Skip to content

Make branch merge decisions recoverable, replayable, and CI-enforced - #758

Merged
unbraind merged 3 commits into
mainfrom
feat/auditable-merge-history-conformance
Jul 27, 2026
Merged

unbraind merged 3 commits into
mainfrom
feat/auditable-merge-history-conformance

Conversation

@unbraind

@unbraind unbraind commented Jul 26, 2026 •

Copy link
Copy Markdown
Owner

Summary

  • persist clone-local, recoverable merge decision receipts while committing only privacy-safe hashes and provenance
  • expose SDK primitives plus pm merge report, and reconcile both drifted and already-clean branch merges into addressable merge_reconcile history events
  • pin clone-local Git drivers to absolute Node/CLI paths, pass the real %P item path, and diagnose missing or drifted driver configuration
  • enforce strict storage and history-drift validation across every tracker stream in CI, backed by a non-representative corruption negative control
  • prove randomized N-branch merge-order convergence and document the full installed-package workflow

PM lineage

Closes #754.

Verification

  • full sandboxed suite: 376 files, 6,437 tests
  • coverage: 100% statements (44,398/44,398), branches (31,515/31,515), functions (9,082/9,082), lines (43,135/43,135)
  • lint, zero-duplicate scan, 100% docstring/static quality, SDK surface/import/transport ratchets, docs/skills, secret scan, npm audit, compatibility, packed npx, and 88-command package-first dogfood
  • installed npm/npx/bunx consumer proof with a real two-branch scalar conflict, receipt report, reconciliation, and strict history/storage validation
  • live tracker validation: 2,117 items and 2,128 history streams with zero drift, duplicate IDs, configuration failures, driver drift, or pending receipts
  • Sentry 14-day gate: zero critical and zero high events; telemetry flush confirmed

Summary by cubic

Makes branch merge decisions auditable and replayable by storing clone‑local merge receipts, adding pm merge report, and reconciling merges into addressable history. Pins and audits absolute Git merge drivers with real %P paths and enforces repository‑wide history drift in CI; fixes fence‑fails‑open and makes GH‑754’s conflict reports durable. Closes #754.

  • New Features

    • Persist merge decision receipts locally; add pm merge report and audited pm merge reconcile to write privacy‑safe merge_reconcile events.
    • Pin Git drivers to absolute CLI paths and pass %P; validate/health now audit driver config and surface pending receipts.
    • CI installs drivers in fresh clones, verifies the committed .gitattributes fence is reproducible, validates all history streams with --check-history-drift, and runs these checks without extensions; adds randomized N‑branch convergence tests.
  • Bug Fixes

    • Write receipts only after successful output writes; merge reconcile distinguishes receipt‑only reconciliation from actual history repair.
    • Align validate with health workspace discovery to audit driver configuration and pending receipts consistently.
    • Strengthen CI’s negative control so a clean representative smoke cannot mask drift elsewhere.
  • Migration

    • Re‑run pm merge install in each clone to refresh driver commands.
    • After merges, run pm merge report and pm merge reconcile (or let CI handle it) to capture receipts and reconcile history.

Written for commit 6ad2718. Summary will update on new commits.

Review in cubic

Persist clone-local merge decision receipts, expose privacy-safe SDK and CLI reporting, and reconcile clean or drifted merges into addressable history events. Pin and audit absolute Git merge drivers with real item paths, enforce workspace-wide history integrity in CI, and add randomized multi-branch convergence coverage plus installed-consumer evidence.\n\nCloses pm-c0wthb, pm-9j2r3b, pm-rh98vo, pm-76dnfg, and pm-pdr8t1.
@gemini-code-assist

Copy link
Copy Markdown

Caution

The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased.

@sourcery-ai sourcery-ai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sorry @unbraind, your pull request is larger than the review limit of 150000 diff characters

@unbraind

Copy link
Copy Markdown
Owner Author

@greptileai please review this broad merge-history and conformance bundle.

@unbraind

Copy link
Copy Markdown
Owner Author

@coderabbitai full review

@coderabbitai

coderabbitai Bot commented Jul 26, 2026 •

Copy link
Copy Markdown
✅ Action performed

Full review finished.


