feat(pr-pipeline): cut the lane hold-path floor to the merge gate's own - #9541

No related issue: owner direction 2026-10-24, lowest-friction hold floor

Summary

The lanes' native auto-merge path held more than the merge gate does. Two extra holds are cut here, down to the gate's own floor, which is the takeover set in babysit_risk.HIGH_FLOOR (owner direction 2026-10-23):

• merge-holds.mjs HOLD_PATH_FLOOR held every **/.claude-plugin/plugin.json and .claude-plugin/marketplace.json path-wide. So enable-auto-merge never armed a lane PR that touched a manifest, even for a userConfig default (the feat(source-control)!: ship the pr_open_state default as ready #9483 shape).
• resolve-config resolveMerge forced .github/** into merge.diff-check.denied-paths. That held every lane PR touching .github/scripts or .github/actions in report-outcome's Hold: line, in enable-auto-merge and in ci-status.

What still holds a manifest:

• enable-auto-merge. It already scored manifests through the gate's reader: evidence --lane-reviews runs lane_risk_refusal, which reads both sides (with_contents) and scores manifest-review-required with this repository's high-path-floor: true.
• ci-status. Its lanes App step had no such scoring. The glob was its only manifest check, and it is what caught a push after arming whose disarm failed. So merge-holds.mjs gets a port of the gate's comparison (manifestChanges, the rule of babysit_risk._manifest_changes), with no blanket glob. Both sides are read at the base commit and the head and compared key by key.

The classes held are the ones #9280 set:

• an _EXECUTABLE_KEYS value differing (hooks, mcpServers, lspServers, monitors), or experimental.monitors;
• a marketplace plugin added, removed, renamed or re-sourced, or the marketplace name changed;
• a manifest removed, renamed or copied;
• a side that cannot be read, does not parse, or repeats a key.

A userConfig default or a version bump merges.

Fix

• resolve.mjs resolveMerge drops .github/** and keeps the config path and the trusted-actor list. merge-holds.mjs FORCED_DENIED_PATHS matches it (merge-authority.test.mjs).
• HOLD_PATH_FLOOR is now the forced paths plus each HIGH_FLOOR glob, listed one by one. Before, .github/** was what covered .github/actions/resolve-config/**, .github/actions/check-trusted-trigger/** and .github/standards/trusted-actors/**. A sync test checks that HOLD_PATH_FLOOR contains babysit_risk.HIGH_FLOOR.
• merge-holds.mjs adds manifestChanges and manifestHold. The port keeps two Python behaviors:
  • its JSON walk rejects a repeated key, as _no_duplicates does;
  • its canonical form tells apart the values json.dumps(sort_keys=True) tells apart (1 and 1.0, false and 0).
• A trusted approval of the head lifts a manifest hold, as it lifted the glob before.
• ci-status's step now writes [filename, previous_filename, status] per file and exports BASE_SHA. A line in the older format has no status, so a manifest on it holds. A module older than this one reads the extra entries as paths that match no hold path.
• Docs, comments, the enable-auto-merge fixture and the tests that stated the old floor are updated.
• Workflow files carry no hold. The lanes App token never carries workflows: request-lane-token/action.yml checks the broker's grant is exactly contents, pull-requests, issues and at most actions. That covers lanes App pushes only. Another identity with write access could still push a workflow change after auto-merge is armed.

Review fixes at ready (security and code review of 4f4b0e2):

• matchesHoldPath folds case, as glob_match and costHold do. Without it, .github/codeowners, .github/actions/Resolve-Config/…, .github/Standards/trusted-actors/… and .github/actions/Check-Trusted-Trigger/… went unheld once .github/** left.
• HIGH_FLOOR and HOLD_PATH_FLOOR add .github/actions/check-kill-switch/**. check-trusted-trigger and resolve-config both import their output writer (writeOutputs) from it, and .github/** was what held it before.
• test_merge_holds_sync.py now compares matched paths, case variants included, between pathHold and glob_match. A new test walks the two floor actions' imports and fails on any file the floor does not hold.
• Manifest contents decode as strict UTF-8 with the BOM kept. An integer past int_max_str_digits holds, since the gate's json.loads refuses it. A path hold and a manifest hold both reach the reason.
• New manifest cases: hooks true to null and to false, a 20-digit integer differing in its last digit, and -0.0 to 0.0.

Verification

• nice bash scripts/check-affected.sh --uncommitted: 12 passed, 4 skipped.
• node --test over .github/scripts/pr-merge/*.test.mjs: 271 pass, 0 fail.
• node --test over .github/actions/resolve-config/*.test.mjs: 680 pass, 0 fail.
• node --test over .github/scripts/work-resolve-issue/*.test.mjs: 257 pass, 0 fail.
• bash scripts/ci-lanes-pr-hold.test.sh: 128 pass, 0 fail.
• uv run --with pytest python -m pytest plugins/source-control/skills/babysit-prs/scripts/tests: 2738 passed.
• After the review fixes, at 5fb7023: scripts/check-affected.sh --tests passed 14 of 14, run with PyYAML on PATH. Each new sync test fails with its fix reverted (seven case variants unheld, and check-kill-switch.mjs unheld).
• The new tests cover each layer:
  • merge-holds.test.mjs holds every feat(source-control): merge MED lane PRs on review pass and cut the path floor to external effects #9280 class through ci-status's command line, and passes a userConfig default (feat(source-control)!: ship the pr_open_state default as ready #9483).
  • test_merge_holds_sync.py checks the JS comparison against babysit_risk._manifest_changes over 30 cases.
  • test_babysit_lane_reviews.py checks that lane_risk_refusal, the native arm path, holds a hooks, mcpServers or experimental.monitors change and passes a userConfig default.
  • enable-auto-merge.test.mjs checks that decide() arms on a null risk score and disarms on a manifest one.

This PR changes .github/actions/resolve-config/**, which is on the HIGH floor, so a person merges it.

🤖 Generated with Claude Code