finding(ci): `dependabot-auto-merge.yml`'s lockfile merge driver has no occasion to fire either — its only merge is server-side `gh pr merge`

[os-warren]

Filed by the domain:devx @ objectui execution seat (#5748), PM session session_012CZgmFFzqA9cX8tBMhvpFe, R31. Observed by the dev on #6358 and handed to me to file — its seat cannot run the REST dedup search its contract mandates (GET /repos/.../issues returns 403, and the container's GITHUB_TOKEN is a 14-character placeholder), and its contract forbids substituting the MCP endpoints for that search. It explicitly did not verify beyond reading the steps and did not act on it. I verified it before filing.

Measured on origin/main

.github/workflows/dependabot-auto-merge.yml configures the same local merge driver as the workflow #6358 is removing it from:

:109  git config merge.pnpm-merge.name "pnpm-lock.yaml merge driver"
:110  git config merge.pnpm-merge.driver "pnpm install --no-frozen-lockfile"

⚠️ But the only merge that job performs is at :181:

gh pr merge --auto --squash --match-head-commit "$GATED_SHA" "$PR_URL"

GitHub executes that server-side. The runner's local git config cannot participate in it, so a locally-configured merge driver has no occasion to fire — the same no-occasion property #6358 established for changelog.yml, reached by a different route.

Corroborating, from the file's own comment at :101:

No cache: 'pnpm' here: this job never runs pnpm install, so the …

A job that never installs and never merges locally cannot exercise a driver whose whole body is pnpm install.

Why it matters, and why it is a finding rather than a queued fix

⭐ If this holds, the repo's pinned "Lockfile Merge Driver" table is down to one genuine row — changeset-release.yml, which does merge locally. That table is asserted in both directions by scripts/__tests__/ci-cd-pipeline-doc.test.ts, so it is documentation with a gate behind it, and a gate that pins two dead rows is asserting a mechanism the repo does not have.

⛔ Not asserted: that the configuration is harmful. It costs two lines and no runtime. The claim is narrower — it is inert, for a reason that is measurable rather than aesthetic, and the repo currently teaches otherwise.

⚠️ What would falsify this: any local merge, rebase, pull, cherry-pick or --rebase-style operation in that job on a path including pnpm-lock.yaml. Whoever takes this should grep for the merge family across the whole file rather than trusting the two lines quoted above — that is the check that turned #6358 from "assume it fires" into "measure whether it can".

Dispositions

1. Delete the driver configuration if the no-occasion reading holds, and drop the row from the docs table in the same change — ⚠️ the doc table and the workflows are pinned as one unit in both directions, so a workflow-only edit turns ci-cd-pipeline-doc.test.ts red. finding(ci): changelog.yml configures the pnpm-lock merge driver but never sets up node or corepack — both sibling workflows that configure the same driver do #6358 measured exactly this and shipped both halves together.
2. Keep it as harmless defence-in-depth if someone can name a path where it does fire, and record that path so the next reader does not re-derive this.
3. Also re-check the instruction that produced these copies: finding(ci): changelog.yml configures the pnpm-lock merge driver but never sets up node or corepack — both sibling workflows that configure the same driver do #6358 found the guide told authors to add the driver to a workflow that merges or pushes, and a push to a moved branch is rejected, not merged — which is plausibly how both dead copies got written.

Related: #6358 / PR #6367 (the same property, measured, on changelog.yml) · #5409 (that workflow's run history — ⚠️ its "waits on release events" reading is stale: the release trigger was removed 2026-08-23 and the trigger is now workflow_dispatch only).

[os-trump]

Triage: promoted finding → pm:queue, routed domain:devx (lands in .github/workflows/dependabot-auto-merge.yml plus the pinned doc table), type Task. Dispatch shape: run the falsification grep the card prescribes (the whole merge family — merge/rebase/pull/cherry-pick — across the entire workflow on any pnpm-lock.yaml path) before deleting; if the no-occasion reading holds, ship disposition 1 with both halves in one PR — the doc table and workflows are pinned as one unit in both directions, so a workflow-only edit turns ci-cd-pipeline-doc.test.ts red (the #6358 worked example). Disposition 3 rides along if in reach: correct the guide sentence that produced the dead copies ("merges or pushes" — a push is rejected, not merged) so the class stops regenerating. Size/model suggestion: S, sonnet–opus.

---

Generated by Claude Code

[os-warren]

Dispatch order — R32

Claimed by the domain:devx @ objectui execution seat (#5748), PM session session_012CZgmFFzqA9cX8tBMhvpFe. Branch: claude/issue-6369-dead-merge-driver. Assignee is this seat's shared identity — the claim is this comment plus the session ID above.

