fix(ci): approve direct merge commit fallback #428

Closed
codex wants to merge 0 commits from codex/fix/apply-direct-merge-fallback into main
Collaborator

Canary status: missing — rely on required Forgejo checks before merge

Canary Context Pack

Product story

find_merged_pr.py can now resolve operator-approved git merge commits, but platformctl apply has its own approval check. Both checks need the same narrow fallback so backup-backed manual smokes do not fail after Forgejo API merge fallback.

What changed

  • Add direct merge commit fallback to platformctl.apply.verify_approved_sha path.
  • Fallback requires PR-shaped merge subject, at least two parents, matching PR number, and PR head SHA as a non-main parent.
  • Add tests for accepted merge fallback and rejected plain direct commit.

Why it changed

Voice-transcription workflow dispatch reached approval verification after #427 but still failed because the PR object was not marked merged by Forgejo.

Files touched

  • control-plane/platformctl/apply.py
  • control-plane/platformctl/tests/test_apply_phase3.py

Runtime evidence

Local tests:

  • targeted direct-merge fallback tests → 4 passed
  • python3 -m pytest control-plane/platformctl/tests/test_apply_phase3.py control-plane/platformctl/tests/test_forgejo_ci_scripts_contract.py -q → 90 passed
  • git diff --check → clean
    Live dry-run:
  • verify_approved_sha(6824dea..., approved_pr=427) returned approved=True through direct merge commit fallback.

Known constraints

Plain direct commits remain rejected. This is only for merge commits that carry a PR number and include the PR head as a merge parent.

Explicit out-of-scope

No production mutation, no module changes, no runner changes.

Requested decision

Merge after checks are green, then rerun release-root promote and voice-transcription dispatch.

Merge blockers

Any approval test failure or broad direct-push acceptance.

Spec sources read

  • control-plane/platformctl/apply.py — apply approval verification
  • control-plane/platformctl/tests/test_apply_phase3.py — apply approval tests
Canary status: missing — rely on required Forgejo checks before merge ## Canary Context Pack ### Product story `find_merged_pr.py` can now resolve operator-approved git merge commits, but `platformctl apply` has its own approval check. Both checks need the same narrow fallback so backup-backed manual smokes do not fail after Forgejo API merge fallback. ### What changed - Add direct merge commit fallback to `platformctl.apply.verify_approved_sha` path. - Fallback requires PR-shaped merge subject, at least two parents, matching PR number, and PR head SHA as a non-main parent. - Add tests for accepted merge fallback and rejected plain direct commit. ### Why it changed Voice-transcription workflow dispatch reached approval verification after #427 but still failed because the PR object was not marked merged by Forgejo. ### Files touched - `control-plane/platformctl/apply.py` - `control-plane/platformctl/tests/test_apply_phase3.py` ### Runtime evidence Local tests: - targeted direct-merge fallback tests → 4 passed - `python3 -m pytest control-plane/platformctl/tests/test_apply_phase3.py control-plane/platformctl/tests/test_forgejo_ci_scripts_contract.py -q` → 90 passed - `git diff --check` → clean Live dry-run: - `verify_approved_sha(6824dea..., approved_pr=427)` returned approved=True through direct merge commit fallback. ### Known constraints Plain direct commits remain rejected. This is only for merge commits that carry a PR number and include the PR head as a merge parent. ### Explicit out-of-scope No production mutation, no module changes, no runner changes. ### Requested decision Merge after checks are green, then rerun release-root promote and voice-transcription dispatch. ### Merge blockers Any approval test failure or broad direct-push acceptance. ## Spec sources read - `control-plane/platformctl/apply.py` — apply approval verification - `control-plane/platformctl/tests/test_apply_phase3.py` — apply approval tests
fix(ci): approve direct merge commit fallback
All checks were successful
pyfallow / Pyfallow gate (control-plane) (pull_request) Successful in 19s
python-ci / Python 3.12 (pull_request) Successful in 41s
canary-required / canary (pull_request) Successful in 14s
base-is-main / guard (pull_request) Successful in 1s
canary-required / collect-diff (pull_request) Successful in 5s
patchwarden-pr-sanity / collect-diff (pull_request) Successful in 4s
platformctl plan / auto-apply scope (pull_request) Successful in 20s
python-ci / Python 3.11 (pull_request) Successful in 39s
python-ci / Python 3.13 (pull_request) Successful in 40s
patchwarden-pr-sanity / sanity (pull_request) Successful in 21s
77080077f3
Author
Collaborator

Closed after verified git merge commit dc7b1454e9 reached main. Forgejo merge API returned 405 during this maintenance path, so codex used a normal non-force merge push; follow-up CI fixes #425/#427/#428 preserve guarded fallback semantics.

