merge-gate — opening a PR here is merging it
The estate runs an autonomous auto-merge (an automation acting as the CleanExpo
account) that force-readies draft PRs and squash-merges them on green, within minutes of
open. --draft does not hold it; the "explicit merge authority" gate does not stop
it. So the only control point you actually own is before the PR opens. This skill moves the
full quality bar to that point and turns a hazard into a safe fast-ship — when the standard is
met first.
Verified 2026-07-10: draft PRs #545 and #546 were both flipped to ready by CleanExpo and
merged on green; #545 (spec-only) merged in the gap between opening the draft and pushing the
code, shipping a half-PR and stranding the implementation. Full worked example + the exact
detection/recovery commands are in references/playbook.md — read it
before you diagnose a premature or truncated merge.
The Iron Law
NO PR OPENS UNTIL THE BRANCH IS COMPLETE AND GREEN.
Treat every gh pr create as gh pr merge. If the branch is not the whole, verified change at
the moment you open it, assume it ships exactly as-is.
Enforce LEFT — the pre-open gate (MANDATORY)
Make a todo per item. Every one must be true before gh pr create (or before any push to a
deploy-on-push branch):
- Whole — every commit of the change is pushed; nothing staged, stashed, or uncommitted
belongs in it.
git status clean, git stash list empty (see [[hermes-agent-autogit-hazard]]),
git log origin/<branch> shows the complete change. Never open, then push more.
- Green on the exact pushed tip — the repo's definition-of-done gates pass locally on the
commit you are about to open: type-check, lint, tests, build, and every project guard
(CARSI:
check:iicrc-terminology, check:designations, check:cec). Paste real output; a
subagent's "green" is unconfirmed until you re-ran it.
- Dark-by-default — any behaviour change ships behind a flag defaulting off; DDL /
destructive / prod-affecting changes are founder-gated or excluded. The test: if this
auto-merges in 90 seconds, is it harmless? If not, it is not ready to open.
- Atomic — spec + implementation land together unless a spec-only merge is intended.
Do not open a branch that a mid-push merge could truncate.
- Standards clean — brand/licence rules hold ([[no-coach8-in-branding]], AU-English,
[[carsi-designations-not-iicrc]], [[carsi-cec-requires-iicrc-approval]]); no secrets; no
unrelated files.
- Authority reconciled — because open ≈ merge, settle merge authority before opening.
If the auto-merge will fire regardless, tell the founder plainly and rely on #3 (flag-off) as
the safety net — never on the draft flag or the authority gate holding.
Completion criterion: all six true, output pasted → push the final tip → gh pr create.
Any one false → do not open; fix first.
After the merge — never trust it
The merge is not the finish line; verification is. Confirm on origin/main that the full
intended tree landed (not a truncated subset — #545's failure mode), the flag default is still
off, and you know which deploy the merge triggered (CARSI main = prod on DO deploy-on-push).
Commands in references/playbook.md.
When it goes wrong
Premature or truncated merge, stranded implementation, orphaned autostash → the recovery recipe
(fresh branch off the moved origin/main, git checkout <old-branch> -- <files>, new PR;
GitHub diffs trees so an already-squashed prefix shows no dup) is in
references/playbook.md. To stop the automation for sustained work,
see the pause options there.
Connection
- nexus — this skill is the ship-safety clause of nexus G7 (Deliver): any run step that
opens a PR, pushes to a shared/deploy branch, or merges passes merge-gate first.
- Hands off, does not duplicate — the idea→ship lifecycle stays with
ship-chain /
ship-it / ship-release; the definition-of-done gate run stays with session-handoff.
merge-gate owns only the git-merge boundary and the auto-merge threat around it.
- Memory — [[hermes-agent-autogit-hazard]] (the automation's full behaviour),
[[agent-pr-merge-needs-explicit-authority]], [[merge-race-fixforward-window]],
[[stacked-pr-train-merge-order-hazard]], [[carsi-preserve-sha-use-tag]].
