merge-orchestrator

Merge Orchestrator Skill

Local Git, Not Remote VCS

This skill performs local git merge of a source (subagent) worktree branch into a target (integration) branch, recording a rollback SHA so a git reset --hard can undo the merge on any failure. It does not call the VCS provider (GitHub / GitLab / Azure DevOps) and does not require a PR id. For remote PR merging, see the companion skill that wraps the merge_pr action.

The mental model and the rationale for why these are two separate concerns are documented in references/local-git-semantics.md.

Overview

This skill activates whenever an operator (or an automated next_actions dispatcher) invokes the merge_orchestrate action against Exarchos MCP. After the source branch has been prepared in a worktree, this skill:

1. Performs a worktree-availability preflight (target branch must not be checked out in a sibling worktree).
2. Composes additional preflight guards (ancestry, current-branch protection, main-worktree assertion, working-tree drift).
3. Records pre-merge HEAD of the target branch as a rollback anchor.
4. Performs a local git merge of the source branch into the target branch.
5. On any failure, runs git reset --hard <rollbackSha> and surfaces a categorized failure reason.
6. Emits dedicated event types so the merge timeline is reconstructable from the event log alone.

Resumable: terminal phases (completed / rolled-back / aborted) short-circuit on re-entry without re-emitting events. Idempotent: re-dispatch with the same taskId collapses via the next_actions idempotency key.

Triggers

Activate this skill when:

• The operator runs exarchos merge-orchestrate ... (CLI).
• mcp__exarchos__exarchos_orchestrate({ action: "merge_orchestrate", ... }) is invoked directly.
• An automated next_actions envelope surfaces a merge_orchestrate verb with idempotency key <streamId>:merge_orchestrate:<taskId>.

Do not activate this skill:

• To merge a remote PR — that is merge_pr. The two are disjoint actions; see Disambiguation below.
• When the orchestrator's recorded mergeOrchestrator.phase is already terminal — the resume short-circuit runs but no fresh dispatch is needed.

Process

Schema: discover the action's argument schema with mcp__exarchos__exarchos_orchestrate({ action: "describe", actions: ["merge_orchestrate"] }). Strategy is required (no schema-level default) — pick squash / merge / rebase deliberately.

Step 1: Pick the merge strategy

Strategy	Local git operation	When to choose
merge	git merge --no-ff --no-edit <source> — explicit merge commit	Preserves the subagent's commit history with a visible merge boundary.
squash	git merge --squash <source> then git commit — single squash commit on target	Subagent commit history is noise; one logical change should land as one commit.
rebase	rebases an ephemeral copy of source onto target then ff-merges target — linear history	No merge commit; integration branch stays linear. The original source ref is preserved (the rebase runs on a temporary branch that is deleted afterward), so an executor rollback only needs to reset target.

Strategy is required at the schema layer (#1127 collision check, #1109 §2 user-visible parity). There is no implicit default — operator intent is always explicit in the event log.

Step 2: Invoke

Via MCP (illustrative — the canonical arg names come from describe):

mcp__exarchos__exarchos_orchestrate({
  action: "merge_orchestrate",
  // workflow-correlation identifier — name per the action's schema
  sourceBranch: "<subagent-branch>",
  targetBranch: "<integration-branch>",
  taskId: "<task-id>",          // present when auto-dispatched from next_actions
  strategy: "squash",            // required
  dryRun: false,                 // optional — preflight only, no executor invocation
  resume: false,                 // optional — short-circuit on terminal phases
})

Via CLI:

exarchos merge-orchestrate \
  --source-branch <subagent-branch> \
  --target-branch <integration-branch> \
  --task-id <task-id> \
  --strategy squash
  # plus the workflow-correlation id flag — see `--help`
  # add --dry-run for preflight-only, --resume for terminal-phase short-circuit

CLI exit codes: 0 = success, 1 = invalid input, 2 = merge failed (preflight blocked or rollback executed), 3 = uncaught exception.

Step 3: Interpret the result

The handler returns a ToolResult whose data.phase discriminates the outcome:

phase	Meaning	Operator action
completed	Local merge landed; mergeSha is the new HEAD of target.	None — workflow continues per the orchestrator's playbook.
aborted	Preflight failed; no merge attempted. data.preflight carries the structured guard sub-results (when produced by the body preflight) OR data.reason discriminates the early-abort cause.	See the abort-reason table below. Resolve the underlying condition and re-dispatch.
rolled-back	Merge was attempted, failed (reason: 'merge-failed' / 'verification-failed' / 'timeout'), and git reset --hard <rollbackSha> ran. The target branch is restored.	Inspect data.reason. If data.rollbackError is also present, the reset itself failed — the working tree is stranded and requires operator intervention.

