diff --git a/.claude/commands/process-konflux-prs.md b/.claude/commands/process-konflux-prs.md
deleted file mode 100644
index 0efaa940905..00000000000
--- a/.claude/commands/process-konflux-prs.md
+++ /dev/null
@@ -1,599 +0,0 @@
----
-name: process-konflux-prs
-description: Look at pull requests created by the Konflux bot and manage them, optimizing their merge to avoid repetitive builds.
-allowed-tools:
-  - Bash(scripts/process-konflux-prs/snapshot-prs.sh *)
-  - Bash(scripts/process-konflux-prs/list-prs.sh *)
-  - Bash(scripts/process-konflux-prs/get-pr-status.sh *)
-  - Bash(scripts/process-konflux-prs/get-pr-components.sh *)
-  - Bash(scripts/process-konflux-prs/label-pr.sh *)
-  - Bash(scripts/process-konflux-prs/merge-pr.sh *)
-  - Bash(scripts/process-konflux-prs/skip-pr.sh *)
-  - Bash(scripts/process-konflux-prs/check-pipeline-status.sh *)
-  - Bash(scripts/process-konflux-prs/check-merge-safety.sh *)
-  - Bash(scripts/process-konflux-prs/get-nudge-prs.sh *)
-  - Bash(scripts/process-konflux-prs/get-component-info.sh)
-  - Bash(scripts/process-konflux-prs/get-component-info.sh *)
----
-
-Process the pull requests from Mintmaker and Konflux
-
-# Implementation Requirements
-
-**CRITICAL: Parameter-gated behavior**: The command behavior is strictly controlled by parameters:
-
-- **No parameter**: ONLY list PRs. For each PR, show which images will be rebuilt and the
-  suggested action (see [Status output format](#status-output-format)). Do NOT label or merge.
-- **`--mintmaker`**: Process Mintmaker PRs ONLY. Apply labels (ok-to-test, lgtm), then merge
-  PRs that are ready (see [Step 1 - Mintmaker PR processing](#step-1---mintmaker-pr-processing)).
-  Do NOT touch Nudge PRs.
-- **`--nudge`**: Process Nudge PRs ONLY, with the Mintmaker safeguard (see
-  [Step 2 - Nudge PR processing](#step-2---nudge-pr-processing)). Do NOT touch Mintmaker PRs.
-  Merges nudge PRs that do not auto-merge (non-osc repos, and osc PRs not targeting `devel`).
-- **`--dry-run`**: Show what would be done. Do NOT label or merge. Can be combined with
-  `--mintmaker` or `--nudge` to preview that specific step.
-
-`--mintmaker` and `--nudge` are mutually exclusive. If neither is given, only list/status output
-is produced.
-
-**CRITICAL**: Always query fresh data. Never use PR numbers from previous runs or earlier in the conversation.
-
-When implementing this skill:
-
-1. **Always start fresh**: Use `list-prs.sh` at the beginning of execution to get current PRs
-2. **Process only discovered PRs**: Only process PR numbers returned from `list-prs.sh`
-3. **Never hardcode PR numbers**: Do not use PR numbers from memory, previous runs, or earlier conversation turns
-4. **Verify state before processing**: Use `get-pr-status.sh` to verify PR state before taking action
-
-All scripts must be called from the **repository root** using the full relative path
-`./scripts/process-konflux-prs/<script>.sh`. Never `cd` into the scripts directory.
-
-Example correct workflow:
-```bash
-# CORRECT: call from repo root, discover PRs dynamically
-prs=$(./scripts/process-konflux-prs/list-prs.sh --mintmaker)
-for pr in $(echo "$prs" | jq -c '.[]'); do
-  repo=$(echo "$pr" | jq -r '.repo')
-  number=$(echo "$pr" | jq -r '.number')
-  # Process each discovered PR
-done
-
-# WRONG: Using hardcoded or remembered PR numbers
-for pr_num in 2147 2146 2144 2143; do  # ❌ Never do this
-  # ...
-done
-```
-
-**Efficiency**: use `snapshot-prs.sh` to discover PRs and fetch all their statuses in a
-single script invocation:
-
-```bash
-snapshot=$(./scripts/process-konflux-prs/snapshot-prs.sh --mintmaker)
-```
-
-Do NOT call `list-prs.sh` followed by a `get-pr-status.sh` loop — `snapshot-prs.sh`
-already does both.
-
-**IMPORTANT**: Do not perform active polling/wait loops when executing.
-This skill is intended to be run on a regular basis. Each time it runs, it should
-evaluate the status of all PRs, and try to move them forward according to the
-workflow. If the workflow states that you "need to wait" for something (like:
-wait for the completion of checks), this skill should actually let the PR untouched,
-and on next run, look at the status again.
-The labels we put on the PRs are used to keep some state information without the
-need to maintain any local status.
