You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
auto-arm: arm only on a reviewed, answered head (step 3/3) - #6063
Step 3 of 3 of "arm only on a reviewed, answered head": auto-arm.yml stops arming and only disarms on a push. Arming is the control plane's job: MeshWeaver.Plugins PrArming (#2828, merged) applies check-review-answered.py --arm-gate.
What changes
auto-arm.yml keeps its file name, so no caller changes. It runs only on synchronize. If the pull request is armed, it runs gh pr merge --disable-auto and reads auto_merge back over REST.
It has no continue-on-error: a disarm that fails quietly would let an unreviewed head merge on a reviewed head's arm.
It still uses the meshweaver-cloud token with contents: write and pull-requests: write. No checks permission is needed.
lane-caller-grants.yml: the RETIRING and ARRIVING checks: read rows are dropped. Every auto-arm.yml row is {contents: write, pull-requests: write}, which is what the callers grant today. check-workflow-permission-pairing.py --fleet exits 0.
Guards:
NoWorkflowArmsAutoMerge: no workflow in .github/workflows arms auto-merge.
TheAutoMergeLaneDisarmsOnEveryPushAndToleratesNoFailure pins the disarm.
The #2916 App-token guards are kept.
Docs:
ReviewFindingsAnswered → "The arm gate" names the predicate the control plane applies.
The pullrequest skill, AGENTS.md (merge-queue line), FleetCiProcess, MergeQueue and HybridGitHubAzureDevOps no longer say auto-arm.yml arms every non-draft PR.
Adapted to Copilot as the reviewer (policy copilot-code-review, after #6229). The arm-gate conditions in the doc, the script comments and the guard message now name the review of the head as a Copilot review against the current head, or a completed internal-review run. They also add condition 5, every required check green (policy review-then-suites). The hard-coded policy dates this PR had added are replaced by policy ids.
Merge precondition: SATISFIED.PrArming now accepts a Copilot review of the head (Plugins#3088, merged), and the control instance has run it since its 13:30Z roll at core cac0664. The workflow armer can therefore be removed without leaving Copilot-only fleet PRs unarmed. This pull request also disarms fork pushes, since a maintainer can arm a fork PR by hand.
Verified locally (merge of origin/main 2026-10-07):
…wed push
Step 3 of 3. The lane asks check-review-answered.py --arm-gate (fetched from core
main, self-tested on every run) before arming, and arms only when the PR is not a
draft, the systemorph-com App's internal-review check run on the CURRENT head has
completed and is not the neutral "Reviewer unavailable" degradation, and every
thread the automatic reviewer opened has a person's reply. Otherwise one line in
the job summary names the missing condition.
Re-evaluates on check_run completed (only the internal reviewer's internal-review
reaches a runner), pull_request_review_comment created, and pull_request_target
ready_for_review/synchronize/opened/reopened. On synchronize an armed PR whose new
head is not ready is disarmed (GitHub keeps auto-merge across a push).
The lane now demands checks: read (the App token has no checks permission); the
roster's RETIRING rows are dropped and the ARRIVING rows are no longer pending.
Doc: ReviewFindingsAnswered gains "The arm gate".
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Results for commit dda8e28. ± Comparison against base commit 041dde2.
This pull request removes 39 and adds 50 tests. Note that renamed tests count towards both.
