[kyle-sexton]

Refs: #10743

Lifted from a person by this PR

merge.lane-arm-gate is true, so these 20 paths ship lane-armed (generated LANE_ARMED). They are the merge gate's own code: babysit_risk.py and every .github/scripts/pr-merge/ script on the floor, floor-ast.py included.

.github/scripts/pr-merge/merge-holds.mjs
.github/scripts/pr-merge/enable-auto-merge.mjs
.github/scripts/pr-merge/superseded.mjs
.github/scripts/pr-merge/clear-escalations.mjs
.github/scripts/pr-merge/carry-run-cache.mjs
.github/scripts/pr-merge/gate-check.mjs
.github/scripts/pr-merge/head-ref-map.mjs
.github/scripts/pr-merge/lane-records.mjs
.github/scripts/pr-merge/last-report.mjs
.github/scripts/pr-merge/rate-stop.bash
.github/scripts/pr-merge/refire-refused.mjs
.github/scripts/pr-merge/rotation.mjs
.github/scripts/pr-merge/sweep-summary.mjs
.github/scripts/pr-merge/who.mjs
.github/scripts/pr-merge/post-unarmed-status.mjs
.github/scripts/pr-merge/verify-answers.mjs
.github/scripts/pr-merge/listing-carry.mjs
.github/scripts/pr-merge/lane-armed.mjs
.github/scripts/pr-merge/floor-ast.py
plugins/source-control/skills/babysit-prs/scripts/babysit_risk.py

Residual, accepted by owner decision Q5: a change that keeps the hold floor whole but weakens the logic of these files merges on the two bound AI reviews plus the pr-merge/lane-armed attestation, with no person. No check reads what that logic does. The hub audits each such merge afterwards.

Only the lanes App's own pull requests lane-arm. A pull request from any other author keeps these paths with a person.

Summary

Owner decisions, verbatim:

• Q5 (how a PR that changes the merge gate's own code gets through): "GO WITH WHATEVER THIS SUGGESTS". Decision: option 1. Build a pr-merge/lane-armed check-run attestation that ci-status verifies, bound to a pr-merge run on main, and lane-arm the gate code when both bound review lanes are clean, with zero findings, zero threads and no hold-floor shrink. Workflows, credentials and the review criteria are not lane-armed. Owner arms continue for gate-code PRs until this PR merges.
• Q-C (the review criteria pr-review-main.yml copies from main): "Lets go with whatever aligns with: [standing direction]". Decision: enforcement.

Still person-held

Every other trust and gate row (generated PERSON_HELD):

.github/actions/check-trusted-trigger/**
**/CODEOWNERS
**/.gitmodules
.github/actions/resolve-config/**
.github/actions/check-kill-switch/**
.github/actions/request-lane-token/**
.github/actions/log-api-budget/rate-guard.mjs
.github/actions/log-api-budget/rate-limits.json
.github/actions/report-check-run/posting-run.mjs
scripts/sync-hold-floor.py
plugins/source-control/skills/babysit-prs/scripts/babysit_merge.py
plugins/source-control/skills/babysit-prs/scripts/babysit_merge_policy.py
plugins/source-control/skills/babysit-prs/scripts/babysit_review_evidence.py
docs/conventions/pr-pipeline.yaml
.github/scripts/pr-review-main/**
**/.claude/**
**/.claude-lane/**
docs/conventions/instruction-exception-register/**
docs/conventions/untrusted-content/**
**/.mcp.json
**/CLAUDE.md
**/CLAUDE.local.md
**/AGENTS.md
REVIEW.md
docs/standards/**
every gated workflow (23, from babysit_risk.gated_workflow)

The trusted-actor list still holds through trust-gate:trusted-actors.

New floor rows

• .github/scripts/pr-merge/lane-armed.mjs and .github/scripts/pr-merge/floor-ast.py: lane-armed.
• plugins/review/skills/** and plugins/review/reference/**: enforcement (Q-C). A change to them waits for a clean bound security review, with no person.

Through the synced lists, these rows also hold the same pull requests every existing floor row holds:

• a pull request from an author no review lane reviews (the exempt-author hold_patterns in pr-require-checks.yml);
• a pull request an agent App touched (.github/trust-path-hold.json).

