feat(w6): require Iskra Matrix approval for automerge #473

Merged

pdurlej merged 1 commit from codex/w6d-iskra-approval-lane into main

2026-05-25 07:10:59 +02:00

codex commented

2026-05-25 07:09:44 +02:00

Collaborator

Canary status: missing — fire canary 3+3 manually before merge

Canary Context Pack

Product story

W6d automerge should remove low-value operator clicking without letting a model or cousin blindly merge code. Iskra is the right final contextual approver because she carries the operator-facing context, but the merge itself must stay deterministic and SHA-bound.

What changed

Added a stdlib-only Matrix approval helper for the Platform Approvals room.
Wired automerge-pilot.yml so W6d readiness must be followed by an exact Iskra approval before the merge actor can run.
Documented the room, identities, exact reply contract, and metadata-only privacy rule.
Added unit coverage for approval parsing, SHA/PR mismatch rejection, metadata-only request payloads, and artifact writing.

Why it changed

The current pilot can prove deterministic readiness, but it needs a final non-author operator-context signal before executing a merge. Matrix gives OpenClaw/Iskra a native lane without turning Forgejo comments into an ad-hoc chat transport.

Files touched

.forgejo/workflows/automerge-pilot.yml
control-plane/platformctl/ci/iskra_matrix_approval.py
control-plane/platformctl/tests/test_iskra_matrix_approval.py
state/cycle/W6d-autonomous-merge-pilot.md

Relevant context

W6d autonomous merge pilot policy in state/cycle/W6d-autonomous-merge-pilot.md
Existing automerge actor/readiness helpers under control-plane/platformctl/ci/
Platform Approvals Matrix runtime lane: #platform-approvals:pdurlej.com

Runtime evidence

Already completed with explicit operator approval before this PR:

@platform-approvals:pdurlej.com joined #platform-approvals:pdurlej.com.
Metadata-only smoke request was sent.
@iskra:pdurlej.com replied with the expected smoke marker.

This PR itself performs no runtime mutation.

Known constraints

Requires runner-local PLATFORM_APPROVALS_MATRIX_ACCESS_TOKEN and PLATFORM_APPROVALS_MATRIX_ROOM_ID from Infisical.
Requires the existing merge token env before execute_merge=true can succeed.
Approval is accepted only for exact PR number and full head SHA.
No raw diff, PR body, prompts, private messages, emails, secrets, or memory contents are sent to Matrix.

Explicit out-of-scope

No broad autonomous merge policy expansion.
No Matrix command bus beyond this approval lane.
No Forgejo branch protection changes.
No runtime env provisioning in this PR.

Requested decision

Approve the repo gate. Merge order recommendation: merge #472 first, then this PR, then run one #470 smoke with execute_merge=false before the real merge trial.

Merge blockers

Helper leaks raw PR/diff/private content to Matrix.
Approval is not bound to exact PR and head SHA.
Workflow can merge without iskra-approval.json approved.

Spec sources read

.forgejo/workflows/automerge-pilot.yml — workflow integration point.
control-plane/platformctl/ci/automerge_actor.py — merge actor contract.
control-plane/platformctl/ci/automerge_readiness.py — readiness artifact shape.
control-plane/platformctl/tests/test_automerge_actor.py — test style for actor helpers.
control-plane/platformctl/tests/test_automerge_readiness.py — test style for readiness helpers.
state/cycle/W6d-autonomous-merge-pilot.md — W6d policy artifact.