--- End of inner exception stack trace ---
--- End of inner exception stack trace ---, expected: True)
--- End of inner exception stack trace ---, isDenial: True)
---> (Inner Exception #1) MeshWeaver.Mesh.QueryProviderStalledException: Query provider(s) [pg] did not emit an Initial within the query fan-in's 16s bound for query 'nodeType:NodeType' (user 'system'). The merged Initial gates on EVERY provider, so this query has NO snapshot to answer with — it is reported as unavailable (retryable) rather than left hanging with no error. This is an availability failure, never a permission verdict: a consumer deciding access must fail CLOSED and say it could not establish the answer. Fix the stalled provider; never bump the consumer's timeout.<---
---> (Inner Exception #1) MeshWeaver.Messaging.Hub.Test.InfrastructureFaultTest+ProviderException (0x80004005): Failed to connect to 10.42.18.4:5432<---
---> (Inner Exception #1) System.ArgumentException: Value does not fall within the expected range.<---
---> (Inner Exception #1) System.InvalidOperationException: boom<---
---> (Inner Exception #1) System.InvalidOperationException: source B is misconfigured<---
---> (Inner Exception #1) System.Net.Sockets.SocketException (0xFFFDFFFF): Name or service not known<---
…
Memex.Portal.Shared.Test.SessionDenialIsAnAnswerTest ‑ OnlyAVerdictReadsAsADenial(shape: "the same verdict nested, as a late denial dispatch"···, failure: System.InvalidOperationException: write failed
---> System.UnauthorizedAccessException: Access denied
--- End of inner exception stack trace ---, isDenial: True)
Memex.Portal.Shared.Test.VersionSelectTest ‑ AMajorPattern_CrossesFromTheOldNotationToTheNew
Memex.Portal.Shared.Test.VersionSelectTest ‑ Stable_NeverSelectsANewNotationBuild
Memex.Portal.Shared.Test.VersionSelectTest ‑ TheNewNotationsEdgeBuild_IsGatedLikeTheOld
Memex.Portal.Shared.Test.VersionSelectTest ‑ TheOldFleetPattern_NeverSelectsTheNewNotation
Memex.Portal.Shared.Test.VersionSelectTest ‑ WideningThePattern_BeforeTheCutOver_ChangesNothing
MeshWeaver.Compiler.Pipeline.Test.SourcesWatcherStallBackoffTest ‑ The_production_classifier_recognises_a_stall_through_every_wrapping(because: "a stall as an aggregate's FIRST member", fault: System.AggregateException: One or more errors occurred. (Query provider(s) [pg] did not emit an Initial within the query fan-in's 16s bound for query 'nodeType:NodeType' (user 'system'). The merged Initial gates on EVERY provider, so this query has NO snapshot to answer with — it is reported as unavailable (retryable) rather than left hanging with no error. This is an availability failure, never a permission verdict: a consumer deciding access must fail CLOSED and say it could not establish the answer. Fix the stalled provider; never bump the consumer's timeout.)
---> MeshWeaver.Mesh.QueryProviderStalledException: Query provider(s) [pg] did not emit an Initial within the query fan-in's 16s bound for query 'nodeType:NodeType' (user 'system'). The merged Initial gates on EVERY provider, so this query has NO snapshot to answer with — it is reported as unavailable (retryable) rather than left hanging with no error. This is an availability failure, never a permission verdict: a consumer deciding access must fail CLOSED and say it could not establish the answer. Fix the stalled provider; never bump the consumer's timeout.
--- End of inner exception stack trace ---, expected: True)
MeshWeaver.Compiler.Pipeline.Test.SourcesWatcherStallBackoffTest ‑ The_production_classifier_recognises_a_stall_through_every_wrapping(because: "a stall as an aggregate's SECOND member", fault: System.AggregateException: One or more errors occurred. (The operation has timed out.) (Query provider(s) [pg] did not emit an Initial within the query fan-in's 16s bound for query 'nodeType:NodeType' (user 'system'). The merged Initial gates on EVERY provider, so this query has NO snapshot to answer with — it is reported as unavailable (retryable) rather than left hanging with no error. This is an availability failure, never a permission verdict: a consumer deciding access must fail CLOSED and say it could not establish the answer. Fix the stalled provider; never bump the consumer's timeout.)
---> System.TimeoutException: The operation has timed out.
