What is tuturuuu-pr-merge-sync?

A procedure for closing a Tuturuuu pull request only after review comments, checks, merging, synchronization, and production verification are complete.

Use it to inspect review threads, wait for new comments to stop, merge the pull request, verify main, run git synchronization, and check production.

It prevents unfinished review work or failing branches from being merged and confirms that both the main and production branches remain healthy afterward.

tuturuuu-pr-merge-sync — Skill for Codex by tutur3u

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent

npx skills add tutur3u/platform --skill tuturuuu-pr-merge-sync

Clone the repo

git clone --depth 1 https://github.com/tutur3u/platform

Made for: Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/tutur3u/platform/tuturuuu-pr-merge-sync/github.svg)](https://agentmods.dev/skills/tutur3u/platform/tuturuuu-pr-merge-sync)

Your own site

<a href="https://agentmods.dev/skills/tutur3u/platform/tuturuuu-pr-merge-sync"><img src="https://agentmods.dev/badge/skills/tutur3u/platform/tuturuuu-pr-merge-sync/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/tutur3u/platform/tuturuuu-pr-merge-sync"><img src="https://agentmods.dev/badge/skills/tutur3u/platform/tuturuuu-pr-merge-sync.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 27 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 1,461 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe. Third-party audits

NVIDIA SkillSpector pass 7 Sept 2026

How audits are shown

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00027	$0.01461
Opus 5	$0.00014	$0.00731
Sonnet 5	$0.00005	$0.00292
Haiku 4.5	$0.00003	$0.00146

Measured 5d ago against content hash 551e617f7d5d, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-11, from the pricing page.

Security

Grade A, and why

tuturuuu-pr-merge-sync scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.

The scan reads SKILL.md. This mod also ships 3 executable files (scripts/watch_branch_runs.mjs, scripts/watch_pr_ready.mjs, scripts/watchers.test.mjs), listed below but not scanned — reading those needs a real analyzer, not pattern matching.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

plugins/tuturuuu/skills/tuturuuu-pr-merge-sync/SKILL.md · 150 lines

How it starts

The opening of the file, as written. The whole thing — 150 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Tuturuuu PR Merge Sync

Use this skill for end-to-end PR closeout requests that go beyond fixing review comments: quiet-window watching, merge, mandatory main-green verification, bun git-sync, and production-green verification.

Compose With Focused Skills

Use $tuturuuu-review-comments first when unresolved review threads need inspection, fixes, replies, or resolution.
Use $tuturuuu-commit before staging, committing, amending, rebasing, or any user-requested commit/push work.
Use $tuturuuu-agent-coordination when the checkout is shared, dirty, or the work will take long enough to need a coordination note.
Use $tuturuuu-ci-docs only when CI workflow behavior or docs navigation must be changed.

Required Gates

Check whether the PR is part of a stack. A base other than main is not proof: a PR can legitimately target production, a release branch, or a maintenance branch with no parent PR at all, and treating those as stacked blocks valid closeout work. It is a stack only when the base branch is the head branch of an open pull request, or the PR body names its parent:
```
gh pr list --state open --json number,headRefName \
  --jq '.[] | select(.headRefName == "<this-pr-base>") | .number'
```
When it is stacked, the parent must merge first — merging a child while its parent is open pulls the parent's unreviewed commits into main through the child, and merging a mid-stack or top PR merges everything below it. Merge bottom-up, one PR at a time, running every gate below for each.

A native stack (gh stack) rebases and retargets the rest on merge and accepts any merge method. A base-chained stack (gh pr create --base) does not: merge its parents with gh pr merge --merge, because a squash or rebase merge leaves the parent's commits outside main's ancestry and the retargeted child re-shows changes that already landed. Either way, confirm each child's baseRefName actually moved before treating the stack as advanced. See /build/development-tools/stacked-pull-requests in apps/docs.
Perform all open-PR work in an isolated .worktrees/ checkout and run bun setup immediately after creating it.
Confirm GitHub auth and rate limits:
- gh auth status
- gh api rate_limit
Confirm the PR has zero active unresolved review threads.
Wait for the requested quiet window, defaulting to 30 minutes after the latest PR comment update or review submission.
Wait for PR checks to finish with only success, skipped, or neutral conclusions.
Merge the PR, preferring normal merge first. Use admin merge only when the user requested merge follow-through and GitHub reports a policy-only block after the gates above are clean.
Fetch and fast-forward local main to origin/main.
Verify every main workflow for the merge SHA is green. This is a hard gate: do not run bun git-sync while any main workflow is queued, in progress, or failed.
Run bun git-sync only after main is fully green.
Verify local and remote main and production point to the same SHA.
Verify every production workflow for that SHA is green.
After the merge is confirmed on main, remove the PR worktree and delete its local task branch.

Read the full file on GitHub · 150 lines

Files

What ships with it

4 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

5d ago Changed · -35 tokens per session 551e617f7d5d
8d ago First seen · 150 lines · 62 tokens per session scan A 2e5853fd51f4

Subscribe to this mod's changes

tuturuuu-pr-merge-sync is a skill published in the GitHub repository tutur3u/platform (53 stars, last pushed today), licensed Apache-2.0. It adds 27 tokens to every session and 1,461 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.

Git and workflow TypeScript nextjs tailwindcss

magic-ui

Use this skill when users want to add, customize, or troubleshoot Magic UI components in React/Next.js projects. It covers component selection, shadcn registry installation (@magicui/), integration patterns, and practical quality checks for accessibility and maintainability.

magicuidesign/magicui · 56 tokens

frontend-engineer

!cat skills/shared/protocols/ux-protocol.md 2>/dev/null || true !cat skills/shared/protocols/input-validation.md 2>/dev/null || true !cat skills/shared/protocols/tool-efficiency.md 2>/dev/null || true !cat .production-grade.yaml 2>/dev/null || echo "No config — using defaults" !cat .forgewright/codebase-context.md…

buiphucminhtam/forgewright · 55 tokens

update-skills

Create or update repository skills and instructions when major learnings are discovered during a session. Use when the user says "learn!", when a significant pattern or pitfall is identified, or when reusable domain knowledge should be captured for future sessions.

microsoft/vscode · 51 tokens

sync

Sync the current session branch with its upstream branch, or publish the current session branch to a remote. Use when the user asks to sync a branch, pull latest changes, rebase onto upstream, push current branch, publish branch, or set upstream.

microsoft/vscode · 52 tokens

merge

Merge changes from the topic branch to the merge base branch. Use when the user wants to merge their session's work back to the base branch.

microsoft/vscode · 31 tokens

contrib-pr

Open a high-quality external contributor PR against prisma/orm. Use when the user is an outside contributor (not a Prisma maintainer) and wants to submit a change as a pull request from a fork. Encodes the contribution flow from CONTRIBUTING.md so the resulting PR passes review on the first round.

prisma/orm · 65 tokens