Tests

PYTHONPATH=control-plane pytest -q control-plane/platformctl/tests/test_iskra_matrix_approval.py control-plane/platformctl/tests/test_automerge_actor.py control-plane/platformctl/tests/test_automerge_readiness.py → 15 passed
python3 -m py_compile control-plane/platformctl/ci/iskra_matrix_approval.py
git diff --check

Refs #470

Canary status: missing — fire canary 3+3 manually before merge ## Canary Context Pack ### Product story W6d automerge should remove low-value operator clicking without letting a model or cousin blindly merge code. Iskra is the right final contextual approver because she carries the operator-facing context, but the merge itself must stay deterministic and SHA-bound. ### What changed - Added a stdlib-only Matrix approval helper for the Platform Approvals room. - Wired `automerge-pilot.yml` so W6d readiness must be followed by an exact Iskra approval before the merge actor can run. - Documented the room, identities, exact reply contract, and metadata-only privacy rule. - Added unit coverage for approval parsing, SHA/PR mismatch rejection, metadata-only request payloads, and artifact writing. ### Why it changed The current pilot can prove deterministic readiness, but it needs a final non-author operator-context signal before executing a merge. Matrix gives OpenClaw/Iskra a native lane without turning Forgejo comments into an ad-hoc chat transport. ### Files touched - `.forgejo/workflows/automerge-pilot.yml` - `control-plane/platformctl/ci/iskra_matrix_approval.py` - `control-plane/platformctl/tests/test_iskra_matrix_approval.py` - `state/cycle/W6d-autonomous-merge-pilot.md` ### Relevant context - W6d autonomous merge pilot policy in `state/cycle/W6d-autonomous-merge-pilot.md` - Existing automerge actor/readiness helpers under `control-plane/platformctl/ci/` - Platform Approvals Matrix runtime lane: `#platform-approvals:pdurlej.com` ### Runtime evidence Already completed with explicit operator approval before this PR: - `@platform-approvals:pdurlej.com` joined `#platform-approvals:pdurlej.com`. - Metadata-only smoke request was sent. - `@iskra:pdurlej.com` replied with the expected smoke marker. This PR itself performs no runtime mutation. ### Known constraints - Requires runner-local `PLATFORM_APPROVALS_MATRIX_ACCESS_TOKEN` and `PLATFORM_APPROVALS_MATRIX_ROOM_ID` from Infisical. - Requires the existing merge token env before `execute_merge=true` can succeed. - Approval is accepted only for exact PR number and full head SHA. - No raw diff, PR body, prompts, private messages, emails, secrets, or memory contents are sent to Matrix. ### Explicit out-of-scope - No broad autonomous merge policy expansion. - No Matrix command bus beyond this approval lane. - No Forgejo branch protection changes. - No runtime env provisioning in this PR. ### Requested decision Approve the repo gate. Merge order recommendation: merge #472 first, then this PR, then run one #470 smoke with `execute_merge=false` before the real merge trial. ### Merge blockers - Helper leaks raw PR/diff/private content to Matrix. - Approval is not bound to exact PR and head SHA. - Workflow can merge without `iskra-approval.json` approved. ## Spec sources read - `.forgejo/workflows/automerge-pilot.yml` — workflow integration point. - `control-plane/platformctl/ci/automerge_actor.py` — merge actor contract. - `control-plane/platformctl/ci/automerge_readiness.py` — readiness artifact shape. - `control-plane/platformctl/tests/test_automerge_actor.py` — test style for actor helpers. - `control-plane/platformctl/tests/test_automerge_readiness.py` — test style for readiness helpers. - `state/cycle/W6d-autonomous-merge-pilot.md` — W6d policy artifact. ## Tests - `PYTHONPATH=control-plane pytest -q control-plane/platformctl/tests/test_iskra_matrix_approval.py control-plane/platformctl/tests/test_automerge_actor.py control-plane/platformctl/tests/test_automerge_readiness.py` → 15 passed - `python3 -m py_compile control-plane/platformctl/ci/iskra_matrix_approval.py` - `git diff --check` Refs #470

codex added 1 commit

2026-05-25 07:09:44 +02:00

feat(w6): require iskra matrix approval for automerge

base-is-main / guard (pull_request) Successful in 1s

Details

pyfallow / Pyfallow gate (control-plane) (pull_request) Successful in 20s

Details

canary-required / collect-diff (pull_request) Successful in 4s

Details

infra-docs-drift / docs-drift (pull_request) Successful in 5s

Details

patchwarden-pr-sanity / collect-diff (pull_request) Successful in 4s