--- End of inner exception stack trace ---
---> (Inner Exception #1) MeshWeaver.Mesh.QueryProviderStalledException: Query provider(s) [pg] did not emit an Initial within the query fan-in's 16s bound for query 'nodeType:NodeType' (user 'system'). The merged Initial gates on EVERY provider, so this query has NO snapshot to answer with — it is reported as unavailable (retryable) rather than left hanging with no error. This is an availability failure, never a permission verdict: a consumer deciding access must fail CLOSED and say it could not establish the answer. Fix the stalled provider; never bump the consumer's timeout.<---
, expected: True)
MeshWeaver.Compiler.Pipeline.Test.SourcesWatcherStallBackoffTest ‑ The_production_classifier_recognises_a_stall_through_every_wrapping(because: "a stall nested in an aggregate inside a wrapper", fault: System.InvalidOperationException: outer
---> System.AggregateException: One or more errors occurred. (Value does not fall within the expected range.) (Query provider(s) [pg] did not emit an Initial within the query fan-in's 16s bound for query 'nodeType:NodeType' (user 'system'). The merged Initial gates on EVERY provider, so this query has NO snapshot to answer with — it is reported as unavailable (retryable) rather than left hanging with no error. This is an availability failure, never a permission verdict: a consumer deciding access must fail CLOSED and say it could not establish the answer. Fix the stalled provider; never bump the consumer's timeout.)
---> System.ArgumentException: Value does not fall within the expected range.
--- End of inner exception stack trace ---
---> (Inner Exception #1) MeshWeaver.Mesh.QueryProviderStalledException: Query provider(s) [pg] did not emit an Initial within the query fan-in's 16s bound for query 'nodeType:NodeType' (user 'system'). The merged Initial gates on EVERY provider, so this query has NO snapshot to answer with — it is reported as unavailable (retryable) rather than left hanging with no error. This is an availability failure, never a permission verdict: a consumer deciding access must fail CLOSED and say it could not establish the answer. Fix the stalled provider; never bump the consumer's timeout.<---
--- End of inner exception stack trace ---, expected: True)
MeshWeaver.Compiler.Pipeline.Test.SourcesWatcherStallBackoffTest ‑ The_production_classifier_recognises_a_stall_through_every_wrapping(because: "a stall wrapped as InnerException", fault: System.InvalidOperationException: outer
---> MeshWeaver.Mesh.QueryProviderStalledException: Query provider(s) [pg] did not emit an Initial within the query fan-in's 16s bound for query 'nodeType:NodeType' (user 'system'). The merged Initial gates on EVERY provider, so this query has NO snapshot to answer with — it is reported as unavailable (retryable) rather than left hanging with no error. This is an availability failure, never a permission verdict: a consumer deciding access must fail CLOSED and say it could not establish the answer. Fix the stalled provider; never bump the consumer's timeout.
--- End of inner exception stack trace ---, expected: True)
…
♻️ This comment has been updated with latest results.
Results for commit dda8e28. ± Comparison against base commit 041dde2.
This pull request removes 44 and adds 104 tests. Note that renamed tests count towards both.
--- End of inner exception stack trace ---
--- End of inner exception stack trace ---, expected: True)
--- End of inner exception stack trace ---, isDenial: True)
---> (Inner Exception #1) MeshWeaver.Mesh.QueryProviderStalledException: Query provider(s) [pg] did not emit an Initial within the query fan-in's 16s bound for query 'nodeType:NodeType' (user 'system'). The merged Initial gates on EVERY provider, so this query has NO snapshot to answer with — it is reported as unavailable (retryable) rather than left hanging with no error. This is an availability failure, never a permission verdict: a consumer deciding access must fail CLOSED and say it could not establish the answer. Fix the stalled provider; never bump the consumer's timeout.<---
---> (Inner Exception #1) MeshWeaver.Messaging.Hub.Test.InfrastructureFaultTest+ProviderException (0x80004005): Failed to connect to 10.42.18.4:5432<---
---> (Inner Exception #1) System.ArgumentException: Value does not fall within the expected range.<---
---> (Inner Exception #1) System.InvalidOperationException: boom<---
---> (Inner Exception #1) System.InvalidOperationException: source B is misconfigured<---
---> (Inner Exception #1) System.Net.Sockets.SocketException (0xFFFDFFFF): Name or service not known<---
…
