarden has already produced green evidence. ## Platform Case Repo: `pdurlej/platform` Related items: - platform PR #826: safe-scope self-merge smoke PR - platform PR #827: fixed the earlier stale read-token blocker in `automerge-pilot` collection - platform issue #823: W6d unattended merge-safety loop - Forgejo Actions run #5944: latest self-merge attempt after #827 Exact PR/head under test: - PR: `pdurlej/platform#826` - Head SHA: `3b1d252a97f18934d7385fffb16aea4ab8272aa0` - Base SHA: `b6615852544d8b339f15998f6d24c7f8f3d81a40` ## Observed After #827 was merged, `automerge-pilot` run #5944 progressed correctly through the earlier blocker: - `Collect Forgejo facts`: passed via `token_env=GITHUB_TOKEN` - `automerge_readiness.py`: `ready_for_controller_merge`, `ready=true` - Required contexts were green: - `base-is-main / guard (pull_request)` - `patchwarden-pr-sanity / sanity (pull_request)` - `patchwarden-client-dry-run / dry-run (pull_request)` - Iskra Matrix approval returned `approved=true` for the exact PR/head SHA. The run then failed in the final merge actor while validating `PLATFORM_AUTOMERGE_BOT_TOKEN`: ```text File "control-plane/platformctl/ci/automerge_actor.py", line 253, in _load_ready_context actor = _token_login(args.forgejo_host, token) ... urllib.error.HTTPError: HTTP Error 401: Unauthorized ``` No secret value was printed in logs. The failing token name is runner-local `PLATFORM_AUTOMERGE_BOT_TOKEN`. ## Expected Patchwarden/merge-safety should surface this as a first-class blocked state before the operator has to inspect raw Actions logs, for example: - verdict: `blocked_merge_actor_credential` or equivalent - reason: merge actor token invalid/unusable for `/api/v1/user` - repair: refresh runner-local `PLATFORM_AUTOMERGE_BOT_TOKEN` for the non-cousin merge-bot identity, then rerun the same PR/head - explicit note that PR readiness and Patchwarden checks are clean, but final merge authority is unavailable This should not weaken the W6d contract. `GITHUB_TOKEN` and cousin tokens must not become merge actors. ## Why This Belongs In Patchwarden Patchwarden is the operator-facing safety layer for PR/automerge state. In this case, the PR was clean and the controller path reached final approval, but the operator-facing state still required log spelunking to distinguish: - bad PR readiness, - failed Matrix approval, - stale read token, - invalid merge-bot credential. The actual result was the fourth case. ## Acceptance Criteria - Patchwarden or its platform integration can classify invalid merge-bot credentials as a distinct blocked state. - The state names the failed capability without exposing token values. - Repair instructions are specific enough: refresh/restore runner-local `PLATFORM_AUTOMERGE_BOT_TOKEN`, then rerun `automerge-pilot` for the same PR/head. - The implementation does not allow `codex`, `claude`, `glm`, `pdurlej`, `GITHUB_TOKEN`, or the PR author to act as merge actor. ## Labels Suggested `bug`, `client:platform`, `domain:ci`, `domain:forgejo`, `dependency/cross-repo`, `agent/codex`

codex added the

agent/codex

client:platform

dependency/cross-repo

domain:ci

domain:forgejo

labels

2026-06-25 21:54:15 +02:00

codex referenced this issue from a pull request from pdurlej/platform that will close it,

2026-06-25 22:10:38 +02:00

fix: surface invalid automerge actor token #828

pdurlej closed this issue

2026-06-25 22:24:14 +02:00

pdurlej referenced this issue from a commit

2026-06-25 22:24:15 +02:00

Merge pull request #828

codex commented

2026-06-25 22:25:30 +02:00

Author

Collaborator

Addressed in platform PR #828: pdurlej/platform#828

Merged commit: f4ddb78724023edf21188e28e702f54a6fcc984e.

What changed:

automerge_actor.py now writes platform_automerge_actor_readiness.v0 for merge actor auth/identity checks.
401/403 from runner-local PLATFORM_AUTOMERGE_BOT_TOKEN becomes blocked_merge_actor_credential with a repair instruction and no token/body leakage.
GITHUB_TOKEN is rejected before token login.
codex, claude, glm, pdurlej, and the PR author are rejected as merge actors, case-insensitively.

Verification:

python3 -m pytest control-plane/platformctl/tests/test_automerge_actor.py
python3 -m pytest control-plane/platformctl/tests/test_automerge_actor.py control-plane/platformctl/tests/test_forgejo_ci_scripts_contract.py control-plane/platformctl/tests/test_automerge_readiness.py
Platform PR #828 CI was green before merge.

Operational note: while merging this, the required patchwarden-pr-sanity / sanity status took 6m36s and the first status read looked pending because Forgejo returns status history out of order. That is a separate PR-sanity health/UX follow-up, not part of this issue.

Addressed in platform PR #828: https://git.pdurlej.com/pdurlej/platform/pulls/828 Merged commit: `f4ddb78724023edf21188e28e702f54a6fcc984e`. What changed: - `automerge_actor.py` now writes `platform_automerge_actor_readiness.v0` for merge actor auth/identity checks. - 401/403 from runner-local `PLATFORM_AUTOMERGE_BOT_TOKEN` becomes `blocked_merge_actor_credential` with a repair instruction and no token/body leakage. - `GITHUB_TOKEN` is rejected before token login. - `codex`, `claude`, `glm`, `pdurlej`, and the PR author are rejected as merge actors, case-insensitively. Verification: - `python3 -m pytest control-plane/platformctl/tests/test_automerge_actor.py` - `python3 -m pytest control-plane/platformctl/tests/test_automerge_actor.py control-plane/platformctl/tests/test_forgejo_ci_scripts_contract.py control-plane/platformctl/tests/test_automerge_readiness.py` - Platform PR #828 CI was green before merge. Operational note: while merging this, the required `patchwarden-pr-sanity / sanity` status took 6m36s and the first status read looked pending because Forgejo returns status history out of order. That is a separate PR-sanity health/UX follow-up, not part of this issue.

codex referenced this issue

2026-06-26 10:28:43 +02:00

feat(pr-sanity): show merge readiness snapshot #249