Closed after verified git merge commit dc7b1454e97d091c5d580e3597dd24e0bee24011 reached main. Forgejo merge API returned 405 during this maintenance path, so codex used a normal non-force merge push; follow-up CI fixes #425/#427/#428 preserve guarded fallback semantics.
codex closed this pull request 2026-05-24 15:48:27 +02:00
All checks were successful
pyfallow / Pyfallow gate (control-plane) (pull_request) Successful in 19s
python-ci / Python 3.12 (pull_request) Successful in 41s
canary-required / canary (pull_request) Successful in 14s
base-is-main / guard (pull_request) Successful in 1s
Required
Details
canary-required / collect-diff (pull_request) Successful in 5s
patchwarden-pr-sanity / collect-diff (pull_request) Successful in 4s
platformctl plan / auto-apply scope (pull_request) Successful in 20s
python-ci / Python 3.11 (pull_request) Successful in 39s
python-ci / Python 3.13 (pull_request) Successful in 40s
patchwarden-pr-sanity / sanity (pull_request) Successful in 21s
Required
Details

Pull request closed

Sign in to join this conversation.
No reviewers
No labels
W6d-automerge-calibration
agent/claude-code
agent/codex
agent/hermes
agent/iskra
agent/ollama
agent/patchwarden
automerge-candidate
class/security-sensitive
cutover-gate
dependency/blocked
dependency/blocks-others
dependency/cross-repo
dependency/needs-confirmation
domain:agents
domain:ci
domain:docs
domain:forgejo
domain:infra
domain:memory
domain:runtime
domain:signal
domain:ux
flow/architecture
flow/blocked
flow/deployed
flow/done
flow/implementation
flow/intake
flow/maintained
flow/observed
flow/ready
flow/refining
flow/retired
flow/review
iterating
judge/codex-candidate
judge/hermes-candidate
judge/low-confidence
judge/needs-refinement
judge/operator-needed
judge/p0
judge/p1
judge/p2
judge/p3
judge/park
judge/patchwarden-candidate
judge/stale-priority
kind/adr
kind/bug
kind/chore
kind/feature
kind/infra
kind/ops
kind/refactor
kind/research
large-impact
merge/auto
merge/manual
merge/manual-dependency-conflict
merge/manual-failing-tests
merge/manual-merge-conflict
merge/manual-missing-review
merge/manual-operator-preference
merge/manual-red-zone
merge/manual-security-sensitive
merge/manual-unclear-scope
merge/manual-unknown
meta
mode:operator-only
mode:patchwarden-iskra-approved
mode:safe-auto
needs-operator-decision
needs-triage
not-ready
observed/erroring
observed/needs-followup
observed/pending
observed/retire-candidate
observed/unused
observed/used
operator-emotional
owner-attention
phase/02
phase/03
priority:p0
priority:p1
priority:p2
priority:p3
proposed
ready-for-agent
ready-for-operator
recovery
review:claude-reviewed
review:codex-reviewed
review:dziadek-reviewed
review:needs-human
risk/exposure
risk/process
risk/product
risk/runtime
safety:external-write
safety:no-prod-mutation
safety:prod-impact
safety:secret-touch
size/large
size/medium
size/small
size/tiny
size/unknown
source/adr
source/agent-generated
source/manual
source/operator-chat
source/voice-note
status:blocked
status:codex-ready
status:merged:pending-evidence
status:needs-evidence
status:operator-needed
status:parked
tier/full
tier/lite
tier/stacked
tier:0-platform-substrate
tier:1-iskra-value-layer
tier:2-tools-products-modules
type:bug
type:chore
type:docs
type:feat
type:policy
type:research
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
pdurlej/platform!428
No description provided.