Memex.Portal.Shared.Test.InstanceIdRulesMatchTheRegistryTest ‑ TheSetupHostAgreesWithTheRegistry(candidate: "cdd651a0-2ce2-47d7-9304-4b9e897c7982")
Memex.Portal.Shared.Test.SessionDenialIsAnAnswerTest ‑ OnlyAVerdictReadsAsADenial(shape: "the same verdict nested, as a late denial dispatch"···, failure: System.InvalidOperationException: write failed
---> System.UnauthorizedAccessException: Access denied
--- End of inner exception stack trace ---, isDenial: True)
Memex.Portal.Shared.Test.VersionSelectTest ‑ AMajorPattern_CrossesFromTheOldNotationToTheNew
Memex.Portal.Shared.Test.VersionSelectTest ‑ Stable_NeverSelectsANewNotationBuild
Memex.Portal.Shared.Test.VersionSelectTest ‑ TheNewNotationsEdgeBuild_IsGatedLikeTheOld
Memex.Portal.Shared.Test.VersionSelectTest ‑ TheOldFleetPattern_NeverSelectsTheNewNotation
Memex.Portal.Shared.Test.VersionSelectTest ‑ WideningThePattern_BeforeTheCutOver_ChangesNothing
MeshWeaver.Compiler.Pipeline.Test.SourcesWatcherStallBackoffTest ‑ The_production_classifier_recognises_a_stall_through_every_wrapping(because: "a stall as an aggregate's FIRST member", fault: System.AggregateException: One or more errors occurred. (Query provider(s) [pg] did not emit an Initial within the query fan-in's 16s bound for query 'nodeType:NodeType' (user 'system'). The merged Initial gates on EVERY provider, so this query has NO snapshot to answer with — it is reported as unavailable (retryable) rather than left hanging with no error. This is an availability failure, never a permission verdict: a consumer deciding access must fail CLOSED and say it could not establish the answer. Fix the stalled provider; never bump the consumer's timeout.)
---> MeshWeaver.Mesh.QueryProviderStalledException: Query provider(s) [pg] did not emit an Initial within the query fan-in's 16s bound for query 'nodeType:NodeType' (user 'system'). The merged Initial gates on EVERY provider, so this query has NO snapshot to answer with — it is reported as unavailable (retryable) rather than left hanging with no error. This is an availability failure, never a permission verdict: a consumer deciding access must fail CLOSED and say it could not establish the answer. Fix the stalled provider; never bump the consumer's timeout.
--- End of inner exception stack trace ---, expected: True)
MeshWeaver.Compiler.Pipeline.Test.SourcesWatcherStallBackoffTest ‑ The_production_classifier_recognises_a_stall_through_every_wrapping(because: "a stall as an aggregate's SECOND member", fault: System.AggregateException: One or more errors occurred. (The operation has timed out.) (Query provider(s) [pg] did not emit an Initial within the query fan-in's 16s bound for query 'nodeType:NodeType' (user 'system'). The merged Initial gates on EVERY provider, so this query has NO snapshot to answer with — it is reported as unavailable (retryable) rather than left hanging with no error. This is an availability failure, never a permission verdict: a consumer deciding access must fail CLOSED and say it could not establish the answer. Fix the stalled provider; never bump the consumer's timeout.)
---> System.TimeoutException: The operation has timed out.
--- End of inner exception stack trace ---
---> (Inner Exception #1) MeshWeaver.Mesh.QueryProviderStalledException: Query provider(s) [pg] did not emit an Initial within the query fan-in's 16s bound for query 'nodeType:NodeType' (user 'system'). The merged Initial gates on EVERY provider, so this query has NO snapshot to answer with — it is reported as unavailable (retryable) rather than left hanging with no error. This is an availability failure, never a permission verdict: a consumer deciding access must fail CLOSED and say it could not establish the answer. Fix the stalled provider; never bump the consumer's timeout.<---
, expected: True)
MeshWeaver.Compiler.Pipeline.Test.SourcesWatcherStallBackoffTest ‑ The_production_classifier_recognises_a_stall_through_every_wrapping(because: "a stall nested in an aggregate inside a wrapper", fault: System.InvalidOperationException: outer
---> System.AggregateException: One or more errors occurred. (Value does not fall within the expected range.) (Query provider(s) [pg] did not emit an Initial within the query fan-in's 16s bound for query 'nodeType:NodeType' (user 'system'). The merged Initial gates on EVERY provider, so this query has NO snapshot to answer with — it is reported as unavailable (retryable) rather than left hanging with no error. This is an availability failure, never a permission verdict: a consumer deciding access must fail CLOSED and say it could not establish the answer. Fix the stalled provider; never bump the consumer's timeout.)
