Workers propose. The refinery decides what lands.

The integration authority

Parallel workers can produce many candidate branches, but one repository and target branch must still become one coherent history. The refinery is the only intended automated integration authority. Workers may propose branches; they cannot decide that their own work lands.

One refinery lane represents one repository and target branch. A lane is serial, while independent lanes may progress concurrently.

One immutable attempt

Every refinery attempt records the immutable base, source, and candidate SHAs; the source note and branch; the gate profile; and its lease owner, deadline, and fencing generation. A fenced lease prevents a stale controller from continuing to mutate an attempt after ownership has moved.

The controller advances one idempotent step at a time:

1. Intake creates the requested attempt.
2. The scheduler grants a fenced lane lease.
3. Preparation constructs the exact candidate in an isolated worktree.
4. The gate broker submits or recovers the verification job.
5. Observations settle the gate outcome.
6. Terminal green authorizes a compare-and-swap push of only that candidate.
7. Optional deployment is observed as a separate effect.
8. The terminal result updates the note and opens operator work when policy cannot decide.

A narrow AI repair path

Deterministic candidate preparation happens first. If it records a merge conflict, reviewed policy may enqueue a bounded AI repair against the original source branch. Only one repair may be active for a note at a time, and total attempts remain capped and observable.

The repair agent may merge the snapshotted target into the source branch, resolve only the recorded conflicts, run targeted tests, commit, and push the repaired source branch. It cannot approve a gate, push the target, deploy, or merge.

The failed attempt remains terminal. A repaired source branch must create a new immutable refinery attempt and pass the complete deterministic gate. AI proposes a new candidate; it never certifies its own repair.

Terminal means terminal

A terminal attempt never reopens. A red gate, unavailable provider, merge conflict, moved target, or policy decision produces a recorded outcome. Retry happens through a successor attempt with a new identity.

• gate_red — the candidate was tested and failed.
• infrastructure_failed — the gate could not produce a candidate verdict.
• push_raced — the target moved after green; construct and gate a successor candidate.
• needs_rework — the source must change before another attempt.
• needs_operator — policy cannot safely decide.

Related: Verification Gates.