-
-# Available Helper Scripts
-
-All scripts are located in `scripts/process-konflux-prs/` and output JSON.
-
-## list-prs.sh
-List Konflux PRs from repositories.
-```bash
-./scripts/process-konflux-prs/list-prs.sh [--mintmaker|--nudge] [--repo REPO_NAME]
-```
-Output: JSON array with `{number, title, url, repo, type}`
-
-## get-pr-status.sh
-Get PR status including checks, labels, and rebuilt components — **one call replaces a
-separate `get-pr-components.sh` call**.
-```bash
-./scripts/process-konflux-prs/get-pr-status.sh --repo REPO_NAME --pr PR_NUMBER
-```
-Output: JSON object — exact shape:
-```json
-{
-  "number": 1234,
-  "title": "chore(deps): update …",
-  "state": "OPEN",
-  "labels": ["ok-to-test"],          // array of strings, NOT objects
-  "has_ok_to_test": true,
-  "has_lgtm": false,
-  "components": ["osc-operator"],    // rebuilt components (from build pipeline checks)
-  "build_checks_passed": true,       // true only when all build pipeline checks are SUCCESS
-                                     // enterprise-contract checks (conclusion=NEUTRAL) excluded
-  "build_checks_failed": [],         // names of build checks with FAILURE conclusion
-  "pending_checks": 0,               // integer count of IN_PROGRESS/QUEUED checks
-  "checks": [...]                    // raw checks array, null entries filtered
-}
-```
-
-**Use `build_checks_passed` (not `all_checks_passed`) to determine if a PR is ready.**
-Enterprise-contract checks legitimately return `NEUTRAL` and are excluded from
-`build_checks_passed`. If `pending_checks > 0`, checks are still running — wait for
-the next run.
-
-## snapshot-prs.sh
-Discover PRs and fetch their status in one pass — replaces a `list-prs.sh` call followed
-by a `get-pr-status.sh` loop.
-```bash
-./scripts/process-konflux-prs/snapshot-prs.sh --mintmaker|--nudge [--repo REPO_NAME]
-```
-Output: JSON array of status objects, one per PR:
-```json
-[{
-  "repo": "osc", "pr": 1234, "title": "…",
-  "base_branch": "devel",
-  "components": ["osc-operator"],
-  "build_checks_passed": true,
-  "build_checks_failed": [],
-  "pending_checks": 0,
-  "has_ok_to_test": true,
-  "has_lgtm": false
-}]
-```
-**Use this instead of calling `list-prs.sh` then looping over `get-pr-status.sh`.**
-
-## label-pr.sh output and error handling
-
-`label-pr.sh` outputs a single JSON object. Do **not** try to parse anything else
-from its output — the underlying `gh` command occasionally prints extra text to
-stdout that is now suppressed, but if a future version leaks text before the JSON,
-a display-layer `jq` parse error does **not** mean the label was not applied.
-
-**When a batch labeling loop produces jq parse errors:**
-1. Do NOT re-run `label-pr.sh` for the same PR — the label may already be set.
-2. Continue to the next phase (e.g. apply `lgtm` after the `ok-to-test` batch).
-3. If verification is needed, use `get-pr-status.sh` to check the current label
-   state — never infer failure from display-layer errors alone.
-
-## get-pr-components.sh
-Identify components that will be rebuilt (excludes enterprise-contract validation checks).
-```bash
-./scripts/process-konflux-prs/get-pr-components.sh --repo REPO_NAME --pr PR_NUMBER
-```
-Output: JSON array of component names.
-**Note:** `get-pr-status.sh` already returns `components` — prefer using that to avoid
-a redundant GitHub API call.
-
-## label-pr.sh
-Add a label to a PR.
-```bash
-./scripts/process-konflux-prs/label-pr.sh --repo REPO_NAME --pr PR_NUMBER --label LABEL_NAME
-```
-Labels: "ok-to-test" or "lgtm"
-Output: JSON with {success, repo, pr, label, comment}
-Note: when label is "ok-to-test", also posts a `/ok-to-test` comment; `comment` indicates whether it succeeded.
-
-## skip-pr.sh
-Mark a PR as intentionally skipped: adds the `mintmaker-skip` label and posts an
-explanatory comment. The label prevents re-posting on subsequent runs.
-```bash
-./scripts/process-konflux-prs/skip-pr.sh --repo REPO_NAME --pr PR_NUMBER --reason "reason"
-```
-Output: JSON with {success, repo, pr, message}
-
-## merge-pr.sh
-Merge a PR using the merge (non-squash) strategy.
-```bash
-./scripts/process-konflux-prs/merge-pr.sh --repo REPO_NAME --pr PR_NUMBER
-```
-Output: JSON with {success, repo, pr, message}
-Note: deletes the source branch after merging.
-
-## check-pipeline-status.sh
-Check Konflux pipeline status.
