gitea: keep the operator's own login on main's merge whitelist beside mesh-tools (ADR 0534 §2)

The operator merges by hand at the forge when the mesh's own path is stuck,
without changing a rule. The logins come from the trusted config value
main-mergers, merged into the runtime config both programs read.

modules/gitea/client.ts

@@ -699,9 +699,9 @@ export class GiteaClient {
     };
   }
 
-  /** Make a branch require these commit statuses to merge (novox/hq ADR 0237): the rule named for the
-   *  branch is edited — its required statuses replaced by these, everything else it says kept unless
-   *  asked — or created, refusing direct pushes unless asked otherwise. Answers the rule as it is now. */
+  /** Protect a branch (novox/hq ADR 0237): the rule named for the branch is edited — its required statuses taken
+   *  off (ADR 0534 §5), everything else it says kept unless asked — or created, refusing direct pushes unless asked
+   *  otherwise. Answers the rule as it is now. */
   async setBranchProtection(owner: string, repo: string, branch: string, want: ProtectionWanted): Promise<{ created: boolean; rule: BranchProtection }> {
     const had = await this.branchProtection(owner, repo, branch);
     const body = protectionBody(want, !had, branch);
@@ -932,9 +932,9 @@ export class GiteaAdmin {
     return Array.isArray(res.body) ? res.body : [];
   }
 
-  /** Put main's rule right in every repository of an organisation (novox/hq ADR 0398 §2, issue 948): no push, and
-   *  only the tools' account merges. The rule there is edited, its statuses left as they are; a repository with no
-   *  rule for main gets one that requires none. Answers the repositories it touched. With the administrator's login:
+  /** Put main's rule right in every repository of an organisation (novox/hq ADR 0398 §2, issue 948): no push, only
+   *  the tools' account merges, and no status required (ADR 0534 §1). The rule there is edited; a repository with no
+   *  rule for main gets one. Answers the repositories it touched. With the administrator's login:
    *  the tools' account is no repository's administrator, so no tool can do this (ADR 0365 §2). */
   async ensureMainMerges(org: string): Promise<string[]> {
     const repos: string[] = [];
@@ -954,11 +954,11 @@ export class GiteaAdmin {
         if (patch.status !== 200) GiteaAdmin.fail(rule, patch);
         continue;
       }
-      // A rule named exactly main is matched before any glob rule, so it would hide the statuses, approvals and
-      // administrator limit a glob rule covering main asks: they are copied into it (issue 948, review round 1).
+      // A rule named exactly main is matched before any glob rule, so it would hide the approvals and administrator
+      // limit a glob rule covering main asks: they are copied into it (issue 948, review round 1). Its statuses are
+      // not: main requires none (ADR 0534 §1).
       const covering = rules.filter((r) => ruleCovers(String(r.rule_name ?? r.branch_name ?? ""), MAIN_BRANCH));
-      const checks = [...new Set(covering.filter((r) => r.enable_status_check).flatMap((r) => (r.status_check_contexts ?? []).filter(Boolean)))];
-      const copied: Record<string, unknown> = { enable_status_check: checks.length > 0, status_check_contexts: checks };
+      const copied: Record<string, unknown> = {};
       const approvals = Math.max(0, ...covering.map((r) => Number(r.required_approvals ?? 0)));
       if (approvals > 0) copied.required_approvals = approvals;
       if (covering.some((r) => r.block_admin_merge_override === true)) copied.block_admin_merge_override = true;

modules/gitea/cmd/repositories/check_test.go

@@ -1,134 +1,135 @@
 package main
 
 import (
+	"os"
+	"path/filepath"
 	"strings"
 	"testing"
 )
 
-// The tests of issue 1301 (ADR 0447 §1, §5; ADR 0503 §3, §5; lead decisions L4 and L11): main requires `mesh/check`
-// alone in place of `mesh/merge-gate` and `mesh/repo-check`; a main that requires `mesh/repo-check` without
-// `mesh/merge-gate` (hq) keeps it; every repository of the organisation whose main requires `mesh/merge-gate` is
-// switched, listed in the value or not; no other status is dropped.
+// The tests of ADR 0534 §1, §2 (the operator, 2026-10-23): the forge requires no status to merge. Main's rule keeps no
+// push, no push whitelist, the tools' account alone in its merge whitelist and no administrator merging past it, and
+// requires no status: the program writes it so on every repository it lists, and takes every required status off a
+// rule covering main in every repository of the organisation it does not list. Nothing else of an unlisted
+// repository's rule is sent.
 
 func narrowedRule(contexts ...any) map[string]any {
 	return map[string]any{
 		"enable_push": false, "enable_push_whitelist": false, "push_whitelist_usernames": []any{},
 		"enable_merge_whitelist": true, "merge_whitelist_usernames": []any{tools},
-		"enable_status_check": true, "status_check_contexts": contexts,
+		"enable_status_check": len(contexts) > 0, "status_check_contexts": contexts,
 		"block_admin_merge_override": true,
 	}
 }
 
-// 1301-S1: a listed repository whose main requires the two old statuses is put right to `mesh/check` in their place,
-// every other status kept; a second pass changes nothing.
-func TestListedRepositorySwapsTheTwoStatusesForCheck(t *testing.T) {
+// requiresNone is whether a rule as the fake forge keeps it requires no status.
+func requiresNone(rule map[string]any) bool {
+	return rule["enable_status_check"] != true && len(strs(rule["status_check_contexts"])) == 0
+}
+
+// 0534-1: a listed repository whose main requires statuses has them all taken off, the rest of the rule kept; a
+// second pass changes nothing.
+func TestListedRepositoryRequiresNoStatus(t *testing.T) {
 	f := newFake()
 	repo := f.add("novox/mesh-delivery", map[string]map[string]any{mainRule: narrowedRule("mesh/merge-gate", "mesh/repo-check", "other/x")}, "main")
+	checked := f.add("novox/checked", map[string]map[string]any{mainRule: narrowedRule("mesh/check")}, "main")
 	s, _ := syncer(t, f)
-	o := run(t, s, Value{"mesh-delivery": {}})
-	got := strs(repo.Rules[mainRule]["status_check_contexts"])
-	if strings.Join(got, ",") != "other/x,mesh/check" {
-		t.Errorf("main requires %v, want other/x and mesh/check", got)
-	}
-	if r := result(o, "mesh-delivery"); r.Did != DidPutRight {
-		t.Errorf("outcome %+v, want put right", r)
+	o := run(t, s, Value{"mesh-delivery": {}, "checked": {}})
+	for name, r := range map[string]*fRepo{"mesh-delivery": repo, "checked": checked} {
+		rule := r.Rules[mainRule]
+		if !requiresNone(rule) {
+			t.Errorf("%s's main still requires %v", name, rule["status_check_contexts"])
+		}
+		if rule["enable_push"] != false || rule["enable_merge_whitelist"] != true ||
+			strings.Join(strs(rule["merge_whitelist_usernames"]), ",") != tools || rule["block_admin_merge_override"] != true {
+			t.Errorf("%s's main lost the rest of its rule: %v", name, rule)
+		}
+		if r := result(o, name); r.Did != DidPutRight {
+			t.Errorf("%s outcome %+v, want put right", name, r)
+		}
 	}
 	before := len(f.writes())
-	run(t, s, Value{"mesh-delivery": {}})
+	o = run(t, s, Value{"mesh-delivery": {}, "checked": {}})
 	if w := f.writes(); len(w) != before {
 		t.Errorf("a second pass wrote %v", w[before:])
 	}
+	if result(o, "checked").Did != DidUnchanged {
+		t.Errorf("second outcome %+v, want unchanged", result(o, "checked"))
+	}
 }
 
-// 1301-S1: a repository the program makes requires `mesh/check` alone from its first rule in the organisation on.
-func TestNewRepositoryRequiresCheckAlone(t *testing.T) {
+// 0534-1: a repository the program makes requires no status from its first rule in the organisation on.
+func TestNewRepositoryRequiresNoStatus(t *testing.T) {
 	f := newFake()
 	s, _ := syncer(t, f)
 	run(t, s, Value{"fresh": {Description: "d"}})
 	rule := f.repos["novox/fresh"].Rules[mainRule]
-	if got := strs(rule["status_check_contexts"]); rule["enable_status_check"] != true || strings.Join(got, ",") != CheckStatus {
-		t.Errorf("a new repository's main requires %v, want %s alone", got, CheckStatus)
+	if !requiresNone(rule) {
+		t.Errorf("a new repository's main requires %v, want none", rule["status_check_contexts"])
 	}
-	if readme := f.repos["novox/fresh"].Files["README.md"]; !strings.Contains(readme, CheckStatus) ||
-		strings.Contains(readme, "mesh/merge-gate") || strings.Contains(readme, "mesh/repo-check") {
+	if readme := f.repos["novox/fresh"].Files["README.md"]; strings.Contains(readme, "mesh/merge-gate") || strings.Contains(readme, "mesh/repo-check") {
 		t.Errorf("the README names the statuses of before: %q", readme)
 	}
 }
 
-// 1301-S1: mesh/check is never dropped, and a rule that requires it beside a retired status loses the retired one.
-func TestCheckIsKeptAndARetiredStatusBesideItGoes(t *testing.T) {
+// 0534-1: a listed repository whose main requires nothing stays so, and is not written when the rest is right.
+func TestListedRuleRequiringNothingIsRight(t *testing.T) {
 	f := newFake()
-	both := f.add("novox/both", map[string]map[string]any{mainRule: narrowedRule("mesh/check", "mesh/repo-check")}, "main")
-	right := f.add("novox/right", map[string]map[string]any{mainRule: narrowedRule("mesh/check")}, "main")
+	none := f.add("novox/none", map[string]map[string]any{mainRule: narrowedRule()}, "main")
 	s, _ := syncer(t, f)
-	o := run(t, s, Value{"both": {}, "right": {}})
-	if got := strs(both.Rules[mainRule]["status_check_contexts"]); strings.Join(got, ",") != CheckStatus {
-		t.Errorf("both requires %v, want %s alone", got, CheckStatus)
+	o := run(t, s, Value{"none": {}})
+	if !requiresNone(none.Rules[mainRule]) {
+		t.Errorf("none requires %v", none.Rules[mainRule]["status_check_contexts"])
 	}
-	if got := strs(right.Rules[mainRule]["status_check_contexts"]); strings.Join(got, ",") != CheckStatus {
-		t.Errorf("right requires %v", got)
+	if result(o, "none").Did != DidUnchanged {
+		t.Errorf("outcome %+v, want unchanged", result(o, "none"))
 	}
-	if result(o, "right").Did != DidUnchanged || result(o, "both").Did != DidPutRight {
-		t.Errorf("outcome %+v", o)
+	for _, w := range f.writes() {
+		t.Errorf("a right rule was written: %s", w)
 	}
 }
 
-// 1301-S1: a listed repository whose main requires nothing is given mesh/check, not the old two.
-func TestListedRuleRequiringNothingGetsCheck(t *testing.T) {
-	f := newFake()
-	none := f.add("novox/none", map[string]map[string]any{mainRule: {"enable_push": false}}, "main")
-	s, _ := syncer(t, f)
-	run(t, s, Value{"none": {}})
-	if got := strs(none.Rules[mainRule]["status_check_contexts"]); strings.Join(got, ",") != CheckStatus {
-		t.Errorf("none requires %v, want %s", got, CheckStatus)
-	}
-}
-
-// 1301-S2 (ADR 0503 §5): a main that requires mesh/repo-check without mesh/merge-gate is judged by its own script
-// alone (hq): it keeps mesh/repo-check and is not given mesh/check, listed or not.
-func TestOwnCheckAloneIsKept(t *testing.T) {
+// 0534-1: hq, whose main required mesh/repo-check alone, requires no status either, listed or not.
+func TestOwnCheckAloneGoesToo(t *testing.T) {
 	f := newFake()
 	hq := f.add("novox/hq", map[string]map[string]any{mainRule: narrowedRule("mesh/repo-check")}, "main")
 	lab := f.add("novox/mesh-lab", map[string]map[string]any{mainRule: narrowedRule("mesh/repo-check")}, "main")
 	s, _ := syncer(t, f)
 	o := run(t, s, Value{"hq": {}})
 	for name, repo := range map[string]*fRepo{"hq": hq, "mesh-lab": lab} {
-		if got := strs(repo.Rules[mainRule]["status_check_contexts"]); strings.Join(got, ",") != "mesh/repo-check" {
-			t.Errorf("%s requires %v, want mesh/repo-check alone", name, got)
+		if !requiresNone(repo.Rules[mainRule]) {
+			t.Errorf("%s requires %v, want none", name, repo.Rules[mainRule]["status_check_contexts"])
+		}
+		if r := result(o, name); r.Did != DidPutRight {
+			t.Errorf("%s outcome %+v, want put right", name, r)
 		}
-	}
-	if result(o, "hq").Did != DidUnchanged {
-		t.Errorf("hq outcome %+v, want unchanged", result(o, "hq"))
-	}
-	for _, w := range f.writes() {
-		t.Errorf("a repository judged by its own check alone was written: %s", w)
 	}
 }
 
