Review & merge

Agent branches don't reach your main branch on vibes. The review inbox runs every branch through a disk-checked gate: tests that actually ran, boxes a human actually ticked.

The review inbox

Code → Review inbox lists every agent branch in the workspace's repos (worktree-backed sessions and agent/* branches), each with: ahead/behind its base, files touched, +/− lines, uncommitted changes, the owning session, and a conflict radar — which other live branches touch the same files, before anyone merges anything.

Tests

Run tests detects the project type (npm, cargo, go, pytest, dotnet) or uses a per-repo custom command. Runs execute in the branch's worktree with a live log; the result — command, exit code, timestamps, log — is written to disk as a verification artifact. That artifact, not a UI checkbox, is what the gate reads.

The verification gate

A branch is mergeable when, on disk:

• its latest test run passed,
• every UAT checklist item you added is ticked,
• and — if the workspace requires it — a human has signed off by name.

Anything missing shows as ⛔ with the reasons. Request changes types your note straight into the owning agent's session and brings its terminal up.

Merge queue

Queue any mergeable branch. The queue processes one branch at a time: rebase onto the base branch → re-run tests → re-check the gate → merge --no-ff under the repo's bound identity. A red step stops the queue with the log; nothing after it merges until you say so.

Pull requests

Prefer GitHub review? Open PR pushes the branch under the profile's identity and creates the PR with gh — body assembled from the commits, diff stats, and the verification record, with Closes #123 when the session started from an issue. The wrong-account guard checks the remote against the profile first.

Getting a second opinion

• Peer review by another AI: hand the branch's diff to the other installed CLIs (e.g. Codex reviews Claude's work) in read-only reviewer sessions. See Orchestration.
• Discard drops a dead-end branch and its worktree — checkpoints of the session survive for archaeology.

After the merge — history & insight

Removing a session archives it: transcript, diff, files touched, outcome, cost. Home searches all of it — “what touched src/auth.rs and why” finds the run, its transcript, and its diff. The dashboard adds live counts, cost today/this week, and a broken-windows ledger: TODO/FIXME markers, skipped tests, and debug leftovers agents left behind, so shortcuts don't quietly accumulate.