Fix

• Lane-armed set. scripts/sync-hold-floor.py generates LANE_ARMED and PERSON_HELD into babysit_risk.py and merge-holds.mjs.

  • LANE_ARMED is babysit_risk.py plus every .github/scripts/pr-merge/ floor row (lane_armable), trust rows included, less merge.person-held.
  • PERSON_HELD is every other trust and gate row.
  • The script refuses to run when a gate row outside the merge gate's code is missing from merge.person-held.

• The gate.

  • babysit_risk.lane_armed drops the high-path: hold on those paths only for a lanes App PR whose two lanes are bound to a main-run review with no open finding, and which has no open review thread.
  • Those paths are lane sources (babysit_review_evidence.lane_source), so only a main-run review binds them.
  • lane_arm_record records the paths, the lane counts, the thread count and the first failed condition in the gate's laneArmed row.

• Attestation. pr-merge's lane-armed job runs only on schedule or workflow_dispatch on main. It attests at most one head per run, in three steps:

  • post pr-merge/lane-armed at the head, with the run id in external_id and details_url;
  • upload the run-scoped artifact pr-merge-lane-armed-<pr>-<head>;
  • re-run the head's red ci-status job.

• The floor check, judged on the change. The attester refuses a change that could weaken the hold floor (lane-armed.mjs floorChange). It never parses the head's text, because a decoy marker pair in a docstring or block comment, or a row inside an expression that drops it (.slice(0, 0), [:0]), fools any text parse.

  • What it reads. The PR's patch to each floor-definition file (babysit_risk.py, merge-holds.mjs, lane-armed.mjs), judged against the base's marked regions. The regions are floor-rows FLOOR_CLASSES, hold-floor HOLD_PATH_CLASSES and hold-floor LANE_ARM. The base is main's copy, read in the exact generated shape: every line between the markers is a comment or a generated row.

  • What refuses. A changed line that names a floor marker. Outside the regions, a line that names a floor table or a set derived from one (FLOOR_CLASSES, HOLD_PATH_CLASSES, HOLD_PATH_FLOOR, HIGH_FLOOR, REVIEW_FLOOR, PERSON_HELD, LANE_ARM* and the rest). Inside them, anything but an added row of the generated shape or an added person-held entry. In any floor file, an added line with a non-ASCII character (Python folds a fullwidth FLOOR_CLASSES to ASCII). A removed row is a shrink.

  • Reflection and rebinding in babysit_risk.py, judged on the parsed trees. The base checkout's floor-ast.py runs as python3 -I <base>/.github/scripts/pr-merge/floor-ast.py <base-copy> <head-copy>. It parses both copies with ast and never imports or runs either; a syntax error refuses. It compares counts between the base and the head, over every Name, attribute and imported name, so an alias (g = globals) or a split line still counts. It refuses a head with more of any of these:

    • Reflective names: globals, locals, vars, setattr, delattr, getattr, exec, eval, compile (the builtin, not re.compile), __import__, importlib, __builtins__, builtins, __dict__, __setattr__, __delattr__, modules, __class__ and __getattribute__.
    • Frame and introspection names: f_globals, f_locals, f_back, _getframe, currentframe, gi_frame, cr_frame, ctypes, gc and inspect. A frame's globals are the module's.
    • Dunder names: any name or attribute that starts and ends with __, such as a function's __globals__.
    • Imports: any import or from statement.

    A logic edit that adds none of these is accepted. These are counts: a dunder, import, frame or reflective reference refuses only when its count rises above the base's. Trading an existing reference for a new one passes. For example, a head that removes one existing getattr and adds getattr(lambda: 0, "__glob" "als__")[...] keeps every count. The JS count has the same limit: [].constructor.constructor(...) and a prototype patch such as Array.prototype.some = ... pass. All of these are the Q5 residual: a logic edit merges on the two bound reviews plus the attestation, and only a check that judges logic closes this class.