-// 1301-S3 (L4, L11): a repository the value does not list whose main requires mesh/merge-gate has the two old
-// statuses swapped for mesh/check, and only its statuses: nothing else of its rule is sent. One that requires
-// neither, or mesh/repo-check alone, is not written to.
-func TestUnlistedRepositoryRequiringTheGateIsSwitched(t *testing.T) {
+// 0534-1: a repository the value does not list whose rule covering main requires any status has them taken off, and
+// only its statuses: nothing else of its rule is sent. One that requires none is not written to.
+func TestUnlistedRepositoryRequiringAStatusHasItTakenOff(t *testing.T) {
 	f := newFake()
 	catalog := f.add("novox/mesh-catalog", map[string]map[string]any{mainRule: {
-		"enable_push": true, "enable_status_check": true, "status_check_contexts": []any{"mesh/merge-gate", "mesh/repo-check"},
+		"enable_push": true, "enable_status_check": true, "status_check_contexts": []any{"mesh/check"},
 	}}, "main")
 	toolsGo := f.add("novox/mesh-tools-go", map[string]map[string]any{mainRule: narrowedRule("mesh/merge-gate")}, "main")
 	f.add("novox/plain", map[string]map[string]any{mainRule: {"enable_push": false}}, "main")
-	f.add("novox/hq", map[string]map[string]any{mainRule: narrowedRule("mesh/repo-check")}, "main")
+	f.add("novox/unticked", map[string]map[string]any{mainRule: {"enable_push": false, "enable_status_check": false,
+		"status_check_contexts": []any{"mesh/check"}}}, "main")
 	f.add("novox/norule", nil, "main")
 	f.add("mesh-admin/elsewhere", map[string]map[string]any{mainRule: narrowedRule("mesh/merge-gate")}, "main")
 	s, _ := syncer(t, f)
 	o := run(t, s, Value{})
 
-	if got := strs(catalog.Rules[mainRule]["status_check_contexts"]); strings.Join(got, ",") != CheckStatus {
-		t.Errorf("mesh-catalog requires %v, want %s", got, CheckStatus)
+	if !requiresNone(catalog.Rules[mainRule]) {
+		t.Errorf("mesh-catalog requires %v, want none", catalog.Rules[mainRule]["status_check_contexts"])
 	}
 	if catalog.Rules[mainRule]["enable_push"] != true {
-		t.Errorf("an unlisted repository's rule was narrowed beyond its statuses: %v", catalog.Rules[mainRule])
+		t.Errorf("an unlisted repository's rule was changed beyond its statuses: %v", catalog.Rules[mainRule])
 	}
-	if got := strs(toolsGo.Rules[mainRule]["status_check_contexts"]); strings.Join(got, ",") != CheckStatus {
-		t.Errorf("mesh-tools-go requires %v, want %s", got, CheckStatus)
+	if !requiresNone(toolsGo.Rules[mainRule]) {
+		t.Errorf("mesh-tools-go requires %v, want none", toolsGo.Rules[mainRule]["status_check_contexts"])
 	}
 	want := []string{
 		"PATCH /api/v1/repos/novox/mesh-catalog/branch_protections/main",
@@ -142,7 +143,7 @@ func TestUnlistedRepositoryRequiringTheGateIsSwitched(t *testing.T) {
 			t.Errorf("%s outcome %+v, want put right", n, r)
 		}
 	}
-	for _, n := range []string{"plain", "hq", "norule", "elsewhere"} {
+	for _, n := range []string{"plain", "unticked", "norule", "elsewhere"} {
 		if r := result(o, n); r.Name != "" {
 			t.Errorf("%s is in the outcome though nothing was done: %+v", n, r)
 		}
@@ -154,27 +155,27 @@ func TestUnlistedRepositoryRequiringTheGateIsSwitched(t *testing.T) {
 	}
 }
 
-// 1301-S3: the organisation's repositories are read page by page, so one past the first page is switched too.
+// 0534-1: the organisation's repositories are read page by page, so one past the first page is put right too.
 func TestUnlistedRepositoriesAreReadPastTheFirstPage(t *testing.T) {
 	f := newFake()
 	f.pageSize = 2
 	for _, n := range []string{"a", "b", "c", "d", "e"} {
-		f.add("novox/"+n, map[string]map[string]any{mainRule: narrowedRule("mesh/merge-gate", "mesh/repo-check")}, "main")
+		f.add("novox/"+n, map[string]map[string]any{mainRule: narrowedRule("mesh/check")}, "main")
 	}
 	s, _ := syncer(t, f)
 	run(t, s, Value{})
 	for _, n := range []string{"a", "b", "c", "d", "e"} {
-		if got := strs(f.repos["novox/"+n].Rules[mainRule]["status_check_contexts"]); strings.Join(got, ",") != CheckStatus {
-			t.Errorf("%s requires %v", n, got)
+		if rule := f.repos["novox/"+n].Rules[mainRule]; !requiresNone(rule) {
+			t.Errorf("%s requires %v", n, rule["status_check_contexts"])
 		}
 	}
 }
 
-// 1301-S3: a refused swap is said with the repository and its step, and the pass goes on to the next.
-func TestRefusedSwapIsSaid(t *testing.T) {
+// 0534-1: a refused removal is said with the repository and its step, and the pass goes on to the next.
+func TestRefusedRemovalIsSaid(t *testing.T) {
 	f := newFake()
-	f.add("novox/a", map[string]map[string]any{mainRule: narrowedRule("mesh/merge-gate")}, "main")
-	f.add("novox/b", map[string]map[string]any{mainRule: narrowedRule("mesh/merge-gate")}, "main")
+	f.add("novox/a", map[string]map[string]any{mainRule: narrowedRule("mesh/check")}, "main")
+	f.add("novox/b", map[string]map[string]any{mainRule: narrowedRule("mesh/check")}, "main")
 	f.refuse = func(method, path string) (int, string) {
 		if method == "PATCH" && strings.Contains(path, "/novox/a/") {
 			return 403, "no"
@@ -183,8 +184,8 @@ func TestRefusedSwapIsSaid(t *testing.T) {
 	}
 	s, _ := syncer(t, f)
 	o := run(t, s, Value{})
-	if r := result(o, "a"); r.Did != DidRefused || r.Step != StepSwap {
-		t.Errorf("a: %+v, want refused at %s", r, StepSwap)
+	if r := result(o, "a"); r.Did != DidRefused || r.Step != StepNoStatus {
+		t.Errorf("a: %+v, want refused at %s", r, StepNoStatus)
 	}
 	if r := result(o, "b"); r.Did != DidPutRight {
 		t.Errorf("b: %+v, want put right", r)
@@ -213,3 +214,50 @@ func TestOrganisationListRefusedIsSaid(t *testing.T) {
 		t.Errorf("the refused list is not in the outcome: %+v", o)
 	}
 }
+
+// 0534-2 (the operator, 2026-10-23 ~12:05): the operator's own forge login stays on main's merge whitelist beside the
+// tools' account, so the operator can always merge by hand at the forge; a rule naming the tools' account alone is put
+// right, and a second pass changes nothing.
+func TestTheOperatorsLoginStaysBesideTheTools(t *testing.T) {
+	f := newFake()
+	repo := f.add("novox/mesh-delivery", map[string]map[string]any{mainRule: narrowedRule()}, "main")
+	s, _ := syncer(t, f)
+	s.Mergers = []string{"jschoubben", tools, "jschoubben"}
+	o := run(t, s, Value{"mesh-delivery": {}, "fresh": {}})
+	for name, rule := range map[string]map[string]any{"mesh-delivery": repo.Rules[mainRule], "fresh": f.repos["novox/fresh"].Rules[mainRule]} {
+		if got := strings.Join(strs(rule["merge_whitelist_usernames"]), ","); got != tools+",jschoubben" {
+			t.Errorf("%s's merge whitelist is %s, want %s and jschoubben", name, got, tools)
+		}
+		if !requiresNone(rule) || rule["enable_push"] != false {
+			t.Errorf("%s's rule: %v", name, rule)
+		}
+	}
+	if r := result(o, "mesh-delivery"); r.Did != DidPutRight {
+		t.Errorf("outcome %+v, want put right", r)
+	}
+	before := len(f.writes())
+	run(t, s, Value{"mesh-delivery": {}, "fresh": {}})
+	if w := f.writes(); len(w) != before {
+		t.Errorf("a second pass wrote %v", w[before:])
+	}
+}
+
+// 0534-2: the mergers are read from the module's runtime config file; a missing key is none; a name that is no forge login
+// is refused.
+func TestReadMergers(t *testing.T) {
+	p := filepath.Join(t.TempDir(), "r.json")
+	_ = os.WriteFile(p, []byte(`{"url":"","main-mergers":["jschoubben"]}`), 0o600)
+	if m, err := ReadMergers(p); err != nil || strings.Join(m, ",") != "jschoubben" {
+		t.Fatalf("%v %v", m, err)
+	}
+	_ = os.WriteFile(p, []byte(`{"url":""}`), 0o600)
+	if m, err := ReadMergers(p); err != nil || len(m) != 0 {
+		t.Fatalf("%v %v", m, err)
+	}
+	for _, bad := range []string{`["a b"]`, `["../x"]`, `[""]`, `"jschoubben"`} {
+		_ = os.WriteFile(p, []byte(`{"main-mergers":`+bad+`}`), 0o600)
+		if _, err := ReadMergers(p); err == nil {
+			t.Errorf("%s was accepted", bad)
+		}
+	}
+}

modules/gitea/cmd/repositories/fake_test.go

@@ -126,7 +126,8 @@ func lets(rule map[string]any, login string) bool {
 // and in the organisation the tools' team does (it is on every repository there); nobody else here.
 func reaches(full, login string) bool {
 	owner := strings.SplitN(full, "/", 2)[0]
-	return owner == login || (owner == org && login == tools)
+	// The operator's own login is an owner of the organisation, so it reaches every repository there (ADR 0534 §2).
+	return owner == login || (owner == org && (login == tools || login == "jschoubben"))
 }
 