---> System.ArgumentException: Value does not fall within the expected range.
--- End of inner exception stack trace ---
---> (Inner Exception #1) MeshWeaver.Mesh.QueryProviderStalledException: Query provider(s) [pg] did not emit an Initial within the query fan-in's 16s bound for query 'nodeType:NodeType' (user 'system'). The merged Initial gates on EVERY provider, so this query has NO snapshot to answer with — it is reported as unavailable (retryable) rather than left hanging with no error. This is an availability failure, never a permission verdict: a consumer deciding access must fail CLOSED and say it could not establish the answer. Fix the stalled provider; never bump the consumer's timeout.<---
--- End of inner exception stack trace ---, expected: True)
…
♻️ This comment has been updated with latest results.
…t a literal branch name
ArmedMergeMustTriggerMainsPushLanesGuard.TheArmLaneArmsOnlyOntoTheRepositoryDefaultBranch
forbids naming the branch literally in this lane. The fetch now names no ref, so the
contents API reads core's default branch (core's, not the caller's, which is what
github.event.repository.default_branch would give on a workflow_call).
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Pushed 79c9c5e: the literal branch name in the gate's fetch is gone. TheArmLaneArmsOnlyOntoTheRepositoryDefaultBranch passes. The fetch now names no ref, so the contents API reads core's default branch. github.event.repository.default_branch would give the caller's branch on a workflow_call, which is the wrong repository for this read. I also merged origin/main.
Still red: NoWorkflowMergesOrArmsAPullRequestWithTheDefaultToken. Local run: Total 11, Failed 1. The gate step sets GH_TOKEN: ${{ github.token }} in a file that runs gh pr merge, and the guard checks the whole file. A minted App token won't fix this as things stand. Measured from orgs/Systemorph/installations:
meshweaver-cloud (4220566), the only App whose secrets the callers pass, has no checks permission.
The Apps that do have checks are meshweaver-reader (4919171, read) and systemorph-com (4918443, write). The satellites have neither App's secrets: Plugins has only MESHWEAVER_APP_*.
Renaming the env var to GITHUB_TOKEN would only get past the guard's spelling check, so I'm not doing that.
Merge blocker (from this PR's own description): no caller grants checks: read yet. I checked auto-arm.yml on main in Plugins, Education, Reinsurance, SocialMedia, Manufacturing, Crm, FundReporting and Memex: none has checks: or the new triggers, and I found no step-2 PRs. Merging now would make the lane fail at startup in all eight. So this stays a draft. Undrafting would let main's auto-arm lane arm it on ready_for_review.
A maintainer needs to pick one:
Grant meshweaver-cloud the Checks: read permission (an org-level App change that needs approval on each installation). The gate then mints permission-checks: read from the App the callers already pass. That fixes the guard honestly, needs no caller changes and no step 2, and the roster's RETIRING rows go back.
Keep the caller-grant design: open the eight step-2 caller PRs and move the gate's read into a separate reusable workflow file that merges nothing. Both the GitHub-documented resolution of a nested ./uses: and the need to avoid a literal @main in auto-arm.yml have to be settled first.
… token
The gate step passed GITHUB_TOKEN as GH_TOKEN in a file that merges, which
ArmedMergeMustTriggerMainsPushLanesGuard forbids file-wide. It now mints a
meshweaver-cloud installation token with checks/contents/pull-requests: read from
the MESHWEAVER_APP_* secrets every caller already passes. No caller grants
checks: read any more: the workflow drops it, and every auto-arm roster row in
lane-caller-grants.yml is back to {contents: write, pull-requests: write} with no
pending marker (the satellites' real grant). Requires the meshweaver-cloud App to
carry Checks: read; without it the mint fails red and nothing is armed.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
New precondition. This replaces "every caller grants checks: read" in the description. The maintainer chose option 1. As of cf2191f:
The arm gate reads the check runs with a read-only token minted from the meshweaver-cloud App: actions/create-github-app-token@v3, with permission-checks: read, permission-contents: read and permission-pull-requests: read. It uses the MESHWEAVER_APP_* secrets every caller already passes. GITHUB_TOKEN no longer appears anywhere in auto-arm.yml.