Your included review limit is currently reached under our Fair Usage Limits Policy. This review may still proceed through usage-based billing if eligible. Your next included review will be available in 59 minutes.

@coderabbitai

coderabbitai Bot commented Jul 26, 2026 •

Copy link
Copy Markdown

Review Change Stack

📝 Walkthrough

Walkthrough

This change adds durable merge-decision receipts, structured conflict reporting, receipt-aware reconciliation, merge-driver configuration audits, CLI reporting, governance diagnostics, stricter CI validation, documentation, tests, and related project-tracking updates.

Changes

Merge receipt and reconciliation flow

Layer / File(s) Summary
Conflict contracts and receipt storage
src/sdk/merge/three-way.ts, src/sdk/merge/receipts.ts, src/sdk/merge/index.ts, sdk/public-surface.json, tests/unit/sdk/merge-receipts.spec.ts
Item merges expose structured retained/discarded decisions, which are persisted as clone-local receipts and summarized with hashes for reporting and history use.
Driver auditing and reconciliation
src/sdk/merge/driver.ts, src/sdk/merge/install.ts, src/sdk/merge/reconcile.ts, src/sdk/history-repair.ts, src/sdk/governance/*
Merge drivers capture receipts, Git configuration is audited for missing or drifted commands, and reconciliation injects receipt context into history repair before marking successful receipts reconciled.
CLI, CI, documentation, and tests
src/cli/*, .github/workflows/ci.yml, docs/MERGE_SAFETY.md, tests/*
pm merge report is added, CI enables strict history-drift validation, merge-safety documentation is expanded, and unit, integration, fuzz, and governance tests cover the new flow.
Tracking and release records
.agents/pm/*, CHANGELOG.md
Task, issue, feature, history, and changelog records are updated with implementation evidence, verification metadata, closure state, and merge-safety entries.

Estimated code review effort: 4 (Complex) | ~60 minutes

Sequence Diagram(s)

sequenceDiagram
  participant GitMerge
  participant MergeDriver
  participant ReceiptStore
  participant MergeCLI
  participant HistoryRepair
  GitMerge->>MergeDriver: invoke item merge with %P path
  MergeDriver->>ReceiptStore: write merge decision receipt
  MergeDriver-->>GitMerge: merged file and receipt summary
  MergeCLI->>ReceiptStore: report pending receipts
  MergeCLI->>HistoryRepair: reconcile receipt context
  HistoryRepair->>ReceiptStore: mark receipts reconciled
Loading

Possibly related PRs

  • unbraind/pm-cli#568 — Extends the same health and validation modules used for merge-driver and receipt diagnostics.
  • unbraind/pm-cli#614 — Introduces the storage-integrity validation pathway extended here with merge signals.
  • unbraind/pm-cli#627 — Provides the merge reconciliation path extended with receipt context and reconciliation state.
🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (2 warnings)

Check name Status Explanation Resolution
Linked Issues check ⚠️ Warning The PR addresses durable reporting, a report command, and validation, but it stores privacy-safe hashes instead of the discarded value the issue requires. Persist the full discarded-value report, or explicitly revise #754’s acceptance criteria to allow privacy-safe hashes instead of raw values.
Docstring Coverage ⚠️ Warning Docstring coverage is 66.67% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (3 passed)
Check name Status Explanation
Out of Scope Changes check ✅ Passed The changes stay focused on merge receipts, reporting, validation, docs, and tests with no clear unrelated code.
Title check ✅ Passed The title clearly summarizes the main change: recoverable, replayable merge decisions with CI enforcement.
Description check ✅ Passed The description matches the changeset and explains the merge receipts, reconciliation, driver auditing, and CI validation work.
✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@codspeed

codspeed Bot commented Jul 26, 2026 •

Copy link
Copy Markdown

Merging this PR will regress 1 benchmark

⚡ 2 improved benchmarks
❌ 1 regressed benchmark
✅ 8 untouched benchmarks

Warning

Please fix the performance issues or acknowledge them on CodSpeed.