 // keepReaching drops from a rule's merge whitelist every user without access to the repository, as gitea's

modules/gitea/cmd/repositories/main.go

@@ -3,8 +3,8 @@
 // again whenever the value changes: it reads the file the mesh renders from that value and, with the setup login,
 // makes every listed repository that does not exist under that login's own account, protects its main, writes
 // main's first commit, narrows main's rule and only then moves it into the organisation; one that exists only has
-// its main rule put right, requiring mesh/check in place of the two statuses it replaces (issue 1301). A repository
-// the value does not list is touched only to swap those two for mesh/check when its main requires mesh/merge-gate. It keeps what it did, per
+// its main rule put right, requiring no status (novox/hq ADR 0534 §1). A repository the value does not list is
+// touched only to take the required statuses off a rule covering its main. It keeps what it did, per
 // repository, in the outcome file, says each change on stdout in one line and never a secret, and exits 1 when a
 // step was refused, its last stderr lines naming each (outcome.go Report): the node-engine's gate on a run-once
 // step (ADR 0136) reports it and runs it again on every apply until it passes.
@@ -30,7 +30,8 @@ func main() {
 func runSync() int {
 	forge, missing := forgehttp.FromEnv()
 	file, outcome := os.Getenv("MESH_REPOSITORIES_FILE"), os.Getenv("MESH_REPOSITORIES_OUTCOME")
-	for k, v := range map[string]string{"MESH_REPOSITORIES_FILE": file, "MESH_REPOSITORIES_OUTCOME": outcome} {
+	for k, v := range map[string]string{"MESH_REPOSITORIES_FILE": file, "MESH_REPOSITORIES_OUTCOME": outcome,
+		"MESH_GITEA_CONFIG_FILE": os.Getenv("MESH_GITEA_CONFIG_FILE")} {
 		if v == "" {
 			missing = append(missing, k)
 		}
@@ -56,6 +57,11 @@ func runSync() int {
 		_ = WriteOutcome(outcome, o)
 		return Report(o, os.Stderr)
 	}
+	if s.Mergers, err = ReadMergers(os.Getenv("MESH_GITEA_CONFIG_FILE")); err != nil {
+		o := Outcome{At: time.Now().UTC(), Org: s.Org, Failed: err.Error()}
+		_ = WriteOutcome(outcome, o)
+		return Report(o, os.Stderr)
+	}
 	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Minute)
 	defer cancel()
 	o, _ := s.Sync(ctx, value) // a forge not reachable is in o.Failed

modules/gitea/cmd/repositories/manifest_test.go

@@ -64,6 +64,7 @@ func TestManifestDeclaresTheValueAndItsTrigger(t *testing.T) {
 	if v, err := ReadValue(filled); err != nil || len(v) != 1 || v["mesh-delivery"].Description != "d" {
 		t.Errorf("the filled template reads as %v, %v; want mesh-delivery", v, err)
 	}
+
 	for _, r := range m.Resources {
 		if r["type"] == "process" && has(strs(r["restart-on"]), file["id"].(string)) {
 			process = r
@@ -105,3 +106,61 @@ func TestManifestDeclaresTheValueAndItsTrigger(t *testing.T) {
 		t.Errorf("repositories is declared unlike agent-read-teams: %v vs %v", v, teams)
 	}
 }
+
+// 0534-2: the manifest declares main-mergers as a trusted list naming the operator's login by default, merges it into
+// the module's runtime config file (with url, which the TypeScript part reads), and the repositories program is given
+// that file and runs again when it changes.
+func TestManifestDeclaresTheMainMergers(t *testing.T) {
+	raw, err := os.ReadFile("../../module.json")
+	if err != nil {
+		t.Fatal(err)
+	}
+	var m struct {
+		Config    map[string]map[string]any `json:"config"`
+		Resources []map[string]any          `json:"resources"`
+	}
+	if err := json.Unmarshal(raw, &m); err != nil {
+		t.Fatal(err)
+	}
+	v := m.Config[MergersKey]
+	if v == nil || v["type"] != "list" || v["trusted"] != true || strings.Join(strs(v["default"]), ",") != "jschoubben" {
+		t.Fatalf("config %s = %v, want a trusted list defaulting to the operator's login", MergersKey, v)
+	}
+	var cfg, process map[string]any
+	for _, r := range m.Resources {
+		if r["id"] == "runtime-config" {
+			cfg = r
+		}
+		if r["name"] == "gitea-repositories" {
+			process = r
+		}
+	}
+	if cfg == nil || !has(strs(cfg["takes-config"]), MergersKey) || cfg["merge"] != "json" {
+		t.Fatalf("runtime-config does not take %s: %v", MergersKey, cfg)
+	}
+	text, err := os.ReadFile("../../" + cfg["template"].(string))
+	if err != nil {
+		t.Fatal(err)
+	}
+	file := filepath.Join(t.TempDir(), "config.json")
+	_ = os.WriteFile(file, text, 0o600)
+	if got, err := ReadMergers(file); err != nil || strings.Join(got, ",") != "jschoubben" {
+		t.Errorf("the template's mergers read as %v, %v; want the default", got, err)
+	}
+	env, _ := process["env"].(map[string]any)
+	if env["MESH_GITEA_CONFIG_FILE"] != cfg["path"] {
+		t.Errorf("the repositories program reads %v, want %v", env["MESH_GITEA_CONFIG_FILE"], cfg["path"])
+	}
+	if !has(strs(process["restart-on"]), "runtime-config") {
+		t.Errorf("the repositories program does not run again when the mergers change: %v", process["restart-on"])
+	}
+}
+
+func has(list []string, want string) bool {
+	for _, s := range list {
+		if s == want {
+			return true
+		}
+	}
+	return false
+}

modules/gitea/cmd/repositories/override_test.go

@@ -5,7 +5,7 @@ import (
 	"testing"
 )
 
-// 1141/AC1: a repository the program makes gets main's rule with an administrator's merge past a status refused,
+// 1141/AC1: a repository the program makes gets main's rule with an administrator's merge past it refused,
 // as every repository's main has had since 2026-10-07.
 func TestNewRepositoryRefusesTheAdministratorsOverride(t *testing.T) {
 	f := newFake()
@@ -18,7 +18,7 @@ func TestNewRepositoryRefusesTheAdministratorsOverride(t *testing.T) {
 }
 
 // 1141/AC2: a narrowed main rule that still lets an administrator override is not right: it is put right, its
-// statuses kept (the two old ones as mesh/check, issue 1301), and a second pass changes nothing.
+// statuses taken off (ADR 0534 §1), and a second pass changes nothing.
 func TestNarrowedRuleLettingTheAdministratorOverrideIsPutRight(t *testing.T) {
 	f := newFake()
 	repo := f.add("novox/mesh-delivery", map[string]map[string]any{mainRule: {
@@ -33,8 +33,8 @@ func TestNarrowedRuleLettingTheAdministratorOverrideIsPutRight(t *testing.T) {
 	if rule["block_admin_merge_override"] != true {
 		t.Errorf("the administrator's override is still allowed: %v", rule)
 	}
-	if c := strs(rule["status_check_contexts"]); strings.Join(c, ",") != "other/x,mesh/check" {
-		t.Errorf("statuses %v, want other/x kept and mesh/check for the two it replaces (issue 1301)", c)
+	if !requiresNone(rule) {
+		t.Errorf("statuses %v, want none (ADR 0534 §1)", rule["status_check_contexts"])
 	}
 	if r := result(o, "mesh-delivery"); r.Did != DidPutRight {
 		t.Errorf("outcome %+v, want put right", r)

modules/gitea/cmd/repositories/repositories.go

@@ -11,6 +11,7 @@ import (
 	"os"
 	"path"
 	"regexp"
+	"slices"
 	"sort"
 	"strings"
 	"time"
@@ -26,46 +27,11 @@ const (
 	MainBranch = "main"
 )
 
-// CheckStatus is the one status main requires (ADR 0447 §1, issue 1301): the checker's verdict on a pull request's
-// head merged onto its trunk's head. It replaces GateStatus and OwnCheckStatus, and is never dropped.
-const CheckStatus = "mesh/check"
-
-// GateStatus and OwnCheckStatus are the two statuses CheckStatus replaces: the controller's merge gate and the
-// repository's own merge-check.sh (ADR 0238 §4, ADR 0428 §5 before ADR 0447 §1).
-const (
-	GateStatus     = "mesh/merge-gate"
-	OwnCheckStatus = "mesh/repo-check"
-)
-
-// wanted is what a main rule requiring have should require: have with GateStatus and OwnCheckStatus replaced by
-// CheckStatus, every other status kept in its order (ADR 0447 §1). A rule requiring OwnCheckStatus with neither
-// GateStatus nor CheckStatus is judged by its own script alone, as hq is until issue 1296 settles how hq is
-// checked (ADR 0503 §5): the checker writes no status there (ADR 0484 §8), so it is left as it is. This reads the
-// rule, not a list of names (lead decision L11 of R4e).
-func wanted(have []string) []string {
-	if !has(have, GateStatus) && !has(have, CheckStatus) && has(have, OwnCheckStatus) {
-		return have
-	}
-	out := []string{}
-	for _, s := range have {
-		if s != GateStatus && s != OwnCheckStatus && s != CheckStatus {
-			out = append(out, s)
-		}
-	}
-	return append(out, CheckStatus)
-}
-
-func has(list []string, want string) bool {
-	for _, s := range list {
-		if s == want {
-			return true
-		}
-	}
-	return false
-}
-
-func sameList(a, b []string) bool {
-	return strings.Join(a, "\x00") == strings.Join(b, "\x00")
+// noStatus is what main's rule says of statuses: none is required to merge (novox/hq ADR 0534 §1, the operator,
+// 2026-10-23). The checks still run and report; mesh-delivery asks the operator's Approve on a passing verdict and the
+// merge tool judges it at the merge (ADR 0534 §3, §4). The forge enforces none of them.
+func noStatus() map[string]any {
+	return map[string]any{"enable_status_check": false, "status_check_contexts": []string{}}
 }
 
 // The steps of one repository, as an outcome names a refused one (ADR 0428 §6).
@@ -82,8 +48,8 @@ const (
 	StepRuleAfterMove = "rule-after-move"
 	// StepList reads the organisation's repositories, for those the value does not list (issue 1301).
 	StepList = "list"
-	// StepSwap swaps the two old statuses for CheckStatus on a repository the value does not list (issue 1301).
-	StepSwap = "swap"
+	// StepNoStatus takes the required statuses off main's rule of a repository the value does not list (ADR 0534 §1).
+	StepNoStatus = "no-status"
 )
 
 // What a pass did with one repository.
@@ -106,6 +72,37 @@ type Repo struct {
 // Value is the config value: each repository of the organisation by name.
 type Value map[string]Repo
 
+// MergersKey is the config value naming the forge logins that merge into main beside the tools' account (ADR 0534 §2).
+const MergersKey = "main-mergers"
+
+// loginName is a forge login: what a merge whitelist may name.
+var loginName = regexp.MustCompile(`^[A-Za-z0-9_][A-Za-z0-9_.-]{0,39}$`)
+
+// ReadMergers reads the main-mergers value from the module's runtime config file, which the mesh merges the value into
+// (module.json runtime-config); a file without the key names none.
+func ReadMergers(file string) ([]string, error) {
+	raw, err := os.ReadFile(file)
+	if err != nil {
+		return nil, fmt.Errorf("the module's config file cannot be read (%s): %w", file, err)
+	}
+	var whole map[string]json.RawMessage
+	if err := json.Unmarshal(raw, &whole); err != nil {
+		return nil, fmt.Errorf("the module's config file %s is not JSON: %w", file, err)
+	}
+	var out []string
+	if r, ok := whole[MergersKey]; ok && string(r) != "null" {
+		if err := json.Unmarshal(r, &out); err != nil {
+			return nil, fmt.Errorf("%s in %s is not a list of forge logins: %w", MergersKey, file, err)
+		}
+	}
+	for _, n := range out {
+		if !loginName.MatchString(n) || strings.Contains(n, "..") {
+			return nil, fmt.Errorf("%s in %s lists %q, which is not a forge login", MergersKey, file, n)
+		}
+	}
+	return out, nil
+}
+
 // ReadValue reads the file the mesh renders from the config value. A file without the key is the empty value,
 // which makes nothing and touches nothing.
 func ReadValue(file string) (Value, error) {
@@ -166,8 +163,11 @@ type Syncer struct {
 	Forge forgehttp.Client // the setup login's
 	Org   string           // the organisation, novox
 	Admin string           // the setup login, under whose own account a repository is made
-	Tools string           // the tools' account, the only one that merges into main
-	Log   func(format string, a ...any)
+	Tools string           // the tools' account, which merges into main for mesh-delivery
+	// Mergers are the forge logins that merge into main beside the tools' account: the operator's own, so the operator
+	// can always merge by hand at the forge (ADR 0534 §2; the gitea module's config value main-mergers).
+	Mergers []string
+	Log     func(format string, a ...any)
 	// WaitFor is how long to wait for the forge to answer; none when zero.
 	WaitFor, Poll time.Duration
 }
@@ -203,7 +203,7 @@ func (s *Syncer) Sync(ctx context.Context, v Value) (Outcome, error) {
 		if r.Did == DidRefused {
 			s.say("refused: %s/%s at the step %s: %s", s.Org, r.Name, r.Step, r.Said)
 		} else {
-			s.say("%s: %s/%s (%s in place of %s and %s)", r.Did, s.Org, r.Name, CheckStatus, GateStatus, OwnCheckStatus)
+			s.say("%s: %s/%s (main requires no status)", r.Did, s.Org, r.Name)
 		}
 		out.Repositories = append(out.Repositories, r)
 	}
@@ -213,12 +213,10 @@ func (s *Syncer) Sync(ctx context.Context, v Value) (Outcome, error) {
 // orgPage is how many repositories one read of the organisation's list asks for.
 const orgPage = 50
 
