cicd branch follower native closeout

.agents/skills/unidesk-cicd/references/branch-follower.md

@@ -44,6 +44,20 @@ Use configRef summaries in plan/status; do not create a `full.md` or super Markd
 - `agentrun-jd01-v02`: follows `pikasTech/agentrun@v0.2`, adapter `agentrun-yaml-lane`, native trigger `build image Job -> GitOps publish Job -> git-mirror flush Job -> Tekton PipelineRun -> Argo Application closeout -> runtime Deployment sourceCommit readiness`. The same source commit must use deterministic Job names so a later controller loop can resume or reuse already completed stages.
 - `web-probe-sentinel-master`: follows `pikasTech/unidesk@master`, adapter `web-probe-sentinel-cicd`, native trigger `Tekton PipelineRun -> Argo Application closeout -> runtime Deployment sourceCommit readiness`.
 
+These three followers are the initial production set. HWLAB and AgentRun both run on JD01; there is no D601 target in the automatic follower set unless YAML is explicitly changed.
+
+## Reuse And Mirror Contract
+
+The controller must preserve the runtime reuse capabilities that already exist in the runtime lanes:
+
+- runtime reuse: if both code identity and env identity are unchanged for a microservice, skip rebuild and rollout for that service;
+- env reuse: if code changed but env identity is unchanged, reuse the previous environment image and publish only the changed service artifact;
+- git mirror: source sync, immutable source snapshot creation and GitOps flush are generic branch-follower stages, not adapter-local afterthoughts.
+
+Adapters should expose reuse evidence through compact native state. HWLAB uses the `plan-artifacts` task event summary (`affectedServices`, `buildServices`, `reusedServices`, `artifactProvenanceAudit`). AgentRun publishes deterministic image/GitOps/git-mirror stage names and source-commit labels so a later loop can resume closeout without rebuilding completed stages. Sentinel keeps the same source/CI/Argo/runtime contract but has no GitOps branch flush gate.
+
+The normal convergence budget is 120 seconds per source change. A follower may report `ClosingOut` while waiting for Argo/runtime readiness, but it must not report `Noop` when the source sha matches and required native gates such as git-mirror flush are still incomplete.
+
 ## Status Contract
 
 Default `status` output must show follower id, phase, adapter, source branch + observed sha, target sha, last triggered sha, last succeeded sha, in-flight job/PipelineRun, budget source and next drill-down commands.
@@ -54,6 +68,8 @@ Status and decision inputs are Kubernetes-native:
 
 - source: k8s git-mirror cache ref and immutable snapshot ref;
 - CI: Tekton `PipelineRun.status.conditions`;
+- CI drill-down: compact TaskRun timings and plan-artifact reuse summary when available;
+- git mirror: source snapshot readiness plus GitOps `pendingFlush`/`githubInSync` when the follower owns a GitOps branch;
 - deployment: Argo `Application.status.sync` and `Application.status.health`;
 - runtime: selected Deployment/StatefulSet readiness plus source commit labels, annotations or env.
 

.agents/skills/unidesk-cicd/references/git-mirror.md

@@ -19,6 +19,8 @@ bun scripts/cli.ts hwlab nodes git-mirror flush --node <node> --lane v03 --confi
 - `sync`: 把当前配置声明的 GitHub refs 拉入本地 mirror，并为 source branch tip 创建不可变 snapshot ref。
 - `flush`: 把本地 lane GitOps ref 快进推回 GitHub。
 
+`cicd branch-follower` 已把 `sync` 和 `flush` 作为通用 Kubernetes-native stage 接入 HWLAB/AgentRun 自动跟随：trigger 前先 sync 并创建 immutable source snapshot，GitOps publish 后必须 flush，status/closeout 以 mirror cache ref 和 `pendingFlush=false`/`githubInSync=true` 为准。正常自动跟随不需要 operator 手动清理旧状态；旧 ConfigMap 或历史 PipelineRun 干扰时只用 `cicd branch-follower cleanup-state --follower <id> --confirm` 做显式 cleanup。
+
 PipelineRun `gitops-promote` 如果报 git mirror 控制面漂移、refs 不一致或 flush/publish 未完成，优先按当前 `devops-infra/git-mirror.yaml` 收敛：先 `git-mirror apply --confirm`，再 `git-mirror sync --confirm --wait`，然后用 `control-plane cleanup-runs --pipeline-run <failed-run> --confirm` 受控清理失败 PipelineRun 后重试。旧 branch/path allowlist gate 已删除，不要恢复旧 hook、直接 `kubectl delete`、手工 patch pod 内 hook 或绕过 `flush`。
 
 手动 trigger closeout 不能只看 PipelineRun `Completed`。必须继续查 `control-plane status --pipeline-run <name>` 和 `git-mirror status`；node-scoped `trigger-current --confirm --wait` 会自动做必要的 mirror pre/post flush，但 closeout 仍要确认最终 `pendingFlush=false`、`githubInSync=true`。如果 lower-level 手工路径或旧 job 留下 `pendingFlush=true`，执行 `git-mirror flush --confirm --wait` 到 `pendingFlush=false`。

.agents/skills/unidesk-gh/references/pull-requests.md

@@ -3,8 +3,10 @@
 PR work uses guarded UniDesk GitHub commands:
 
 - `pr review-plan`, `pr diff --file`, and bounded file drill-down before review.
-- `pr preflight` before merge when required by the issue or branch policy.
-- `pr merge --merge --delete-branch` by default.
+- `pr preflight` is optional read-only diagnosis; `pr merge` runs preflight internally.
+- `pr merge --merge` by default deletes the merged same-repo head branch, cleans a matching clean local `.worktree`, and fast-forwards the local main worktree on the PR base branch.
+- `pr merge --merge --sync-node JD01` additionally runs mapped node source-workspace sync when supported, currently HWLAB `v0.3`.
+- Use `--keep-branch` or `--skip-local-closeout` only when intentionally preserving post-merge state.
 - Use squash only when ancestry and semantic absorption are explicitly safe.
 
 Closeout should mention source branch, validation evidence and any residual risk.