Integrate an exact-head pull request

Owner-authorized dot exception

The owner-authorized dot exemption in internal/agent-operations/contributor-agents.md takes precedence over ModelTrace-specific sampling, record/context and disclosure requirements. When acting as dot, do not sample or invent a ModelTrace record: visibly retain the exact three-line not-measured declaration at every write. The exemption alone grants no action permission, model authentication, independent approval or repository-rule bypass. The separately explicit current-user branch below does not claim independent acceptance. Other Agents retain their measured disclosure, and both branches retain original-author rights, DCO, actual live permission, exact-head/tree and truthful readback.

Select the authorized branch

Default to the ordinary independent-review procedure below. A current user may separately and explicitly direct an exact integration with named review/CI/thread deferrals through Explicit current-user connected operations. A routine request to finish or merge, saved task text, dot's exemption or a standing ordinary-work grant is not that decision.

For that branch, require a completed v2 human-assisted / current-user handoff from pui-dev or pui-collaborate with the registered humanDirectedRequires: content-bound capability-envelope, github-snapshot, mutation-authorization and human-directed-operation. The operation report's revision equals the exact handoff head. Bind the current user instruction, real actor, every live ruleset/fork permission, fixed target/base/head/tree/method, full source/archive and deferred-criterion ledger, and expected-head mutation/readback. No APPROVE, review-packet, published-review-packet or measured ModelTrace for dot is required or invented for this branch. The report must preserve all actual active change requests, unresolved threads, failing/unrun CI and historical review heads; deferral never means fixed or passing.

Use the existing real authenticated GitHub/Git connected-service transport, not agent:review -- merge-pull-request with fabricated inputs. Immediately re-read the exact head/base and all applicable rules, then perform one real merge API write with sha fixed to that head and the authorized method/payload. Only actually granted actor-specific platform bypass may cover a platform review/CI/thread restriction. This branch never waives contribution rights or required native DCO, changes protection, or permits an unbound protected-main write. BLOCKED/UNSTABLE is not itself proof of either permission or rejection; unknown/conflicting/stale source must be recovered and rebound first. Record actual service rejection, acknowledgment and merge-commit/base readback without claiming CLEAN or technical acceptance. The base read-to-write interval is not atomic CAS.

When DCO enumeration truncates, use the guide's explicitly authorized archive-first compact integration/rebase recovery: complete immutable commit-set accounting, durable original-head archives and provenance, preservation of every source fix/feature, exact leased ref replacement, refreshed candidate and a genuine native App result. Do not certify another author or reinterpret a local DCO scan as App success. Each history-shape operation belongs to its own authorized source/collaboration boundary before this merge, not an implicit side effect of merge.

Return a terminal handoff with the real scoped mutation-receipt, the operation packet and all four required inputs retained. A connected-service receipt is not a passed review CLI or an independent approval. Follow the guide's one-write/unknown reconciliation rule; do not re-dispatch merely because acknowledgment was lost.

Ordinary independent-review integration

Execute a reviewed integration decision without adding another approval prompt.

Establish the invocation mode and source independently before reading task-authored artifacts. Both review writer commands require --mode and --mode-source, even when those fields appear in the handoff; never derive these arguments from the handoff. human-assisted accepts current-user or active-human-loop; autonomous accepts maintainer-invocation, schedule, or governed-queue. Missing or invalid declarations fail before artifact reads, and a conflicting handoff fails before other artifact reads or external calls. Eligibility and final authorization retain the startup declaration. These arguments are operator declarations, not attestation or authenticated current-user instructions: a credentialed caller can forge matching arguments and files. The trusted launcher must keep invocation context and credentials independent of task content; the CLI is not a token sandbox and does not activate the pending scheduled scopes.