-// switchUnlisted swaps the two old statuses for CheckStatus on main's rule of every repository of the organisation
-// the value does not list whose main requires GateStatus (issue 1301, lead decisions L4 and L11 of R4e): the
-// repositories the merge gate judges are switched in the delivery that has the checker write mesh/check (ADR 0447
-// §5), with no list kept by hand. Only the statuses of a rule covering main are sent; nothing else of a rule the
-// value does not hold is changed (ADR 0428 §7 for all of it but the statuses the mesh itself requires). A main that
-// does not require GateStatus gets no call. It answers only what it did: a repository switched, or refused.
+// switchUnlisted takes every required status off a rule covering main in every repository of the organisation the
+// value does not list (ADR 0534 §1): the forge requires no status to merge anywhere, with no list kept by hand. Only
+// the statuses are sent; nothing else of a rule the value does not hold is changed (ADR 0428 §7). A main whose rules
+// require no status gets no call. It answers only what it did: a repository put right, or refused.
 func (s *Syncer) switchUnlisted(ctx context.Context, v Value) []Result {
 	var names []string
 	for page := 1; ; page++ {
@@ -248,13 +246,12 @@ func (s *Syncer) switchUnlisted(ctx context.Context, v Value) []Result {
 		}
 		var did *Result
 		for _, r := range rules {
-			if ok, _ := path.Match(ruleName(r), MainBranch); !ok || !has(required(r), GateStatus) {
+			if ok, _ := path.Match(ruleName(r), MainBranch); !ok || len(required(r)) == 0 {
 				continue
 			}
-			body := map[string]any{"enable_status_check": true, "status_check_contexts": wanted(required(r))}
 			if err := s.Forge.SendJSON(ctx, http.MethodPatch,
-				repoAPI(s.Org, n)+"/branch_protections/"+url.PathEscape(ruleName(r)), body, nil); err != nil {
-				did = &Result{Name: n, Did: DidRefused, Step: StepSwap, Said: err.Error()}
+				repoAPI(s.Org, n)+"/branch_protections/"+url.PathEscape(ruleName(r)), noStatus(), nil); err != nil {
+				did = &Result{Name: n, Did: DidRefused, Step: StepNoStatus, Said: err.Error()}
 				break
 			}
 			did = &Result{Name: n, Did: DidPutRight}
@@ -349,9 +346,9 @@ func (s *Syncer) one(ctx context.Context, name string, r Repo) Result {
 			return refused(name, StepFirstCommit, err)
 		}
 	}
-	if rule == nil || !isRight(rule, s.Tools) {
+	if rule == nil || !isRight(rule, s.Tools, s.Mergers) {
 		if err := s.Forge.SendJSON(ctx, http.MethodPatch, repoAPI(s.Admin, name)+"/branch_protections/"+MainBranch,
-			narrowed(rule, s.Tools), nil); err != nil {
+			narrowed(s.Tools, s.Mergers), nil); err != nil {
 			return refused(name, StepNarrow, err)
 		}
 	}
@@ -415,24 +412,6 @@ func strList(v any) []string {
 	return out
 }
 
-// statuses is what the rules require together, as wanted makes it.
-func statuses(rules ...rule) []string {
-	seen := map[string]bool{}
-	var out []string
-	add := func(s string) {
-		if !seen[s] {
-			seen[s] = true
-			out = append(out, s)
-		}
-	}
-	for _, r := range rules {
-		for _, s := range required(r) {
-			add(s)
-		}
-	}
-	return wanted(out)
-}
-
 // required is what a rule requires: its statuses when it checks them, else none.
 func required(r rule) []string {
 	if r == nil || r["enable_status_check"] != true {
@@ -441,46 +420,58 @@ func required(r rule) []string {
 	return strList(r["status_check_contexts"])
 }
 
-// narrowed is main's rule of ADR 0398 §2 (protection.ts mainRuleBody): no push, only the tools' account merges,
-// requiring the statuses (ADR 0428 §5), and no administrator merging past them, as every repository's main has been
-// since 2026-10-07 (issue 1141). A field the forge keeps beside these is left as it is.
-func narrowed(r rule, toolsAccount string, also ...rule) map[string]any {
-	return map[string]any{
+// narrowed is main's rule of ADR 0398 §2 (protection.ts mainRuleBody): no push, only the tools' account merges, no
+// administrator merging past the rule, as every repository's main has been since 2026-10-07 (issue 1141), and no
+// status required (ADR 0534 §1). A field the forge keeps beside these is left as it is.
+func narrowed(toolsAccount string, mergers []string) map[string]any {
+	body := map[string]any{
 		"enable_push": false, "enable_push_whitelist": false, "push_whitelist_usernames": []string{},
-		"enable_merge_whitelist": true, "merge_whitelist_usernames": []string{toolsAccount},
-		"enable_status_check": true, "status_check_contexts": statuses(append([]rule{r}, also...)...),
+		"enable_merge_whitelist": true, "merge_whitelist_usernames": whitelist(toolsAccount, mergers),
 		"block_admin_merge_override": true,
 	}
+	for k, v := range noStatus() {
+		body[k] = v
+	}
+	return body
 }
 
-// isRight says whether a rule already is narrowed and requires what wanted makes of it.
-func isRight(r rule, toolsAccount string) bool {
+// whitelist is main's merge whitelist: the tools' account first, then each other merger once, in the value's order.
+func whitelist(toolsAccount string, mergers []string) []string {
+	out := []string{toolsAccount}
+	for _, m := range mergers {
+		if !slices.Contains(out, m) {
+			out = append(out, m)
+		}
+	}
+	return out
+}
+
+// isRight says whether a rule already is narrowed and requires no status.
+func isRight(r rule, toolsAccount string, mergers []string) bool {
 	if r["enable_push"] != false || r["enable_push_whitelist"] == true || r["enable_merge_whitelist"] != true {
 		return false
 	}
-	if m := strList(r["merge_whitelist_usernames"]); len(m) != 1 || m[0] != toolsAccount {
+	if m := strList(r["merge_whitelist_usernames"]); !slices.Equal(m, whitelist(toolsAccount, mergers)) {
 		return false
 	}
-	have := strList(r["status_check_contexts"])
-	return r["enable_status_check"] == true && len(have) > 0 && sameList(have, wanted(have)) &&
+	return r["enable_status_check"] != true && len(strList(r["status_check_contexts"])) == 0 &&
 		r["block_admin_merge_override"] == true
 }
 
-// putRight makes main's rule in an organisation's repository the narrowed one, keeping every status it requires but
-// the two CheckStatus replaces (ADR 0447 §1).
-// A repository with no rule named main gets one, carrying what a glob rule covering main asks (client.ts
-// ensureMainMerges, issue 948). It takes away no other status and never unprotects (ADR 0428 §5, §7).
+// putRight makes main's rule in an organisation's repository the narrowed one, requiring no status (ADR 0534 §1).
+// A repository with no rule named main gets one, carrying the approvals a glob rule covering main asks (client.ts
+// ensureMainMerges, issue 948). It never unprotects (ADR 0428 §7).
 func (s *Syncer) putRight(ctx context.Context, owner, name string) (bool, error) {
 	rules, err := s.rules(ctx, owner, name)
 	if err != nil {
 		return false, err
 	}
 	if own := ruleNamed(rules, MainBranch); own != nil {
-		if isRight(own, s.Tools) {
+		if isRight(own, s.Tools, s.Mergers) {
 			return false, nil
 		}
 		return true, s.Forge.SendJSON(ctx, http.MethodPatch, repoAPI(owner, name)+"/branch_protections/"+MainBranch,
-			narrowed(own, s.Tools), nil)
+			narrowed(s.Tools, s.Mergers), nil)
 	}
 	var covering []rule
 	for _, r := range rules {
@@ -488,7 +479,7 @@ func (s *Syncer) putRight(ctx context.Context, owner, name string) (bool, error)
 			covering = append(covering, r)
 		}
 	}
-	body := narrowed(nil, s.Tools, covering...)
+	body := narrowed(s.Tools, s.Mergers)
 	body["rule_name"] = MainBranch
 	approvals := 0.0
 	for _, r := range covering {

modules/gitea/cmd/repositories/repositories_test.go

@@ -19,7 +19,7 @@ const mainRule = "main"
 // 1124/AC2: a listed repository that does not exist is made under the setup account, given main's rule letting that
 // login alone push, given its first commit, narrowed to no push and the tools' merge requiring mesh/check (1124/AC5
 // as issue 1301 changes it), and only then moved into the organisation. Nothing reaches the organisation before the
-// narrowed rule, and nothing else is pushed to main.
+// narrowed rule, and nothing else is pushed to main. Main requires no status (ADR 0534 §1).
 func TestNewRepositoryIsMadeInOrder(t *testing.T) {
 	f := newFake()
 	s, _ := syncer(t, f)
@@ -66,9 +66,8 @@ func TestNewRepositoryIsMadeInOrder(t *testing.T) {
 	if rule["enable_merge_whitelist"] != true || strings.Join(strs(rule["merge_whitelist_usernames"]), ",") != tools {
 		t.Errorf("main's merge whitelist is not the tools' account alone: %v", rule)
 	}
-	checks := strs(rule["status_check_contexts"])
-	if rule["enable_status_check"] != true || strings.Join(checks, ",") != CheckStatus {
-		t.Errorf("main does not require mesh/check alone (1124/AC5, issue 1301): %v", rule)
+	if !requiresNone(rule) {
+		t.Errorf("main requires a status (ADR 0534 §1): %v", rule)
 	}
 	if r := result(o, "mesh-delivery"); r.Did != DidMade || r.Step != "" {
 		t.Errorf("outcome %+v, want made", r)
@@ -87,7 +86,7 @@ func TestNewRepositoryIsMadeInOrder(t *testing.T) {
 
 // 1124/AC2: the forge drops from a merge whitelist a user without access to the repository, and under the setup
 // account the tools' account has none; so once the repository is in the organisation its main rule is read back and
-// put right: the tools' account the only one that merges, mesh/check required.
+// put right: the tools' account the only one that merges, no status required (ADR 0534 §1).
 func TestOrganisationRuleListsTheToolsAfterTheMove(t *testing.T) {
 	f := newFake()
 	s, _ := syncer(t, f)
@@ -103,9 +102,8 @@ func TestOrganisationRuleListsTheToolsAfterTheMove(t *testing.T) {
 	if rule["enable_push"] != false {
 		t.Errorf("after the move main takes a push: %v", rule)
 	}
-	checks := strs(rule["status_check_contexts"])
-	if rule["enable_status_check"] != true || strings.Join(checks, ",") != CheckStatus {
-		t.Errorf("after the move main does not require mesh/check alone: %v", rule)
+	if !requiresNone(rule) {
+		t.Errorf("after the move main requires a status (ADR 0534 §1): %v", rule)
 	}
 	if r := result(o, "mesh-delivery"); r.Did != DidMade {
 		t.Errorf("outcome %+v, want made", r)
@@ -136,8 +134,7 @@ func TestAdminRuleLetsTheSetupLoginAlonePush(t *testing.T) {
 }
 
 // 1124/AC3: a listed repository that exists in the organisation is not made again, only its main rule put right;
-// a rule still letting the setup login push is narrowed, its statuses kept but the two mesh/check replaces (1124/AC5,
-// issue 1301).
+// a rule still letting the setup login push is narrowed, and requires no status (ADR 0534 §1).
 func TestExistingOrganisationRepositoryIsOnlyPutRight(t *testing.T) {
 	f := newFake()
 	hq := f.add("novox/hq", map[string]map[string]any{mainRule: {
@@ -157,12 +154,11 @@ func TestExistingOrganisationRepositoryIsOnlyPutRight(t *testing.T) {
 	if rule["enable_push"] != false || strings.Join(strs(rule["merge_whitelist_usernames"]), ",") != tools {
 		t.Errorf("hq's rule not narrowed: %v", rule)
 	}
-	checks := strs(rule["status_check_contexts"])
-	if strings.Join(checks, ",") != "other/x,mesh/check" {
-		t.Errorf("hq's rule requires %v, want other/x and mesh/check", checks)
+	if !requiresNone(rule) {
+		t.Errorf("hq's rule requires %v, want none (ADR 0534 §1)", rule["status_check_contexts"])
 	}
 	made := bare.Rules[mainRule]
-	if made == nil || made["enable_push"] != false || strings.Join(strs(made["status_check_contexts"]), ",") != CheckStatus {
+	if made == nil || made["enable_push"] != false || !requiresNone(made) {
 		t.Errorf("bare's rule: %v", made)
 	}
 	if hq.Commits != 0 || bare.Commits != 0 {
@@ -212,33 +208,33 @@ func TestRepositoryUnderTheSetupAccountIsFinished(t *testing.T) {
 	}
 }
 