The workflow drops checks: read. Every auto-arm.yml row in lane-caller-grants.yml is back to {contents: write, pull-requests: write} with no pending marker, which is what the satellites grant today. No caller PRs are needed.
I updated the doc paragraph in ReviewFindingsAnswered → "The arm gate" to match.
Merge only once the meshweaver-cloud App (app id 4220566, installation 144517285) carries Checks: read. Before then the mint fails, the lane goes red, and nothing is armed. Check with: gh api orgs/Systemorph/installations --jq '.installations[]|select(.app_id==4220566)|.permissions.checks'
Local results: ArmedMergeMustTriggerMainsPushLanesGuard Total 11, Failed 0. check-workflow-permission-pairing.py --fleet exits 0, and its --self-test passes 14/14.
Arming is a decision (reviewed head, every finding answered), and the control
instance's PR steward (App systemorph-com) already reads both, so it becomes the
one place that arms. auto-arm.yml keeps its name and callers and now only
DISARMS on synchronize (GitHub keeps auto-merge across a push), with a read-back
and no tolerated failure. The read token, the check_run and review-comment
triggers, the arm and the base/comment steps are gone; the lane needs no checks
permission.
Guards: NoWorkflowArmsAutoMerge replaces the per-workflow default-branch checks
(nothing left to arm), and TheAutoMergeLaneDisarmsOnEveryPushAndToleratesNoFailure
pins the disarm. Doc ReviewFindingsAnswered 'The arm gate' states the control
plane's predicate; check-review-answered.py --arm-gate is its reference.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Reshaped (ad68d15): arming moves to the control plane. This replaces the precondition in my previous comment. The meshweaver-cloudChecks route is dropped.
auto-arm.ymlno longer arms. It keeps its file name, so the eight callers need no change. On synchronize it now only disarms: if the pull request is armed it runs gh pr merge --disable-auto, then reads auto_merge back. It has no continue-on-error, because a disarm that fails quietly would let an unreviewed head merge on the reviewed head's arm. These are gone from it: the read token, the check_run and pull_request_review_comment triggers, the base step, the comment step and the arm step. It uses only contents: write and pull-requests: write, so meshweaver-cloud needs no Checks permission.
lane-caller-grants.yml: every auto-arm.yml row reads {contents: write, pull-requests: write} with no pending marker.
Guards:
NoWorkflowArmsAutoMerge replaces the per-workflow default-branch checks, since no workflow arms any more.
TheAutoMergeLaneDisarmsOnEveryPushAndToleratesNoFailure pins the disarm.
Local runs: guard class Total 9, Failed 0. Against main's arming lane, both new tests fail. Full Documentation.Test suite: 663 / 0.
ReviewFindingsAnswered → "The arm gate" now states the predicate the control plane applies. check-review-answered.py --arm-gate is its reference implementation, and its self-test cases are the test vectors.
Precondition: merge only once control-plane arming is live. Once this lands, no workflow arms, so until the PR steward arms, every pull request in the fleet needs a hand-arm. Stays draft until then.
…te's five conditions; no stale 'auto-arm arms' claims
Adapts #6063 to policy copilot-code-review (#6229): the arm-gate doc, the
script comments and the guard message accept a Copilot review of the current
head ahead of an internal-review run, and add condition 5 (required checks
green, policy review-then-suites). Replaces the hard-coded policy dates with
policy ids. AGENTS.md, the pullrequest skill, FleetCiProcess, MergeQueue and
HybridGitHubAzureDevOps no longer say auto-arm.yml arms every non-draft PR.