Performance Changes

Benchmark BASE HEAD Efficiency
❌ decodeQueryCursor 114.4 µs 116.1 µs -1.44%
⚡ createQueryFingerprint 533.9 µs 525.1 µs +1.69%
⚡ encodeQueryCursor 102.8 µs 101.2 µs +1.61%

Tip

Investigate this regression by commenting @codspeedbot fix this regression on this PR, or directly use the CodSpeed MCP with your agent.


Comparing feat/auditable-merge-history-conformance (6ad2718) with main (421c767)

Open in CodSpeed

@codecov

codecov Bot commented Jul 26, 2026 •

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ All tests successful. No failed tests found.

📢 Thoughts on this report? Let us know!

@unbraind

Copy link
Copy Markdown
Owner Author

@gemini-code-assist Acknowledged: this retirement notice means no Gemini finding exists to address on the current head.

@gemini-code-assist

Copy link
Copy Markdown

Caution

The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased.

@unbraind

Copy link
Copy Markdown
Owner Author

@coderabbitai Acknowledged the fair-usage status. The run nevertheless started; I am waiting for the exact-head review result before classifying or fixing findings.

@unbraind

Copy link
Copy Markdown
Owner Author

@coderabbitai Acknowledged the 37-file review scope and exact commit range. I will respond in each inline thread after the review completes.

@unbraind

Copy link
Copy Markdown
Owner Author

@codspeed-hq Acknowledged: all 11 benchmarks are unchanged on exact head 6597510.

@unbraind

Copy link
Copy Markdown
Owner Author

@codecov Acknowledged: all modified coverable lines and tests are green; local aggregate coverage is also exactly 100/100/100/100.

@unbraind

Copy link
Copy Markdown
Owner Author

@sourcery-ai Acknowledged: the 150,000-character service limit prevented a review, so there is no Sourcery finding to accept or reject.

@coderabbitai

coderabbitai Bot commented Jul 27, 2026

Copy link
Copy Markdown

Tip

For best results, initiate chat on the files or code changes.

@unbraind Understood. I’ll await the exact-head review result before raising or classifying findings.

@coderabbitai

coderabbitai Bot commented Jul 27, 2026

Copy link
Copy Markdown

Tip

For best results, initiate chat on the files or code changes.

@unbraind Acknowledged. I’ll await the completed review and your responses in any resulting inline threads.

Install absolute merge drivers before strict storage validation, assert the committed extension-independent fence is reproducible, and keep the CI history scan isolated from developer-global extensions. Record the exact-head failure and focused verification on pm-pdr8t1.
@unbraind

Copy link
Copy Markdown
Owner Author

@greptileai please re-review exact head 495fb28, including the fresh-clone merge bootstrap fix.

@unbraind

Copy link
Copy Markdown
Owner Author

@coderabbitai full review

@coderabbitai

coderabbitai Bot commented Jul 27, 2026 •

Copy link
Copy Markdown
✅ Action performed

Full review finished.


Your included review limit is currently reached under our Fair Usage Limits Policy. This review may still proceed through usage-based billing if eligible. Your next included review will be available in 46 minutes.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 7

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.agents/pm/history/pm-9j2r3b.jsonl:
- Around line 18-23: Before closing pm-9j2r3b, add canonical PM evidence in
.agents/pm/history/pm-9j2r3b.jsonl covering workspace-scope settings, schema,
and relationship artifacts, or explicitly record an accepted deferral; then
synchronize the acceptance and closure metadata in
.agents/pm/tasks/pm-9j2r3b.toon with that canonical decision. Update
.agents/pm/history/pm-9j2r3b.jsonl lines 18-23 and
.agents/pm/tasks/pm-9j2r3b.toon lines 26-50 accordingly, preserving PM history
as the system of record and keeping both records consistent.

In @.agents/pm/history/pm-c0wthb.jsonl:
- Line 32: Update the PM close workflow so canonical resolution and acceptance
metadata are recorded before ownership is released, or explicitly reclaim
ownership before any post-release mutation; do not edit the immutable histories
directly. Apply this to .agents/pm/history/pm-c0wthb.jsonl:32-32 and
.agents/pm/history/pm-rh98vo.jsonl:13-13, using pm and preserving the existing
audit entries.

