chore(distribution): re-arm fleet automerge

[kyle-sexton]

Summary

Phase 1.5 of the standards-sync audit: the .github canary was observed end-to-end on 2026-08-23, inside the Phase 1.4 time box. PR 62 opened at 02:28:08Z, the sync App armed auto-merge on it two seconds later (enabledBy the App itself, SQUASH), and it self-merged at 02:28:39Z with mergedBy the same App and no human action, all four required contexts green. That discharges the 1.4 gate, so the fleet re-arms.

Fix

automerge: false removed from 8 targets — the 7 originals (ci-runner, ci-workflows, claude-code-plugins, dotfiles, github-iac, medley, provisioning) plus codex-plugins. Absent key = armed default (schema-optional; the engine sets automergeValue = "true" unless the key is present, sync-manifest.mjs:666-684). Removal rather than an automerge: true flip, matching PR #299 and PR #418. (To be precise about the engine: an explicit literal true would be both schema-legal and engine-legal; the literal-spelling rule at sync-manifest.mjs:678-682 only rejects non-canonical spellings such as True or yes. Removal is the house pattern because it keeps the armed default terse, not because a flip would be rejected.)

Three Phase 4 targets keep the key: agent-plugins, claude-code-proxy, cursor-plugins. Their default branches are not covered by the org ci-gate ruleset (id 17989001) — the rule supplying pr-title, pr-issue-linkage, do-not-merge and ci-status as required contexts. They resolve base + signing only, so they carry no required status checks at all and an armed sync PR would merge with nothing gating it.

That is proven live rather than inferred: claude-code-proxy PR 182 merged 2026-08-23 with ci-status, Ruff, Pester and pytest all FAILURE, precisely because none of them are required. agent-plugins PR 2 and cursor-plugins PR 12 each show a single GitGuardian entry as their entire check rollup.

The opt-out is therefore not roster vintage — codex-plugins entered in the same Phase 4 window and is armed here, because it alone among the four carries ci-gate (verified on its PR 22: all four contexts SUCCESS). Each surviving key now carries a comment naming its own blocker and removal trigger, and the fleet-automerge header comment is re-cut to the restored state.

This corrects the count in #481 and in PLAN.md Phase 1.5 (7 removals, residue 0). Both were authored on 2026-08-17 against an 8-target roster, two days before the Phase 4 expansion took it to 12; git log -S puts both lines in the same commit, 967ef48. Phase 4R reconciled the Brief against the new roster but never revisited 1.5's count.

Also in this PR: PLAN.md Phases 1.4 and 1.5 tagged DONE with evidence, the stale 1.5 sanity check corrected (→ 0 was arithmetic from the 8-target era), the discharged Brief constraint marked, and a new Phase 1.6 filed to extend ci-gate to the three disarmed repositories — a Pulumi change in github-iac per repo convention, never the GitHub UI or ad-hoc gh.

Verification

node distribution/sync-manifest.mjs validate → Manifest valid: 33 components, 12 targets, exit 0 (counts unchanged — pure policy change).

yq '[.targets[] | select(has("automerge"))] | length' → 3, and those three are exactly agent-plugins, claude-code-proxy, cursor-plugins.

Engine-computed matrix (sync-manifest.mjs matrix) — 9 armed, 3 disarmed:

melodic-software/.github               automerge=true
melodic-software/agent-plugins         automerge=false
melodic-software/ci-runner             automerge=true
melodic-software/ci-workflows          automerge=true
melodic-software/claude-code-plugins   automerge=true
melodic-software/claude-code-proxy     automerge=false
melodic-software/codex-plugins         automerge=true
melodic-software/cursor-plugins        automerge=false
melodic-software/dotfiles              automerge=true
melodic-software/github-iac            automerge=true
melodic-software/medley                automerge=true
melodic-software/provisioning          automerge=true

npm run lint:md → 118 files, 0 issues. Pre-commit lefthook green (editorconfig, typos, gitleaks, markdownlint).

Merge-path safety for the 8 armed targets was checked the same way Phase 1.4 checked .github: gh api repos/<repo>/rules/branches/main for required contexts plus statusCheckRollup on each repo's most recent real bot sync PR. All 8 carry the four required contexts with allow_auto_merge and allow_squash_merge true. github-iac PR 348 is currently open and BLOCKED on a flaked pr-title — the armed-BLOCKED condition the now-proven watchdog reports, not a blocker to arming.

The two conditional comment re-cuts from Phases 1.1 and 1.2 were checked and had already landed on main (ci-workflows reusable, now at lines 215-218 after file growth; the standards caller at lines 20-22). Neither becomes false when the fleet re-arms, so neither is carried here.

