work complete --merge flag for structured PR merging

The pipeline manages every step from scope to PR creation, but merge is unmanaged. When developers delegate the merge to an agent (which they inevitably do), the agent improvises with raw `gh` commands — using `--delete-branch` (worktree conflict), `--squash` (opinionated), `--admin` (bypasses branch protection) — producing confusing errors and inconsistent state. Observed live: the verify agent hit every one of these failure modes in sequence when asked to merge PR #95. The user wants a structured merge path that agents can use without improvising.

verdict PASSscore 25 / 25findings 7 (1 risk · 3 debt · 3 obs)duration 19h 10mrejection cycles 0shipped May 9, 2026surface cli

Pipeline timeline

Intent to proven code in 19h 10m across Think, Plan, Build, and Verify.

Think
167m
Plan
18m
Build
31m
Verify
6m

Assertion ledger

25 claims, each independently verified. Showing 8 — show all →

IDSaysMatcher
A001Merging and completing in one command produces a successful completionverifiedok
A002The merge step calls gh pr merge without a strategy flagverifiedok
A003The merge step never uses --delete-branchverifiedok
A004Running without --merge behaves identically to beforeverifiedok
A005Pending checks trigger auto-merge attemptverifiedok
A006Successful auto-merge tells the user to come back after the PR mergesverifiedok
A007Auto-merge failure tells the user to merge manuallyverifiedok
A008Branch behind shows rebase commands with the worktree pathverifiedok

Findings 7 total

debtpackages/cli/tests/commands/work.test.tsclosed
A020, A021 assert on source code content instead of testing behavior
debtpackages/cli/tests/commands/work-merge.test.tsscope
No tests verify --json output for any of the 7 merge failure paths
riskpackages/cli/src/commands/work.tsclosed
JSON.parse on gh pr view stdout has no try/catch — malformed response crashes
debtpackages/cli/src/commands/work.tsclosed
getNextAction multi-line return breaks status output formatting — second line lacks indentation and styling
obspackages/cli/src/commands/work.tsclosed
Auto-merge enabled path writes plain text to stdout before JSON output — pollutes stdout for --json consumers
+2more findings

Integrity seal

scopesha256:707df42eb686d...
contractsha256:95d27b3d98d88...
plansha256:e6bc43181949d...
specsha256:63c8edf19c8d2...
build-reportsha256:df4af4973b47a...
build-datasha256:866e1d4435153...
verify-reportsha256:73836316254af...
verify-datasha256:cc05cdafbf8da...
audit cmd$ ana proof audit work-complete-merge   → all hashes match