Skip to content
Back to skills

Bt6 Merge Train

ASecurity

Run an explicitly authorized, conservative BT6 merge train that processes validated pull requests one at a time and reconciles repository, CI, evidence, and issue state after each merge.

  • 2 stars
  • 0 votes
  • 0 copies
  • 1 view
  • Added October 17, 2026
researchgobashrailssecurity

Security analysis

A100/100

Scanned October 17, 2026

npx -y skills add karanmrn/karanagentskills --skill bt6-merge-train --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Bt6 Merge Train?

Add the live security badge to your README. It updates with every re-scan.

Security grade badge for Bt6 Merge Train
[![Security: A — Skills Directory](https://www.skillsdirectory.com/api/skills/karanmrn-bt6-merge-train/badge)](https://www.skillsdirectory.com/skills/karanmrn-bt6-merge-train)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

SKILL.md
---
namespace: bt6-maintainer
name: bt6-merge-train
platforms: [all]
description: Run an explicitly authorized, conservative BT6 merge train that processes validated pull requests one at a time and reconciles repository, CI, evidence, and issue state after each merge.
triggers:
  - bt6 merge train
  - merge validated BT6 pull requests
  - start a maintainer merge session
  - integrate ready research tool changes
requires:
  - current-queue-audit: ready candidates with exact audited head SHAs
  - explicit-merge-authorization: operator authorizes repository, candidates, and mutation in the current context
  - tracker-write-access: configured canonical tracker actor may merge
ensures:
  - dry-run-default: no merge occurs unless explicitly authorized and dry-run is disabled
  - one-at-a-time: only one PR is merged before all relevant state is refreshed
  - current-gates: head, base, reviews, checks, risk-surface verification, and policy are rechecked immediately before merge
  - reconciliation: canonical branch, CI, linked issues, and queue state are checked after each merge
commandHint:
  argumentHint: "<pr...> [--method squash|merge|rebase] [--dry-run] [--stop-on-conflict]"
  allowedTools: Bash, Read
  model: sonnet
  category: release-management
  modelRole: reasoning
  modelTier: standard
---

# BT6 Merge Train

Use only after `bt6-queue-audit`. Apply `bt6-maintainer-guardrails`.

## Authorization preflight

Confirm the current operator explicitly authorized merging in the resolved
repository. Record:

- canonical repository/tracker and expected actor;
- candidate PR numbers and audited head SHAs;
- base branch and permitted merge method;
- whether this is dry-run or live;
- current queue-audit reference and expiration conditions.

Approval to inspect, plan, review, fix, or prepare is not merge authorization.

## Never merge

- requested-changes, draft, conflict/dirty, or ambiguous PR state;
- missing/failing required checks;
- head SHA different from the audited SHA;
- policy-disallowed merge method or unexpected base branch;
- unresolved security, privacy, citation, provenance, corpus, schema, data-loss,
  compatibility, or research-integrity finding;
- missing profile-required risk-surface verification;
- missing, stale, incomplete, or non-merge-ready external-provider assessment;
- a PR whose target repository/tracker/actor cannot be proven.

## Candidate ordering

Respect dependencies and gate-critical fixes first. For otherwise independent
work, prefer narrowly scoped docs/config, small verified defects, integrity and
compatibility fixes, then larger features. Recompute ordering after each merge.

## Per-PR procedure

1. Re-fetch PR metadata, exact head SHA, base, mergeability, reviews, required
   checks, linked issues, dependencies, and new human feedback.
2. Compare the head with the queue audit and PR-audit evidence.
3. Confirm hostile-input and all matched risk-surface checks are current.
4. Run any profile validation invalidated by base-branch movement.
5. For external-provider changes, confirm the provider assessment matches the
   exact head and its integration-complete and merge-ready verdicts are `yes`.
6. Verify the merge method is allowed and dry-run is false.
7. Merge exactly one PR through the canonical tracker.
8. Verify the resulting canonical-branch commit and post-merge CI.
9. Reconcile linked issues by observed state. Comment/close only when separately
   authorized; do not assume closing keywords worked.
10. Refresh base branch, open queue, reviews, checks, dependencies, and candidate
   ordering before considering another PR.

## Stop conditions

Stop on any merge conflict, check failure, unexpected commit, issue mismatch,
new feedback, stale audit, changed profile/policy, or ambiguous external state.
Do not skip a failed candidate and continue unless the operator's authorization
explicitly covers that behavior and remaining candidates are independent.

Use `templates/bt6-merge-train-report.md`. Record every attempted/merged PR,
exact SHA, method, checks, authorization, linked-issue outcome, and stop reason.

Attribution

Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.

Comments

Loading comments…

Newsletter

Get the weekly list of safe new skills, and the ones we pulled.