-// 1124/AC5 as issue 1301 changes it: putting a rule right adds mesh/check when the rule requires mesh/merge-gate,
-// and keeps every other status there; a rule requiring mesh/repo-check alone keeps it (ADR 0503 §5).
-func TestStatusesAreAddedAndNeverDropped(t *testing.T) {
+// ADR 0534 §1: putting a rule right takes every required status off it, whichever they are, and a rule already right
+// is not written.
+func TestStatusesAreTakenOff(t *testing.T) {
 	f := newFake()
 	only := f.add("novox/only", map[string]map[string]any{mainRule: {
 		"enable_push": false, "enable_merge_whitelist": true, "merge_whitelist_usernames": []any{tools},
 		"enable_status_check": true, "status_check_contexts": []any{"mesh/repo-check"},
 	}}, "main")
-	more := f.add("novox/more", map[string]map[string]any{mainRule: {
+	right := f.add("novox/right", map[string]map[string]any{mainRule: {
 		"enable_push": false, "enable_merge_whitelist": true, "merge_whitelist_usernames": []any{tools},
-		"enable_status_check": true, "status_check_contexts": []any{"mesh/delivery", "mesh/check"},
+		"enable_status_check": false, "status_check_contexts": []any{},
 		"block_admin_merge_override": true, // right since issue 1141
 	}}, "main")
 	s, _ := syncer(t, f)
-	o := run(t, s, Value{"only": {}, "more": {}})
-	if c := strs(only.Rules[mainRule]["status_check_contexts"]); strings.Join(c, ",") != "mesh/repo-check" {
-		t.Errorf("only: %v", c)
+	o := run(t, s, Value{"only": {}, "right": {}})
+	if !requiresNone(only.Rules[mainRule]) {
+		t.Errorf("only: %v", only.Rules[mainRule]["status_check_contexts"])
 	}
-	if c := strs(more.Rules[mainRule]["status_check_contexts"]); len(c) != 2 || !has(c, "mesh/delivery") {
-		t.Errorf("more lost a status: %v", c)
+	if !requiresNone(right.Rules[mainRule]) {
+		t.Errorf("right: %v", right.Rules[mainRule]["status_check_contexts"])
 	}
 	for _, w := range f.writes() {
-		if strings.Contains(w, "/more/") {
+		if strings.Contains(w, "/right/") {
 			t.Errorf("a right rule was written: %s", w)
 		}
 	}
-	if result(o, "more").Did != DidUnchanged || result(o, "only").Did != DidPutRight {
+	if result(o, "right").Did != DidUnchanged || result(o, "only").Did != DidPutRight {
 		t.Errorf("outcome %+v", o)
 	}
 }

modules/gitea/files/config.json

@@ -1 +1 @@
-{}
+{"main-mergers": ["jschoubben"]}

modules/gitea/guard.ts

@@ -10,15 +10,16 @@
 //     Everything else — administration, protection, settings, collaborators, teams, hooks, keys, tokens,
 //     statuses, a merge, a repository deleted or moved — has its own tool or is the operator's, at the
 //     forge as themselves;
-//   - `gitea_branch_protection_set` only makes protection stronger;
-//   - `gitea_merge_pull_request` merges only a head whose every required status succeeded, and only that
-//     head;
+//   - `gitea_branch_protection_set` lets no person push and no administrator merge past a rule, and on main keeps
+//     the tools' account the only one that merges; it requires no status, as no rule of the mesh does (ADR 0534 §5);
+//   - `gitea_merge_pull_request` merges only into a branch that refuses its push, only a head whose mesh/check passed
+//     against the trunk's head, approved by the operator where the branch requires no status (ADR 0534 §4), and only
+//     that head;
 //   - `gitea_delete_repo` refuses a repository any protection rule guards.
 //
 // Pure, so it is tested without a forge; the tools do the asking (tools/index.ts).
 
-import { MAIN_BRANCH, type BranchProtection, type ProtectionWanted } from "./protection.js";
-import { TOOLS_ACCOUNT } from "./tools-account.js";
+import { MAIN_BRANCH, mainMergers, type BranchProtection, type ProtectionWanted } from "./protection.js";
 
 /** A refusal of policy, in the words the caller sees. Never an error of the forge's. */
 export class Refused extends Error {
@@ -163,7 +164,7 @@ export function judgeApiCall(method: string, rawPath: string, body: unknown): Ap
       `that is not the default branch and that no protection rule names. The forge's administration, a ` +
       `branch's protection, a repository's settings, collaborators, teams, hooks, keys, tokens and statuses ` +
       `are the operator's at the forge, or have their own tool (gitea_merge_pull_request, gitea_commit_status, ` +
-      `gitea_branch_protection_set, which only strengthens). Nothing was sent`,
+      `gitea_branch_protection_set, which never lets a person push). Nothing was sent`,
   };
 }
 
@@ -287,7 +288,7 @@ export function judgeContentsWrite(target: string, defaultBranch: string, rules:
  * Refuses a protection change that weakens what guards a branch (novox/hq ADR 0266): the branch's own rule, or —
  * when it has none — every glob rule that covers it, since a rule named for the branch takes the glob's place.
  * A rule made new takes the forge's defaults for what it does not say: pushes refused, an administrator's
- * override allowed.
+ * override allowed. A required status taken away is no weakening: no rule of the mesh requires one (ADR 0534 §5).
  */
 export function judgeProtectionChange(before: BranchProtection | null, want: ProtectionWanted,
   covering: BranchProtection[] = [], branch = ""): string | null {
@@ -305,37 +306,34 @@ export function judgeProtectionChange(before: BranchProtection | null, want: Pro
     }
     return null; // A new rule protects what nothing protected.
   }
-  const had = before.enable_status_check ? [...new Set((before.status_check_contexts ?? []).filter(Boolean))] : [];
-  const wanted = new Set(want.statusChecks.map((c) => c.trim()).filter(Boolean));
-  const dropped = had.filter((c) => !wanted.has(c));
   const why: string[] = [];
-  if (dropped.length) why.push(`it drops the required status ${dropped.join(", ")}`);
   if (want.push === true && before.enable_push === false) why.push("it lets a person push to the branch directly");
   if (want.blockAdminOverride === false && before.block_admin_merge_override === true) {
-    why.push("it lets an administrator merge past a status that has not succeeded");
+    why.push("it lets an administrator merge past what the rule asks");
   }
   if (!why.length) return null;
   return `the protection of ${before.rule_name ?? before.branch_name} is only made stronger through a tool: ` +
     `${why.join("; ")}. Whoever may call a tool includes agents, and a branch's protection is what keeps a ` +
-    `change from merging without its checks and the operator (novox/hq ADR 0266) — weakening it is the ` +
+    `change from landing but through a pull request the operator approved (novox/hq ADR 0266, ADR 0534) — weakening it is the ` +
     `operator's, at the forge as themselves. Nothing was changed`;
 }
 
-/** Main's rule takes no push and lets only the tools' account merge (novox/hq ADR 0398 §2, issue 948): a change
- *  that enables push, drops the merge whitelist or widens it past that account is refused, whatever the rule was. */
+/** Main's rule takes no push and lets only the tools' account and main-mergers merge (novox/hq ADR 0398 §2, issue 948,
+ *  ADR 0534 §2): a change that enables push, drops the merge whitelist or widens it past them is refused, whatever the
+ *  rule was. */
 function judgeMain(before: BranchProtection | null, want: ProtectionWanted): string | null {
   const why: string[] = [];
   if (want.push === true) why.push("it lets a person push to the branch directly");
   if (want.mergeWhitelist !== undefined) {
     const names = want.mergeWhitelist ?? [];
     if (names.length === 0) why.push("it drops the merge whitelist of main");
-    else if (names.some((n) => n !== TOOLS_ACCOUNT)) {
-      why.push(`it widens who may merge into main beyond ${TOOLS_ACCOUNT}`);
+    else if (names.some((n) => !mainMergers().includes(n))) {
+      why.push(`it widens who may merge into main beyond ${mainMergers().join(", ")}`);
     }
   }
   if (!why.length) return null;
   return `the protection of ${before?.rule_name ?? before?.branch_name ?? "main"} is only made stronger through a tool: ` +
-    `${why.join("; ")}. Main takes no push, and only ${TOOLS_ACCOUNT} merges into it (novox/hq ADR 0398 §2) — ` +
+    `${why.join("; ")}. Main takes no push, and only ${mainMergers().join(" and ")} merge into it (novox/hq ADR 0398 §2, ADR 0534 §2) — ` +
     `weakening that is the operator's, at the forge as themselves. Nothing was changed`;
 }
 

modules/gitea/merge.ts

@@ -5,10 +5,12 @@
 // puts its statuses back to pending through that writer, so where the check runs is said and no second check is asked.
 // Each bundle the runtime serves is its own process; from the tools' bundle the pending bypassed the writer's chain.
 //
-// **It judges on the status the base requires** (issue 1301; ADR 0447 §1, §4; ADR 0503 §5): mesh/check, the checker's,
-// whose line names the trunk it judged ("pass <head12> on <trunk12>"); where a base does not require it, the controller's
-// status it still requires (hq's mesh/repo-check), as before. A mesh/check of another trunk is refused and nothing is
-// asked: the checker sets it out of date on the trunk's move and checks it again.
+// **It judges mesh/check whether or not the base requires it** (issue 1301; ADR 0447 §1, §4; ADR 0534 §4): the checker's
+// verdict, whose line names the trunk it judged ("pass <head12> on <trunk12>"), must be a pass against the trunk's head.
+// The forge requires no status to merge (ADR 0534 §1); where a base still requires one of the controller's old statuses,
+// until the forge's holder takes it off, that status judges, as before. A mesh/check of another trunk is refused and
+// nothing is asked: the checker sets it out of date on the trunk's move and checks it again. Where the base requires no
+// status, only a head the operator's Approve names (approved_heads) merges (ADR 0534 §4, ADR 0421 §9).
 
