[leifj]

Step 1 of the integration-branch plan: no manifest file in the branch; the history is the record and a tool reads it back.

What

scripts/integration.py with two commands (docs: docs/INTEGRATION-BRANCHES.md):

• report --path <clone> --tip integration/<name> [--repos ...] [--json]: the base, the ordered PRs (the latest merged head of each; PR number/title/state/draft/labels from the GitHub API; whether the PR's head has moved since it was merged) and everything on the branch that is not a PR merge.
• verify ...: exit 1 when the branch contains anything a replay of its PR merges would not produce: a plain commit on the first-parent path, a merge whose result differs from the automatic merge of its parents (a change hidden in the merge commit), a merge that conflicts when replayed (a conflict resolved by hand inside the merge), or (with --repos) a merged head that is not any PR's head. Uses git merge-tree --write-tree (git >= 2.38).

Tests

tests/test_integration_tool.py (8) builds real git repositories: clean merges pass and are listed in order; a patch commit, a change inside a merge and a hand-resolved conflict each fail; a PR re-merged as it moved is one entry with its latest head; an unmapped head is reported; the CLI exit codes; the JSON shape. Proven non-vacuous: disabling the merge-tree comparison fails the hidden-change test, and treating plain commits as merges fails the patch test.

First run on the real branches (read-only, nothing changed)

• vc integration/gdc-nymauth-v5 @ c8c5b1eafd0ff08c14ca3cf8ebaceaa4473533f0: 57 merges, 12 PRs (all in SUNET/vc: feat(issuer): seed-backed commitment claims, derived sources SUNET/vc#793 and Feat/auth scope document claims merge SUNET/vc#838 merged since, and open 821, 825, 826, 827, 829, 830, 831, 832, 839, 840). Correction: this PR's first report attributed most of these to the fork sirosfoundation/vc; GitHub answers the pulls lookup on a fork with the UPSTREAM's PRs, so their numbers belong to SUNET/vc. Fixed in integration: sync from a PR list, and the CI build that refuses a branch that does not verify #91 (the PR's base repository is used), 47 commits that are not merges of a PR (the branch started on a feature line) and 51 problems in all. Most of the PRs' heads have moved since they were merged (the branch is stale for them). The PIN PROVENANCE block in environments/gdc.yaml did not mention sirosfoundation/vc 825 and 826 at all.
• engine local/gdc-nymauth-integration-4 @ 1d0708b13f7afe4752250f8e9fe04e0ab719c98f: 3 problems: the two known local-only commits (a25df83, 1d0708b) and a conflict resolved by hand inside the #163 merge.

So neither can be published as a documented bundle until it is regenerated from its PR list. That (a sync command that rebuilds the branch with merge messages naming the PR, and the CI build that refuses a branch that fails verify) is the next step; this PR changes no environment and no image.

🤖 Generated with Claude Code

[leifj]

Superseded by the org-level version: sirosfoundation/.github#36 (plan-generated branches, verify, glue classification, a reusable workflow and PR comments; no sirosid-dev dependency). This PR should be closed once that direction is agreed.