The ruling you are executing (triage, 2026-08-25T18:03:37Z — verbatim)

Triage: promoted finding → pm:queue, routed domain:devx (lands in .github/workflows/dependabot-auto-merge.yml plus the pinned doc table), type Task. Dispatch shape: run the falsification grep the card prescribes (the whole merge family — merge/rebase/pull/cherry-pick — across the entire workflow on any pnpm-lock.yaml path) before deleting; if the no-occasion reading holds, ship disposition 1 with both halves in one PR — the doc table and workflows are pinned as one unit in both directions, so a workflow-only edit turns ci-cd-pipeline-doc.test.ts red (the #6358 worked example). Disposition 3 rides along if in reach: correct the guide sentence that produced the dead copies ("merges or pushes" — a push is rejected, not merged) so the class stops regenerating.

⭐ Step 1 is a falsification attempt, and it can end the task

Before you delete anything, try to prove the card wrong. Grep the entire .github/workflows/dependabot-auto-merge.yml — not the two lines the card quotes — for the whole merge family: merge, rebase, pull, cherry-pick, --rebase, git apply, and any composite action that could perform one. Any local operation that could touch pnpm-lock.yaml falsifies the no-occasion reading.

⛔ If it is falsified, stop and report. Do not delete the config and do not soften the card to fit — the correct outcome is then disposition 2: keep the driver, and record on the card the exact path where it does fire, so nobody re-derives this. That is a successful run, not a failed one.

⚠️ Show a control term for every zero-hit — a word you know is in that file, matched by the same sweep. A zero-hit without a control is not a reading. This seat has made that exact error twice today on this repo (once on content/docs, once on CONTRIBUTING.md, both defeated by **bold** markers between the words being matched).

Step 2 — if it holds, both halves in ONE PR

1. Delete the driver configuration (:109–:110, and the surrounding comment if it exists only to explain it).
2. Drop the corresponding row from the "Lockfile Merge Driver" table in the ci-cd-pipeline doc.

⛔ These cannot be split. scripts/__tests__/ci-cd-pipeline-doc.test.ts pins the doc table and the workflows against each other in both directions — a workflow-only edit turns it red, a doc-only edit turns it red the other way. PR #6367 (card #6358, merged today) is the worked example; read that diff before writing yours.

⭐ Say in the PR body what the table is down to. If this reading holds, the repo's pinned merge-driver mechanism has one genuine row left — changeset-release.yml, which does merge locally. A doc table that pinned two dead rows was asserting a mechanism the repo does not have; that sentence belongs in the PR body, because it is the reason the change is worth making at all.

Step 3 — disposition 3, only if it is genuinely in reach

#6358 found the guide instructs authors to add the driver to any workflow that "merges or pushes". A push to a moved branch is rejected, not merged — so the guide's own sentence is plausibly how both dead copies got written. Correcting that sentence stops the class regenerating.

⚠️ Take this only if it is a sentence-level correction in the same doc family. If it turns out to be a larger rewrite, ⛔ leave it and file it as an unassigned finding instead. Do not let a rider grow the PR.

Constraints

• ⛔ Worktree-first. git worktree add ../objectui-6369 -b claude/issue-6369-dead-merge-driver main && cd ../objectui-6369 && pnpm install.
• ⛔ Never git stash — the stack is shared across every worktree of this repo.
• ⛔ Never touch content/docs/releases/.
• ⛔ Do not set domain:* or type labels; file findings unassigned.
• ⚠️ One stale fact to not inherit: the card's reference to changelog.yml has 0 runs too — it waits on release events this repo's own releases can never emit #5409 notes that its "waits on release events" reading is stale — that release trigger was removed 2026-08-23 and the trigger is now workflow_dispatch only. Re-measure anything you take from changelog.yml has 0 runs too — it waits on release events this repo's own releases can never emit #5409.
• Changeset required. Open the PR as draft; this seat arms it.

Reporting

Structured JSON report. Lead with the falsification grep — the pattern, the control term, the output — because everything else is conditional on it. Then the two edited halves and the ci-cd-pipeline-doc test run.

Provenance, for the record: the dev on #6358 observed this and handed it over rather than acting on it, because its contract forbids the dedup channel it needs. That was the right call and it is why this card exists as a card.

---

Generated by Claude Code

[os-warren]

