Bind merge-queue review to the queued source - #4221

Merge queue refs serialize the base commit, not the pull request head. Resolve the queued source through GitHub merge queue metadata, validate every identity boundary, and keep independent invalidation fail-closed across all matching queue refs.

Constraint: Merge-group payloads do not expose the source pull request head directly.

Rejected: Reuse the queue-ref suffix as the source head | live queue evidence proves it is the base commit.

Confidence: high

Scope-risk: moderate

Reversibility: clean

Directive: Do not require Automated review until a live source and merge-group canary succeeds on this implementation.

Tested: Deno 2.7.7 focused gate 68 steps; fmt; repository lint; typecheck and generated artifacts; unit 4277 tests and 34124 steps; cwd suites; independent code review.

Not-tested: Live mergeQueueEntry values and synthetic status propagation, pending an active queue entry.

Live queue evidence showed that MergeQueueEntry carries separate base, synthetic merge-group, and pull-request source commits. Validate each identity independently before publishing a successful automated-review status.

Constraint: GitHub GraphQL MergeQueueEntry.headCommit is the synthetic merge-group commit, not the pull-request source commit.
Rejected: Equate headCommit with pullRequest.headRefOid | would fail every valid merge-group review closed.
Confidence: high
Scope-risk: narrow
Reversibility: clean
Directive: Keep baseCommit, headCommit, and pullRequest.headRefOid as separate trust bindings.
Tested: Focused automated-review gate suite, 68 steps; repository lint; repository typecheck; diff check; independent code review at 96% confidence.
Not-tested: Exact synthetic merge-group execution, pending deployment of this default-branch workflow fix.

A failure run for an old source head could discover a newly queued ref by pull-request number and overwrite its successful synthetic status. Bind every queue failure write to GitHub’s current base, synthetic commit, and source-head identity, including the independent workflow fallback.

Constraint: Queue-ref suffixes identify the base commit, not the source head.
Rejected: Recheck only the pull-request number | a force-push can reuse the same number for a different source and synthetic commit.
Confidence: high
Scope-risk: narrow
Reversibility: clean
Directive: Never publish a queue status from a PR-number-only ref match.
Tested: Focused gate suite, 70 steps; repository lint; repository typecheck; diff check; independent review at 95% confidence.
Not-tested: Exact synthetic merge-group execution, pending deployment of this default-branch workflow fix.
Related: #4221 (comment)

A later authenticated exact-head Codex no-findings verdict now supersedes earlier findings only when GitHub timestamps or same-second timeline order prove it is newer. Repeated review and comment reconciliation signals also coalesce before runner allocation, reducing the Actions backlog without dropping source-update or merge-group events.

Constraint: Ambiguous finding chronology remains fail-closed, and wakeup runs are not coalesced because cancellation is an invalidation signal.

Rejected: Require a no-op source commit after a false positive | wastes CI and makes resolved same-head findings impossible to clear automatically.

Rejected: Coalesce all gate and wakeup events | can drop source review requests or turn harmless supersession into fail-closed invalidation.

Confidence: high

Scope-risk: moderate

Reversibility: clean

Directive: Keep source-update and merge-group runs unique unless reconciliation becomes fully state-derived before runner allocation.

Tested: deno task test:file scripts/ci/automated-review-gate.test.ts (7 suites, 71 steps)

Tested: deno task lint

Tested: deno task typecheck

Tested: deno fmt --check and git diff --check

Tested: independent code review approved at 92% confidence and security review approved at 93% confidence

Not-tested: Hosted GitHub concurrency behavior requires the post-merge canary.

Merge-queue status propagation must never reuse stale source proof or publish against a superseded synthetic commit. Reconcile live pull request, base, queue-ref, and status evidence at each publication boundary, preserve exact-head verdict ordering, and coalesce replaceable reconciliation runs without cancelling fail-closed wakeups.

Constraint: Human approval remains required until the merged workflow passes a real source and merge-group canary.

Rejected: Trust the synthetic merge-group head alone | it does not prove the queued source, base, or current queue-ref ownership

Rejected: Cancel wakeup runs with shared concurrency | cancellation itself is a fail-closed invalidation signal

Confidence: high

Scope-risk: moderate

Reversibility: clean

Directive: Do not remove live source, base, queue-ref, and final pre-publication checks without an equivalent race-proof binding.

Tested: Focused automated-review gate suite, 7 suites and 80 steps

Tested: Direct script typecheck, repository lint, repository typecheck, format, syntax, and diff checks

Not-tested: Live merge-group propagation until this commit reaches the default branch

A queue binding can disappear after ref enumeration but before a failure status is safe to publish. Re-read the exact queue ref and skip only a moved or deleted entry; keep a still-live entry, malformed response, or API outage fail-closed.

Constraint: GitHub can delete or retarget merge-queue refs during reconciliation.

Rejected: Treat every unpublished failure as obsolete | a live synthetic commit could retain an older successful review status

Rejected: Suppress queue-ref lookup failures | an outage is not proof that the entry disappeared

Confidence: high

Scope-risk: narrow

Reversibility: clean

Directive: An unpublished failure may be skipped only after exact live-ref evidence proves the synthetic commit is no longer active.

Tested: Focused automated-review gate suite, 7 suites and 82 steps

Tested: Direct typecheck, lint, format, syntax, and diff checks

Not-tested: Live merge-queue ref deletion race until the workflow reaches the default branch

Issue-comment edits expose the current verdict body, so comment evidence now
uses a valid updated timestamp while preserving the creation timestamp as a
defensive fallback. Reviews and reset boundaries retain their existing clocks.

Constraint: The gate runs on issue_comment edited events and evaluates current comment bodies
Rejected: Apply updated_at to all evidence and boundaries | review and boundary semantics must remain unchanged
Confidence: high
Scope-risk: narrow
Directive: Keep review evidence on submitted_at and request, base, and status boundaries on created_at
Tested: PATH=/private/tmp/vf-deno-2.7.7.b6yD1m:$PATH deno task test:file scripts/ci/automated-review-gate.test.ts
Tested: Deno format and lint checks with scripts/test.deno.json on both touched files
Tested: git diff --check
Not-tested: Full repository test suite