Prevent recursive nested integration promotion

README.md

@@ -11,11 +11,11 @@ integration PRs, follows `main` through production, and pauses after failures.
 
 ## Install
 
-Install the reviewed `v0.2.17` source commit directly from GitHub:
+Install the reviewed `v0.2.18` source commit directly from GitHub:
 
 ```bash
 python3 -m pip install \
-  'deploybot-merge-queue[mcp] @ git+https://github.com/Forward-Future/DeployBot.git@7842edbd5fe75cdb68324e98c2a7244aed3009f6'
+  'deploybot-merge-queue[mcp] @ git+https://github.com/Forward-Future/DeployBot.git@208d4168e5a02b994905e94d648599d06b4afbd2'
 deploybot init
 ```
 
@@ -95,7 +95,7 @@ worker can dispatch deployment when GitHub suppresses the `workflow_run` event
 for token-dispatched CI. Pin the Action to the full reviewed release commit:
 
 ```yaml
-- uses: Forward-Future/DeployBot@7842edbd5fe75cdb68324e98c2a7244aed3009f6
+- uses: Forward-Future/DeployBot@208d4168e5a02b994905e94d648599d06b4afbd2
 ```
 
 The Action uses GitHub's built-in workflow token. GitHub intentionally does not

adapters/claude-code/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "deploybot",
-  "version": "0.2.17",
+  "version": "0.2.18",
   "description": "DeployBot: a provider-neutral GitHub merge queue for coding agents",
   "author": {
     "name": "DeployBot contributors"

adapters/claude-code/.mcp.json

@@ -4,7 +4,7 @@
       "command": "uvx",
       "args": [
         "--from",
-        "deploybot-merge-queue[mcp] @ git+https://github.com/Forward-Future/DeployBot.git@7842edbd5fe75cdb68324e98c2a7244aed3009f6",
+        "deploybot-merge-queue[mcp] @ git+https://github.com/Forward-Future/DeployBot.git@208d4168e5a02b994905e94d648599d06b4afbd2",
         "deploybot-mcp"
       ]
     }

adapters/codex/agent-merge-queue/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "deploybot",
-  "version": "0.2.17",
+  "version": "0.2.18",
   "description": "Coordinate exact-head pull requests through verified deployment and thread notification",
   "author": {
     "name": "DeployBot contributors"

adapters/cursor/.cursor/mcp.json

@@ -4,7 +4,7 @@
       "command": "uvx",
       "args": [
         "--from",
-        "deploybot-merge-queue[mcp] @ git+https://github.com/Forward-Future/DeployBot.git@7842edbd5fe75cdb68324e98c2a7244aed3009f6",
+        "deploybot-merge-queue[mcp] @ git+https://github.com/Forward-Future/DeployBot.git@208d4168e5a02b994905e94d648599d06b4afbd2",
         "deploybot-mcp"
       ]
     }

docs/reference.md

@@ -1,7 +1,7 @@
 # DeployBot reference
 
 This reference describes the CLI, MCP server, policy file, and GitHub Action in
-DeployBot v0.2.17. GitHub labels and authenticated comments are the durable state;
+DeployBot v0.2.18. GitHub labels and authenticated comments are the durable state;
 the CLI and MCP tools are two interfaces to the same operations.
 
 ## CLI

examples/github-workflow.yml

@@ -59,5 +59,5 @@ jobs:
         with:
           ref: ${{ github.event.repository.default_branch }}
           persist-credentials: false
-      # v0.2.17 implementation; keep the full commit for privileged workflows.
-      - uses: Forward-Future/DeployBot@7842edbd5fe75cdb68324e98c2a7244aed3009f6
+      # v0.2.18 implementation; keep the full commit for privileged workflows.
+      - uses: Forward-Future/DeployBot@208d4168e5a02b994905e94d648599d06b4afbd2

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "deploybot-merge-queue"
-version = "0.2.17"
+version = "0.2.18"
 description = "DeployBot: a provider-neutral GitHub merge queue for coding agents"
 readme = "README.md"
 license = "MIT"

src/agent_merge_queue/__init__.py

@@ -1,3 +1,3 @@
 """DeployBot: a provider-neutral GitHub merge queue for coding agents."""
 
-__version__ = "0.2.17"
+__version__ = "0.2.18"

src/agent_merge_queue/cli.py

@@ -3290,7 +3290,13 @@ def promote_integrations(
     known_checks_by_number: dict[int, dict[str, str]] | None = None,
 ) -> list[int]:
     promoted: list[int] = []
+    delegated_integrations = client.active_integration_sources()
     for number in client.integration_pull_request_numbers():
+        # A newer cumulative PR owns any integration PR listed among its
+        # sources. Re-promoting that nested source would recursively integrate
+        # the same frozen work into another cumulative PR.
+        if number in delegated_integrations:
+            continue
         comments = client.comments(number)
         integration = latest_payload(
             comments,

tests/test_cli.py

@@ -4706,6 +4706,7 @@ def test_integration_promotion_reuses_owned_exact_checks(self) -> None:
         client.config = CONFIG
         client.coordinator_logins = {"coordinator"}
         client.integration_pull_request_numbers.return_value = [number]
+        client.active_integration_sources.return_value = set()
         client.comments.return_value = [
             {
                 "created_at": "2026-06-20T00:00:00Z",
@@ -4732,6 +4733,41 @@ def test_integration_promotion_reuses_owned_exact_checks(self) -> None:
             known_checks={"CI": "passed"},
         )
 
+    def test_integration_promotion_skips_nested_source_integrations(self) -> None:
+        nested = 38
+        canonical = 39
+        marker = {
+            "batch_id": "batch",
+            "conflict": None,
+            "heads": {str(nested): "a" * 40},
+            "pull_requests": [nested],
+        }
+        client = Mock()
+        client.config = CONFIG
+        client.coordinator_logins = {"coordinator"}
+        client.integration_pull_request_numbers.return_value = [nested, canonical]
+        client.active_integration_sources.return_value = {nested}
+        client.comments.return_value = [
+            {
+                "created_at": "2026-06-20T00:00:00Z",
+                "user": {"login": "coordinator"},
+                "body": integration_body(marker),
+            }
+        ]
+        client.labels.return_value = set()
+        ready = entry(canonical, "combined.py")
+        client.snapshot.return_value = ready
+
+        promoted = promote_integrations(client)
+
+        self.assertEqual(promoted, [canonical])
+        client.snapshot.assert_called_once_with(
+            canonical,
+            require_marker=False,
+            allow_blocked_label=True,
+            known_checks=None,
+        )
+
     def test_reactor_pauses_when_post_merge_ci_dispatch_fails(self) -> None:
         client = Mock()
         client.config = CONFIG

tests/test_skill.py

@@ -8,7 +8,7 @@
 
 ROOT = Path(__file__).resolve().parents[1]
 CANONICAL = ROOT / "skills" / "deploybot" / "SKILL.md"
-RELEASE_COMMIT = "7842edbd5fe75cdb68324e98c2a7244aed3009f6"
+RELEASE_COMMIT = "208d4168e5a02b994905e94d648599d06b4afbd2"
 CHECKOUT_COMMIT = "9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0"