fix: bind guarded auto-merge to required head checks

[dexsword]

Guarded native squash auto-merge now passes live end-to-end tests. GitHub evaluates all three required contexts on the source HEAD in this repository; the independent synthetic MERGE_SHA and current BASE_SHA remain exact-candidate guards.

The workflow disarms stale requests and installs pending custom HEAD checks before bounded merge discovery. Per-PR concurrency cancels superseded runs; ownership checks reject obsolete attempts. Reruns establish pending replacements before giving older custom checks historical names, preserving their original conclusions. Native CI is never copied, renamed or rewritten. Broad edited and recursive check/status triggers are absent.

The separate write job validates native CI, required-check source/placement, candidate/run identity, mergeability, schema/confidence, eligibility and pending checks. It requests native SQUASH and confirms it before publishing success. GitHub itself holds the merge for required human approvals/conversations, which can be satisfied later without another review event. The controller cannot approve, dismiss reviews, resolve threads, or merge immediately.

Live evidence: https://github.com/dexsword/dextech/actions/runs/34119147421 completed with all seven jobs successful. Disposable PR #21 auto-merged at 2026-09-07 11:58:15 UTC as e47c53f. Native auto-merge was enabled at 11:57:23 while both custom checks were pending; all checks passed by 11:57:47 while GitHub still enforced an intentionally unresolved test conversation. Resolving only that test conversation allowed GitHub to merge without another workflow run or a manual merge.

Required checks all succeeded on acb49fb:

• checks: 101732849296
• Codex Review / gate: 101733029156
• Auto Merge / eligible: 101733052101

Earlier disposable tests verified cancellation, pending-check ownership, completed-check recovery and post-merge feedback. A low-confidence review also rejected authorization in the live test; corrected harmless wording was reviewed afresh. The documentation records source/base/merge SHAs, check IDs and run URLs. The isolated pre-installation harness has a fixed PR adapter and vetted control code; it is not part of this PR or the production workflow. Local gh lacks Actions write for dispatch, so no settings/token changes were needed: the harness used a branch-specific push trigger.

Security: automatic execution remains base-controlled pull_request_target, with no control-ref or dispatch override. The reviewer has only contents: read, read-only/drop-sudo protection, and Codex remains its final substantive step. No untrusted candidate code executes with write credentials. Exact source/merge/base binding, deterministic eligibility, 0.95 review confidence, fork isolation, metadata-only feedback and all deployment controls are preserved.

Validation: clean npm ci; 85 Node tests; 9 deployment-control tests; CI smoke/synthetic health; actionlint; ShellCheck; YAML, JSON Schema, TOML, JavaScript/Python/shell parsing; production dependency audit; diff/security inspection. All pass and all validators were available. Audit has zero high/critical findings, with one existing low and one moderate advisory.

Changed files: .github/workflows/codex-review.yml, .github/codex/control.cjs, test/codex-review.test.js, docs/guarded-auto-merge.md. This hotfix is protected/ineligible and requires manual review. PR #17 is not merged; PR #13 is untouched. No GitHub settings, secrets, tailnet, production or deployment changes were made.

Limitations: GitHub reads/writes are not atomic, so expectedHeadOid and strict protections remain authoritative. Current mandatory approval count is zero; the live test proves conversation enforcement, while nonzero approval requirements rely on GitHub native enforcement and local contract tests. GITHUB_TOKEN auto-merges suppress downstream deployment workflows; no reusable token was added. After manually installing the hotfix, synchronize PR #13 with current main for a fresh evaluation as a separate action.

Current implementation head: 5c2c051

[github-actions]

Codex review feedback

Status: Changes requested
Reviewed head: 01cb2a93a196b1b3f671bd7c5e9de7e5cd1e68ce
Confidence: 0.97

Blocking findings: P0: 0, P1: 1, P2: 1, P3: 0

Model-supplied filenames, locations, explanations and summaries are withheld to prevent disclosure.

This feedback applies only to the exact head above. A new push requires a new review.

[dexsword]

Updated PR #17 at 3d52512fa9253479a567bf0624662a95658e36c5 with the CI-wait and retarget fixes.

• Removed the ten-minute CI completion poll. Native squash auto-merge now waits for existing queued/running required CI; missing, malformed, or terminally unsuccessful CI still rejects authorization. Schema/confidence, eligibility, head/base/merge binding, run ownership, and pending custom checks remain mandatory. Custom successes still require confirmed native auto-merge first.
• Added narrowly filtered base-retarget edited events to both Codex Review and native CI. Title/body edits skip all jobs, use isolated concurrency groups, cannot supersede a review, and cannot add another required native checks context.
• Preserved v1.11 action pin, CLI 0.153.4, reviewer timeout/permissions, metadata-only feedback, and all deployment controls.

Changed files: .github/codex/control.cjs, .github/workflows/ci.yml, .github/workflows/codex-review.yml, test/codex-review.test.js, docs/guarded-auto-merge.md.

Validation: clean npm ci; 89 Node tests; 9 deployment tests; CI smoke and synthetic health; actionlint; ShellCheck; shell/JavaScript syntax; YAML, JSON Schema, TOML schema, Python parsing; git diff --check. Production audit: 0 high, 0 critical; existing 1 low and 1 moderate. All passed. Diff reviewed for workflow security; protected changes remain ineligible for auto-merge.

The earlier PR18–21 live native auto-merge evidence remains in the deployment documentation. These new queued-CI/retarget cases have local regression coverage, not a new live integration claim. Because pull_request_target loads main, PR17's own review uses the existing main controller until installation. After installation, validate queued CI and base retargeting as documented. PR17 remains open and unmerged. No settings, secrets, production, or tailnet changes were made.