-```bash
-# For on-push (default)
-./scripts/process-konflux-prs/check-pipeline-status.sh --component COMPONENT_NAME
-
-# For on-pull-request (--pr-id REQUIRED)
-./scripts/process-konflux-prs/check-pipeline-status.sh --component COMPONENT_NAME --type on-pull-request --pr-id PR_ID
-```
-Output: JSON with {component, pipeline_type, latest, all_runs}
-Note: --pr-id is mandatory for on-pull-request to avoid matching runs from different PRs
-
-## check-merge-safety.sh
-Check whether it is safe to merge a PR by verifying no on-push pipeline is running
-for any of its components. Wraps `check-pipeline-status.sh` over a component list.
-```bash
-./scripts/process-konflux-prs/check-merge-safety.sh --components "comp1 comp2 ..."
-```
-Output: JSON `{safe_to_merge: bool, blocking: [{component, pipeline, reason}]}`
-- `safe_to_merge`: true when no component has a running on-push pipeline
-- `blocking`: list of components currently blocked (empty when safe)
-
-**Use this instead of a manual loop over `check-pipeline-status.sh` before each merge.**
-
-## get-nudge-prs.sh
-Find nudge PRs for a component.
-```bash
-./scripts/process-konflux-prs/get-nudge-prs.sh --component COMPONENT_NAME
-```
-Output: JSON array of nudge PRs
-
-## get-component-info.sh
-Get component metadata.
-```bash
-./scripts/process-konflux-prs/get-component-info.sh [--component COMPONENT_NAME]
-```
-Output: JSON with {name, repository, build_time_minutes, nudges}
-
-# Workflow definition
-
-We receive two types of pull requests from Konflux:
-
-- **Mintmaker PRs**: dependency updates (base images, konflux references).
-- **Nudge PRs**: updated reference to a newly built image from our own pipelines.
-
-The first type comes on a regular basis from Mintmaker.
-The second is triggered automatically when a PR is merged: each merge builds (at
-least) one image, which then causes Konflux to open or update a Nudge PR in the
-downstream component(s).
-See the [list of components](#list-of-components) for nudge relationships.
-
-**The workflow is two separate steps, run independently:**
-
-1. **Step 1 — Mintmaker PRs** (`--mintmaker`): label and advance Mintmaker PRs.
-2. **Step 2 — Nudge PRs** (`--nudge`): label and advance Nudge PRs, but ONLY
-   those that are safe to process (see below).
-
-Merging Mintmaker PRs triggers component rebuilds, which in turn refresh the
-existing Nudge PRs. Processing a Nudge PR before the corresponding Mintmaker PRs
-are done would merge a stale image reference that gets immediately superseded.
-Steps 1 and 2 must therefore stay separate.
-
-## Labelling rules (applies to both steps)
-
-Using labels marks the progression of PRs towards merging, so the command can be
-re-run without keeping external state. Developers can also set labels manually and
-this process will respect them.
-
-Labels used:
-
-- `ok-to-test`: triggers automated CI on the PR.
-- `lgtm`: marks the PR as ready to merge.
-
-Rules:
-
-Both rules are evaluated against the **state returned by `get-pr-status.sh` at the
-start of this run** — the snapshot is fixed before any labels are applied. Applying
-`ok-to-test` in this run does NOT qualify the same PR for `lgtm` in the same run,
-because `ok-to-test` triggers new CI pipelines whose results are not yet known.
-
-- If `has_ok_to_test` is `false` in the snapshot, set `ok-to-test` **and** post a
-  `/ok-to-test` comment. Some bots only react to maintainer comments, not label
-  additions alone. Stop here for this PR — do NOT also set `lgtm`.
-- If `has_ok_to_test` is `true` in the snapshot AND `build_checks_passed` is `true`
-  AND `pending_checks` is `0`, set `lgtm`. (`build_checks_passed` excludes
-  enterprise-contract checks that return `NEUTRAL` — do NOT use `all_checks_passed`.)
-
-Labelling can be done in parallel for all PRs from all repositories, as there
-is no conflict between "on-pull-request" pipelines running concurrently.
-
-Note that Nudge PRs in the osc repository targeting the **`devel` branch** are
-configured to auto-merge when tests pass. Setting `ok-to-test` on those PRs is
-therefore the only required label. Nudge PRs in osc targeting any other branch
-(e.g. `osc-release-v1.12`) do NOT auto-merge and must be treated the same as
-PRs from non-osc repositories (explicit lgtm + merge). Track the merge pipeline
-when a PR auto-merges to confirm success (see [merging](#merging)).
-
-## Step 1 - Mintmaker PR processing
-
-**Only executed when `--mintmaker` is passed.**
-
-### Phase 0 — Skip filter
-
-Before labelling or merging, identify PRs that match a known skip pattern and remove
-them from the processing set.