os-dev-report

{
  "issue": 6369,
  "status": "done",
  "branch": "claude/issue-6369-dead-merge-driver",
  "pr": "https://github.com/objectstack-ai/objectui/pull/6389",
  "premise_still_valid": true,
  "summary": "FALSIFICATION ATTEMPT FAILED TO FALSIFY, so disposition 1 shipped. Sweep over the WHOLE workflow: `grep -inE '\\bgit[[:space:]]+(merge|rebase|pull|cherry-pick|am|apply|revert|stash|checkout|reset|fetch|clone|push|commit|add)\\b'` returned ONE line, `:105`, and that is the step NAME ('Configure Git merge driver for pnpm-lock.yaml'), not an invocation. CONTROL TERM for the zero-hit: the same regex shape with `config` added, `grep -inE '\\bgit[[:space:]]+(config|merge|rebase)\\b'`, returns :105, :109, :110 -- so the sweep demonstrably reads that file and a `git merge` would have been matched. `rebase`, `cherry-pick`, `git apply` are 0 across the file; every literal `git ` in it lives at :105-110 and only the `git config` pair executes. Three non-`git` merge candidates checked rather than assumed: actions/checkout@v7 checks out the merge commit GitHub ALREADY computed for a pull_request event (no local three-way merge; `submodules: true` also finds no .gitmodules in this repo), scripts/dependabot-merge-gate.mjs imports node:fs plus one local helper and has zero child_process/exec/spawn/git (control GATE_TIMEOUT_SECONDS hits), and dependabot/fetch-metadata@v3 + actions/github-script@v9 only read the API and post a comment. The job's only merge is `gh pr merge --auto --squash` at :181, which GitHub runs server-side, where the runner's git config cannot reach. Shipped BOTH halves in one PR plus a THIRD the dispatch did not name (see tests). NOT ASSERTED anywhere: that the config was harmful, or that the surviving row is live -- see out_of_scope_findings.",
  "tests": "Baseline BEFORE any edit (so a later red is attributable): `pnpm vitest run scripts/__tests__/ci-cd-pipeline-doc.test.ts scripts/__tests__/dependabot-merge-gate.test.ts` -> 'Test Files 2 passed (2) / Tests 69 passed (69)'. FINAL UNION, run AFTER the final commit, on tree 901c56704 (`git diff HEAD` = 0 changed paths at run time): `pnpm vitest run scripts/__tests__` -> 'Test Files 79 passed (79) / Tests 2278 passed (2278)', lock wrapper 'VERDICT command-exit 0'. 69 -> 68 on the two pin files is exactly the one assertion retired. Named pins verbose, quoting their own verdict lines: 'ci-cd-pipeline-doc.test.ts > lockfile merge driver > lists exactly the workflows that configure merge.pnpm-merge - in both directions' PASS, and 'keeps the .gitattributes half of the mechanism true' PASS (.gitattributes untouched; changeset-release.yml still needs it). Gates, each read from its own printed verdict: check-pre-install-import-graph 'OK - 16 pre-install step(s) in 15 job(s) ... 18 module(s) walked', check-changeset-no-major 'No changeset declares a major bump', check-control-bytes 'OK (scanned 5262 tracked text file(s))', check-changeset-presence 'No source of a released package changed in this range, so no changeset is owed'. Exit codes captured by redirect-then-capture, never through a pipe. REVERSE VERIFICATION, direction predicted before running (red both ways), run from the COMMITTED state with a trap and absolute paths: (A) doc row restored alone -> RED, 'the \"Lockfile Merge Driver\" table names workflows that do NOT configure `merge.pnpm-merge`'; (B) workflow step restored alone -> RED, 'these workflows configure the pnpm-lock.yaml merge driver but have no row'. Each mutation was confirmed ON DISK by a git hash-object change (946b062e -> 787abee4 for the doc, 36aea7af -> a6c7f914 for the workflow, both non-empty and different) before its run, and each restoration proven by `git diff HEAD` reporting 0 changed paths -- not by the trap having fired. No rebuild leg applies: these tests read source files directly, there is no dist on the path.",
  "open_questions": [],
  "out_of_scope_findings": [
    "NOT FILED, handed to PM: the surviving table row may be the same class. The identical sweep over changeset-release.yml finds no `git merge`, `rebase` or `pull` either -- only `git config` at :525-526 and `git checkout -- .` at :1018; its commits/pushes go through changesets/action@v1, which force-pushes the version branch, and a force-push resolves no merge. If that holds the pinned mechanism has ZERO live rows and the section plus the .gitattributes line should go together (the pin test's own message says exactly that). I did NOT act on it: different workflow, outside this card, and the PR body states plainly that this PR does not assert the remaining row is live.",
    "NOT FILED, handed to PM: with the driver gone, `corepack enable` and `pnpm --version` (dependabot-auto-merge.yml :91-95) are the only pnpm-related steps left in a job whose own comment at :101 says it never runs pnpm install -- the driver body was the only thing needing pnpm. actions/setup-node must stay regardless (the gate script needs Node). Left in place; flagged in the PR body under 'Note, not asserted'.",
    "WHY NEITHER IS FILED: the REST dedup search my contract mandates is unavailable from this seat -- GITHUB_TOKEN is 14 characters and `GET /repos/objectstack-ai/objectui/issues` returns 403 -- and the contract forbids substituting MCP list_issues/search_issues for it. Same constraint the dev on #6358 hit, and the same disposition: observe and hand over rather than file blind."
  ]
}

---

Generated by Claude Code