From 75cb4ce08d509fa3fc72ba76b05955e406f67425 Mon Sep 17 00:00:00 2001
From: Fabro <noreply@fabro.sh>
Date: Wed, 1 Jul 2026 21:52:10 +0000
Subject: [PATCH] fabro(01KWFTMDQVT7SD0GRRWKXH776E): plan (succeeded)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Fabro-Run: 01KWFTMDQVT7SD0GRRWKXH776E
Fabro-Completed: 3
Fabro-Checkpoint: 0597c7e17008fed2e5fbf631aaa0495e27bf29db

⚒️ Generated with [Fabro](https://fabro.sh)
---
 merge-train-plan.md | 48 +++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 48 insertions(+)
 create mode 100644 merge-train-plan.md

diff --git a/merge-train-plan.md b/merge-train-plan.md
new file mode 100644
index 000000000..e20c7423f
--- /dev/null
+++ b/merge-train-plan.md
@@ -0,0 +1,48 @@
+# Merge Train Plan
+
+Base branch: `main`
+Requested order: **543, 544** (squash merge, rebase each onto latest main)
+
+## READY PRs (in merge order)
+
+| # | Title | Head branch | Author | Mergeable |
+|---|-------|-------------|--------|-----------|
+| 543 | feat: grant Dependabot alerts read/write to auto-created GitHub Apps | `add-dependabot-alerts-app-scope` | swerner | MERGEABLE |
+| 544 | fix: grant organization_projects to auto-created GitHub Apps for Projects V2 | `add-organization-projects-app-scope` | swerner | MERGEABLE |
+
+Both are open, not draft, target `main`, and their head branches live in the
+`fabro-sh/fabro` repo (not forks). Both are eligible.
+
+## SKIP list
+
+None.
+
+## Ordering notes
+
+Keep the requested order **543 → 544**. No logical dependency was detected; the
+two PRs add independent GitHub App permissions. Order does not matter
+functionally, so the given order stands — no human confirmation needed.
+
+## Conflict warnings
+
+**PR 544 will conflict after 543 merges** (expected — the train resolves it).
+
+Both PRs touch the exact same two files and the exact same regions:
+
+- `lib/crates/fabro-cli/src/commands/install.rs`
+  - `build_github_app_manifest`: both change the `"emails": "read"` line
+    (add trailing comma + a new permission key).
+    - 543 adds `"vulnerability_alerts": "write"`
+    - 544 adds `"organization_projects": "write"`
+  - Test block: both insert an `assert_eq!` on
+    `manifest["default_permissions"][...]` at the same line.
+- `lib/crates/fabro-server/src/install.rs`
+  - `build_github_app_manifest`: same `"emails": "read"` line edit.
+
+**Resolution guidance for the train stage:** these are additive and
+non-contradictory. When rebasing 544 onto main (after 543 is in), keep BOTH
+permission keys in the manifest map and BOTH test assertions. The final
+`default_permissions` block should contain `"emails": "read"`,
+`"vulnerability_alerts": "write"`, and `"organization_projects": "write"`
+(with correct trailing commas). Verify with
+`cargo nextest run -p fabro-cli -p fabro-server` before pushing.