0063 — Five repos merge through GitHub's merge queue, on one shared sharded CI

• Status: Accepted 2026-10-17 (Gera approved the rollout to all four repos; agent-smith flipped 2026-10-16).
• Date: 2026-10-17
• Deciders: Gera (the rollout). The hosting choice, the tag rule and the lander changes are the rollout lane's, recorded here per ADR-0004.

Context

agent-smith moved to a "slim" merge-queue setup on 2026-10-16: a reusable workflow that lints once, splits the tests over N shards by file, and reports ONE aggregate check, ci / result; branch protection requires that check; a ruleset ("main merge queue") squashes up to 5 PRs per group with no bypass. Four more repos had the problems it fixes: factory (main broke 12x since 10-03, no protection), local-bin (3x, no protection, ~10 min suite), agentflow-relay (strict up-to-date rule forcing a rebase per PR), appfolio-browser-agent (~15 min single job that ran the suite twice).

Decision

1. One template, hosted in agent-smith. agent-smith/.github/workflows/sharded-ci.yml is called by factory, agentflow-relay, local-bin and appfolio-browser-agent (agent-smith's Actions access is organization). Not a new shared-workflows repo: agent-smith's own tests read the workflow from disk to prove every pytest the CI lane runs is bounded, so a copy elsewhere would be a second source of truth.
2. Callers pin a tag, and a tag is never moved. sharded-ci-v1 → agent-smith e0deb28. Any change, additive or not, is the next tag; callers move one at a time. agent-smith runs its local copy, which exercises only python-uv, so a change to node/pnpm/none is proven by a caller run pinned to the branch sha before the tag is cut.
3. Every repo requires ci / result, strict off (the queue re-tests on top of main instead). agentflow-relay also keeps review; its review is a commit status posted on pull_request only, so .github/workflows/review-merge-group.yml carries it onto the queue commit as success. That green is safe only while review stays required for queue entry.
4. In-repo landers queue, they do not merge. factory's and local-bin's land-on-green call gh pr merge --match-head-commit <sha> with no strategy flag (local-bin's REST PUT .../merge is refused on a queue branch). Their holds are unchanged.

Consequences

• Direct pushes to these repos' main are refused, local-bin included. A census found no tool that pushes to local-bin main; its live checkout only fast-forwards.
• A strategy flag is a warning, not a refusal, on the CLI path: measured on agentflow-relay#399 with gh 2.92 and pr-merge (always --squash, no --auto): "! The merge strategy for main is set by the merge queue", queued, exit 0. So pr-merge needs no change. Only that path was measured.
• Queue merges fire push workflows (pushed by github-merge-queue[bot], even when GITHUB_TOKEN enqueued), so deploy-on-main keeps working; merge_group runs never deploy. Before this, factory and local-bin merges made by GITHUB_TOKEN fired no push run at all.
• A push to a queued PR drops it from the queue, and every PR opened before a flip needs one push to get ci / result (60 were told, 2026-10-17).
• Vercel builds each gh-readonly-queue/... branch of appfolio-browser-agent as a Preview before the Production build on main: cost, not a defect.

Amendment 2026-11-04: tenio joins, on its own CI

• Status: Accepted 2026-11-04 (Gera: "all repos now have a shared thing: a GitHub reviewer, the merge queue and all that... make sure our repo here has that too").
• PropFlow-Technologies/tenio gets the same "main merge queue" ruleset (squash, groups of up to 5, ALLGREEN, 60 min timeout, no bypass) and classic protection with strict off and admins enforced. It keeps its OWN ci.yml (Node + pnpm, three vitest shards) rather than calling sharded-ci-v1, so its required checks are CI result (the aggregate job's name, not ci / result) and review, both from the Actions app.
• Its review is a commit status like agentflow-relay's (tenio review.yml, mirrored from factory), so decision 3's carry-over applies: tenio review-merge-group.yml posts review=success on the queue commit, safe only while review stays required.
• Unlike decision 4's repos, tenio has no in-repo lander. A 🟢 PR is enqueued by pr-autoqueue (its repos.txt line), so tenio's reviewer writes the glyph header that loop reads (## 🟢 LGTM), and labels the risk per ADR-0078: risk:low|med|high, with HIGH (or no readable risk) adding hold-for-review and one note naming both founders.