-
-**Known skip patterns:**
-
-- **go-toolset major-version-only tag**: title contains `ubi9/go-toolset` or
-  `ubi10/go-toolset` AND the tag is a bare major version (e.g. `v9`, `v10`) with no
-  Go version number.
-  Detection: title matches `ubi[0-9]+/go-toolset` AND ends with `tag to v<N>` where
-  `<N>` is a single integer (no dots). Example: `"Update ubi9/go-toolset Docker tag to v9"`.
-  *Why*: we pin `go-toolset` to the Go version tag (e.g. `v1.26.4-...`), not the
-  image's own major version. A separate PR with the correct Go version tag will arrive.
-
-For each PR matching a skip pattern:
-- If `has_mintmaker_skip` is `false` in the snapshot: call `skip-pr.sh` with an
-  appropriate `--reason` explaining the skip. This posts a comment and adds the
-  `mintmaker-skip` label so subsequent runs skip it silently.
-- Remove the PR from the snapshot used in Phase A and Phase B (do not label or merge it,
-  regardless of `has_mintmaker_skip`).
-
-### Phase A — Labelling
-
-1. Call `snapshot-prs.sh --mintmaker` to discover open Mintmaker PRs and fetch their
-   status in one pass. Record the result as the **initial snapshot** (this snapshot is
-   fixed; it must not be refreshed during the same run).
-2. Run Phase 0 to remove skip-pattern PRs from the snapshot.
-3. For each remaining entry in the snapshot, apply labelling rules above.
-
-### Phase B — Merging
-
-After all labelling is complete, merge PRs that were **already ready before this run**:
-
-- A PR is eligible to merge if, in the **initial snapshot**: `has_lgtm` is `true`
-  AND `build_checks_passed` is `true` AND `pending_checks` is `0`.
-- Do NOT merge a PR that received `lgtm` during this run's Phase A — the same
-  snapshot principle applies: lgtm was just set, so this is its first eligible run,
-  not a confirmed-ready state from a prior run.
-- **Pre-merge pipeline check**: Before merging a PR, call:
-  ```bash
-  ./scripts/process-konflux-prs/check-merge-safety.sh --components "comp1 comp2 ..."
-  ```
-  using the snapshot's `components` array. If `safe_to_merge` is `false`, **skip this
-  PR** and report it as "blocked by running on-push pipeline" (include the `blocking`
-  list in the report). Do NOT merge it.
-- Merge PRs one at a time using `merge-pr.sh`. After each merge, note which
-  components will be rebuilt (from the snapshot's `components` field).
-- Within a single run, do NOT merge two PRs that rebuild the same component —
-  the second one must wait for the on-push pipeline triggered by the first to complete.
-  Leave it for the next run.
-- Use `merge-pr.sh --repo REPO_NAME --pr PR_NUMBER` to merge.
-
-### Phase C — Report
-
-Report four groups:
-- PRs skipped this run (matched a skip pattern; `skip-pr.sh` called for first-time skips).
-- PRs labelled in this run (ok-to-test or lgtm added).
-- PRs merged in this run.
-- PRs waiting (checks pending, build failed, blocked by a running on-push pipeline, or blocked by a same-component merge in this run).
-
-Do NOT touch Nudge PRs during Step 1.
-
-## Step 2 - Nudge PR processing
-
-**Only executed when `--nudge` is passed.**
-
-Nudge PRs must only be processed when we are certain that no open Mintmaker PR
-will trigger a rebuild of the same source component. If a Mintmaker PR would
-rebuild component C, and a Nudge PR carries an updated reference for C, merging
-the Nudge PR now would be immediately obsoleted by the Mintmaker rebuild.
-
-### Why the hold-back strategy is needed
-
-When multiple Nudge PRs all target the same downstream component (e.g.
-`osc-operator-bundle`), merging them triggers one on-push pipeline per merge.
-These pipelines run concurrently on their respective HEADs. Because each pipeline
-builds and publishes independently, the one that **finishes last** wins — regardless
-of merge order. If the last-finishing pipeline was triggered by the first merge, it
-produces an image that is missing all the updates from later merges.
-
-The fix: hold one PR back and only merge it once all other on-push pipelines for
-that component group have completed. Its merge then triggers a single, uncontested
-final pipeline that builds from HEAD containing all previous merges, producing a
-complete image with all component updates.
-
-### Step 2 algorithm
-
-**Phase A — Build the "Mintmaker-blocked" component set**
-
-1. Call `snapshot-prs.sh --mintmaker` to get all open Mintmaker PRs with their status.
-2. Union the `components` arrays from all entries into a single set:
-   `mintmaker_rebuilding_components`.
-
-**Phase B — Filter, group, and label Nudge PRs**
-
-1. Call `snapshot-prs.sh --nudge` to get all open Nudge PRs with their status.
-   Record the result as the **initial snapshot** (fixed for this run).
-2. For each Nudge PR, identify the **source component** — the component whose
-   reference was updated — by matching known component names against the PR title.
