Adopt `auto-merge.yml` across the ci-green union — the arming roll's claim anchor

[bdelanghe]

The claim anchor for the PRs reroll-auto-merge.sh opens. Each rolled PR carries Claim-issue: bounded-systems/.github#<this> and pr-claim / pr-claim is required org-wide, so this issue must be open and claimed while any rolled PR is unmerged.

Why here and not on the private issue. pr-claim reads the named issue with the PR repo's own token, so a PR in a public repo can never satisfy it by naming a private repo's issue (.github#358; docs/claim-trailers.md). Private targets read a public issue fine — the rule is not symmetric — so one public anchor serves the whole set.

What the rolled file is. A thin caller of _auto-merge.yml: on every non-draft PR in a repo whose default branch requires a CI context, it arms auto-merge under the broker-minted pr-arm identity. The repo's required checks remain the only gate.

---

Wave 2 — reopened 2026-09-10 (.github-private#913)

Two things changed since the first wave closed, and both make every existing caller stale:

1. The callee moved. .github_auto-merge: gated means a CI context is required — the claim alone is not a gate #399: _auto-merge.yml now decides "gated" from the required contexts, dropping pr-claim / pr-claim. Counting rules made the count non-zero everywhere (required-baseline requires the claim on every default branch), so the lane armed wherever its caller was rolled and a claimed PR in a claim-only repo merged with its CI red. The door pr-arm is re-pinned to that commit (infra#650/#651, deployed run 34425339530), so a caller on the old SHA is now refused at mint.
2. The denominator widened, 37 → 51. .github-private#932: the roll targets the union of every org/rulesets/ci-green*.json include list, so repos gated by their own ruleset (.github, keycard, front-desk-scheduler, claude-box, .github-private, infra) stop being gated-but-unarmed — the conformance snapshot's arming-lane-absent finding.

Dry run 34425260470: 51 of 51 would open a ready PR, accounting reconciled.

Close when the rolled PRs have merged (or been deliberately declined, named here).

Wave 1 (2026-09-08, closed and superseded)

The 37 ci-green-standard repos: anchored-chain, anchored-chain-sqlite, audit-context, auth, bd, bounded.tools, cas, cf-oidc-token-broker, deploy, descriptor-kit, desk, disposition, door-net, door-peercred, env, fs, gh, git, git-ast, github-budget, hooksmith, host, installer, lone, machine-schema, mint, policy, proc, repo-root, schema-gen, scout, seam-check, site-mcp, slack, surface-sync, verbspec, verbspec-mcp.

[bounded-systems-front-desk]

🎫 Claimed by claude/repo-health-dashboard-6n35lv — dispatched by bdelanghe — run

Authorization: human-authorized · assurance aal2
Authorized by bdelanghe with credential Si98d1nbmy2LL3nSc1--ROWWL8E (relying party keeper.bounded.tools).
Claim-request digest (the passkey's challenge, recomputed by this door): 852f893bc2aba5c9fcdadcd34f4798cf01607a39c8fb7d273c1f816c8bf7234b · base64url hS-JO8Krpcn82tzTT0eYzwFgejnI-30nPB-BbIv3I0s

Release by removing the claimed label (and unassigning) if work stops without a merged PR.

[bdelanghe]

All 37 rolled PRs are on main. Evidence, measured rather than inferred from the lanes' own green:

• roll: .github-private run 34225276282 opened 37 of 37, accounting reconciled;
• desk#84 marked ready by hand → its own auto-merge / arm job minted pr-arm, armed, merged as 0dbff8d (desk run 34225794020);
• the other 36: merge-claude-harness run 34225907523 marked ready and armed, needs-attention 0;
• pr-sweep dry run over every repo at 12:33–12:45 (run 34226721355) lists 225 open PRs and none titled "ci: adopt auto-merge" — the projection the desk shows is hourly and could have been stale, so this is the read that counts.

Closing the anchor; nothing else names it.

---

Generated by Claude Code

[github-actions]

🔓 Released by claim-sweep — the issue is closed, so the claim guards no remaining work.

Re-claim through the same door if this work is live; releasing and re-claiming are both cheap, and a fresh claim spares it from the next sweep. A standing claim held by a machine lane should carry the standing-claim label, which this sweep never releases.

Recorded by the sweep, not by a guest. This does not assert who held the claim.