Related

Closes #488. Related: #481 (operator checklist — its 11 → 4 count is superseded by 11 → 3), #418 (canary), #299 (prior fleet restore), #406 (audit umbrella).

🤖 Generated with Claude Code

https://claude.ai/code/session_01EtfvgtanSD6nyC9JqYMz6A

[claude]

Claude finished @kyle-sexton's task in 2m 10s —— View job

---

Code review complete

• Gather context (PR body, changed files)
• Review distribution/sync-manifest.yml changes
• Review docs/topics/standards-sync-audit/PLAN.md changes
• Post findings

No blocking findings. This is the CI code-review lane (correctness/maintainability; security is scoped to a separate lane where present).

What I checked, independently (not just restating the PR's own claims):

• yq-equivalent counts confirmed by direct grep against the working tree: exactly 3 targets retain automerge: false (agent-plugins, claude-code-proxy, cursor-plugins), exactly 12 melodic-software/* targets total — matches the PR's stated matrix and PLAN.md's Phase 1.5 sanity check.
• Verified the engine's actual absent-key-defaults-to-armed and literal-spelling logic against distribution/sync-manifest.mjs:666-684 — matches the PR's citation.
• Confirmed distribution/sync-manifest.schema.json declares automerge as a plain boolean, consistent with the "schema-optional" claim.
• Walked every diff hunk in sync-manifest.yml for structural correctness after the 8 key removals and 3 new comment blocks (ci-runner, ci-workflows, claude-code-plugins, dotfiles, github-iac, medley, provisioning, codex-plugins, agent-plugins, claude-code-proxy, cursor-plugins) — no orphaned comments, no duplicate/misplaced keys, indentation and alphabetical component ordering intact, file ends cleanly.
• Cross-checked PLAN.md's Phase 1.4/1.5/1.6 status tags and numbering for internal consistency (DOING→DONE transitions, new Phase 1.6 correctly gated on Phase 1.5's findings) — consistent.
• Searched other docs referencing automerge (distribution/README.md, distribution/THREAT-MODEL.md, components/runner-policy/README.md) for now-stale counts — none found; those describe general mechanics, not per-target counts, so this PR doesn't leave them stale.

One non-blocking note (not filed as an inline finding since it's PR-description narrative, not a change to either file in this diff): the PR body states the engine's "literal-spelling rule rejects" an automerge: true flip. That's not quite what the cited code does — sync-manifest.mjs:678-682 only rejects non-canonical spellings (e.g. True, yes); the literal true is schema-legal and engine-legal. PLAN.md's own description of this rule (line 540, "restricting the automerge scalar to literal true/false, with a False rejection fixture") is accurate — it's only the PR body's shorthand that overstates it. Worth a mental correction if this phrasing gets reused elsewhere, but it doesn't affect the actual manifest/plan content being merged.

[github-actions]

Claude has reviewed this PR 1 time. The lane skips further automatic reviews after 5; deleting this comment resets the count.

[kyle-sexton]

🤖 AI-generated comment (autonomous triage lane).

Claiming for triage (/work-items:triage 489).

[kyle-sexton]

🤖 AI-generated comment (autonomous triage lane).

Verification

Confirmed the diff matches the PR's own claims. distribution/sync-manifest.yml currently carries
11 automerge: false occurrences on main (independently confirmed against the live file during
this pass, matching #488's baseline); this PR removes the key from 8 named targets and adds
per-target blocker comments to the 3 that keep it. The PR's own CI code-review comment
(github-actions[bot], 2026-08-23T16:12Z) independently re-derived the same counts by direct grep
against the working tree (exactly 3 residual automerge: false targets, exactly 12
melodic-software/* targets total) and found no blocking findings across the manifest structure,
sync-manifest.mjs citation accuracy, and PLAN.md phase-tag consistency. mergeable: MERGEABLE,
not a draft.

This is the implementation PR for issue #488 (Closes #488), which this triage pass also routed
human-gated in this same cycle — see that item for the fleet-wide blast-radius reasoning.

Classification

• Type: Task (fleet configuration change)
• Priority: medium (mirrors Operator checklist: Phase 1.5 fleet automerge re-arm (gate + hand-back) #481 and Phase 1.5: re-arm fleet automerge #488's assessed priority)
• Work-class: structural (fleet-wide automerge re-arm across 8 repos; irreversible in practice
  once sync PRs begin self-merging unattended)
• Route: human-gated — capability blocker, not an open design question. The design is already
  settled (prior audit phases + this PR's own careful per-target justification), but this triage
  lane never merges PRs, and this specific merge arms unattended self-merging across 8 repositories.

Outcome

Routing human-gated. Labels applied: priority: medium, needs-human (role),
work-class: structural. No raw/needs-triage marker was present to clear.

Recommended next step: a human reviews and merges this PR directly.