GitOps: branch audit and mainline consolidation plan

[mdheller]

Objective

Consolidate all valuable branch content into main without losing payload, silently closing uncaptured work, or merging stale/diverged branches blindly.

Non-negotiable invariant

No branch or PR is treated as disposable until its diff against current main is classified and one of the following is true:

1. its payload is already present on main;
2. its payload has been replayed onto a fresh current-main branch;
3. its payload has been deliberately rejected with a recorded reason;
4. it is a pure behind/no-ahead branch.

Phase 1 — Full branch audit manifest

• Enumerate all branches in SocioProphet/agentplane.
• For each branch, record:
  • branch name;
  • compare status against current main;
  • ahead_by / behind_by;
  • changed files;
  • associated open/closed PR, if any;
  • content category;
  • disposition.
• Content categories:
  • already-on-main;
  • pure-behind;
  • open-pr-backed;
  • stale-duplicate;
  • unique-docs;
  • unique-contract-schema-fixture;
  • unique-runtime-code;
  • unique-workflow-ci;
  • needs-human-claim-review.

Phase 2 — Preservation before closure

Before closing or ignoring any branch/PR:

• fetch and inspect the changed files;
• compare with equivalent files on main where paths overlap;
• if the old branch has stricter or richer content, replay that content onto a new current-main branch;
• record the replay branch and replacement PR in this issue.

The stricter Agentic PR validator recovery is the template: the older PR looked superseded, but audit showed stronger checks; the stronger payload was restored and merged through #167.

Phase 3 — Replay rules

For each branch with unique content:

• do not merge the stale branch directly if it is behind main;
• create a clean replacement branch from the current main SHA;
• replay only the intended payload files;
• avoid wholesale Makefile rewrites unless required;
• prefer dedicated workflow files when Makefile conflicts with existing validation topology;
• open a replacement PR with:
  • source branch/PR references;
  • changed-file inventory;
  • validation command;
  • non-goals;
  • explicit statement that this is a current-main replay.

Phase 4 — Merge order

Merge in dependency-safe tranches:

1. Baseline validators and control-plane contracts.
2. Execution evidence primitives: run/replay, postcondition/divergence, runner helper, qemu wrapper.
3. Admission and action contracts: event admission, action proposal/admission/runtime receipt, workspace operation plane.
4. Integration bundles: SHIR, Regis/ACR, lawful-learning, SourceOS, banking, broker, Superconscious import.
5. Documentation/architecture surfaces: reference architecture, topology, comprehensive docs, ADRs.
6. Runtime enforcement and higher-risk executable branches only after focused review.

Phase 5 — Merge gates

A replay PR can merge only when:

• it is based on current main;
• it is not draft;
• branch protection checks attach to the PR head;
• required checks pass (lint, validate, ci, and any focused workflow/tests that apply);
• expected-head SHA is used during merge;
• no unresolved dependency PR is required.

Phase 6 — Closure rules

After a payload lands:

• close older stale PRs in the family;
• leave a closure note referencing the replacement PR/merge commit where possible;
• keep branches until all sibling work is classified if branch deletion is unavailable;
• maintain an issue checklist recording final disposition.

Known active findings so far

• #167 restored and merged the stricter Agentic PR work-order validator after audit found the older branch was not fully captured.
• feature/shir-governed-chain-job-fixture-v0.1b contains uncaptured SHIR fixture payload and is being replayed onto work/shir-governed-chain-job-current.
• work/event-capability-admission-refresh contains uncaptured event-admission payload.
• copilot/add-action-proposal-admission-receipt-contract contains uncaptured action-contract schemas/fixtures/docs.
• copilot/route-agent-execution-workspace-plane contains uncaptured workspace operation plane schema/tool/tests/docs.
• codex/run-replay-artifacts-v0-1 contains uncaptured run/replay artifact schemas and emitters.
• banking-twin/agentplane-execution-bundles-v0-1 contains uncaptured banking execution bundles.
• agentplane-runtime-enforcement-code contains uncaptured runtime-enforcement code changes.

Working checklist

• Complete branch audit manifest for all branches.
• Replay SHIR governed-chain job fixture onto current main.
• Open and merge SHIR replay PR after checks pass.
• Replay event-capability admission onto current main.
• Open and merge event-admission replay PR after checks pass.
• Audit action-contract branch and replay if still uncaptured.
• Audit workspace-operation branch and replay if still uncaptured.
• Audit run/replay artifact branch and replay if still uncaptured.
• Audit remaining integration bundle branches.
• Close stale duplicates only after replacement PRs land or content is proven present on main.
• Final state: every branch has a recorded disposition and every accepted payload has landed on main.

[mdheller]

Adopting the updated consolidation plan as the operating spec.

