Merge Orchestration runtime · operational glue: Dispatcher.decide_all + write_manifest

[hyperpolymath]

Operational glue — the runtime now emits a manifest

This closes the gap between the pure Dispatcher.dispatch/1 (decision → {decision, manifest_entry, lease}) and the file the downstream consumers actually read. Two additions to lib/merge_orchestration/dispatcher.ex:

• decide_all/1 — batch-decide over many PR contexts → %{decisions, entries, leases, stats}, where stats tallies by strategy (auto_execute / review / report_only). Pure (data in, data out).
• write_manifest/2 — the thin operational glue: decides over the contexts and writes merge-decisions.jsonl (one entry per line) into the verisim dispatch dir — the same tier × strategy vocabulary the dispatch-runner and the .git-private-farm actuator already consume.

Encoder is injected, so the logic tests stay dependency-free

encode = Keyword.get_lazy(opts, :encode, fn -> &Jason.encode!/1 end)

Production resolves Jason (a real hypatia dep); the tests pass a stub encoder, so the manifest-writing logic is exercised without dragging the JSON dep into the unit suite.

Testing (actual, not looks-right)

Ran the full merge-orchestration suite locally under Elixir 1.14:

22 tests, 0 failures

Two new tests in test/merge_orchestration/dispatcher_test.exs:

• decide_all batches three contexts (arm/clamp/veto) and asserts stats == %{total: 3, auto_execute: 1, review: 1, report_only: 1}.
• write_manifest writes one JSONL line per decision into a System.tmp_dir! path using a stub encoder, then reads it back and asserts the line count + content.

Scope / safety

• Not auto-armed — core-tier code, so it routes to your review per the pool rule we're dogfooding (docs/design PRs arm; lib/ does not).
• Object-level, additive only: two new public functions + one private nothing; no change to dispatch/1, to_manifest_entry/1, or lease_for/2.

Where this leaves the runtime

Sense → deliberate → actuate is now wired end-to-end on the deliberate→actuate seam: Strategist (decide) → Kin.Council (consensus) → Dispatcher (dispatch + decide_all + write_manifest) → JSONL → dispatch-runner / .git-private-farm actuator (independent re-verification).

The remaining piece for full operation is the INPUT/sensory layer: fetch open PRs, build a context per PR from the bots' signed attestations + the repo's bot_directive pool, and feed those into decide_all. That's the next increment — held for your steer.

---

Generated by Claude Code

[github-actions]

🔍 Hypatia Security Scan

Findings: 42 issues detected

Severity	Count
🔴 Critical	0
🟠 High	0
🟡 Medium	42

View findings

[
  {
    "reason": "Repository has 5 non-main remote branch(es). Policy: single main branch only.",
    "type": "GS007",
    "file": ".",
    "action": "delete_remote_branches",
    "rule_module": "git_state",
    "severity": "medium"
  },
  {
    "reason": "Code scanning (Hypatia): hypatia/structural_drift/SD022 -- Hypatia structural_drift: SD022 -- 11 day(s) old",
    "type": "CSA001",
    "file": "src/ui/gossamer/README.adoc",
    "action": "review",
    "rule_module": "code_scanning_alerts",
    "severity": "medium"
  },
  {
    "reason": "Code scanning (Hypatia): hypatia/structural_drift/SD022 -- Hypatia structural_drift: SD022 -- 11 day(s) old",
    "type": "CSA001",
    "file": "scripts/ci-tools/Cargo.toml",
    "action": "review",
    "rule_module": "code_scanning_alerts",
    "severity": "medium"
  },
  {
    "reason": "Code scanning (Hypatia): hypatia/structural_drift/SD022 -- Hypatia structural_drift: SD022 -- 11 day(s) old",
    "type": "CSA001",
    "file": "scripts/bench-tools/Cargo.toml",
    "action": "review",
    "rule_module": "code_scanning_alerts",
    "severity": "medium"
  },
  {
    "reason": "Code scanning (Hypatia): hypatia/structural_drift/SD022 -- Hypatia structural_drift: SD022 -- 11 day(s) old",
    "type": "CSA001",
    "file": "ffi/zig/README.adoc",
    "action": "review",
    "rule_module": "code_scanning_alerts",
    "severity": "medium"
  },
  {
    "reason": "Code scanning (Hypatia): hypatia/structural_drift/SD022 -- Hypatia structural_drift: SD022 -- 11 day(s) old",
    "type": "CSA001",
    "file": "docs/reports/audit/audit-2026-04-15-post.md",
    "action": "review",
    "rule_module": "code_scanning_alerts",
    "severity": "medium"
  },
  {
    "reason": "Code scanning (Hypatia): hypatia/structural_drift/SD022 -- Hypatia structural_drift: SD022 -- 11 day(s) old",
    "type": "CSA001",
    "file": "docs/integration/github-registry.adoc",
    "action": "review",
    "rule_module": "code_scanning_alerts",
    "severity": "medium"
  },
  {
    "reason": "Code scanning (Hypatia): hypatia/structural_drift/SD022 -- Hypatia structural_drift: SD022 -- 11 day(s) old",
    "type": "CSA001",
    "file": "docs/integration/github-registry.adoc",
    "action": "review",
    "rule_module": "code_scanning_alerts",
    "severity": "medium"
  },
  {
    "reason": "Code scanning (Hypatia): hypatia/structural_drift/SD022 -- Hypatia structural_drift: SD022 -- 11 day(s) old",
    "type": "CSA001",
    "file": "docs/integration/a2ml-k9.md",
    "action": "review",
    "rule_module": "code_scanning_alerts",
    "severity": "medium"
  },
  {
    "reason": "Code scanning (Hypatia): hypatia/structural_drift/SD022 -- Hypatia structural_drift: SD022 -- 11 day(s) old",
    "type": "CSA001",
    "file": "docs/architecture/system-integration.md",
    "action": "review",
    "rule_module": "code_scanning_alerts",
    "severity": "medium"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence