Monitor the live head
Codex Monitor tracks open pull requests, review receipts, CI evidence, and exact commit identity.
Governed delivery system
Autonomous E2E Merge Blocker Pipeline
A closed-loop operating system for pull requests: observe the exact head, request independent review, dispatch real blockers, resolve only with recorded approval, and merge only when every guard is true.
pipeline live
01Conductorroutes verified work
02Codex Monitorobserves exact PR heads
03Blocker Dispatcherturns findings into briefs
04Thread Resolvercloses approved threads only
05Merge Gaterefuses incomplete evidence
Exact headEvery decision binds to a full commit SHA.
Fail closedMissing or ambiguous evidence blocks progression.
AuditableReports and resolution records preserve the decision trail.
One pipeline, four accountable movements.
The system does not guess. Each movement either produces the evidence required for the next one or leaves an explicit blocker behind for the right owner.
Dispatch the real blocker
Conductor and the Blocker Dispatcher create targeted briefs for the pane that owns the evidence or implementation.
Resolve only with proof
Thread Resolver rechecks the current head and original opener approval before one governed resolution mutation.
Merge only when clean
Principal Merge Gate independently verifies reviews, threads, checks, contracts, and the immutable head before merging.
The pipeline is autonomous, not permissive.
A
ConductorConsumes governed work signals, validates handoffs, and dispatches briefs to the fleet.
B
Review monitor and reporterDetects changed heads, requests review where policy permits, and emits a durable receipt trail.
C
Blocker dispatcherClassifies actionable blockers and wakes the exact owner instead of creating generic queue noise.
D
Thread resolverRetries transient reads, then remains safely blocked if the source of truth cannot be read.
E
Principal Merge GatePerforms final independent verification. A healthy pipeline still refuses a noncompliant merge.
Three boundaries keep autonomy trustworthy.
The pipeline coordinates work without widening authority. It separates observation, remediation, and irreversible action so a fast signal never becomes an unsafe merge.
Observe
Monitors and reporters inspect GitHub state, retain exact-head receipts, and create durable reports. They do not merge code.
Remediate
The dispatcher sends the smallest useful brief to the owning pane. Work remains scoped to the blocker, branch, and evidence trail.
Commit irreversible actions
Only the Principal Merge Gate performs a merge after independently rechecking policy, reviews, threads, CI, and the final head.
Every result is legible at a glance.
Evidence advances
New exact-head review, an approved closure, or a passing CI result moves the relevant gate forward.
Wait without guessing
Rate limits, unavailable reviewers, and pending checks are reported as holds. The system keeps evidence intact and waits for a change.
Refuse unsafe mutation
Head drift, ambiguous approval, stale receipts, or unreadable threads prevent closure and merge until independently resolved.
What the pipeline does when the world is imperfect.
Every branch has a defined outcome. The system either produces the evidence required to move forward or leaves a clear, safe hold for the right owner.
Clean, merge-ready PR
Advances1
Monitor: records the current head and review receipts.
2
Resolver: confirms connector-opened threads are resolved or explicitly approved.
3
Gate: independently verifies CI, reviews, policy evidence, and head identity before merge.
Reviewer has a finding
Routes work1
Reporter: persists the finding with its review link and path.
2
Dispatcher: creates an owner-specific brief instead of broad queue noise.
3
Gate: refuses the PR until the repaired head has fresh governed review evidence.
GitHub read is transiently unavailable
Retries, then holds1
Resolver: performs bounded read retries under review policy.
2
Safety: an unreadable source of truth produces no resolution mutation.
3
Recovery: the next scheduled sweep retries with fresh remote state.
Approval becomes stale after a new commit
Refuses1
Resolver: compares approval evidence with the current full head SHA.
2
Drift guard: re-fetches the head immediately before a mutation.
3
Outcome: the old approval cannot close a thread on the newer commit.
Every automated decision leaves a human-readable record.
- PR observation captures repository, number, current full head, and status snapshot.
- Review receipts prove the reviewer saw the same immutable head.
- Blocker briefs preserve ownership, priority, and a focused remediation request.
- Thread-resolution JSONL records the approving comment, thread ID, and head.
- Merge verification rechecks the final truth independently from the dispatcher.