-   Use `get-component-info.sh` (no args) to get the full list of component names.
-3. Remove PRs whose source component is in `mintmaker_rebuilding_components` from
-   the working set. Note them as "blocked by open Mintmaker PR". Do NOT label them.
-4. **Group** the remaining PRs by their `components` array (exact match on the set
-   of components they will rebuild — same components = same group).
-5. For each group:
-
-   **Group has multiple open PRs:**
-   The **held-back PR** for a multi-PR group is always the **lowest-numbered open PR**,
-   regardless of its label state. It is kept last so that its on-push pipeline runs
-   uncontested after all peers have merged.
-   - Identify PRs with `has_ok_to_test: false` (not yet labeled).
-   - If **2 or more** PRs have `has_ok_to_test: false`: apply `ok-to-test` to all
-     except the lowest-numbered (the held-back PR). Do NOT label the held-back PR.
-   - If **exactly one** PR has `has_ok_to_test: false` and the rest have
-     `has_ok_to_test: true` (still open, not yet merged): that sole unlabeled PR is
-     the held-back PR waiting for its peers to merge first. Do NOT label it.
-   - If **all** PRs have `has_ok_to_test: true`: all are in flight; nothing to label.
-     The lowest-numbered is still implicitly the held-back PR (Phase C will not merge it).
-
-   **Group has exactly one open PR** (all peers have merged — they are no longer in
-   the snapshot):
-   - This is either a standalone PR or the held-back PR whose peers have all merged.
-   - Call `check-merge-safety.sh --components "<components>"`.
-   - If `safe_to_merge: true`: apply standard labelling rules — `ok-to-test` if not
-     set; `lgtm` if `ok-to-test` is already set and checks pass (for non-osc repos;
-     see Phase C).
-   - If `safe_to_merge: false`: **do not label**. Report as "waiting for on-push
-     pipelines to complete" and include the `blocking` list. Revisit next run.
-
-**Phase C — Merge PRs that do not auto-merge**
-
-Only osc Nudge PRs with `base_branch == "devel"` auto-merge when tests pass.
-All other PRs require explicit merging:
-- PRs from non-osc repositories (compute-artifacts, podvm-scripts).
-- osc PRs with `base_branch != "devel"` (e.g. targeting `osc-release-v1.12`).
-
-For each group that requires explicit merging, process as follows:
-
-**Single-PR group** (solo or held-back PR whose peers have all merged): merge it if
-`has_ok_to_test: true` AND `build_checks_passed: true` AND `pending_checks: 0` AND
-`check-merge-safety` passes.
-
-**Multi-PR group**: the held-back PR is the **lowest-numbered open PR** in the group.
-For all other PRs where the **initial snapshot** shows `has_ok_to_test: true`
-AND `build_checks_passed: true` AND `pending_checks: 0`:
-- Call `check-merge-safety.sh --components "<components>"` **once** before merging
-  any PR in the group. If `safe_to_merge` is `false`, skip the entire group and report
-  as "blocked by running on-push pipeline".
-- Apply `lgtm` and merge **all** eligible PRs in this single run. Merging multiple PRs
-  from the same group in one run is intentional: their on-push pipelines will race, but
-  the held-back PR's final pipeline (merged in a later run once all pipelines complete)
-  produces the definitive image containing all component updates.
-- The held-back PR (lowest-numbered) is NOT merged this run. It is processed in a
-  subsequent run once all peers have merged and check-merge-safety passes (Phase B
-  solo-group path).
-
-**Phase D — Report**
-
-Report four groups:
-- **Labeled this run**: Nudge PRs that received `ok-to-test` or `lgtm`.
-- **Merged this run**: non-osc Nudge PRs successfully merged.
-- **Held back**: PRs designated as held-back (waiting for group peers to merge or
-  for pipelines to clear). For each, show which peers are still open or which
-  pipelines are blocking.
-- **Skipped**: PRs blocked by an open Mintmaker PR, by still-running on-push
-  pipelines, or with pending/failed checks. Include the reason for each.
-
-## Merging
-
-PRs are ready to merge when they have `lgtm` and all checks are passing.
-
-We need to be careful when merging a PR: each merge triggers on-push pipelines
-that rebuild the component. A second PR for the same component must not be merged
-until those pipelines succeed.
-
-The checks that run on the pull request itself include Konflux pipeline builds.
-The same pipelines will run on-push when the PR is merged. It is then possible
-to know, before the PR is merged, which component it will rebuild.
-Use `get-pr-components.sh` to identify which components will be rebuilt.
-
-The build pipelines themselves can be monitored from the Konflux cluster, using
-`check-pipeline-status.sh`.
-Then when we merge a PR, we can monitor which on-push pipelines are triggered, and
-wait for their completion before merging another PR for the same component.
-
-When the on-push pipeline is successful, a Nudge PR can be created.