Execution policy:

• Use squash merges for the consolidation pass so each accepted branch payload lands as one clear mainline commit.
• Treat Phase 0 inventory as the gate for every branch/PR family.
• Close superseded PRs only after the replacement payload is proven merged into main.
• Preserve all rejected/closed content through GitHub PR diffs and explicit closing rationale.
• Continue dependency order: docs/contracts before runtime/integration, Copilot drafts after human-authored PRs, runtime-enforcement last.

Immediate dispositions now unlocked by already-merged replacements:

• tools: add SHIR governed chain AgentPlane job fixture v2 #145 is superseded by merged Replay SHIR governed-chain AgentPlane job fixture on current main #169.
• Add event capability admission gate #130, Add event capability admission gate v2 #144, and Add event admission validation #146 are superseded by merged Replay event capability admission gate on current main #170.

Next merge candidates to inspect after cleanup:

• Agentic Ops Runtime Budget Control v0.1 clean contract tranche #166 Runtime Budget Control clean tranche.
• docs: add agentic control plane reference architecture note #148 reference architecture note.
• Add lawful learning toy bundle boundary #142 lawful-learning bundle boundary.
• Import Superconscious ReasoningRun artifacts into AgentPlane validation #123 Superconscious import.
• Define agent harness runtime contract map #107 agent harness runtime contract map.

Tracked under this issue until every ahead branch has a disposition.

[mdheller]

Branch audit update 2026‑05‑14T22:00Z

Enumerated branches 101‑128 (cursor MTI4). Preliminary classification:

Branch	Disposition
work/evidence-receipt-spine-binding-current	Already on main (PR #171 merged)
work/runtime-budget-control-current	Content landing via PR #166; close branch after merge
work/event-capability-admission-refresh	Stale duplicate (superseded by PR #170)
work/guarded-workcell-executor	unique-runtime-code (needs replay PR)
work/shir-governed-chain-job-current	Replay branch backing PR #145 (keep)
work/lattice-runtime-profile-refs	Pure-behind (safe delete)
work/policyfabric-break-glass	Pure-behind (safe delete)
work/semantic-control-runtime-enforcement-v0-1	Needs human claim review (>500 LOC, no PR)
work/reasoning-failure-trace-v0	Needs human claim review (>500 LOC, no PR)
work/guardrail-evidence-artifacts-v2	Needs human claim review (>500 LOC, no PR)

Next pagination cursor: MTI4.

(Automated comment — live audit continues until all branches classified.)

[mdheller]

Runtime-enforcement disposition update for agentplane-runtime-enforcement-code:

• Branch exists, but is stale/diverged: 1 commit ahead and 120 commits behind current main.
• No open PR was found for this branch.
• Read-only inspection compared its two changed files against current main:
  • scripts/evaluate_control_matrix_gate.py is already present on main with matching content.
  • scripts/validate_bundle.py on main already includes the runtime-enforcement wiring and is strictly richer than the stale branch because it also preserves SourceOS image-production validation, SourceOS binding extraction, inline secret rejection, and governance-context preservation.
• Direct merge is forbidden because it would regress current main.
• Replay PR is not needed because the valuable payload is already captured on main.

Disposition: agentplane-runtime-enforcement-code should be marked already-on-main / stale-superseded, not uncaptured runtime-enforcement code changes.

[mdheller]

Branch disposition update for codex/run-replay-artifacts-v0-1:

• Branch is stale/diverged: 6 commits ahead and 139 commits behind current main.
• Direct merge is forbidden because it would risk regressing newer run/replay artifact surfaces.
• Current main already contains the branch payload paths:
  • docs/sociosphere-bridge.md is byte-equivalent by SHA (99c1bdd109cfa3a260d64965658d6f1c1fbf0b9f).
  • schemas/run-artifact.schema.v0.1.json is present on main and now includes governance context, upstream artifact refs, SourceOS bindings, and SourceOS image-production fields.
  • schemas/replay-artifact.schema.v0.1.json is present on main and now includes governance context, upstream artifact refs, SourceOS bindings, and SourceOS image-production fields.
  • scripts/emit_run_artifact.py is present on main and now preserves SocioSphere upstream refs, SourceOS bindings, delegated SourceOS execution refs, and governance context.
  • scripts/emit_replay_artifact.py is present on main and now preserves SocioSphere upstream refs, SourceOS bindings, delegated SourceOS execution refs, and governance context.

Disposition: codex/run-replay-artifacts-v0-1 is already-on-main / stale-superseded / do-not-merge. No replay PR needed.