Names the owed PrArming port as the merge precondition.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Prerequisite: Systemorph/MeshWeaver.Plugins#3088. It ports core #6229's Copilot acceptance (copilot_review_on, checked first, then a real internal-review) into the control plane's PrArming. Without it, PrArming still requires an internal-review run and never arms. Keep this PR a draft until #3088 has MERGED and is deployed on the control instance (with a recycle of the Hosting/Deployment NodeType). Only then should auto-arm.yml become disarm-only. The register note is updated in #6238.
This directory-only text scan already has a false negative: merge-queue-steward.yml invokes .github/scripts/merge-queue-steward.py, whose enqueue method executes both enqueuePullRequest and the enablePullRequestAutoMerge fallback (lines 701 and 707). Therefore NoWorkflowArmsAutoMerge reports no offender even though a workflow can still arm auto-merge. Either include workflow-invoked scripts in the guard or narrow the invariant and explicitly account for the steward.
Update Copilot auto-arming records to shipped state
This newly added warning contradicts the PR's stated satisfied precondition: Plugins#3088 has merged and the deployed PrArming now accepts Copilot reviews. It also points readers to PolicyNotProse.md:170, which still lists that port as owed. Update both records to the shipped state; otherwise the operational manual says Copilot-only PRs still require manual arming.
The reason will be displayed to describe this comment to others. Learn more.
Fixed in dda8e28: the guard now matches the actual single-line form and asserts the exact predicate github.event.action == 'synchronize'; the class passes (9/9).
The reason will be displayed to describe this comment to others. Learn more.
Fixed in dda8e28: ReviewFindingsAnswered.md and review-answered.yml now say the control plane (PrArming) arms, and auto-arm.yml only disarms on a push.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Step 3 of 3 of "arm only on a reviewed, answered head":
auto-arm.ymlstops arming and only disarms on a push. Arming is the control plane's job: MeshWeaver.PluginsPrArming(#2828, merged) appliescheck-review-answered.py --arm-gate.What changes
auto-arm.ymlkeeps its file name, so no caller changes. It runs only onsynchronize. If the pull request is armed, it runsgh pr merge --disable-autoand readsauto_mergeback over REST.continue-on-error: a disarm that fails quietly would let an unreviewed head merge on a reviewed head's arm.contents: writeandpull-requests: write. Nocheckspermission is needed.lane-caller-grants.yml: the RETIRING and ARRIVINGchecks: readrows are dropped. Everyauto-arm.ymlrow is{contents: write, pull-requests: write}, which is what the callers grant today.check-workflow-permission-pairing.py --fleetexits 0.NoWorkflowArmsAutoMerge: no workflow in.github/workflowsarms auto-merge.TheAutoMergeLaneDisarmsOnEveryPushAndToleratesNoFailurepins the disarm.#2916App-token guards are kept.ReviewFindingsAnswered→ "The arm gate" names the predicate the control plane applies.auto-arm.ymlarms every non-draft PR.Adapted to Copilot as the reviewer (policy
copilot-code-review, after #6229). The arm-gate conditions in the doc, the script comments and the guard message now name the review of the head as a Copilot review against the current head, or a completedinternal-reviewrun. They also add condition 5, every required check green (policyreview-then-suites). The hard-coded policy dates this PR had added are replaced by policy ids.Merge precondition: SATISFIED.
PrArmingnow accepts a Copilot review of the head (Plugins#3088, merged), and the control instance has run it since its 13:30Z roll at core cac0664. The workflow armer can therefore be removed without leaving Copilot-only fleet PRs unarmed. This pull request also disarms fork pushes, since a maintainer can arm a fork PR by hand.Verified locally (merge of origin/main 2026-10-07):
check-review-answered.py --self-test: 226 ok, 0 FAIL, exit 0.check-workflow-permission-pairing.py --root .and--fleetboth report 0 violations.check-workflow-timeouts.py: 0 violations.MeshWeaver.Documentation.Test: Release-warnaserrorbuild, 0 warnings, 0 errors;ArmedMergeMustTriggerMainsPushLanesGuard+DocumentationLink*: 10 of 10 passed.Deploy: nothing beyond the merge. Every caller floats on
@main.🤖 Generated with Claude Code