-If the Nudge PR already exists, it is updated every time the same component is rebuilt.
-We then let the Nudge PRs open as long as we are processing Mintmaker PRs, and
-process the Nudge PRs as a second step, to avoid unnecessary rebuilds.
-Use `get-component-info.sh` to see which components are nudged when a component is rebuilt.
-
-Verifying that the nudge PR is created or updated is part of how we verify that
-a Mintmaker PR was successfully merged. If the on-push pipeline failed, or if the
-expected Nudge PR update doesn't come, we consider the merge as failed, report it,
-and stop processing any other PR related to the same component.
-
-# List of repositories
-
-| Repo name         | URL                                                           |
-| ----------------- | ------------------------------------------------------------- |
-| kata-containers   | `https://github.com/openshift/kata-containers`                |
-| cloud-api-adaptor | `https://github.com/openshift/cloud-api-adaptor`              |
-| compute-artifacts | `https://github.com/openshift/confidential-compute-artifacts` |
-| podvm-scripts     | `https://github.com/confidential-devhub/coco-podvm-scripts`   |
-| osc               | `https://github.com/openshift/sandboxed-containers-operator`  |
-
-# Mintmaker PRs filter
-
-Implemented in `list-prs.sh --mintmaker`:
-
-- status is "open"
-- author is the "app/red-hat-konflux" bot
-- title matches one of the following patterns (note: generalised to avoid missing new image types):
-
-  - starts with `"chore(deps): update konflux references"` or `"Update Konflux references"`
-  - starts with `"chore(deps): update registry.access.redhat.com/ubi9/"` (any ubi9 image)
-  - starts with `"chore(deps): update registry.access.redhat.com/ubi10/"` (any ubi10 image)
-  - starts with `"Update registry.access.redhat.com/ubi9/"` or `"Update registry.access.redhat.com/ubi10/"`
-  - starts with `"chore(deps): update registry.redhat.io/rhel9/rhel-bootc"` (rhel-bootc image)
-  - starts with `"Update registry.redhat.io/rhel9/rhel-bootc"`
-
-# Nudge PRs filter
-
-Implemented in `list-prs.sh --nudge`:
-
-- status is "open"
-- author is the "app/red-hat-konflux" bot
-- label "konflux-nudge" is set
-- title does NOT start with "chore(deps): update osc-operator-bundle"
-
-# List of components
-
-The following table shows the list of components, the repository they are built from,
-an estimation of the time to build the image, and the component(s) that is updated
-by a Nudge PR when they are rebuilt.
-
-Available via `get-component-info.sh`.
-
-| Component             | Repository        | Approx. build time | Nudged component(s)                                   |
-| --------------------- | ----------------- | ------------------ | ----------------------------------------------------- |
-| osc-monitor           | kata-containers   | 10 min             | osc-operator-bundle                                   |
-| osc-caa               | cloud-api-adaptor | 15 min             | osc-operator-bundle                                   |
-| osc-caa-webhook       | cloud-api-adaptor | 10 min             | osc-operator-bundle                                   |
-| osc-podvm-payload     | cloud-api-adaptor | 45 min             | osc-operator-bundle, osc-dm-verity-image, osc-initrds |
-| osc-pccs              | compute-artifacts |  8 min             | osc-operator-bundle                                   |
-| osc-tdx-qgs           | compute-artifacts |  8 min             | osc-operator-bundle                                   |
-| osc-storage-helper    | compute-artifacts |  8 min             | osc-operator-bundle                                   |
-| osc-operator          | osc               | 12 min             | osc-operator-bundle                                   |
-| osc-operator-bundle   | osc               |  3 min             | osc-test-fbc                                          |
-| osc-podvm-builder     | osc               | 10 min             | osc-operator-bundle                                   |
-| osc-must-gather       | osc               | 10 min             | osc-operator-bundle                                   |
-| osc-dm-verity-image   | podvm-scripts     | 50 min             | osc-operator-bundle                                   |
-| build-dm-verity-image | podvm-scripts     |  2 min             | osc-dm-verity-image                                   |
-| osc-initrds           | compute-artifacts | 15 min             |                                                       |
-| osc-test-fbc          | osc               | 15 min             |                                                       |
-
-Note about the osc-test-fbc component:
-This is the file-based catalog that we use for testing. It is updated when the
-bundle is rebuilt.
-As the bundle gets rebuilt every time any other image is rebuilt, we want to keep
-the Nudge PR for the osc-test-fbc opened as long as there are updates going on.
-That's why this process should ignore the Nudge PR with title like:
-"chore(deps): update osc-operator-bundle"
-as these are the PRs that update the catalog.
-Merging this PR should only be done manually, when we are ready to start testing
-the whole set of images.
-
-# Konflux cluster access
-
-Access to Konflux is granted with a token, generated from a dedicated service account,
-with limited access. The token will be provided when setting up the automated process.
