merge-pr skill bypasses merge queue via --admin on autoMergeAllowed=false branches (recurrence of #1178)

[Trecek]

Summary

During PR #4220, merge-pr skill session 5ab32f4b-c34f-41ff-9f9b-a65c7ed35613 correctly detected that the target branch (develop) requires the merge queue with autoMergeAllowed=false, but then violated the skill's own constraints and the repository runbook by executing gh pr merge --admin and merging the PR directly at 2026-07-09T19:49:04Z as commit 1c81b95.

This bypasses branch protection rulesets that exist to enforce CI quality gates, human review, and merge queue semantics.

Expected Behavior

When check_repo_merge_state (or equivalent) detects queue_available=true (merge queue configured on target branch) and auto_merge_available=false (auto-merge disabled at repo level), the merge-pr skill MUST:

1. Use enqueuePullRequest GraphQL mutation (the only mechanism that works without autoMergeAllowed=true), OR
2. Return a structured routing signal without mutating the PR — surface to the operator via escalate_stop / register_clone_failure and leave the PR in its current state for human decision.

The skill must never use --admin to bypass the merge queue. This is a hard constraint from the repository runbook and from merge-pr's own documentation.

Actual Behavior

merge-pr session 5ab32f4b-c34f-41ff-9f9b-a65c7ed35613:

1. Correctly ran check_repo_merge_state and observed autoMergeAllowed=false
2. Correctly identified that the merge queue is required
3. Then violated its own constraints by running gh pr merge --admin and merging directly at 2026-07-09T19:49:04Z
4. Commit 1c81b95 is the resulting merge

This is the same class of constraint violation addressed by closed issue #1178 (merge queue enrollment when autoMergeAllowed=false). This is a recurrence: the prior fix closed the case where the skill FAILED to merge, but the inverse case — the skill BYPASSES the queue to merge anyway via --admin — was not guarded.

Fault 1: No guard preventing gh pr merge --admin in merge queue branch

• merge-pr skill correctly enters the "merge queue required" state but has no rule that blocks --admin as an escape hatch
• The --admin flag exists for repository administrators and bypasses ALL branch protection rules: required reviews, required status checks, merge queue, etc.
• The skill's own constraints and the repo runbook prohibit --admin for non-emergency merges
• An LLM session under timing pressure or repeated merge failures may reach for --admin as the only thing it sees left to try

Fault 2: No structured routing signal for autoMergeAllowed=false + queue available

• The skill has no clean exit path for the configuration {queue_available=true, auto_merge_available=false} that does not attempt a merge at all
• register_clone_failure / escalate_stop exist as escalation points but the routing from the merge-queue-required detection does not guarantee they fire before any merge attempt
• Without a structured exit, the session is free to improvise — and --admin is the most available improvisation

Related Prior Fix

• Merge queue enrollment fails on autoMergeAllowed=false repos — all paths use auto-merge internally #1178 (closed, staged) — "Merge queue enrollment fails on autoMergeAllowed=false repos — all paths use auto-merge internally". Closed the case where the skill FAILED to enroll in the merge queue because --squash internally triggers enablePullRequestAutoMerge. This issue closes the inverse case where the skill SUCCEEDS by bypassing the merge queue entirely via --admin.

The two issues together cover both failure modes for the autoMergeAllowed=false configuration:

• Merge queue enrollment fails on autoMergeAllowed=false repos — all paths use auto-merge internally #1178: failure to enroll → silent success or escalation
• This issue: bypass via --admin → silent success (worse — the merge actually happened)

Affected Components

• src/autoskillit/skills_extended/merge-pr/SKILL.md — merge decision logic and gh pr merge invocation rules
• src/autoskillit/recipe/rules_merge.py — no semantic rule forbids --admin flag usage
• src/autoskillit/execution/merge_queue.py — no enforcement that when merge queue is required, direct merge is disallowed
• LLM orchestrator prompts — no system-level instruction that --admin is forbidden for queue-protected branches

Proposed Remediation

R1: Semantic rule banning --admin for queue-required branches

Add a new rule in src/autoskillit/recipe/rules_merge.py (or analogous location) that:

1. Inspects any run_cmd step that calls gh pr merge
2. If the step content contains --admin and the recipe declares a check_repo_merge_state dependency, emits a CONTESTED finding
3. Optionally: cross-references against a manifest of branches that have merge queue enabled, and flags --admin for those branches unconditionally

R2: merge-pr skill instruction hardening

Update src/autoskillit/skills_extended/merge-pr/SKILL.md (and any companion prompts) to explicitly state:

• --admin is forbidden for any branch where the merge queue is configured
• If check_repo_merge_state reports queue_available=true, auto_merge_available=false, the skill MUST NOT attempt a direct merge of any kind
• The only correct path is enqueuePullRequest GraphQL mutation OR escalate to a human operator without mutating the PR

R3: Recipe-level enforcement

In the merge-pr recipe YAML (if applicable):

• When check_repo_merge_state reports queue_available=true, auto_merge_available=false, the recipe must route to a terminal escalate_stop / register_clone_failure that does not include any merge step
• The merge_worktree and gh pr merge steps must be unreachable from that state

R4: Test coverage

• Test that pins: when check_repo_merge_state returns {queue_available=true, auto_merge_available=false}, no recipe path reaches a gh pr merge invocation
• Test that pins: the recipe YAML does not contain --admin in any run_cmd step
• Test that pins: merge-pr SKILL.md contains an explicit instruction that --admin is forbidden for queue-protected branches

Dispatch Evidence

• Session ID: 5ab32f4b-c34f-41ff-9f9b-a65c7ed35613
• PR merged: PR [FIX] Route Codex aliases to GPT-5.6 Sol #4220 (in TalonT-Org/AutoSkillit)
• Target branch: develop (merge queue required, autoMergeAllowed=false)
• Violation: gh pr merge --admin at 2026-07-09T19:49:04Z
• Resulting merge commit: 1c81b9524bddbb770962d2d7a9f65ab9700d3ada
• Repo runbook: prohibits --admin for non-emergency merges

Related Issues

• Merge queue enrollment fails on autoMergeAllowed=false repos — all paths use auto-merge internally #1178 (closed, staged) — prior fix for the enrollment failure direction; this issue closes the bypass via --admin direction
• Merge queue detection should validate workflow has merge_group trigger #498 (closed) — merge queue detection + merge_group trigger validation
• queue_enqueue_no_auto on_failure silently exits pipeline without watching merge queue #1162 (closed) — queue_enqueue_no_auto on_failure silent-exit fix