Use proof-of-work for the PR lifecycle: current origin/main, codex/ branch/worktree, worklog, PR, exact-head checks, auto-merge, and merge verification.
Inspect current package surfaces before editing: package.json, lockfile, package-manager config, workspace files, release notes when needed, npm dist-tags, and pnpm outdated or the repo's package-manager equivalent.
Handle prerelease lines intentionally. For Svelte/SvelteKit/adapters, compilers, and framework packages, do not downgrade from an intentional prerelease channel just because latest points at an older stable line.
Update versions and lockfiles with the repo's package manager. Do not hand edit lockfiles except for mechanical conflict resolution.
Run minimum local proof for dependency changes: frozen install, typecheck, unit tests, and build. Add any repo-specific proof documented by the target repo.
For framework, compiler, adapter, build-tool, native, or platform-sensitive packages, prove the deployed preview/runtime path too.
Commit, push, update the PR body with decisions and proof, and enable auto-merge once local proof passes and required exact-head checks are pending or green.
Monitor until merged. If checks fail, inspect logs and fix, rebase, rerun, or back out. Do not leave the merge path ambiguous.

Runtime Proof

Treat build/deploy readiness as readiness, not runtime proof.
For native or platform-sensitive packages such as image processors, crypto, database drivers, or optional native binaries, exercise a deployed route, function, worker, or browser flow that imports or uses the package on the target runtime.
For Vercel or similar previews, verify the PR head SHA and confirm the actual browser/runtime test step ran. A skipped, stale, or unrelated preview check is not evidence.
If runtime proof needs a temporary probe route, script, or diagnostic, remove it before merge unless it is a useful permanent regression test.

Failure Triage

Rebase or restart stale branches from current origin/main.
Keep auto-merge enabled after local proof unless the dependency change causes a real bug or incompatible dependency breakage.
Distinguish unrelated flaky CI, dirty branch state, and preview-environment failures from dependency-caused failures; work through the former.
If the dependency itself is bad, document the exact package/version, reproduction, logs, and rollback or pinning decision.

Report:

source: agents