-
-Scripts should not use the "oc project" command, as there are limitations
-for the service account here. Instead, they should specify the target namespace on
-every command (default: ose-osc-tenant).
-
-# GitHub access
-
-A dedicated token should be provided to access GitHub via `gh auth login`.
-
-# How to identify the pipelineruns for a given PR
-
-The pipelines running on the PR can be identified as checks with a name that matches the following pattern:
-"Red Hat Konflux / {component-name}-on-pull-request"
-
-**Important:** Enterprise contract checks (validation checks) should be excluded. They follow a different pattern and do not represent component builds.
-
-Multiple component build checks can exist for a given PR, depending on which files are modified by the PR.
-The details of the check will show the exact pipelinerun ID, with format {component-name}-on-pull-request-{alphanumeric ID}.
-When the PR is merged, a similar pipelinerun will start, with pattern:
-{component-name}-on-push-{other alphanumeric ID}
-
-# Status output format
-
-When run with no parameter (list-only mode), the result should be displayed on the
-terminal (if available) and saved under the local folder as a markdown file with
-a timestamp in the filename for easy filtering (like: "YYYYMMDD-Konflux-PR-status.md").
-
-The output for each PR should include:
-
-- PR Number (with link to the PR on GitHub)
-- Rebuilt component(s)
-- Current status
-- Recommended action
diff --git a/scripts/process-konflux-prs/README.md b/scripts/process-konflux-prs/README.md
index c2f9926a23c..e7a2ce49626 100644
--- a/scripts/process-konflux-prs/README.md
+++ b/scripts/process-konflux-prs/README.md
@@ -1,233 +1,203 @@
-# Process Konflux PRs - Helper Scripts
+# Konflux PRs Processing
 
-This directory contains independent scripts that provide base functionalities for managing Konflux PRs. These scripts are designed to be called by the `process-konflux-prs` skill, but can also be used standalone.
+## The problem
 
-## Scripts Overview
+We're getting automated PRs across several of our repositories, to keep
+dependencies and component images up to date. Two families of PRs are involved:
 
-### 1. list-prs.sh
-List Konflux PRs from all repositories.
+**Mintmaker PRs** update source-level dependencies. We're using it for base image
+digests, Konflux bundle references, RPM lockfiles, and cross-repository image
+digests. These PRs must be approved and merged. Each merge triggers an on-push
+pipeline that rebuilds and publishes the component image, generating Nudge PRs.
 
-**Usage:**
-```bash
-./list-prs.sh [--mintmaker|--nudge] [--repo REPO_NAME]
-```
-
-**Options:**
-- `--mintmaker`: Filter for Mintmaker PRs only
-- `--nudge`: Filter for Nudge PRs only
-- `--repo REPO_NAME`: Filter for a specific repository
-
-**Output:** JSON array of PRs with number, title, url, repo, and type.
+**Nudge PRs** updates our own image references, whenever one of them is rebuilt.
+They also need approval before being merged.
+To avoid multiple unneeded rebuilds, it is generally better to merge the Nudge
+PRs only when Mintmaker PRs are fully processed.
+Also, it is important to be careful when merging multiple nudge PRs in parallel,
+as the build time and schedule can be unpredictable, leading to the latest bundle
+image not carrying the latest images references.
 
-**Example:**
-```bash
-# List all Konflux PRs
-./list-prs.sh
+**Test-FBC PRs** are a special subset of nudge PRs that update `osc-operator-bundle` for
+our test catalog. We use this as a way to control when a test catalog, containing
+all expected updates, should be created. It should be merged only when all 
+Mintmaker and Nudge PRs are processed.
+Building the test catalog triggers an automated test on the full image set.
 
-# List only Mintmaker PRs
-./list-prs.sh --mintmaker
+Processing this volume of PRs correctly by hand is time-consuming. The queue spans
+five repositories, PRs arrive continuously, pipelines can fail, and merging in
+the wrong order wastes rebuild capacity.
 
-# List Nudge PRs from the osc repository
-./list-prs.sh --nudge --repo osc
-```
+## The process
 
-### 2. get-pr-status.sh
-Get the status of a specific PR including checks, labels, and merge state.
+Each run executes three stages in order:
 
-**Usage:**
-```bash
-./get-pr-status.sh --repo REPO_NAME --pr PR_NUMBER
 ```
-
-**Options:**
-- `--repo REPO_NAME`: Repository name (kata-containers, cloud-api-adaptor, compute-artifacts, podvm-scripts, osc)
-- `--pr PR_NUMBER`: Pull request number
-
-**Output:** JSON with PR details including:
-- `number`, `title`, `state`
-- `labels`: Array of label names
-- `checks`: Array of status checks with name, status, conclusion, details_url
-- `has_ok_to_test`: Boolean indicating if "ok-to-test" label is present
-- `has_lgtm`: Boolean indicating if "lgtm" label is present
-- `build_checks_passed`: Boolean indicating if all build checks have passed
-- `pending_checks`: Count of checks still in progress
-
-**Example:**
-```bash
-./get-pr-status.sh --repo osc --pr 2147
-```
-
-### 3. get-pr-components.sh
-Identify which components will be rebuilt by a PR based on its Konflux checks.