In `@src/sdk/governance/health.ts`:
- Around line 606-614: The merge diagnostics use inconsistent git workspace root
resolution. In src/sdk/governance/health.ts lines 606-614, retain or refactor
findGitWorkspaceRoot as the canonical shared resolver for
auditMergeDriverConfiguration and listMergeReceipts; in
src/sdk/governance/validate.ts lines 3289-3306, replace the
path.dirname(fenceAudit.path) derivation with that same shared resolution and
preserve the existing null/skip behavior when no root is found. Ensure both
health and strict validation use identical root-resolution conditions.

In `@src/sdk/merge/driver.ts`:
- Around line 243-255: Reorder the merge flow around writeMergeReceipt and the
merged-file write so the output is successfully written before any receipt is
persisted or summarized. Keep the existing receipt parameters and itemPath
guard, but move the writeMergeReceipt call and result.receipt assignment after
the write operation identified by outputPath and merged.

In `@src/sdk/merge/receipts.ts`:
- Around line 90-101: Update resolveReceiptDirectory so it no longer derives
pm-merge-receipts via git rev-parse --git-path. Resolve and return a
repository-level, checkout-independent receipts directory controlled by the
coordinator, ensuring linked worktrees share the same merge-receipt state while
preserving null on resolution failure.

In `@src/sdk/merge/reconcile.ts`:
- Around line 125-149: Update the fulfilled branch of the receipt-only handling
in the receiptOnlyResults loop to derive outcome from settled.value’s actual
changed/audit-entry status, matching the bulk-repair convention used by
runHistoryRepairAll, rather than directly from dryRun. Keep dry_run as the
top-level indicator of whether writes occurred and preserve the existing totals
and history fields.

In `@tests/integration/ci-workflow-contract.spec.ts`:
- Around line 254-283: Create a clean representative item before the existing
drifted item in the test, then corrupt only the second item’s history stream.
Update the fixture setup and identifiers so the CI merge-integrity command
verifies the representative stream while --check-history-drift must scan and
reject the separately corrupted non-representative stream.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Repository UI (base), Organization UI (inherited)

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: d0a95111-74c6-4a70-a759-e06fa2d01114

📥 Commits

Reviewing files that changed from the base of the PR and between 421c767 and 6597510.

📒 Files selected for processing (37)
  • .agents/pm/extensions/.managed-extensions.json
  • .agents/pm/features/pm-feecbs.toon
  • .agents/pm/history/pm-76dnfg.jsonl
  • .agents/pm/history/pm-9j2r3b.jsonl
  • .agents/pm/history/pm-c0wthb.jsonl
  • .agents/pm/history/pm-feecbs.jsonl
  • .agents/pm/history/pm-pdr8t1.jsonl
  • .agents/pm/history/pm-rh98vo.jsonl
  • .agents/pm/issues/pm-c0wthb.toon
  • .agents/pm/issues/pm-rh98vo.toon
  • .agents/pm/tasks/pm-76dnfg.toon
  • .agents/pm/tasks/pm-9j2r3b.toon
  • .agents/pm/tasks/pm-pdr8t1.toon
  • .github/workflows/ci.yml
  • CHANGELOG.md
  • docs/MERGE_SAFETY.md
  • sdk/public-surface.json
  • src/cli/commands/merge.ts
  • src/cli/register-mutation.ts
  • src/sdk/governance/health.ts
  • src/sdk/governance/validate.ts
  • src/sdk/history-repair.ts
  • src/sdk/merge/driver.ts
  • src/sdk/merge/index.ts
  • src/sdk/merge/install.ts
  • src/sdk/merge/receipts.ts
  • src/sdk/merge/reconcile.ts
  • src/sdk/merge/three-way.ts
  • tests/fuzz/project-boundaries.fuzz.spec.ts
  • tests/integration/ci-workflow-contract.spec.ts
  • tests/unit/cli/merge-reconcile-registration.spec.ts
  • tests/unit/commands/history-repair-command.spec.ts
  • tests/unit/commands/merge-reconcile-command.spec.ts
  • tests/unit/sdk/merge-receipts.spec.ts
  • tests/unit/sdk/merge-reconcile.spec.ts
  • tests/unit/sdk/merge-safety.spec.ts
  • tests/unit/sdk/tracked-runtime-cache.spec.ts

