fix(sdlc): native merge queue core drain — arm-only autoqueue + all-green + governance-gate

.github/workflows/ci.yml

@@ -1179,3 +1179,37 @@ jobs:
             fi
           fi
           echo "No high-severity security issues found"
+
+  all-green:
+    # Single aggregate required context (task reform-native-merge-queue). Collapses
+    # the five literal required checks (lint/test/typecheck/web-build/vscode-build)
+    # into one job so the merge queue can't be permanently stalled by a
+    # required-context-name mismatch. `if: always()` + treating `skipped` as OK
+    # preserves the fast/slow split: `test-full-shard` is merge_group-only, so it
+    # is `skipped` on pull_request events and all-green still passes there.
+    name: all-green
+    needs: [lint, typecheck, test, test-full-shard, web-build, vscode-build]
+    if: always()
+    runs-on: ubuntu-latest
+    steps:
+      - name: Aggregate required CI results
+        env:
+          RESULTS: ${{ join(needs.*.result, ' ') }}
+        run: |
+          set -euo pipefail
+          echo "Aggregated required-job results: $RESULTS"
+          failed=0
+          for r in $RESULTS; do
+            case "$r" in
+            success | skipped) ;;
+            *)
+              echo "::error::A required CI job concluded '$r'"
+              failed=1
+              ;;
+            esac
+          done
+          if [ "$failed" -ne 0 ]; then
+            echo "all-green: FAIL — at least one required CI job did not succeed."
+            exit 1
+          fi
+          echo "all-green: PASS — all required CI jobs succeeded or were skipped."

.github/workflows/governance-gate.yml

@@ -0,0 +1,56 @@
+name: governance-gate
+
+# Server-side governance required check for the native merge queue
+# (task reform-native-merge-queue, part 3).
+#
+# A PR may enter the merge queue only when its linked cc-task is
+# governance-releasable: stage >= S7_RELEASE, release_authorized == true, and an
+# authority_case present. That decision needs the local Obsidian cc-task vault,
+# which GitHub-hosted runners CANNOT read. So this gate verifies the server-side
+# PROOF instead: the `hapax/autoqueue-admission` commit status that the
+# vault-reading local autoqueue posts on the PR head SHA after it validates the
+# task. scripts/queue-admission-proof-check.py asserts that proof is fresh and
+# successful for queued / auto-merge PRs.
+#
+# Scope: the proof is enforced only for enqueued / auto_merge_enabled PRs (and
+# merge_group), so ordinary PR CI is never wedged by this gate. It is the
+# governance counterpart to pr-admission.yml's freeze governor — kept as a
+# distinct, clearly-named context so it can be made a required status check in
+# the main-merge-queue ruleset ("enqueueing itself is governed").
+
+on:
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - ready_for_review
+      - enqueued
+      - auto_merge_enabled
+      - auto_merge_disabled
+  merge_group:
+    types: [checks_requested]
+
+permissions:
+  contents: read
+  pull-requests: read
+  statuses: read
+
+jobs:
+  governance-gate:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 1
+
+      - name: Verify queue admission governance proof
+        env:
+          GH_TOKEN: ${{ github.token }}
+          REPO: ${{ github.repository }}
+        run: |
+          set -euo pipefail
+          python3 scripts/queue-admission-proof-check.py \
+            --repo "$REPO" \
+            --event-path "$GITHUB_EVENT_PATH"

hooks/gate-manifest.yaml

@@ -252,6 +252,7 @@ runtimes:
       - vscode-build
       - secrets-scan
       - security
+      - all-green
     run_markers:
       - 'astral-sh/ruff-action@v3'
       - 'uv run python scripts/check-unused-functions.py'

scripts/cc-pr-autoqueue.py

@@ -3,12 +3,14 @@
 
 The merge queue should not depend on a human/session remembering to run
 ``gh pr merge`` after a governed PR is ready. This reconciler scans open PRs,
-matches each PR to a cc-task in the local Obsidian vault, and queues or arms
-auto-merge only when Hapax governance and GitHub protection state both pass.
+matches each PR to a cc-task in the local Obsidian vault, and ARMS auto-merge
+only when Hapax governance and GitHub protection state both pass.
 
-GitHub's current CLI behavior for branches that require a merge queue is the
-primitive this script uses: ``gh pr merge`` adds a ready PR to the queue, and
-``gh pr merge --auto`` arms auto-merge until required checks/reviews pass.
+Arm-only (task reform-native-merge-queue): the sole positive GitHub mutation is
+one idempotent ``gh pr merge --auto --squash``. GitHub's native merge queue then
+owns batching, speculative ``gh-readonly-queue`` branches, auto-rebase, and
+bisect-on-failure — this script no longer issues a direct ``--merge`` or manages
+the queue itself, which previously raced GitHub's own batching and stranded PRs.
 
 Usage::
 
@@ -114,9 +116,15 @@
 # concurrently in flight in a DIFFERENT lane (the actual hazard); same-lane serial
 # work is never held, and a deterministic lowest-PR tiebreak keeps two
 # different-lane epic PRs from dead-holding each other.
-SHARED_FILE_EPIC_PARENT_SPECS = {
-    # parent_spec basename -> serialized-epic id (the shared file it contends on)
-    "clog-frontend-elevation-design-2026-06-01.md": "clog-dashboard-lisp",
+SHARED_FILE_EPIC_PARENT_SPECS: dict[str, str] = {
+    # parent_spec basename -> serialized-epic id (the shared file it contends on).
+    #
+    # Emptied 2026-06-01 (task reform-native-merge-queue): the native GitHub merge
+    # queue serializes shared-file contention through its speculative
+    # gh-readonly-queue branches (auto-rebase + bisect-on-failure), so a
+    # pre-admission affinity hold is no longer needed to keep two different-lane
+    # epic PRs from merge-conflicting. Re-add an entry here only to re-enable the
+    # local pre-queue hold for a specific shared-file epic.
 }
 EPIC_INFLIGHT_STATUSES = frozenset(
     {"claimed", "in_progress", "pr_open", "in_review", "merge_queue", "ready_for_merge"}
@@ -899,10 +907,15 @@ def merge_pr(
         ]
     else:
         cmd = ["gh", "pr", "merge", str(decision.pr.number), "--repo", repo]
-    if decision.action == "enable_auto_merge":
-        cmd.extend(["--auto", "--merge"])
-    elif decision.action == "queue":
-        cmd.append("--merge")
+    if decision.action in ("enable_auto_merge", "queue"):
+        # Arm-only (task reform-native-merge-queue): the local autoqueue's sole
+        # positive mutation is to ARM auto-merge with one idempotent command.
+        # GitHub's native merge queue then owns batching, speculative
+        # gh-readonly-queue branches, auto-rebase, and bisect-on-failure — we no
+        # longer issue a direct `--merge` (which raced the queue's own management).
+        # Re-arming an already-armed PR is a no-op; `--squash` matches the queue's
+        # configured merge method.
+        cmd.extend(["--auto", "--squash"])
     elif decision.action == "disable_auto_merge":
         cmd.append("--disable-auto")
     elif decision.action != "dequeue":