merge-scan

merge-scan is an agent for coding agents from watt-mind/factory. It costs 0 tokens per session (1,194 once invoked), scanned A, original, Apache-2.0.

A fixed scan that finds open GitHub pull requests whose recorded review state is missing or out of date.

In plain words
What is it for?
It checks the review ledger, detects moved commits, optionally forces selected reviews, and can produce mechanical rebase actions for conflicting or outdated pull requests.
Why use it?
It avoids repeating reviews when the relevant commit has not changed and identifies pull requests that need operational follow-up.

Agent

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add agents/watt-mind/factory/merge-scan
Clone the repo
git clone --depth 1 https://github.com/watt-mind/factory

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for merge-scan

README.md
[![agentmods](https://agentmods.dev/badge/agents/watt-mind/factory/merge-scan.svg)](https://agentmods.dev/agents/watt-mind/factory/merge-scan)
Your own site
<a href="https://agentmods.dev/agents/watt-mind/factory/merge-scan"><img src="https://agentmods.dev/badge/agents/watt-mind/factory/merge-scan.svg" alt="Measured on agentmods" height="20"></a>
Per session 0 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 1,194 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00000 $0.01194
Opus 5 $0.00000 $0.00597
Sonnet 5 $0.00000 $0.00239
Haiku 4.5 $0.00000 $0.00119

Measured 3d ago against content hash 7bd516697f53, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

merge-scan scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

event-runtime/agents/merge-scan.md · 107 lines

How it starts

The opening of the file, as written. The whole thing — 107 lines — stays where its author put it; the contents beside it link to each section on GitHub.

merge-scan — ledger enumerator (not a reviewer)

Not a prompt: this definition executes a fixed command template via the deterministic command adapter (lib/adapters/command.mjs). No model runs.

bun {factoryRoot}/event-runtime/lib/merge-reviews.mjs scan

The command reads ./input.json and writes ./result.json. It lists open PRs via the forge, looks each (github, pr, headSha) up in the merge_reviews ledger (baseSha is recorded, not part of the key), and emits reviews[] only for misses — a moved head. A moved base with the same head is a hit. A selected scan (prNumbers) forces a review even on a ledger hit. For a hit whose live state is CONFLICTING or BEHIND (or whose recorded baseSha differs from the live base tip), normally emit an operational rebase_onto_base item in fix[] with mechanical: true, withinOwnedPaths: true, and round from the ledger; do not start a review run. Never emit a rebase for a PR labelled ai:landing. For a non-conflicting rebase candidate, also skip the rebase when the current head has a Full verification check that is queued/running or succeeded within the FACTORY_MERGE_REBASE_SKIP_FRESH_CI_MINUTES fresh-CI window (default 60); the scan summary names the skip reason. A CONFLICTING PR still emits a rebase unless it carries ai:landing. Do not emit a review item when an open, queued, or running merge-review@1 proposal or run already exists at the same (pr, headSha). MERGE ledger hits are not stubbed into plan[] — they are queued as planRequests[] so merge-plan@1 can batch them. plan[] on a scan artifact is always empty.

When prNumbers is absent, enumerate all open PRs and consider every base-targeting, non-draft PR. Emit an escalate[] item for every non-draft PR with an identifiable ticket that targets a different base, and name every wrong-base PR and its actual/expected bases in the summary rather than silently excluding it; this is a dispatch/handoff escape that needs an operator to retarget or close. When prNumbers is present, review exactly those PR numbers in the listed repo — do not enumerate the open-PR set and do not add newer, related, or otherwise open PRs to the scan. Selected scans must stay O(the number selected), normally O(1).

Resolve every selected number directly, including numbers absent from an open-PR listing. A selected PR that is missing, closed, draft, or targets a base other than the configured base fails the whole selected scan closed. Write a schema-valid refusal with terminalState: "refused" and reasonCode: "needs_human", with evidence clearly naming every invalid selected PR and whether it is missing, closed, draft, or wrong-base. Do not emit a merge-plan artifact, FIX request, or merge candidate when any selected target is invalid. This whole-run refusal is the explicit human escalation; never silently skip an invalid selected number.

Transient forge errors (list/view/base SHA) complete as NOOP with a summary naming the error, not as a per-PR human escalation — the next tick retries.

Never modify the checkout, GitHub, or Linear. Write only ./result.json in the workspace root.

If the named repo's configuration is missing or malformed, fail closed with this complete result and stop:

{
  "schemaVersion": "factory.agent-result/v1",
  "terminalState": "refused",
  "reasonCode": "needs_human"
}

Read the full file on GitHub · 107 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 3d ago First seen · 107 lines · 0 tokens per session scan A 7bd516697f53

Subscribe to this mod's changes

merge-scan is an agent published in the GitHub repository watt-mind/factory (10 stars, last pushed 3d ago), licensed Apache-2.0. It costs nothing until one of its globs matches a file; then it loads 1,194 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Related

Other agents, from other repositories

ap-implementer

L3 executor - G4 IMPLEMENT. Builds one feature from its approved executable roadmap item or conditional frozen plan using strict TDD and real test runs; coverage >=95% on changed lines. Reports PLAN-CONFLICT rather than improvising.

Spielewoy/autoprompt-skill · 52 tokens

ap-manager

L2 optional manager - coordinates a multi-lane slice, builds compact pointer envelopes, and dispatches disjoint L3 work without executing it.

Spielewoy/autoprompt-skill · 32 tokens

ap-feature-coordinator

L1 feature coordinator - drives approved ROADMAP.md lanes through their required build/review/verification gates and owns the run-wide feature frontier.

Spielewoy/autoprompt-skill · 33 tokens

ap-framework-generator

L3 executor - FRAMEWORK GENERATE. When the SELECTOR returns MISS, generates a one-off custom framework for the exact task shape - classifies the orthogonal axes, composes the gate sequence from the GATE-LIBRARY with the correct axis-specific gate, emits the gen- leaf with the BLOCKED invariant verbatim, binds an…

Spielewoy/autoprompt-skill · 93 tokens

ap-framework-validator

L4 terminal leaf - FRAMEWORK VALIDATE (HRN-5). A fresh, default-FAIL juror that proves a GENERATED framework is SOUND before any gate runs. Checks the HRN-5 default-FAIL checklist - every gate mapped, exactly one terminal DONE with negatives looping UP, the BLOCKED invariant verbatim, a non-empty acceptance set. PASS…

Spielewoy/autoprompt-skill · 93 tokens

ap-scope-coordinator

L1 scope coordinator - drives the useful-first adaptive roadmap flow and returns one independently approved executable ROADMAP.md before build.

Spielewoy/autoprompt-skill · 30 tokens