feat(source-control): babysit autopilot merge tier — bot-account review + criteria-gated merge

[kyle-sexton]

Plugin: source-control (babysit-prs) · Category: operational/throughput
Source: overnight audit 2026-07-19 — merge flow is the pipeline bottleneck

Problem

Work lane produced 13 green PRs in ~100 min (7.8 min/PR); at day-scale that is ~100 PRs/day. Branch ruleset requires an approving review, and babysit safety rails say "never merge / never enable auto-merge / never bypass required reviews" — so every PR waits on a human approval+merge. Human approval is now the rate-limiting step of the whole pipeline.

Proposal (needs human sign-off — changes the babysit safety contract)

Add an explicit autopilot merge tier that satisfies the ruleset instead of bypassing it:

• A second babysit/bot account (author ≠ approver; see gh-bot.sh machinery, blocked today by source-control:babysit-prs: gh-bot.sh bot token generation fails, worker writes fall back to personal identity #450) runs a GENUINE review pass (review plugin, Opus+) on each candidate PR and submits an approving review only when clean.
• Merge criteria (all required): all required checks green (incl. review workflow), PR is issue-linked, authored by a pipeline lane, no human CHANGES_REQUESTED / blocking comment / unresolved thread, no do-not-merge label, head SHA unchanged since review.
• Anything failing a criterion falls back to today's behavior: listed for the human pass.
• safety.md "Never do automatically: merge" updated deliberately as part of this change, with the criteria codified. Ruleset itself unchanged (required review stays meaningful — the bot review is real, not a rubber stamp).

Dependencies

• source-control:babysit-prs: gh-bot.sh bot token generation fails, worker writes fall back to personal identity #450 (bot token generation) is a prerequisite.
• Safety trio babysit-prs: merge-step no-monitor STOP, bare-wrapper pipe rule, snapshot exit-code taxonomy, cross-PR dependency channel #373/fix(source-control): review-trigger head-staleness hardening (BLOCKED-behind guard, stale-head reactions) #327/fix(source-control): require per-thread pins for autonomous bulk babysit thread resolves #326 must land first (merge-step hardening).

Decision for human

Approve the tier + criteria set, or keep human-approval-only and accept the throughput ceiling.

[kyle-sexton]

Maintainer decision (2026-07-19): APPROVED — staged. The criteria set in this issue's body is signed off verbatim. Sequencing is binding:

1. source-control:babysit-prs: gh-bot.sh bot token generation fails, worker writes fall back to personal identity #450 lands first (real author≠approver identity + loud fallback) — hard prerequisite.
2. Safety trio babysit-prs: merge-step no-monitor STOP, bare-wrapper pipe rule, snapshot exit-code taxonomy, cross-PR dependency channel #373/fix(source-control): review-trigger head-staleness hardening (BLOCKED-behind guard, stale-head reactions) #327/fix(source-control): require per-thread pins for autonomous bulk babysit thread resolves #326 fixes all merged.
3. Only then: implement the tier, updating safety.md's "never merge / never enable auto-merge" contract deliberately as part of the same change, criteria codified there. Ruleset untouched; the bot review must be a genuine review pass, not a rubber stamp. Anything failing a criterion falls back to the human list.

May be planned now (T2), executed only when 1-2 are satisfied.

[kyle-sexton]

This was generated by AI during triage. · Category: operational/throughput (Feature) · Priority: priority: high (week 2nd-priority: pipeline throughput — human approval is the pipeline's rate-limiting step). Routed needs-human + wayfind: design.

Triage

Author-flagged as needing human sign-off, and correctly: this changes the babysit safety contract (safety.md's "never merge / never enable auto-merge / never bypass required reviews"). Deciding whether an autopilot bot-account tier may submit approving reviews and merge is product intent + safety posture, not a maintainer-vetoable implementation fork — squarely needs-human. The detailed proposal in the body is the plan; no separate planning pass needed until the human approves the tier + criteria set.

The decision for the human

Approve the autopilot merge tier (second bot account submits a GENUINE review, then criteria-gated merge — all required checks green incl. review workflow, issue-linked, pipeline-authored, no human CHANGES_REQUESTED / blocking comment / unresolved thread, no do-not-merge label, head SHA unchanged), updating safety.md's "never merge" deliberately with the criteria codified — or keep human-approval-only and accept the throughput ceiling (~100 PRs/day gated on human approve+merge).

Dependencies (block implementation, not the decision)

• source-control:babysit-prs: gh-bot.sh bot token generation fails, worker writes fall back to personal identity #450 (bot token generation fails → personal-identity fallback) is a hard prerequisite: the author≠approver guarantee needs a working second bot identity. source-control:babysit-prs: gh-bot.sh bot token generation fails, worker writes fall back to personal identity #450 routed status: ready this cycle.
• Safety trio babysit-prs: merge-step no-monitor STOP, bare-wrapper pipe rule, snapshot exit-code taxonomy, cross-PR dependency channel #373 / fix(source-control): review-trigger head-staleness hardening (BLOCKED-behind guard, stale-head reactions) #327 / fix(source-control): require per-thread pins for autonomous bulk babysit thread resolves #326 (merge-step hardening) must land first.

Note

This is the merge-gate tier that #477's bullet 4 ("merge-gate mode as a first-class documented tier") defers to — keep them consistent: #477 documents the tier surface, this issue decides whether autopilot merge is sanctioned. The ruleset itself stays unchanged (the bot review is real, not a rubber stamp), which is the design property that makes this defensible.