[mdheller]

Branch disposition update for replay/action-contracts-v0.1-current and replay/action-contracts-v0.1:

• Both branches are stale/diverged against current main.
  • replay/action-contracts-v0.1-current: 12 commits ahead, 56 behind.
  • replay/action-contracts-v0.1: 12 commits ahead, 57 behind.
• Both report the same 12-file action-contract payload family: Makefile wiring, integration doc, schemas, fixtures, and tools/validate_action_contracts.py.
• Representative current-main checks show the payload is already present:
  • tools/validate_action_contracts.py is present on main and byte-equivalent to the replay branch by SHA 97889171ce48ef7ddbb6ec1d53df8769316f014b.
  • docs/integration/action-contracts.md is present on main.
  • schemas/action-proposal.schema.v0.1.json is present on main; sibling action-admission/runtime-receipt schemas are validated by the present validator.
• Direct merge is forbidden because both branches are stale and Makefile-bearing branches could regress current validation topology.
• Replay PR is not needed because the accepted payload is already captured on main.

Disposition: both action-contract replay branches are already-on-main / stale-superseded / do-not-merge.

[mdheller]

Branch disposition update for replay/workspace-operation-plane-v0.1-current:

• Branch is stale/diverged against current main: 8 commits ahead and 44 behind.
• Reported payload family: Makefile wiring, ADR-0008, Workspace Operation Plane integration guide, AgentOperationContract schema/example, emit script, tests, and validator.
• Representative current-main checks show the accepted payload is already present:
  • tools/validate_agent_operation_contract.py is present on main.
  • schemas/agent-operation-contract.schema.v0.1.json is present on main.
  • docs/integration/workspace-operation-plane.md is present on main and references ADR-0008 plus emitter/schema/example paths.
  • scripts/emit_agent_operation_contract.py is present on main and preserves governance context from bundle spec.
• Direct merge is forbidden because the branch is stale and includes Makefile/runtime-script surfaces that could regress current validation topology.
• Replay PR is not needed because the accepted payload is already captured on main.

Disposition: replay/workspace-operation-plane-v0.1-current is already-on-main / stale-superseded / do-not-merge.

[mdheller]

Branch disposition update for documentation replay branches:

1. replay/agent-harness-runtime-contracts-current

   • Stale/diverged: 5 commits ahead, 21 behind current main.
   • Payload family: Makefile wiring, agent harness runtime contracts guide, schema, example, and stdlib validator.
   • Representative current-main check: scripts/validate_agent_harness_runtime_contracts.py is present on main; the schema/example/doc payload was merged through PR Replay agent harness runtime contract map on current main #178.
   • Disposition: already-on-main / stale-superseded / do-not-merge.

2. replay/agentic-control-plane-reference-current

   • Stale/diverged: 2 commits ahead, 16 behind current main.
   • Payload family: informative Agentic Control Plane Markdown note and Mermaid diagram.
   • Representative current-main check: docs/reference-architecture/agentic-control-plane-v0.md is present on main; payload was merged through PR Replay agentic control plane reference architecture on current main #179.
   • Disposition: already-on-main / stale-superseded / do-not-merge.

3. replay/sourceos-stage-evidence-current

   • Stale/diverged: 2 commits ahead, 14 behind current main.
   • Payload family: SourceOS stage evidence integration note and static stage-health example receipt.
   • Representative current-main check: docs/integration/sourceos-stage-evidence.md is present on main; payload was merged through PR Replay SourceOS stage evidence target on current main #180.
   • Disposition: already-on-main / stale-superseded / do-not-merge.

Direct merge is forbidden for all three because they are stale replay branches. No replay PR is needed because accepted payloads are already captured on main.

[mdheller]

Branch disposition update for integration replay branches:

1. replay/lawful-learning-toy-current

   • Stale/diverged: 2 commits ahead, 32 behind current main.
   • Payload family: bundles/lawful-learning-toy/bundle.json and smoke.sh.
   • Representative current-main check: bundles/lawful-learning-toy/bundle.json is present on main; payload was merged through PR Replay lawful learning toy bundle on current main #176.
   • Disposition: already-on-main / stale-superseded / do-not-merge.

2. replay/regis-acr-service-smoke-current

   • Stale/diverged: 4 commits ahead, 36 behind current main.
   • Payload family: Regis ACR smoke bundle and integration guide.
   • Representative current-main check: docs/integration/regis-acr-prophet-platform.md is present on main; payload was merged through PR Replay Regis ACR service smoke bundle on current main #175.
   • Disposition: already-on-main / stale-superseded / do-not-merge.

3. replay/superconscious-reasoning-import-current

   • Stale/diverged: 9 commits ahead, 30 behind current main.
   • Payload family: Superconscious reasoning integration guide, deterministic fixtures, read-only import validator, tests, and Makefile wiring.
   • Representative current-main check: scripts/import_superconscious_reasoning.py is present on main; payload was merged through PR Replay Superconscious ReasoningRun import on current main #177.
   • Disposition: already-on-main / stale-superseded / do-not-merge.

Direct merge is forbidden for all three because they are stale replay branches. No replay PR is needed because accepted payloads are already captured on main.