 import { announce } from "./announce.js";
 import type { ToolDefinition } from "@novox/mesh-sdk/tools";
@@ -36,9 +38,10 @@ export function mergeTool(gitea: GiteaClient, given: MergeDeps): ToolDefinition
     now: given.now ?? (() => new Date()) };
   return {
     name: "gitea_merge_pull_request",
-    description: "Merge a pull request at the head you name — the commit you reviewed — when that is still its head " +
-      "and every status its base branch's protection requires succeeded there (mesh/check; hq's mesh/repo-check), " +
-      "judged against the trunk's head as it is now, optionally deleting the source branch afterwards. Refused " +
+    description: "Merge a pull request at the head you name — the commit you reviewed — when that is still its head, " +
+      "its base refuses this account's push, its mesh/check passed judged against the trunk's head as it is now, and, " +
+      "where the base requires no status (novox/hq ADR 0534), the operator's Approve names it in approved_heads; " +
+      "optionally deleting the source branch afterwards. Refused " +
       "otherwise, with nothing merged: no tool merges past a check, and none merges a head that moved after it was " +
       "reviewed. A verdict judged against an earlier trunk commit is refused, naming both, and the head's check against " +
       "the trunk's head is asked once, with how long the last check of the repository took: ask again at the same head " +
@@ -100,11 +103,11 @@ export function mergeTool(gitea: GiteaClient, given: MergeDeps): ToolDefinition
           `approved (novox/hq ADR 0421). Nothing was merged`);
       }
       const rule = await gitea.appliedProtection(owner, repo, pull.base);
-      // Only into a branch whose protection requires the checks: a pull request whose base was moved to a
-      // branch nothing guards would merge past every check (novox/hq ADR 0266).
-      if (!rule || !rule.enable_status_check || !(rule.status_check_contexts ?? []).filter(Boolean).length) {
-        throw new Refused(`${owner}/${repo}#${number} merges into ${pull.base}, which no protection rule requiring ` +
-          `the checks guards: a tool merges only into such a branch (novox/hq ADR 0266). Nothing was merged`);
+      // Only into a branch whose protection refuses this account's push: a pull request whose base was moved to a
+      // branch nothing guards would land where anyone pushes (novox/hq ADR 0266, ADR 0534 §4).
+      if (!rule || rule.enable_push !== false) {
+        throw new Refused(`${owner}/${repo}#${number} merges into ${pull.base}, which no protection rule refusing ` +
+          `a push guards: a tool merges only into such a branch (novox/hq ADR 0266, ADR 0534). Nothing was merged`);
       }
       // **The verdict must be judged against the trunk's head** (novox/hq ADR 0323 §5, issue 341): a check judges the
       // head merged into a named trunk commit, and a merge of another trunk is not the one that check judged. Compared
@@ -114,7 +117,16 @@ export function mergeTool(gitea: GiteaClient, given: MergeDeps): ToolDefinition
       const trunkHead = await gitea.branchHead(owner, repo, pull.base);
       const checks = await gitea.headChecks(owner, repo, pull.head_sha);
       const required = requiredOf(rule) ?? [];
-      if (required.includes(CHECK_STATUS)) {
+      // **The forge requires no status; the operator's Approve and mesh/check do** (ADR 0534 §4): where the base requires
+      // no status, only a head the Approve names merges, and mesh/check judges it as where it was required.
+      if (required.length === 0 && !approved) {
+        throw new Refused(`${owner}/${repo}#${number} is not merged: ${pull.base} requires no status, so a merge into it ` +
+          `lands only a head the operator's Approve names: give approved_heads with ${owner}/${repo}@<full sha> ` +
+          `(novox/hq ADR 0534, ADR 0421 §9). Nothing was merged`);
+      }
+      const kept = maintained(required);
+      const byCheck = required.includes(CHECK_STATUS) || kept.length === 0;
+      if (byCheck) {
         // **mesh/check is the checker's** (ADR 0447 §4): it is judged here against the trunk's head, and refused when it
         // is not current; nothing is written or asked — the checker checks a head again when its trunk moves.
         const check = checks[CHECK_STATUS];
@@ -124,6 +136,10 @@ export function mergeTool(gitea: GiteaClient, given: MergeDeps): ToolDefinition
             `${check ? `pending (${check.description ?? ""})` : "not set yet"}; the checker answers it. Ask again at ` +
             `${twelve(pull.head_sha)} once it passes against ${pull.base}'s head ${twelve(trunkHead)}. Nothing was merged`);
         }
+        if (check.state !== "success") {
+          throw new Refused(`${owner}/${repo}#${number} is not merged: its ${CHECK_STATUS} is ${check.state} ` +
+            `(${check.description ?? ""}). A pull request merges once its check passes (novox/hq ADR 0534). Nothing was merged`);
+        }
         if (!at.current) {
           throw new Refused(`${owner}/${repo}#${number} is not merged: its ${CHECK_STATUS} ` +
             `${at.judged ? `was judged on trunk ${twelve(at.judged)}` : "names no trunk commit it was judged on"}, and ` +
@@ -133,7 +149,6 @@ export function mergeTool(gitea: GiteaClient, given: MergeDeps): ToolDefinition
       }
       // Where the base still requires the controller's statuses (hq's mesh/repo-check; mesh/merge-gate only on a
       // revert), the first it requires judges, as before (ADR 0323 §5).
-      const kept = maintained(required);
       const judge = kept[0] ?? CHECK_CONTEXT;
       const at = kept.length ? verdictAtTrunk(checks, trunkHead, judge) : { current: true, onItsWay: false };
       if (!at.current) {
@@ -197,9 +212,9 @@ export function mergeTool(gitea: GiteaClient, given: MergeDeps): ToolDefinition
       // of them is no verdict to merge on, never read as none.
       // Under mesh/check (issue 1301) the group is the checker's one verdict on every member's head (ADR 0447 §2) and the
       // Approve's heads above; a record the controller's verdicts left before the switch judges nothing there.
-      const heard = required.includes(CHECK_STATUS) ? undefined : readSiblings(siblingsFile(deps.stateDir))[memberKey(owner, repo, number)];
+      const heard = byCheck ? undefined : readSiblings(siblingsFile(deps.stateDir))[memberKey(owner, repo, number)];
       const siblings = heard && sameCommit(heard.head, pull.head_sha) ? heard.siblings : [];
-      if (!siblings.length && !required.includes(CHECK_STATUS) &&
+      if (!siblings.length && !byCheck &&
         namesSiblings(statuses.find((s) => s.context === CHECK_CONTEXT)?.description)) {
         throw new Refused(`${owner}/${repo}#${number} is not merged: its verdict read siblings, and which ones is not held ` +
           `here, so the group cannot be weighed. Ask its check again at ${twelve(pull.head_sha)}. Nothing was merged`);

modules/gitea/module.json

@@ -172,9 +172,15 @@
     },
     "repositories": {
       "type": "object",
-      "description": "The repositories of the organisation novox the mesh holds (ADR 0428): each by name, {\"<name>\": {\"private\": true, \"description\": \"...\"}}. One that does not exist is made by the module's setup login under its own account, its main protected and given a first commit (a README naming the description and a merge-check.sh), its rule narrowed to no push and the tools' merge requiring mesh/check, and only then moved into the organisation; one that exists only has main's rule put right, mesh/check in place of mesh/merge-gate and mesh/repo-check and its other statuses kept (a main requiring mesh/repo-check alone keeps it). Every other repository whose main requires mesh/merge-gate has the two swapped for mesh/check; nothing else of a repository out of the value is touched.",
+      "description": "The repositories of the organisation novox the mesh holds (ADR 0428): each by name, {\"<name>\": {\"private\": true, \"description\": \"...\"}}. One that does not exist is made by the module's setup login under its own account, its main protected and given a first commit (a README naming the description and a merge-check.sh), its rule narrowed to no push, the tools' account and main-mergers alone merging, and no status required (ADR 0534), and only then moved into the organisation; one that exists only has main's rule put right so. Every other repository has the statuses its main requires taken off; nothing else of a repository out of the value is touched.",
       "trusted": true,
       "default": {}
+    },
+    "main-mergers": {
+      "type": "list",
+      "description": "The forge logins that may merge into main beside the tools' account, on every repository of the organisation (ADR 0534 §2): the operator's own, so the operator can always merge by hand at the forge. The tools' account is always on main's merge whitelist; no agent's account belongs here.",
+      "trusted": true,
+      "default": ["jschoubben"]
     }
   },
   "facts": {
@@ -303,7 +309,8 @@
       "template": "files/config.json",
       "merge": "json",
       "takes-config": [
-        "url"
+        "url",
+        "main-mergers"
       ]
     },
     {
@@ -366,10 +373,12 @@
         "MESH_GITEA_ADMIN_PASSWORD_FILE": "${dir:state}/admin.secret",
         "MESH_GITEA_TOOLS_USER": "mesh-tools",
         "MESH_REPOSITORIES_FILE": "${dir:mesh-state}/repositories.json",
-        "MESH_REPOSITORIES_OUTCOME": "${dir:runtime-state}/repositories-outcome.json"
+        "MESH_REPOSITORIES_OUTCOME": "${dir:runtime-state}/repositories-outcome.json",
+        "MESH_GITEA_CONFIG_FILE": "${dir:mesh-state}/config.json"
       },
       "restart-on": [
-        "repositories-file"
+        "repositories-file",
+        "runtime-config"
       ]
     }
   ],

modules/gitea/protection.ts

@@ -1,7 +1,9 @@
-// A branch's protection (novox/hq ADR 0237): what makes a pull request wait for the mesh's check — `mesh/check`,
-// the checker's verdict on the head merged onto its trunk (ADR 0447 §1; hq's `mesh/repo-check` until issue 1296) —
-// before it may merge. Pure, so it is tested without a forge; the client does the asking (client.ts).
+// A branch's protection (novox/hq ADR 0237): no direct push, and on main only the tools' account merges (ADR 0398 §2).
+// The forge requires no status to merge (ADR 0534 §1): the checks still run and report, and mesh-delivery and the
+// merge tool judge them (ADR 0534 §3, §4), never the forge. Pure, so it is tested without a forge; the client does the
+// asking (client.ts).
 
+import { readFileSync } from "node:fs";
 import { TOOLS_ACCOUNT } from "./tools-account.js";
 
 /** The branch whose rule takes no push and lets only the tools' account merge (novox/hq ADR 0398 §2, issue 948). */
@@ -24,26 +26,50 @@ export interface BranchProtection {
 /** What a branch's protection is set to. A field not given is left as the rule has it (or the forge's
  *  default on a new rule), except pushes, which a new rule refuses unless `push` says otherwise. */
 export interface ProtectionWanted {
-  /** The statuses a pull request must have succeeded before it merges, e.g. mesh/check. Empty: none. */
-  statusChecks: string[];
   /** Whether a person may push to the branch directly. */
   push?: boolean;
-  /** Whether an administrator is stopped from merging past a status that has not succeeded. */
+  /** Whether an administrator is stopped from merging past what the rule asks. */
   blockAdminOverride?: boolean;
   /** Who may merge into the branch; for main only ever the tools' account (ADR 0398 §2). Not given: left as it is.
    *  Empty or null asks for no whitelist, which the guard refuses for main; the body for main ignores it. */
   mergeWhitelist?: string[] | null;
 }
 
-/** What main's rule always says: no push, and only the tools' account merges (novox/hq ADR 0398 §2, issue 948). */
-export function mainRuleBody(): Record<string, unknown> {
-  return { enable_push: false, enable_merge_whitelist: true, merge_whitelist_usernames: [TOOLS_ACCOUNT] };
+/** What every rule the mesh writes says of statuses: none is required to merge (novox/hq ADR 0534 §1). */
+export function noStatusBody(): Record<string, unknown> {
+  return { enable_status_check: false, status_check_contexts: [] };
+}
+
+/** A forge login a merge whitelist may name. */
+const LOGIN = /^[A-Za-z0-9_][A-Za-z0-9_.-]{0,39}$/;
+
+/** Who merges into main: the tools' account, for mesh-delivery, then each login of the module's config value
+ *  main-mergers once, the operator's own, so the operator can always merge by hand at the forge (novox/hq ADR 0534 §2).
+ *  Read from the module's runtime config file (MESH_GITEA_CONFIG_FILE); a file not there, or a name that is no login,
+ *  leaves the tools' account alone, the narrowest whitelist. */
+export function mainMergers(env: NodeJS.ProcessEnv = process.env): string[] {
+  const out = [TOOLS_ACCOUNT];
+  let given: unknown = [];
+  try {
+    if (env.MESH_GITEA_CONFIG_FILE) given = JSON.parse(readFileSync(env.MESH_GITEA_CONFIG_FILE, "utf8"))["main-mergers"] ?? [];
+  } catch {
+    given = [];
+  }
+  for (const name of Array.isArray(given) ? given : []) {
+    if (typeof name === "string" && LOGIN.test(name) && !name.includes("..") && !out.includes(name)) out.push(name);
+  }
+  return out;
+}
+
+/** What main's rule always says: no push, only the tools' account and main-mergers merge (novox/hq ADR 0398 §2,
+ *  issue 948, ADR 0534 §2), and no status required (ADR 0534 §1). */
+export function mainRuleBody(mergers: string[] = mainMergers()): Record<string, unknown> {
+  return { enable_push: false, enable_merge_whitelist: true, merge_whitelist_usernames: mergers, ...noStatusBody() };
 }
 
 /** The forge's body for a wanted protection. */
 export function protectionBody(want: ProtectionWanted, creating: boolean, branch = ""): Record<string, unknown> {
-  const checks = [...new Set(want.statusChecks.map((c) => c.trim()).filter(Boolean))];
-  const body: Record<string, unknown> = { enable_status_check: checks.length > 0, status_check_contexts: checks };
+  const body: Record<string, unknown> = noStatusBody();
   if (want.push !== undefined) body.enable_push = want.push;
   else if (creating) body.enable_push = false;
   if (want.blockAdminOverride !== undefined) body.block_admin_merge_override = want.blockAdminOverride;

modules/gitea/test/guard.test.ts

@@ -109,7 +109,7 @@ const server = createServer(async (req, res) => {
     const rule = (state.rules as any[]).find((r) => ruleCovers(String(r.rule_name ?? r.branch_name), branch));
     return json(res, 200, { name: branch, commit: { id: branch === "main" ? state.trunk : "c0ffee" }, protected: !!rule,
       ...(rule ? { effective_branch_protection_name: rule.rule_name ?? rule.branch_name, enable_status_check: !!rule.enable_status_check,
-        status_check_contexts: rule.status_check_contexts ?? [], required_approvals: rule.required_approvals ?? 0, user_can_push: false } : {}) });
+        status_check_contexts: rule.status_check_contexts ?? [], required_approvals: rule.required_approvals ?? 0, user_can_push: !!rule.enable_push } : {}) });
   }
   if (method === "GET" && path === `${repo}/pulls/7/files`) {
     return json(res, 200, url.searchParams.get("page") === "1" ? [{ filename: "modules/gitea/x.ts", status: "modified" }] : []);
@@ -237,18 +237,24 @@ test("gitea_api still writes what an author writes", async () => {
   assert.deepEqual(writes(), ["POST /repos/novox/mesh-catalog/issues/3/comments", "POST /repos/novox/mesh-catalog/pulls/7/reviews"]);
 });
 