    It also refuses a head where a floor table (FLOOR_CLASSES, LANE_ARM_GATE, LANE_ARMED, PERSON_HELD, COST_PATHS) or a set derived from one (FLOOR, HIGH_FLOOR, REVIEW_FLOOR and the rest) is bound other than exactly once, at module level, by one plain or annotated assignment. A table must be bound to a literal ast.literal_eval accepts, and a derived set to the base's own expression. Any other binding refuses: augmented, del, a for, with, except or match target, an import alias, global or nonlocal, a walrus, an argument, a def or a class. The base's tables use annotated assignments, so those are allowed too.

  • The JS floor. merge-holds.mjs binds its tables with const and Object.freeze, which no later line can rebind by name. Its head copy, and the head copy of lane-armed.mjs, also refuses when it holds more of these than the base copy: eval(, Function(, new Function, globalThis, Reflect., Object.defineProperty, __proto__, import(, require(, vm. and process.binding (jsRefusal). The tokens are counted over the whole text, so splitting a string around a table name does not help. Each token is call-shaped or not a path segment, so a floor row naming an eval-* workflow counts as nothing. lane-armed.mjs's own token list sits in a js-dynamic marker block: the block is not counted, and a patch line inside it or naming its markers refuses, so a literal cannot be traded for a real call. Any other JS logic edit stays the Q5 residual.

  • Judge code. floor-ast.py holds no floor table. Its patch is judged for floor markers and hold names only, and its logic edits are the Q5 residual.

  • Where the base is read. The base copy and the patches come from one compare of the base branch with the head (GET /compare/<base>...<head>), and the base copy is read at its merge_base_commit, the commit GitHub measures the patch from. A merge base that cannot be read refuses.

  • Unreadable input. Only a floor file with status modified is judged; a renamed, added or deleted one refuses. A missing patch (GitHub omits one for a large or binary change) refuses. A compare file list shorter than the pull request's changed_files refuses; the compare lists at most 300 files. A line inside a region with a CRLF ending is not the generated shape, so it refuses.

  • What still passes. Pure row additions and logic edits that name no hold.

• ci-status. merge-holds.mjs laneArmedHold, loaded from the base commit and keyed on the PR head (so merge_group runs check the same thing), passes a lane-armed path only when all of these hold:

  • the check run at the head is from github-actions, succeeded, and carries a record of this PR and head that covers every lane-armed path changed;
  • the run it names is .github/workflows/pr-merge.yml on the default branch, in this repository, started by schedule or workflow_dispatch (never workflow_run), and running or succeeded;
  • the run's commit is the default branch tip, read from /branches/<default>, or an ancestor of it: the compare API returns identical or ahead. head_branch is only a ref name, and a tag can share the branch's name;
  • that run uploaded the unexpired artifact, which only its own steps can.

  Any workflow with checks: write posts as github-actions and can copy a real run id, so the run and its artifact are the proof, not the check run. Anything missing or unreadable holds. A trusted approval of the head still lifts the hold.

• Cycle. pr-review-main.yml also runs after a red pr-require-checks run, for a PR whose full file list matches main's lane-armed globs. A list of 3000 or more files reviews nothing. Neither the red status nor needs-human blocks the review, so the same-head clear in clear-escalations stays.

• Measurement (§9). Each lane-armed merge is preceded by exactly one countable attestation record, the line lane-armed {"v":1,"pr":N,"head":"<sha>","paths":[...],"lanes":{"claude-review":0,"claude-security-review":0},"threads":0,"run":<id>}. It is recorded in two places:

  • in the pr-merge/lane-armed check run's summary at the head;
  • as a ::notice:: in the pr-merge run.

  The same record is uploaded as the run's pr-merge-lane-armed-<pr>-<head> artifact. Each head the job declines logs ::notice::lane-armed refused {...,"reason":"..."}.

• Not done. Showing the person hold as neutral in ci-status is skipped: pr-review-main reads the workflow conclusion, so a neutral-looking annotation changes nothing it decides.

Verification

• babysit-prs Python suites: 3569 passed.
• node --test .github/scripts/pr-merge/*.test.mjs .github/scripts/pr-review-main/*.test.mjs: 708 passed. These include:

  • Attestation forgery. Another app; a copied genuine pr-merge run with no artifact for this head; an expired artifact, or an artifact of another run, name or PR; a run of another workflow, from a PR branch, from pull_request_target, pull_request or workflow_run, failed, queued, in a fork, or with another id; a run whose commit is not on main, which covers a tag named main; a record for another head, run, version or PR, or one missing a path; each read failing. Mutating away the branch, app, event, artifact or on-branch check fails them.

