Integrate a reviewed pull request

Owner-authorized dot exception

The owner-authorized dot exemption in internal/agent-operations/contributor-agents.md takes precedence over this leaf's ModelTrace-specific sampling, record/context and disclosure requirements. When acting as dot, do not sample or invent a ModelTrace record: visibly identify Agent: dot and the exact not-measured exemption declaration at every write. Use the supported publisher's explicit dot branch or the guide's real connected-service path; never fake a measured artifact, a successful validator, or live gh responses. The exemption grants no action permission, model authentication, independent approval or repository-rule bypass. All non-ModelTrace inputs and existing authorization, exact-head/tree, DCO, CI, independent-review and readback requirements remain. Other Agents follow the measured path below unchanged.

Execute a reviewed integration decision without adding another approval prompt.

Establish the invocation mode and source independently before reading task-authored artifacts. Both review writer commands require --mode and --mode-source, even when those fields appear in the handoff; never derive these arguments from the handoff. human-assisted accepts current-user or active-human-loop; autonomous accepts maintainer-invocation, schedule, or governed-queue. Missing or invalid declarations fail before artifact reads, and a conflicting handoff fails before other artifact reads or external calls. Eligibility and final authorization retain the startup declaration. These arguments are operator declarations, not attestation or authenticated current-user instructions: a credentialed caller can forge matching arguments and files. The trusted launcher must keep invocation context and credentials independent of task content; the CLI is not a token sandbox and does not activate the pending scheduled scopes.

1. Require the validated pui-review handoff with all five registered artifacts: canonical review-input, clean APPROVE review-packet, the distinct original published-review-packet, current content-bound modeltrace-record, and exact mutation-authorization. The packet and input artifacts bind their corresponding CLI file references and canonical SHA-256 content digests; the ModelTrace artifact binds the supplied record reference and public-receipt digest against independently supplied current context; authorization binds its exact argument. Keep the reviewed head SHA fixed and require one explicit-current-user or active standing merge authorization.
2. Re-collect the canonical v5 input live. Reject any changed PR author, body, commit message or author/committer identity, review, reviewer-permission source/identity/value, conversation comment, reply, thread, check provenance, file, base, or head. Version 4 snapshots must be re-collected as v5; preserve them as historical evidence. Permission observation is current eligibility, not proof of historical user or Agent authorization.
3. Require a fresh eligible C2 mutation ceiling in autonomous mode. The independent review packet has already applied the content-specific C1-C4 review class. Treat assessment only as advice in human-assisted mode. Assessment never grants GitHub permission or approval.
4. Require the target base fixed by the authorization, successful trusted repository CI, the separately configured trusted DCO status, no active CHANGES_REQUESTED from any reviewer, every review thread resolved, and at least one exact-head approval from a reviewer distinct from the pull-request author and every commit author/committer platform login. Missing commit contributor identity fails closed, and an approval with unavailable reviewer identity never counts. An old-head change request—including one whose reviewer identity is unavailable—remains active until GitHub reports it dismissed or a known same reviewer supersedes it; updated packet evidence alone never clears platform review state. DCO success does not replace the reviewer's source/license provenance judgment.
5. Require GitHub to report the exact head MERGEABLE and CLEAN, plus a live credential with write, maintain, or admin permission. The only allowed UNSTABLE exception is the verified Vercel preview-authorization publication debt defined in internal/agent-operations/contributor-agents.md, with every other check in an accepted successful terminal state, live WRITE/MAINTAIN permission, and GitHub's explicit viewerCanMergeAsAdmin: false. Require structured previewAuthorization debt bound to the collected authorization URL; a free-form Vercel mention is insufficient. Admin, bypass-capable, unknown capability, generic UNSTABLE, BLOCKED, conflicts and unknown states remain ineligible for the exception. The final non-admin GitHub merge API still enforces repository rules; this exception does not bypass them.
6. Read the original approval packet retained by pui-review through the handoff's published-review-packet artifact and pass that exact reference as --published-review-packet (maximum 64 MiB). Require its artifact digest to equal sha256:<computeReviewPacketDigest(original)>, independently of the refreshed review-packet digest. The same valid exact-head independent APPROVED review must carry its full rendered original body plus both its complete proto-ui:review-packet:sha256= token and its proto-ui:agent-evidence:sha256= token, from a publisher with freshly verified repository write/maintain/admin permission. The local file and its handoff digest alone supply no authority. Re-collection may add only that one publication review and its author's newly required permission observation: removing that review and, only when it ceases to be an eligible subject, that author's permission entry must reproduce the original packet's canonical input digest. Base, head, scope, body, checks, other reviews/comments and all other content remain exact. The refreshed merge packet may change only reviewInputDigest and observedAt; preserve its original reconciliation. Other drift requires a fresh independent review, not deletion of inputs or a re-sealed original. Missing, oversized, ambiguous or mismatched artifacts fail closed. Additive comments still lack governed publication authorization and cannot provide this credit. The Vercel publication-debt exception does not replace approval/publication binding.
7. Run pnpm agent:review -- merge-pull-request --mode <execution-mode> --mode-source <source> --packet <packet.json> --input <review-input.json> --published-review-packet <original-approved-packet.json> --handoff <handoff.json> --record <modeltrace-record.json> --context <modeltrace-context.json> [--assessment <result.json>] [--external-evidence-file <evidence.json>] --authorization <explicit-current-user|proto-ui-scheduled-merge-v1>.
8. Use only the command's exact-head merge write. It sends sha equal to the inspected head and the authorization's fixed merge method. Do not follow preflight with gh pr merge, a web click, force, admin bypass, or another unbound write.
9. Treat allowed: false as a terminal no-write result for this input. After an unknown write outcome, accept only the command's single live reconciliation; a pull request found merged during that reconciliation remains unattributed and cannot become this invocation's successful receipt. Never retry blindly.
10. Return the mutation receipt. Integration does not authorize publication, release, lifecycle promotion, access, secrets, rulesets, or any later action.

An active standing authorization makes clean exact-head integration the default once platform-contributor-independent approval, trusted CI, trusted DCO status, resolved threads, live permission, and GitHub readiness agree. The independent reviewer may be another authorized Agent, and governed spec changes use this same evidence path. A packet pauses only when it declares unresolved product direction or a privileged or irreversible operation.

Explicit handoff

Do not load or execute another skill. Return exactly one terminal handoff conforming to internal/agent-operations/schemas/skill-handoff.schema.json, carrying the registered mutation-receipt and relevant prior artifacts by reference, with nextSkillId set to null.

Communicate with the user in the user's current language. Keep repository, pull-request, SHA, review, check, and receipt references exact.

Durable owner continuation

Read internal/agent-operations/handoff.md when a trusted runner supplies durable owner delegation. Pass its --owner-authorization, --owner-key and --owner-grant options to supported commands; bind mutation authorization to the same grant ID. Covered ordinary work continues across turns without repeated human confirmation or assessment admission. Keep the actual mode/source, exact target, live permissions, evidence and independent review. Reference strings and task-authored files cannot activate delegation. Privileged and unresolved semantic decisions remain separate.