-test("gitea_branch_protection_set only strengthens", async () => {
+// **The forge requires no status to merge** (novox/hq ADR 0534 §5): the tool writes no required status and takes no
+// status argument; taking a required status away is no weakening it refuses, and a push or an administrator's merge
+// past the rule still is.
+test("gitea_branch_protection_set writes no required status, and refuses a push or an administrator's override", async () => {
   state.admin = true; // a repository administrator's token: the tools' account is refused the rules by the forge
   const set = (args: Record<string, unknown>) =>
     tool("gitea_branch_protection_set").run({ owner: "novox", repo: "mesh-catalog", branch: "main", ...args });
-  await assert.rejects(set({ status_checks: "" }), /drops the required status mesh\/merge-gate, mesh\/repo-check/);
-  await assert.rejects(set({ status_checks: "mesh/merge-gate" }), /drops the required status mesh\/repo-check/);
-  await assert.rejects(set({ status_checks: "mesh/merge-gate,mesh/repo-check", push: true }), /push to the branch directly/);
-  await assert.rejects(set({ status_checks: "mesh/merge-gate,mesh/repo-check", block_admin_override: false }),
-    /merge past a status/);
+  assert.equal((tool("gitea_branch_protection_set").input as Record<string, unknown>).status_checks, undefined,
+    "the tool takes no status argument");
+  await assert.rejects(set({ push: true }), /push to the branch directly/);
+  await assert.rejects(set({ block_admin_override: false }), /merge past/);
   assert.deepEqual(writes(), []);
-  await set({ status_checks: "mesh/merge-gate,mesh/repo-check,mesh/delivery" });
+  await set({ status_checks: "mesh/check" }); // an argument it no longer takes is not read
   assert.deepEqual(writes(), ["PATCH /repos/novox/mesh-catalog/branch_protections/main"]);
+  const sent = state.sent[0].body;
+  assert.equal(sent.enable_status_check, false);
+  assert.deepEqual(sent.status_check_contexts, []);
+  assert.equal(sent.enable_push, false);
 });
 
 test("gitea_merge_pull_request merges only a head whose required statuses all succeeded, and only that head", async () => {
@@ -474,26 +480,62 @@ test("gitea_api sends the path it judged, and refuses moving a pull request's ba
   assert.equal(writes().length, 2);
 });
 
-test("gitea_merge_pull_request merges only into a branch whose protection requires the checks", async () => {
+test("gitea_merge_pull_request merges only into a branch whose protection refuses its push", async () => {
+  const approved_heads = [`novox/mesh-catalog@${REVIEWED}`];
+  state.statuses = [{ context: "mesh/check", state: "success", description: `pass ${REVIEWED.slice(0, 12)} on ${TRUNK.slice(0, 12)}` }];
   state.rules = [];
-  await assert.rejects(tool("gitea_merge_pull_request").run({ owner: "novox", repo: "mesh-catalog", number: 7, head: REVIEWED }),
-    /no protection rule requiring the checks guards/);
-  state.rules = [{ rule_name: "main", enable_push: false, enable_status_check: false, status_check_contexts: [] }];
-  await assert.rejects(tool("gitea_merge_pull_request").run({ owner: "novox", repo: "mesh-catalog", number: 7, head: REVIEWED }),
-    /no protection rule requiring the checks guards/);
+  await assert.rejects(tool("gitea_merge_pull_request").run({ owner: "novox", repo: "mesh-catalog", number: 7, head: REVIEWED,
+    approved_heads }), /no protection rule refusing/);
+  state.rules = [{ rule_name: "main", enable_push: true, enable_status_check: false, status_check_contexts: [] }];
+  await assert.rejects(tool("gitea_merge_pull_request").run({ owner: "novox", repo: "mesh-catalog", number: 7, head: REVIEWED,
+    approved_heads }), /no protection rule refusing/);
   assert.deepEqual(writes(), []);
 });
 
+// **The forge requires no status to merge; the merge tool still judges mesh/check, and asks the operator's Approve**
+// (novox/hq ADR 0534 §4): on a main whose rule takes no push and requires no status, a head merges only with
+// approved_heads naming it and a mesh/check that passed against the trunk's head at the merge.
+test("gitea_merge_pull_request judges mesh/check on a main requiring no status, and merges only an approved head", async () => {
+  const { keepSiblings, siblingsFile } = await import("../dist/siblings.js");
+  keepSiblings(siblingsFile(stateDir), {});
+  const approved_heads = [`novox/mesh-catalog@${REVIEWED}`];
+  const merge = (args: Record<string, unknown> = { approved_heads }) =>
+    tool("gitea_merge_pull_request").run({ owner: "novox", repo: "mesh-catalog", number: 7, head: REVIEWED, ...args });
+  state.rules = [{ rule_name: "main", enable_push: false, enable_status_check: false, status_check_contexts: [],
+    block_admin_merge_override: true, enable_merge_whitelist: true, merge_whitelist_usernames: ["mesh-tools"] }];
+  const line = (trunk: string, s = "success", words = "pass") =>
+    [{ context: "mesh/check", state: s, description: `${words} ${REVIEWED.slice(0, 12)} on ${trunk.slice(0, 12)} | unit 12 run` }];
+  const before = state.emitted.length;
+
+  state.statuses = line(TRUNK);
+  await assert.rejects(merge({}), /Approve/);
+  state.statuses = [];
+  await assert.rejects(merge(), /mesh\/check is not set yet/);
+  state.statuses = line(TRUNK, "pending", "checking");
+  await assert.rejects(merge(), /mesh\/check is pending/);
+  state.statuses = line(TRUNK, "failure", "fail");
+  await assert.rejects(merge(), /mesh\/check is failure/);
+  state.statuses = line(MOVED);
+  await assert.rejects(merge(), new RegExp(`${MOVED.slice(0, 12)}.*${TRUNK.slice(0, 12)}`));
+  state.statuses = judgedAt(TRUNK); // the old two, current: not mesh/check
+  await assert.rejects(merge(), /mesh\/check/);
+  assert.deepEqual(writes(), [], "nothing is written: mesh/check is the checker's");
+  assert.equal(state.emitted.length, before, "no check is asked");
+  assert.equal(state.merged, false);
+
+  state.statuses = line(TRUNK);
+  assert.equal(((await merge()) as Record<string, unknown>).merged, true);
+});
+
 test("a rule named for a branch is not made weaker than the glob rule that guards it now", async () => {
   state.admin = true; // reads the rules' list, a repository administrator's (novox/hq ADR 0365)
   state.rules.push({ rule_name: "release/*", enable_push: false, enable_status_check: true,
     status_check_contexts: ["mesh/merge-gate"], block_admin_merge_override: true });
   const set = (args: Record<string, unknown>) =>
     tool("gitea_branch_protection_set").run({ owner: "novox", repo: "mesh-catalog", branch: "release/1", ...args });
-  await assert.rejects(set({ status_checks: "" }), /drops the required status mesh\/merge-gate/);
-  await assert.rejects(set({ status_checks: "mesh/merge-gate" }), /merge past a status/);
+  await assert.rejects(set({}), /merge past/);
   assert.deepEqual(writes(), []);
-  await set({ status_checks: "mesh/merge-gate", block_admin_override: true });
+  await set({ block_admin_override: true }); // the glob's required status is no longer asked (ADR 0534 §5)
   assert.deepEqual(writes(), ["POST /repos/novox/mesh-catalog/branch_protections"]);
 });
 
@@ -511,26 +553,25 @@ test("the judges, without a forge", () => {
   assert.ok("refused" in judgeApiCall("POST", "/repos/a/b/branch_protections", {}));
   assert.ok("contents" in judgeApiCall("POST", "/repos/a/b/contents", { new_branch: "x" }));
   assert.ok(ruleCovers("release/**", "release/a/b") && ruleCovers("feat/*", "feat/a") && !ruleCovers("feat/*", "feat/a/b"));
-  assert.equal(judgeProtectionChange(null, { statusChecks: [] }), null);
-  assert.equal(judgeProtectionChange(protectedMain(), { statusChecks: ["mesh/repo-check", "mesh/merge-gate"] }), null);
+  assert.equal(judgeProtectionChange(null, {}), null);
+  assert.equal(judgeProtectionChange(protectedMain(), {}), null, "taking its required statuses off is no weakening (ADR 0534 §5)");
 });
 
 test("main's protection is never weakened in its push or its merge whitelist (issue 948, ADR 0398 §2)", () => {
   const strong = () => ({ ...protectedMain(), enable_merge_whitelist: true, merge_whitelist_usernames: ["mesh-tools"] });
-  const checks = ["mesh/merge-gate", "mesh/repo-check"];
-  assert.equal(judgeProtectionChange(strong(), { statusChecks: checks }, [], "main"), null);
-  assert.equal(judgeProtectionChange(strong(), { statusChecks: checks, mergeWhitelist: ["mesh-tools"] }, [], "main"), null);
-  assert.match(judgeProtectionChange(strong(), { statusChecks: checks, mergeWhitelist: [] }, [], "main") ?? "", /merge whitelist/);
-  assert.match(judgeProtectionChange(strong(), { statusChecks: checks, mergeWhitelist: null }, [], "main") ?? "", /merge whitelist/);
-  assert.match(judgeProtectionChange(strong(), { statusChecks: checks, mergeWhitelist: ["mesh-tools", "agent-ace"] }, [], "main") ?? "", /widens/);
-  assert.match(judgeProtectionChange(strong(), { statusChecks: checks, mergeWhitelist: ["agent-ace"] }, [], "main") ?? "", /widens/);
-  assert.match(judgeProtectionChange(strong(), { statusChecks: checks, push: true }, [], "main") ?? "", /push/);
+  assert.equal(judgeProtectionChange(strong(), {}, [], "main"), null);
+  assert.equal(judgeProtectionChange(strong(), { mergeWhitelist: ["mesh-tools"] }, [], "main"), null);
+  assert.match(judgeProtectionChange(strong(), { mergeWhitelist: [] }, [], "main") ?? "", /merge whitelist/);
+  assert.match(judgeProtectionChange(strong(), { mergeWhitelist: null }, [], "main") ?? "", /merge whitelist/);
+  assert.match(judgeProtectionChange(strong(), { mergeWhitelist: ["mesh-tools", "agent-ace"] }, [], "main") ?? "", /widens/);
+  assert.match(judgeProtectionChange(strong(), { mergeWhitelist: ["agent-ace"] }, [], "main") ?? "", /widens/);
+  assert.match(judgeProtectionChange(strong(), { push: true }, [], "main") ?? "", /push/);
   // Even a rule that lets a person push already, or has no rule yet, is not given a push through a tool.
-  assert.match(judgeProtectionChange({ ...strong(), enable_push: true }, { statusChecks: checks, push: true }, [], "main") ?? "", /push/);
-  assert.match(judgeProtectionChange(null, { statusChecks: checks, push: true }, [], "main") ?? "", /push/);
-  assert.match(judgeProtectionChange(null, { statusChecks: checks, mergeWhitelist: ["agent-ace"] }, [], "main") ?? "", /widens/);
+  assert.match(judgeProtectionChange({ ...strong(), enable_push: true }, { push: true }, [], "main") ?? "", /push/);
+  assert.match(judgeProtectionChange(null, { push: true }, [], "main") ?? "", /push/);
+  assert.match(judgeProtectionChange(null, { mergeWhitelist: ["agent-ace"] }, [], "main") ?? "", /widens/);
   // Another branch is judged as before.
-  assert.equal(judgeProtectionChange(null, { statusChecks: checks, push: true }, [], "feat/x"), null);
+  assert.equal(judgeProtectionChange(null, { push: true }, [], "feat/x"), null);
 });
 
 test("gitea_api never acts as another user: sudo, in any case, and any query key it does not send are refused", async () => {

modules/gitea/test/protection-read.test.ts

@@ -52,7 +52,7 @@ test("gitea_branch_protection_get answers the rule for a branch, null when it ha
 
 test("gitea_branch_protection_set still gets the forge's refusal, as the tools' account", async () => {
   await assert.rejects(
-    tool("gitea_branch_protection_set").run({ owner: "novox", repo: "mesh-controller", branch: "main", status_checks: "mesh/merge-gate" }),
+    tool("gitea_branch_protection_set").run({ owner: "novox", repo: "mesh-controller", branch: "main" }),
     /403/,
   );
   assert.ok(!seen.some((s) => /^(PATCH|POST|PUT|DELETE) .*branch_protections.* as admin$/.test(s)), seen.join("\n"));

modules/gitea/test/protection.test.ts

@@ -4,32 +4,33 @@ import { test } from "node:test";
 // A branch's protection (novox/hq ADR 0237): what the operator's agent sets so a pull request waits for the
 // mesh's merge check before it merges.
 