  • The floor judge (floorChange and floorRefusal, .github/scripts/pr-merge/lane-armed.mjs). Patches come from git diff. Each of these refuses: a Python docstring decoy; a JS block-comment decoy; a LANE_ARM decoy; .slice(0, 0); [:0]; a removed or weakened row; a moved marker; a HOLD_PATH_CLASSES = [] re-definition; a rebound FLOOR; a newly lane-armed glob; a dropped person-held entry; a fullwidth identifier; a removed last row when main has moved past the merge base; a missing patch; a renamed file; a cut-short list; an unreadable merge base. Each of these is accepted: a pure row addition, a person-held entry, a logic edit, and a RE.exec( method call.

  • floor-ast.py, against the real babysit_risk.py. Each of these refuses:

    • reflective references: locals()[...], an alias g = globals, (globals\n)() split over lines, builtins.setattr, object.__setattr__, sys.modules[__name__].__setattr__, __import__(...).exec, importlib, getattr, the compile builtin, __builtins__;
    • frames, dunders and imports: (lambda: 0).__globals__[...], sys._getframe().f_globals[...], inspect.currentframe().f_globals[...], an added import helper;
    • rebindings: a second, augmented, loop, with, import-alias, walrus, def, argument, del or global binding of a floor name;
    • a re-derived FLOOR, a non-literal LANE_ARM_GATE, and a syntax error.

    A logic edit that uses re.compile, a pure logic edit inside an existing function, and a row addition are accepted.

  • The JS count, and floor-ast.py. An added eval, globalThis, Function(, Reflect., Object.defineProperty, __proto__, import( or require( refuses, and so does an eval added to merge-holds.mjs end to end. A logic edit is accepted, and so is a name like evaluate. A logic edit to floor-ast.py is not refused for an unreadable base. The previous checker accepts the __globals__, _getframe and import helper cases. End to end, a locals() rebinding that the patch rules accept is refused through floor-ast.py. The previous text-parsing floor check accepts the block-comment decoy.

• scripts/ci-lanes-pr-hold.test.sh: PASS=243 FAIL=0. scripts/ci-review-lanes.test.sh: PASS=140 FAIL=0.
• scripts/sync-hold-floor.py --check exits 0 at this head, which shows only that the generated copies match. It is not a control on a lane-armed PR: it runs the head's own test_merge_holds_sync.py (follow-up 1). actionlint is clean.

Known follow-ups (MEDIUM, defense in depth over the Q5 residual)

These ship in a follow-up PR right after this one merges.

1. The sync check can be skipped. sync-hold-floor.py --check runs through the head's test_merge_holds_sync.py in test-python, and the tests directory has no floor row, so a PR can skip or weaken it.
2. #11048: judge reflective references by position, not count. Add constructor, prototype, getPrototypeOf and setPrototypeOf to JS_DYNAMIC. Refuse a getattr or setattr with a non-literal name, and any string concatenation that joins into a dunder or a table name.
3. Floor readers outside FLOOR_FILES. clear-escalations.mjs and enable-auto-merge.mjs read the floor tables outside FLOOR_FILES. A logic change there is the accepted Q5 residual.

Related

• Owner decision records Q5 and Q-C: the 2026-10-29 audit session.
• Review thread on clear-escalations, the label and review cycle: the pr-review-main change above breaks the cycle.
• lib/publish-gate.mjs: the main-run review's verdict writer imports it, and it sits on no floor row. Recorded on fix(source-control): close five pre-existing secret and hold-path detection gaps (hardening deferred) #10943; no row added here.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-29T15:12:32.083692Z	e6696af	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

claude-security-review reviewed 081662b44e6440d70e6f5d572bebbad0489878f4: 1 finding(s), 1 as inline comments.

