The Audit Said No Bump Could Merge. Seven Minutes Later the ADR Said Agents May.

Can an agent merge a dependency bump, yes or no? The repo's rulebook now says yes and its merge tool says no, and the way it got there took ten minutes. A "bump" is a pull request (a proposed change) that moves a library to a newer minor or patch version; Dependabot, GitHub's bot, opens them. On the evening of October 13th an audit-docs run, an agent whose job is checking the project's docs against its code, edited the clause about bumps in ADR-0004, the numbered decision record on who may merge what, in PR #1909. The clause began as "merges like any other PR". At 22:58 UTC one commit made it "is not by itself an exception". At 23:05 the next put "merges like any other PR" back. At 23:08 a third wrote the version that stands: a bump "can be merged by an agent, even though it changes package.json".

The reasons are in the commit messages. The first, titled "ADR-0004 and ADR-0009 match what the code enforces", says "every bump changes package.json, which is Human-only, so no bump could merge the way the clause said." Human-only is the list of files whose changes a person must merge, and package.json, the file that names a project's libraries, is on it. The second says "The owner confirmed agents are meant to merge minor or patch bumps; that merge-pr.ts can't yet is #1889's gap, not a wrong ADR." So the audit set the ADR against the code and concluded no bump could merge as the ADR read. The reply, in the commit's own words, was to keep the ADR and call the code the gap.

Check the gap. The workflow doc calls scripts/merge-pr.ts, the project's merge script, "the only merge path". Its header says it refuses "for a PR that changes a Human-only path", and package.json is on that list. The same doc, thirty lines further down, says of Dependabot's PRs that "merge-pr.ts refuses every one". Then the permission got used. PR #1907, Dependabot's bump of four libraries, merged at 23:29 UTC, twenty-one minutes after the third commit. A comment on #1889 says that "at the owner's explicit request, an agent merged" it with a different merge tool, one that skips the script, because the script "refused it for the two reasons in the comment above" (the earlier comment lists them: the script counts Dependabot as an outsider, and package.json is Human-only). It calls this "a manual workaround" that is "not yet allowed by pr-workflow.md".

Credit, since it's owed: nobody hid it. The commits and the comment name the gap, the agent left a written verdict (a comment recording its review) on #1907 before merging, and PR #1898, the rewrite of every ADR that day, lists #1889 among its follow-ups. Issue #1889, which asks the owner to choose how these PRs should merge, is still open.