-test("the statuses asked for replace the rule's, and an empty list requires none", async () => {
+test("a rule's body requires no status, whatever the rule required (ADR 0534 §5)", async () => {
   const { protectionBody } = await import("../dist/protection.js");
-  assert.deepEqual(protectionBody({ statusChecks: ["mesh/merge-gate", " mesh/repo-check", "", "mesh/merge-gate"] }, false),
-    { enable_status_check: true, status_check_contexts: ["mesh/merge-gate", "mesh/repo-check"] },
-    "an edited rule keeps its pushes as they are, and each status once");
-  assert.deepEqual(protectionBody({ statusChecks: [] }, false), { enable_status_check: false, status_check_contexts: [] });
+  assert.deepEqual(protectionBody({}, false), { enable_status_check: false, status_check_contexts: [] },
+    "an edited rule keeps its pushes as they are, and requires no status");
 });
 
 test("a new rule refuses direct pushes unless asked; an administrator's override only when said", async () => {
   const { protectionBody } = await import("../dist/protection.js");
-  assert.equal(protectionBody({ statusChecks: ["mesh/merge-gate"] }, true).enable_push, false);
-  assert.equal(protectionBody({ statusChecks: ["mesh/merge-gate"], push: true }, true).enable_push, true);
-  assert.equal(protectionBody({ statusChecks: ["mesh/merge-gate"] }, true).block_admin_merge_override, undefined);
-  assert.equal(protectionBody({ statusChecks: ["mesh/merge-gate"], blockAdminOverride: true }, false).block_admin_merge_override, true);
+  assert.equal(protectionBody({}, true).enable_push, false);
+  assert.equal(protectionBody({ push: true }, true).enable_push, true);
+  assert.equal(protectionBody({}, true).block_admin_merge_override, undefined);
+  assert.equal(protectionBody({ blockAdminOverride: true }, false).block_admin_merge_override, true);
 });
 
-// Issue 948 (novox/hq ADR 0398 §2): main takes no push, and only the tools' account merges.
+// Issue 948 (novox/hq ADR 0398 §2): main takes no push, and only the tools' account merges; it requires no status
+// (ADR 0534 §1).
 test("main's body always refuses pushes and lets only the tools' account merge, whatever is asked", async () => {
   const { protectionBody } = await import("../dist/protection.js");
   const { TOOLS_ACCOUNT } = await import("../dist/tools-account.js");
   for (const creating of [true, false]) {
-    for (const want of [{ statusChecks: ["mesh/merge-gate"] }, { statusChecks: [], push: true }, { statusChecks: [], push: false }]) {
+    for (const want of [{}, { push: true }, { push: false }]) {
       const body = protectionBody(want, creating, "main");
       assert.equal(body.enable_push, false, "main takes no push, an edit and a push=true included");
       assert.equal(body.enable_merge_whitelist, true);
       assert.deepEqual(body.merge_whitelist_usernames, [TOOLS_ACCOUNT]);
+      assert.equal(body.enable_status_check, false);
+      assert.deepEqual(body.status_check_contexts, []);
     }
   }
   assert.deepEqual(TOOLS_ACCOUNT, "mesh-tools");
@@ -37,13 +38,28 @@ test("main's body always refuses pushes and lets only the tools' account merge,
 
 test("another branch's body carries no merge whitelist", async () => {
   const { protectionBody } = await import("../dist/protection.js");
-  const body = protectionBody({ statusChecks: ["mesh/merge-gate"] }, false, "release/1");
+  const body = protectionBody({}, false, "release/1");
   assert.equal(body.enable_merge_whitelist, undefined);
   assert.equal(body.merge_whitelist_usernames, undefined);
-  assert.equal(protectionBody({ statusChecks: [] }, false).enable_merge_whitelist, undefined);
 });
 
-test("the rule main is put right in the forge's own words: the body a setup sends carries no status checks of its own", async () => {
+test("the rule main is put right in the forge's own words: no push, the tools' account merges, no status required", async () => {
   const { mainRuleBody } = await import("../dist/protection.js");
-  assert.deepEqual(mainRuleBody(), { enable_push: false, enable_merge_whitelist: true, merge_whitelist_usernames: ["mesh-tools"] });
+  assert.deepEqual(mainRuleBody(), { enable_push: false, enable_merge_whitelist: true, merge_whitelist_usernames: ["mesh-tools"],
+    enable_status_check: false, status_check_contexts: [] });
+});
+
+// The operator's own login stays on main's merge whitelist beside the tools' account (novox/hq ADR 0534 §2): read from
+// the module's config value main-mergers, in the runtime config file; nothing there leaves the tools' account alone.
+test("main's merge whitelist is the tools' account, then the configured mergers once each", async () => {
+  const { mainMergers, mainRuleBody } = await import("../dist/protection.js");
+  const { mkdtempSync, writeFileSync } = await import("node:fs");
+  const { join } = await import("node:path");
+  const { tmpdir } = await import("node:os");
+  const file = join(mkdtempSync(join(tmpdir(), "gitea-mergers-")), "config.json");
+  writeFileSync(file, JSON.stringify({ url: "", "main-mergers": ["jschoubben", "mesh-tools", "jschoubben", "../x", "a b"] }));
+  assert.deepEqual(mainMergers({ MESH_GITEA_CONFIG_FILE: file }), ["mesh-tools", "jschoubben"]);
+  assert.deepEqual(mainMergers({}), ["mesh-tools"]);
+  assert.deepEqual(mainMergers({ MESH_GITEA_CONFIG_FILE: join(tmpdir(), "no-such-gitea-config.json") }), ["mesh-tools"]);
+  assert.deepEqual(mainRuleBody(["mesh-tools", "jschoubben"]).merge_whitelist_usernames, ["mesh-tools", "jschoubben"]);
 });

modules/gitea/test/tools-account.test.ts

@@ -235,7 +235,7 @@ test("with the tools' token, the forge writes a status and refuses a protection
   const client = fresh(env);
   await client.setCommitStatus("novox", "hq", "abc123def4567890abc123def4567890abc12345", { state: "success", context: "mesh/merge-gate", description: "ok" } as any);
   await assert.rejects(
-    client.setBranchProtection("novox", "hq", "main", { statusChecks: ["mesh/merge-gate"] }),
+    client.setBranchProtection("novox", "hq", "main", {}),
     /403/,
   );
 });
@@ -350,7 +350,7 @@ test("a team another process made between the look and the create is found, not
   assert.ok(team?.members.has(TOOLS_ACCOUNT));
 });
 
-test("setting the tools' account up puts main's rule right in every repository: no push, only the tools' account merges (issue 948)", async () => {
+test("setting the tools' account up puts main's rule right in every repository: no push, only the tools' account merges, no status (issue 948, ADR 0534 §1)", async () => {
   const env = await environment();
   const from = forge.calls.length;
   await fresh(env).listRepos();
@@ -358,7 +358,8 @@ test("setting the tools' account up puts main's rule right in every repository:
   assert.equal(hq.enable_push, false);
   assert.equal(hq.enable_merge_whitelist, true);
   assert.deepEqual(hq.merge_whitelist_usernames, [TOOLS_ACCOUNT]);
-  assert.deepEqual(hq.status_check_contexts, ["mesh/merge-gate"], "a rule found keeps the statuses it requires");
+  assert.deepEqual(hq.status_check_contexts, [], "a rule found has its required statuses taken off (ADR 0534 §1)");
+  assert.equal(hq.enable_status_check, false);
   const catalog = forge.mainRules.get("mesh-catalog");
   assert.ok(catalog, "a repository with no rule for main is given one");
   assert.equal(catalog.rule_name, "main");
@@ -368,13 +369,13 @@ test("setting the tools' account up puts main's rule right in every repository:
     "only the administrator's login touches a rule: the tools' account is no repository's administrator");
 });
 
-test("a glob rule covering main keeps its statuses when main is given a rule of its own name (issue 948, review round 1)", async () => {
+test("a glob rule covering main gives its approvals and override, not its statuses, when main is given a rule of its own name (issue 948, ADR 0534 §1)", async () => {
   const env = await environment();
   await fresh(env).listRepos();
   const rule = forge.mainRules.get("globbed");
   assert.ok(rule, "main is given its own rule");
-  assert.deepEqual(rule.status_check_contexts, ["mesh/merge-gate", "mesh/repo-check"]);
-  assert.equal(rule.enable_status_check, true);
+  assert.deepEqual(rule.status_check_contexts, []);
+  assert.equal(rule.enable_status_check, false);
   assert.equal(rule.block_admin_merge_override, true);
   assert.equal(rule.required_approvals, 1);
   assert.equal(rule.enable_push, false);

modules/gitea/tools/index.ts

@@ -429,14 +429,13 @@ function allGiteaTools(gitea: GiteaClient, admin?: () => GiteaAdmin): ToolDefini
     },
     {
       name: "gitea_branch_protection_set",
-      description: "Only ever stronger (novox/hq ADR 0266): a change that drops a required status, lets a person push directly or lets an administrator merge past a status is refused, and on main so is a change that drops the merge whitelist (only mesh-tools merges there) or widens it (novox/hq ADR 0398 §2, issue 948) — that is the operator's, at the forge. Make a branch require commit statuses before a pull request merges into it — the mesh's checker sets `mesh/check` (ADR 0447), and the repositories program requires it on every main. Edits the branch's rule (its required statuses replaced by these, everything else kept unless given) or creates one, which refuses direct pushes unless push=true. Answers the rule before and after.",
+      description: "Protect a branch. Never weaker (novox/hq ADR 0266): a change that lets a person push directly or lets an administrator merge past the rule is refused, and on main so is a change that drops the merge whitelist (only mesh-tools merges there) or widens it (novox/hq ADR 0398 §2, issue 948) — that is the operator's, at the forge. The forge requires no status to merge (ADR 0534): the rule written requires none, and one the rule required is taken off; the checks are judged by mesh-delivery and the merge tool. Edits the branch's rule (everything else kept unless given) or creates one, which refuses direct pushes unless push=true. Answers the rule before and after.",
       input: {
         owner: { type: "string", description: "the repository owner" },
         repo: { type: "string", description: "the repository name" },
         branch: { type: "string", description: "the branch to protect, e.g. main" },
-        status_checks: { type: "string", description: "comma-separated statuses required to merge, e.g. mesh/check; empty requires none" },
         push: { type: "boolean", description: "whether a person may push to the branch directly (a new rule refuses it when not given)" },
-        block_admin_override: { type: "boolean", description: "stop an administrator merging past a status that has not succeeded (left as it is when not given)" },
+        block_admin_override: { type: "boolean", description: "stop an administrator merging past what the rule asks (left as it is when not given)" },
       },
       run: async (args) => {
         const owner = String(args.owner), repo = String(args.repo), branch = String(args.branch ?? "").trim();
@@ -445,7 +444,6 @@ function allGiteaTools(gitea: GiteaClient, admin?: () => GiteaAdmin): ToolDefini
 
         const before = await gitea.branchProtection(owner, repo, branch);
         const want = {
-          statusChecks: String(args.status_checks ?? "").split(","),
           push: args.push === undefined ? undefined : Boolean(args.push),
           blockAdminOverride: args.block_admin_override === undefined ? undefined : Boolean(args.block_admin_override),
         };