Incremental security review of lane-armed.mjs, its test and the README line, against the previous review at 9563725.

critical-findings: 0

What I checked

• Locked block patch rule (floorChange, locked argument): the boundary arithmetic is right. A removed line is refused strictly between the markers. An added line is refused from the BEGIN line through the line before END. patchLines sets at to the base line an added line follows, so the block cannot be edited or extended through a patch.
• Marker handling: MARKER now includes js-dynamic, so any added or removed marker line is refused. A head copy therefore cannot gain a second block, and cannot move or drop the existing one. The jsRefusal fallback also fails closed. A head copy whose bounds is not exactly one block is counted whole, literals included, which trips the count.
• Block exclusion in jsRefusal: the base and head blocks are byte-identical because the patch rule forbids changing them. Excluding them only drops the self-referential literals. I found no way to make block text execute as code.
• floorRefusal: it fails closed when the base copy of lane-armed.mjs has no single block. That includes this PR's own merge base, so a person lands it. This is a fail-closed behaviour and not a finding.
• Test and README changes: the test world() fallback reads the checkout's own file and has no security effect. The README matches the code.

Finding (1, IMPORTANT): the eval token was narrowed from \beval\b to \beval\s*\(, which stops counting indirect-eval and aliased forms. See the inline comment.

Spend: none.

No manifest fields were touched, so there are no manifest <field> lines.

[github-actions]

claude-security-review holds this pull request for a person (critical-security) at e6696af5bc92616c480efeba8996723fbb270816.

The PR turns on merge.lane-arm-gate in docs/conventions/pr-pipeline.yaml, which weakens a merge hold. Credentialed workflows (release-publish-plugins.yml, work-resolve-issue.yml) and agent settings and instruction files (.claude/, CLAUDE.md, AGENTS.md, .mcp.json, docs/standards/) then merge on a model-only verdict, with no person. The remaining control is a model review of attacker-influenced diff text, and the repository rulesets are outside the diff. Whether that suffices is unsettled, so it is rated CRITICAL under the fail-closed rule.

claude-lane: claude-security-review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e6696af5bc

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[github-actions]

claude-review reviewed 081662b44e6440d70e6f5d572bebbad0489878f4: 1 finding(s), 1 as inline comments.

Incremental review of lane-armed.mjs, its test and the pr-pipeline README since 9563725. I read the diff and the head copy of lane-armed.mjs. I did not run the tests.

What I checked

• Patch-line lock. The locked check in floorChange uses the right base-line arithmetic. A removed line is refused strictly between BEGIN and END. An added line is refused when it follows BEGIN through the line before END. An added line after END is allowed.
• Block counting. jsRefusal strips the block from the base and head copies and counts what is left. A head with a missing or duplicated block keeps its literals in the head count and refuses, because the base count excludes them. The js-dynamic marker is also refused at the patch level.
• Base copy without a block. floorRefusal fails closed when the base copy of lane-armed.mjs has no single block. This PR's own base lacks the block, so the PR itself cannot attest. That fits a person-held floor file.
• Tests. The new test lane-armed.mjs cannot trade a JS_DYNAMIC literal for a real call exercises both layers: the count alone, then the patch rule. The eval-foo.yml floor-row case covers the false positive the narrowing fixes.

Finding (1, doc drift)

• The README describes the lane-armed check but not the new js-dynamic marker block or the patch-line lock. See the inline comment.

Observation, not counted as a finding

• Narrowing eval to eval( means a head that only aliases it no longer trips jsRefusal. Examples are const run = eval; and (0, eval)(x). An indirect eval runs in global scope and cannot reach the module-level floor tables. Function and Reflect aliases were already outside the call-shaped patterns, so this is consistent with the existing design. It is worth knowing about if the guard's intent is "no dynamic code at all".

No cost or critical-security hold applies. No closing issues were checked against criteria in this pass.

[github-actions]

claude-review: 2 inline finding(s) on 60af038043ca12628cd7f97f2938e2c900d3caca; the summary is in this lane's pull request comment.

claude-lane: claude-review

[github-actions]

claude-review holds this pull request for a person (critical-security) at 60af038043ca12628cd7f97f2938e2c900d3caca.