Comment thread .agents/pm/history/pm-9j2r3b.jsonl Resolved
Comment thread .agents/pm/history/pm-c0wthb.jsonl Resolved
Comment thread src/sdk/governance/health.ts Resolved
Comment thread src/sdk/merge/driver.ts Resolved
Comment thread src/sdk/merge/receipts.ts Resolved
Comment thread src/sdk/merge/reconcile.ts Resolved
Persist decision receipts only after output writes succeed, align validate with health workspace discovery, and classify receipt-only reconciliation from the actual repair result. Strengthen CI's negative control so a clean representative smoke cannot mask corruption in another stream. Record the workspace-scope deferral and exact 100% gate evidence in canonical PM history.
@unbraind

Copy link
Copy Markdown
Owner Author

Exact-head review requested after corrective commit 6ad2718.

@coderabbitai full review
@greptileai please review the new exact head, including the seven previously identified threads and their tests.

@coderabbitai

coderabbitai Bot commented Jul 27, 2026 •

Copy link
Copy Markdown

@unbraind I’ll perform a full review of the current PR head, including the previously identified threads and their regression coverage.

✅ Action performed

Full review finished.


Your included review limit is currently reached under our Fair Usage Limits Policy. This review may still proceed through usage-based billing if eligible. Your next included review will be available in 16 minutes.

@unbraind

Copy link
Copy Markdown
Owner Author

Final bot-surface disposition for exact head 6ad2718377ea542e631c73c67c315a0d706ccba4:

  • CodeRabbit review 4782916028: all seven inline findings received usefulness-based reactions and direct thread replies. Six were implemented and verified; the worktree-sharing suggestion was declined because checkout-local receipt ownership prevents a different coordinator from consuming decisions for a merged state absent from its worktree. All seven threads are resolved.
  • CodeRabbit walkthrough 5085998455: the summary is useful, but both warning checks are stale/incorrect. Raw retained/discarded values are persisted in the clone-local receipt and exposed by pm merge report; only committed history uses hashes. The enforced repository static gate reports 100% source/export/member docstring coverage, not 66.67%.
  • CodeRabbit command replies 5086027745, 5086027801, 5086046629, and 5086191573: acknowledged; the final exact-head review completed under the service rate limit and introduced no new finding.
  • CodSpeed 5086004125: acknowledged. The touched code has no pagination path; its simulation reports two improvements and one 1.44% decode movement, while the mandatory repository benchmark/import/transport ratchets all pass. This is treated as unrelated measurement variance, not a product regression.
  • Codecov 5086009496: acknowledged as useful; patch coverage and all tests are green.
  • Gemini notices 5085997129 and 5086027003: acknowledged as non-actionable service-sunset duplicates.
  • Sourcery review 4782880201: acknowledged as non-actionable infrastructure limit (PR exceeds its 150k-character review ceiling), not an approval or product finding.
  • Greptile was requested twice, including after the final push, but emitted no review surface; this is reviewer availability rather than a product result.

Exact-head GitHub checks are all terminal and green/skipped as designed, including static, 4 coverage shards plus aggregate, Windows/macOS/Linux, CodeQL, Semgrep, Trivy, TruffleHog, ShellCheck, PSScriptAnalyzer, actionlint, CodeFactor, DeepScan, Codecov, docs, compatibility, smokes, and benchmarks.

@unbraind

Copy link
Copy Markdown
Owner Author

CodeRabbit follow-up confirmations 3653827369, 3653827498, 3653827539, 3653827563, 3653827756, 3653827772, and 3653827905 are individually acknowledged with positive reactions. The bot explicitly confirmed all six fixes and withdrew the worktree-storage finding after the coordinator-isolation rationale. Their seven associated review records are also acknowledged. No thread remains unresolved.

@unbraind
unbraind merged commit 47591b5 into main Jul 27, 2026
32 checks passed
@unbraind

unbraind commented Aug 4, 2026

Copy link
Copy Markdown
Owner Author

Tracked in PM: pm-76dnfg, pm-9j2r3b, pm-c0wthb, pm-pdr8t1, pm-rh98vo.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

1 participant