Abort-reason payload shapes

When phase === 'aborted', the data payload discriminates the cause:

data.reason	Payload fields	Cause	Operator remediation
target-checked-out-elsewhere	siblingWorktreePath: string (absolute path)	Target branch is already checked out in a sibling worktree of the same repository. Detected by the worktree-availability preflight (issue #1356) before any event emission, executor invocation, or state persistence.	Resolve the sibling worktree: either remove it (git worktree remove <path>), switch its checkout to another branch, or invoke merge_orchestrate against a different target. Then re-dispatch.
(body preflight failures)	data.preflight: { ancestry, worktree, currentBranchProtection, drift }	Body-preflight guard failed (ancestry mismatch, worktree drift, protected current branch, etc.).	Inspect preflight.* sub-results to identify which guard failed. Resolve the underlying condition (e.g., commit/stash drift, switch off a protected branch) and re-dispatch.

The target-checked-out-elsewhere abort path is special: it suppresses both the merge.requested and merge.preflight events and skips state persistence entirely. This guarantees the event log is never contaminated with an attempt that could not have captured a correct rollback SHA (the executor would have read HEAD from the wrong worktree).

For the full recovery flow per outcome, see references/recovery-runbook.md.

Step 4: Confirm event emissions

Four events are emitted directly to the orchestrator's event stream (stream id is the value passed as streamId) — not wrapped in gate.executed:

Event type	When	Carries
merge.preflight	Always (after preflight runs, before any merge attempt) — except for the early-abort target-checked-out-elsewhere path, which emits nothing	Full structured guard sub-results + failureReasons if passed: false
merge.requested	After preflight passes, before the executor runs (Phase A intent record from the two-event split) — suppressed on the early-abort target-checked-out-elsewhere path	sourceBranch, targetBranch, strategy, taskId
merge.executed	On successful local merge	mergeSha, rollbackSha, taskId, source/target branches
merge.rollback	On post-merge failure followed by reset	rollbackSha, reason, taskId, source/target branches

These events are auto-emitted by the handler — do not manually append them via mcp__exarchos__exarchos_event during normal operation. Manual emission is only sanctioned during the documented manual-recovery flow in recovery-runbook.md when a merge has been completed out-of-band (e.g., conflict resolution) and the event log must be brought back in sync — follow that runbook's event-first sequencing.

Discover the event payload schemas via mcp__exarchos__exarchos_event({ action: "describe", eventTypes: ["merge.preflight", "merge.requested", "merge.executed", "merge.rollback"] }).

Disambiguation: merge_orchestrate vs merge_pr

Two related actions, two distinct concerns:

Aspect	merge_orchestrate (this skill)	merge_pr (companion skill)
Layer	Local SDLC handoff	Remote PR primitive
What it merges	A subagent worktree branch into a target branch	A user-facing PR via the VCS provider API
Identifier required	sourceBranch + targetBranch	prId
Underlying operation	git merge (local)	provider.mergePr() (remote API)
Rollback	git reset --hard <rollbackSha> (real, undoes the merge)	None — the VCS provider owns merge state
Events	merge.preflight / merge.requested / merge.executed / merge.rollback	pr.merged

If you reach for merge_orchestrate thinking "I want to merge a PR," you want merge_pr instead.

Resume Semantics

When invoked with resume: true, the handler reads existing mergeOrchestrator state. Terminal phases (completed / rolled-back / aborted, members of EXCLUDED_MERGE_PHASES) short-circuit and return the recorded result with no new events and no executor call. Non-terminal phases (pending / executing) fall through to a fresh preflight + executor run, which is safe because the underlying git operations are idempotent on already-merged branches.

When invoked without resume, prior state is deliberately ignored — fresh-dispatch semantics.

Note: the target-checked-out-elsewhere early-abort path runs before the resume state read, so it short-circuits regardless of resume and never persists state.