The head ships merge.lane-arm-gate: true with 19 lane-armed paths (babysit_risk.py and 18 .github/scripts/pr-merge/ scripts, including merge-holds.mjs and lane-armed.mjs). A pull request that rewrites the merge gate's own logic can merge with no person once the two bound AI reviews are clean and pr-merge/lane-armed is posted. The PR description says the opposite: lane-armed set ∅, LANE_ARMED_FLOOR = [], merge-holds.mjs person-held, and sync refusing any lane-armed gate row. A person must confirm the shipped scope is the intended one before this merges.

claude-lane: claude-review

[github-actions]

claude-security-review: 1 inline finding(s) on ffdde4431a5e573d68dd804dcf4c18d0f488920b; the summary is in this lane's pull request comment.

claude-lane: claude-security-review

[github-actions]

claude-security-review: 1 inline finding(s) on e4812b19d5a810cead29f591d79ea95bc61d41ee; the summary is in this lane's pull request comment.

claude-lane: claude-security-review

[github-actions]

claude-review: 1 inline finding(s) on e4812b19d5a810cead29f591d79ea95bc61d41ee; the summary is in this lane's pull request comment.

claude-lane: claude-review

[github-actions]

claude-review: 2 inline finding(s) on 6daeb478cc76c4b12d305d704b53ea4d64325134; the summary is in this lane's pull request comment.

claude-lane: claude-review

[github-actions]

claude-security-review: 1 inline finding(s) on 6daeb478cc76c4b12d305d704b53ea4d64325134; the summary is in this lane's pull request comment.

claude-lane: claude-security-review

[github-actions]

claude-review: 2 inline finding(s) on 860916aef19187a58d70688aa222ea584894d043; the summary is in this lane's pull request comment.

claude-lane: claude-review

[github-actions]

claude-security-review: 2 inline finding(s) on 860916aef19187a58d70688aa222ea584894d043; the summary is in this lane's pull request comment.

claude-lane: claude-security-review

[github-actions]

claude-review: 2 inline finding(s) on 95637252837f47b48fadde8923dfcd14701e7ca3; the summary is in this lane's pull request comment.

claude-lane: claude-review

[github-actions]

claude-review: 1 inline finding(s) on 081662b44e6440d70e6f5d572bebbad0489878f4; the summary is in this lane's pull request comment.

claude-lane: claude-review

[github-actions]

This paragraph covers the new eval( wording, but not the rest of this change. lane-armed.mjs now holds its token list in a js-dynamic JS_DYNAMIC marker block. The block's literals are excluded from the dynamic-token count. Any patch line inside the block refuses, and so does a changed line that names the js-dynamic marker. The step-4 text above lists only the floor-rows and hold-floor markers. A reader of this page will not learn that editing the token list in lane-armed.mjs always refuses attestation, or why the count skips that block. Add a sentence here and name the new marker alongside the others at lines 2494-2496.

claude-lane: claude-review

[github-actions]

claude-security-review: 1 inline finding(s) on 081662b44e6440d70e6f5d572bebbad0489878f4; the summary is in this lane's pull request comment.

claude-lane: claude-security-review

[github-actions]

The eval token is narrowed from /\beval\b/g to /\beval\s*\(/g, so jsRefusal no longer counts forms where eval is not directly followed by (. Examples: eval?.(src), (0, eval)(src), and const e = eval; e(src). All of these were counted before and now count as zero.

The path is a pull request that edits merge-holds.mjs or lane-armed.mjs, the files this check guards. It can add one of these forms and jsRefusal returns null. The text of an eval call can be assembled from split strings, which is the case the comment above this list describes. These forms are indirect eval, which runs in global scope. It cannot rebind the module's frozen const tables, and plain logic edits to these files are already the documented residual. That is why this is IMPORTANT and not CRITICAL.

The narrowing was made so a floor row such as .github/workflows/eval-browser-dispatch.yml counts as nothing. A pattern that keeps the alias forms and still skips eval- filenames is /\beval\b(?!-)/g.

severity: IMPORTANT

claude-lane: claude-security-review

[kyle-sexton]

Superseded by owner decision Q15 (no path-based merge holds; harden later). Path holds go off behind one config switch, merge.path-holds, on branch feat/merge-path-holds-switch.

[kyle-sexton]

Replacement for owner decision Q15: #11058, which turns path-based merge holds off behind merge.diff-check.path-holds (default false). Hardening means setting it to true once open issues and open PRs both reach 0.