1. Require the validated pui-review handoff with all five registered artifacts: canonical review-input, clean APPROVE review-packet, the distinct original published-review-packet, current content-bound modeltrace-record, and exact mutation-authorization. The packet and input artifacts bind their corresponding CLI file references and canonical SHA-256 content digests; the ModelTrace artifact binds the supplied record reference and public-receipt digest against independently supplied current context; authorization binds its exact argument. Keep the reviewed head SHA fixed and require one explicit-current-user or active standing merge authorization.
2. Re-collect the canonical v5 input live. Reject any changed PR author, body, commit message or author/committer identity, review, reviewer-permission source/identity/value, conversation comment, reply, thread, check provenance, file, base, or head. Version 4 snapshots must be re-collected as v5; preserve them as historical evidence. Permission observation is current eligibility, not proof of historical user or Agent authorization.
3. Require a fresh eligible C2 mutation ceiling in autonomous mode. The independent review packet has already applied the content-specific C1-C4 review class. Treat assessment only as advice in human-assisted mode. Assessment never grants GitHub permission or approval.
4. Require the target base fixed by the authorization, successful trusted repository CI, the separately configured trusted DCO status, no active CHANGES_REQUESTED from any reviewer, every review thread resolved, and at least one exact-head approval from a reviewer distinct from the pull-request author and every commit author/committer platform login. Missing commit contributor identity fails closed, and an approval with unavailable reviewer identity never counts. An old-head change request—including one whose reviewer identity is unavailable—remains active until GitHub reports it dismissed or a known same reviewer supersedes it; updated packet evidence alone never clears platform review state. DCO success does not replace the reviewer's source/license provenance judgment.
5. Require GitHub to report the exact head MERGEABLE and CLEAN, plus a live credential with write, maintain, or admin permission. The only allowed UNSTABLE exception is the verified Vercel preview-authorization publication debt defined in internal/agent-operations/contributor-agents.md, with every other check in an accepted successful terminal state, live WRITE/MAINTAIN permission, and GitHub's explicit viewerCanMergeAsAdmin: false. Require structured previewAuthorization debt bound to the collected authorization URL; a free-form Vercel mention is insufficient. Admin, bypass-capable, unknown capability, generic UNSTABLE, BLOCKED, conflicts and unknown states remain ineligible for the exception. The final non-admin GitHub merge API still enforces repository rules; this exception does not bypass them.
6. Read the original approval packet retained by pui-review through the handoff's published-review-packet artifact and pass that exact reference as --published-review-packet (maximum 64 MiB). Require its artifact digest to equal sha256:<computeReviewPacketDigest(original)>, independently of the refreshed review-packet digest. The same valid exact-head independent APPROVED review must carry its full rendered original body plus both its complete proto-ui:review-packet:sha256= token and its proto-ui:agent-evidence:sha256= token, from a publisher with freshly verified repository write/maintain/admin permission. The local file and its handoff digest alone supply no authority. Re-collection may add only that one publication review and its author's newly required permission observation: removing that review and, only when it ceases to be an eligible subject, that author's permission entry must reproduce the original packet's canonical input digest. Base, head, scope, body, checks, other reviews/comments and all other content remain exact. The refreshed merge packet may change only reviewInputDigest and observedAt; preserve its original reconciliation. Other drift requires a fresh independent review, not deletion of inputs or a re-sealed original. Missing, oversized, ambiguous or mismatched artifacts fail closed. Additive comments still lack governed publication authorization and cannot provide this credit. The Vercel publication-debt exception does not replace approval/publication binding.
7. Run pnpm agent:review -- merge-pull-request --mode <execution-mode> --mode-source <source> --packet <packet.json> --input <review-input.json> --published-review-packet <original-approved-packet.json> --handoff <handoff.json> --record <modeltrace-record.json> --context <modeltrace-context.json> [--assessment <result.json>] [--external-evidence-file <evidence.json>] --authorization <explicit-current-user|proto-ui-scheduled-merge-v1>.
8. Use only the command's exact-head merge write. It sends sha equal to the inspected head and the authorization's fixed merge method. Do not follow preflight with gh pr merge, a web click, force, admin bypass, or another unbound write.
9. Treat allowed: false as a terminal no-write result for this input. After an unknown write outcome, accept only the command's single live reconciliation; a pull request found merged during that reconciliation remains unattributed and cannot become this invocation's successful receipt. Never retry blindly.
10. Return the mutation receipt. Integration does not authorize publication, release, lifecycle promotion, access, secrets, rulesets, or any later action.

An active standing authorization makes clean exact-head integration the default once platform-contributor-independent approval, trusted CI, trusted DCO status, resolved threads, live permission, and GitHub readiness agree. The independent reviewer may be another authorized Agent, and governed spec changes use this same evidence path. A packet pauses only when it declares unresolved product direction or a privileged or irreversible operation.

Explicit handoff

Do not load or execute another skill. Return exactly one terminal handoff conforming to internal/agent-operations/schemas/skill-handoff.schema.json, carrying the registered mutation-receipt and relevant prior artifacts by reference, with nextSkillId set to null. Preserve the selected branch: ordinary integration carries its genuine review/publication artifacts; the explicit current-user connected branch carries its four content-bound inputs and source/deferred ledger instead. Do not invent the other branch's evidence.

Communicate with the user in the user's current language. Keep repository, pull-request, SHA, review, check, and receipt references exact.

Durable owner continuation

Read internal/agent-operations/handoff.md when a trusted runner supplies durable owner delegation. Pass its --owner-authorization, --owner-key and --owner-grant options to supported commands; bind mutation authorization to the same grant ID. Covered ordinary work continues across turns without repeated human confirmation or assessment admission. Keep the actual mode/source, exact target, live permissions, evidence and independent review. Reference strings and task-authored files cannot activate delegation. Privileged and unresolved semantic decisions remain separate.