Dry-Run

dryRun: true runs the body preflight, emits merge.preflight, and short-circuits before the executor runs and before any state persistence. Returns { dryRun: true, preflight, phase: 'pending' | 'aborted' }. Useful for CI integrations that check merge readiness before the merge window opens. Dry-run still observes the worktree-availability early abort — a sibling-worktree conflict aborts with reason: 'target-checked-out-elsewhere' even under dryRun.

Anti-Patterns

Don't	Do Instead
Use this skill to merge a remote PR	Use the merge_pr skill
Manually emit merge.preflight / merge.requested / merge.executed / merge.rollback in normal flow	Let the handler auto-emit; manual emission causes duplicates (one exception: documented manual-recovery flow in recovery-runbook.md)
Wrap merge events under gate.executed	Direct stream append with the dedicated event type — these are state transitions, not gate executions
Re-dispatch after a rolled-back outcome without inspecting the reason	Read data.reason and data.rollbackError; address the root cause first
Re-dispatch after reason: 'target-checked-out-elsewhere' without first freeing the sibling worktree	Remove or re-checkout the sibling worktree referenced by data.siblingWorktreePath, then re-dispatch
Omit --strategy / strategy: field expecting a default	Strategy is required; supply squash / merge / rebase explicitly
Invoke from a subagent worktree	Preflight refuses (main-worktree assertion); invoke from the main worktree

Diagnostics

Set EXARCHOS_PREFLIGHT_DEBUG=1 in the environment before invoking merge_orchestrate to attach a structured debug payload to merge.preflight events. The payload is gated on two conditions, both of which must hold:

1. EXARCHOS_PREFLIGHT_DEBUG=1 is present in the orchestrator process environment.
2. The preflight's ancestry guard failed (i.e., ancestry.passed === false).

Passing preflights do not carry the debug payload even when the env var is set — the failure-only gating is deliberate (event-store growth concern). A future EXARCHOS_PREFLIGHT_DEBUG=2 channel may add verbose / passing-preflight diagnostics; that is out of scope for phase 1.

The debug block carries nine fields:

Field	Source	Purpose
gitVersion	git --version	Differentiate behaviors across git releases.
repoRoot	git rev-parse --show-toplevel	Distinguish symlinked or normalized vs raw repo paths.
worktreeList	git worktree list --porcelain	Surface sibling worktree topology that could affect ref resolution.
refsHeadsSource	git for-each-ref refs/heads/<source>	SHA + packed-state of the source branch ref.
refsHeadsTarget	git for-each-ref refs/heads/<target>	SHA + packed-state of the target branch ref.
mergeBaseCommand	constructed	Exact argv re-run by the helper, including 'git' prefix — copy-pasteable for the operator.
mergeBaseExitCode	rerun of git merge-base --is-ancestor <target> <source>	The exit code that drove the ancestry failure.
mergeBaseStdout	same invocation	Captured stdout.
mergeBaseStderr	same invocation	Captured stderr (collapsed into stdout under the default git adapter).

Fail-closed: any individual git invocation that fails inside the debug helper degrades to an empty string / default value for that field rather than throwing. The debug attachment must never mask the underlying preflight failure the operator is trying to investigate.

Reporting workflow. When you capture a debug-bearing event, attach the full data.debug block to a new GitHub issue tagged with relevant scope labels (e.g., windows, merge-orchestrator, preflight). Phase-2 root-cause analysis depends on at least one real-host event with this payload.

Schema Discovery

For the argument schema, call mcp__exarchos__exarchos_orchestrate({ action: "describe", actions: ["merge_orchestrate"] }). Event payload shapes come from mcp__exarchos__exarchos_event({ action: "describe", eventTypes: ["merge.preflight", "merge.requested", "merge.executed", "merge.rollback"] }).

mergeOrchestrator.* fields on workflow state are written by this skill and mergeOrchestrator.phase is read by gates; the underlying phase workflow field is immutable and must be changed via transition, not update. See the Reserved fields section in the workflow-state skill for the full immutable-key list and the typed RESERVED_FIELD error envelope.

Completion Criteria

• Preflight result passed: true (or operator has decided to proceed despite a documented preflight gap)
• mergeOrchestrator.phase === 'completed' in orchestrator state
• merge.executed event present in the stream with the recorded mergeSha and rollbackSha
• Target branch's HEAD matches the recorded mergeSha

If any criterion fails, consult references/recovery-runbook.md before re-dispatching.