🏭 Add trusted Git merge and conflict suspension

[minkimcello]

Parent: #633

Architecture ancestry: PR #630

Planning base: 0479b3b1e6a3de08fb7d9de515a3efde80e7fe91; implementation base is the exact accepted C0 feedback commit recorded before handoff

Stack position: F4; parallel with F1, F3, F5, and F6; consumed by L8 and L10

Readiness: blocked only until C0's accepted feedback SHA is recorded and present; no parent-order, conflict, rollback, or history policy is delegated

Purpose and observable outcome

Authored XMD can request one exact ordered-parent Git merge as a transactional Workspace effect. A clean merge publishes one complete commit/root/result; any conflict publishes complete structured evidence only after the pre-merge Workspace root is restored.

Authoritative behavior

• The request fixes Repository and checkout identity, first parent, second parent, merge base, purpose, and pre-merge Workspace root before mutation.
• Stage 4 synchronization uses ordered parents { implementationHead, targetBase }; Stage 7 target publication uses { reviewedBase, reviewedHead }.
• The result is a closed clean or conflicted value. No partial conflict set or partially mutated Workspace becomes authoritative.
• Every conflict suspends for human resolution in v1. Binary, submodule, rename, symbolic-link, unrecognized-index, and mixed sets are retained/refused as conflicts, not automatically edited.
• Hooks, signing, filters, configured programs, worktree config, rebase, reset-based history replacement, force, and force-with-lease are unavailable.
• Merge, evidence, Push/ref publication, PR observation, and lifecycle advancement remain separate effects.

Current state

packages/workflow/src/composition/git-api.ts and components expose Switch, Add, Commit, and Push. packages/workflow/src/deno/composition/commit.ts deliberately permits one-parent commits and rejects merge commits. Workspace transactions, root restoration, Git crash children, object-source authentication, non-force Push reconciliation, and Git-focused tests already exist. There is no provider-neutral merge request/result or normalized conflict record.

Affected modules and public contracts

• Add the ordered-parent Git.Merge public contract, records, parser, component, installation, and exports under packages/workflow/src/composition/** as frozen by C0.
• Add the Deno Git implementation under packages/workflow/src/deno/composition/**, reusing authenticated Repository/Worktree placement and Workspace transaction/root restoration.
• Add normalized conflict records to the provider-neutral API with exact path, classification, index stage, mode, and available base/ours/theirs object IDs.
• Update specs/workflow-workspace-spec.md, specs/executable-mdx-spec.md, architecture.md, and construct/test inventories in the same feedback commit.
• Add explicit clean/conflict/durability/crash tests under packages/workflow/tests/ and support processes under packages/workflow/tests/support/.

Ordered implementation plan

1. Define strict request/result/conflict parsers and ordered-parent semantics for both synchronization and target-publication purposes.
2. Authenticate the retained Repository, checkout, parent objects, merge base, current root, and live provider acquisition before opening mutation.
3. Perform the merge with hooks/signing/filters/configured programs disabled and construct the exact ordered-parent commit on the clean path.
4. Publish clean filesystem/object changes, new logical root, and filtered journal result in one Workspace transaction.
5. On any non-clean index/worktree state, collect the whole normalized conflict set, roll back/restore the pre-merge root, verify restoration, and only then publish the conflicted result.
6. Implement cancellation/fatal-failure cleanup so uncommitted merge state never becomes the selected root.
7. Export/install/specify the component and add focused process-level crash tests.

Failure, cancellation, teardown, and replay

Stale parent/merge-base/root, changed checkout, missing/unreadable object, wrong purpose/order, foreign acquisition, unsupported repository state, malformed result, and failed restoration refuse/fail before a new authoritative root. Cancellation or host death rolls back the open transaction and exposes the old root. A conflict is an accepted closed result only after restoration succeeds. Completed replay parses the retained result and runs no Git command.

Frozen evidence matrix

• Stage 4 clean merge produces parents [implementationHead, targetBase]; Stage 7 produces [reviewedBase, reviewedHead].
• Every exact input is checked before mutation, and changing any one produces no new root or ref.
• Clean publication atomically commits Git objects/files, logical root, and one result.
• Text and every structurally distinct unsupported/mixed conflict class retain complete evidence and restore the exact old root.
• Cancellation and kill points before result commit leave the old root and no merge result; after commit they expose the complete new result.
• No trace invokes hooks, signing, rebase, reset replacement, force, force-with-lease, automatic conflict edits, or an Agent.
• Completed replay invokes no Git process and preserves parent/conflict records byte-for-byte.
• Existing Switch/Add/Commit/Push behavior and tests remain unchanged.

Focused feedback evidence

Add explicit files such as packages/workflow/tests/git-merge.test.ts, git-merge-conflicts.test.ts, git-merge-durability.test.ts, and git-merge-crash.test.ts. Run them with existing git-commit*.test.ts, workspace-root-restoration.test.ts, and deno task test --changed. These process/fixture boundaries must be named explicitly. Commit when they pass and report the exact F4 SHA and commands.

Delivery verification

Run deno task lint, deno task check, and deno task check:jsr because public workflow APIs move. CI owns exhaustive runtimes unless shared Git process setup changes, in which case run the full affected runtime adapter suites locally.

Exclusions

No evidence command execution, Push or target-ref mutation inside Merge, automatic/generated conflict resolution, human form, lifecycle transition, native Git authority for Agents, or second blind attempt.

Risks and recovery

Parent order and root restoration are structural persistence boundaries. Any ambiguity is corrected here and reruns the frozen merge evidence before L8/L10 proceed. A new conflict permutation is blocking only if it violates the closed clean/conflicted contract or exposes a distinct structural consequence.

Handoff

Record C0's exact feedback SHA, implement only the merge capability, and return the exact F4 feedback commit with the frozen commands. L8 and L10 consume that reviewed commit through the foundation integration branch.