1---2name: merge-gate3description: Use before opening any PR, pushing to a shared branch, or merging in this estate — where automation force-readies draft PRs and squash-merges them on green within minutes, so opening a PR is authorising its merge. Fires when about to run gh pr create / gh pr ready / gh pr merge, or push to a deploy-on-push branch.4---56# merge-gate — opening a PR here *is* merging it78The estate runs an autonomous **auto-merge** (an automation acting as the `CleanExpo`9account) that **force-readies draft PRs and squash-merges them on green, within minutes of10open**. `--draft` does **not** hold it; the "explicit merge authority" gate does **not** stop11it. So the only control point you actually own is **before the PR opens**. This skill moves the12full quality bar to that point and turns a hazard into a safe fast-ship — *when* the standard is13met first.1415Verified 2026-07-10: draft PRs #545 and #546 were both flipped to ready by `CleanExpo` and16merged on green; #545 (spec-only) merged in the gap **between** opening the draft and pushing the17code, shipping a half-PR and stranding the implementation. Full worked example + the exact18detection/recovery commands are in [`references/playbook.md`](references/playbook.md) — read it19before you diagnose a premature or truncated merge.2021## The Iron Law2223```24NO PR OPENS UNTIL THE BRANCH IS COMPLETE AND GREEN.25```2627Treat every `gh pr create` as `gh pr merge`. If the branch is not the whole, verified change at28the moment you open it, assume it ships exactly as-is.2930## Enforce LEFT — the pre-open gate (MANDATORY)3132Make a todo per item. **Every one must be true before `gh pr create`** (or before any push to a33deploy-on-push branch):34351. **Whole** — every commit of the change is pushed; nothing staged, stashed, or uncommitted36 belongs in it. `git status` clean, `git stash list` empty (see [[hermes-agent-autogit-hazard]]),37 `git log origin/<branch>` shows the *complete* change. *Never open, then push more.*382. **Green on the exact pushed tip** — the repo's definition-of-done gates pass locally on the39 commit you are about to open: type-check, lint, tests, build, **and every project guard**40 (CARSI: `check:iicrc-terminology`, `check:designations`, `check:cec`). Paste real output; a41 subagent's "green" is unconfirmed until you re-ran it.423. **Dark-by-default** — any behaviour change ships behind a flag defaulting **off**; DDL /43 destructive / prod-affecting changes are founder-gated or excluded. The test: *if this44 auto-merges in 90 seconds, is it harmless?* If not, it is not ready to open.454. **Atomic** — spec + implementation land together unless a spec-only merge is intended.46 Do not open a branch that a mid-push merge could truncate.475. **Standards clean** — brand/licence rules hold ([[no-coach8-in-branding]], AU-English,48 [[carsi-designations-not-iicrc]], [[carsi-cec-requires-iicrc-approval]]); no secrets; no49 unrelated files.506. **Authority reconciled** — because open ≈ merge, settle merge authority *before* opening.51 If the auto-merge will fire regardless, tell the founder plainly and rely on #3 (flag-off) as52 the safety net — never on the draft flag or the authority gate holding.5354**Completion criterion:** all six true, output pasted → push the final tip → `gh pr create`.55Any one false → do not open; fix first.5657## After the merge — never trust it5859The merge is not the finish line; verification is. Confirm on `origin/main` that the **full60intended tree** landed (not a truncated subset — #545's failure mode), the flag default is still61**off**, and you know which deploy the merge triggered (CARSI `main = prod` on DO deploy-on-push).62Commands in [`references/playbook.md`](references/playbook.md).6364## When it goes wrong6566Premature or truncated merge, stranded implementation, orphaned autostash → the recovery recipe67(fresh branch off the moved `origin/main`, `git checkout <old-branch> -- <files>`, new PR;68GitHub diffs trees so an already-squashed prefix shows no dup) is in69[`references/playbook.md`](references/playbook.md). To stop the automation for sustained work,70see the pause options there.7172## Connection7374- **nexus** — this skill is the ship-safety clause of nexus **G7 (Deliver)**: any run step that75 opens a PR, pushes to a shared/deploy branch, or merges passes merge-gate first.76- **Hands off, does not duplicate** — the *idea→ship lifecycle* stays with `ship-chain` /77 `ship-it` / `ship-release`; the *definition-of-done gate run* stays with `session-handoff`.78 merge-gate owns only the **git-merge boundary** and the auto-merge threat around it.79- **Memory** — [[hermes-agent-autogit-hazard]] (the automation's full behaviour),80 [[agent-pr-merge-needs-explicit-authority]], [[merge-race-fixforward-window]],81 [[stacked-pr-train-merge-order-hazard]], [[carsi-preserve-sha-use-tag]].
cleanexpo