-
-**Usage:**
-```bash
-./get-pr-components.sh --repo REPO_NAME --pr PR_NUMBER
-```
-
-**Options:**
-- `--repo REPO_NAME`: Repository name
-- `--pr PR_NUMBER`: Pull request number
-
-**Output:** JSON array of component names that will be rebuilt.
-
-**Note:** This script filters out enterprise-contract validation checks, which are not component builds. It only returns actual component builds that match the pattern "Red Hat Konflux / {component-name}-on-pull-request".
-
-**Example:**
-```bash
-./get-pr-components.sh --repo cloud-api-adaptor --pr 1234
-# Output: ["osc-caa", "osc-caa-webhook"]
-```
-
-### 4. label-pr.sh
-Add a label to a PR.
-
-**Usage:**
-```bash
-./label-pr.sh --repo REPO_NAME --pr PR_NUMBER --label LABEL_NAME
-```
-
-**Options:**
-- `--repo REPO_NAME`: Repository name
-- `--pr PR_NUMBER`: Pull request number
-- `--label LABEL_NAME`: Label to add (must be "ok-to-test" or "lgtm")
-
-**Output:** JSON with success status.
-
-**Example:**
-```bash
-./label-pr.sh --repo osc --pr 2147 --label ok-to-test
+Stage 1 — Mintmaker
+  For each open Mintmaker PR:
+    • label ok-to-test (if missing)
+    • label lgtm (if ok-to-test set, all build checks passed, none pending)
+    • merge  (if lgtm already set before this run and merge is safe)
+
+Stage 2 — Nudge
+  For each open Nudge PR:
+    • skip: if the component being refreshed still has a Mintmaker PR opened
+    • Group processing: hold back the oldest, process the rest
+      We can trigger merges for all Nudges at once, as long as we keep one open.
+      This last PR will be merged separately, when no other is oppen, effectively
+      prevenging race conditions and controlling the content of the bundle image
+      that results from the merge.
+    • label ok-to-test / lgtm, merge — same rules as Mintmaker
+
+Stage 3 — Test-FBC   (only when Stage 2 queue is fully drained)
+  Same labelling/merge flow as a solo nudge PR.
 ```
 
-### 5. check-pipeline-status.sh
-Check the status of Konflux pipelines for a component.
+Merge safety is enforced before every merge. The merge is deferred if:
+- an on-push pipeline is currently running for any of the components impacted by
+  the PR
+- the last on-push pipeline for this component on the target branch did not succeed
+
+A markdown report is written at the end of each run.
+
+## Interacting with the process
+
+This set of script is meant to be run in automation, in a stateless manner.
+It takes all required information from the PRs it is managing
+(labels and test/pipeline status).
+It is also looking at pipelines running on our Konflux instance at the time it
+is executing, to avoid multiple parallel rebuilds of the same components.
+
+In order to control its execution for select PRs, we can also use the labels:
+
+- **ok-to-test**: this label triggers the build/test automations on the CI
+  We can add this label manually to start the tests earlier, and make the script
+  catch from there.
+  We can remove the label to interupt new tests and delay the time where the PR
+  will be merged.
+- **lgtm**: this label marks the PR as ready to merge, assuming the builds/tests
+  are passing. We can manually add or remove this label to control the PR readiness.
+- **do-not-merge/hold**: this label can be used to make the script ignore this PR.
+  It will still be reported (and maked "on hold"), but the script will not block
+  the processing of all other PRs because of it.
+- **mintmaker-skip**: this is applied by these scripts, and used to mark some PRs
+  as non-needed. The one case where these scripts will mark a PR like that
+  is for go-toolset image updates, where we can be suggested an update to the
+  "ubi version tag", while we want to keep using the "go version tag", for clarity
+  on the toolchain used.
+  When the script marks it with this label, it makes us aware that this PR should
+  probably be closed, but it doesn't close it itself. It will then ignore this
+  PR from all processing, leaving it to us to do what's needed on the PR.
+  We can manually add this label to a PR we want to remove from the script's view
+  entirely, but somehow want to keep open still (?). "hold" seems more appropriate
+  though.
+
+## Script breakdown
+
+### Entry point
+
+| Script | Purpose |
+|--------|---------|
+| `process-konflux-prs.sh` | Top-level orchestrator. Runs the three stages in order, captures JSON from each, generates the markdown report. Accepts `--dry-run` to generate a status report with no actual changes. |
+
+### Stage scripts
+
+| Script | Purpose |
+|--------|---------|
+| `process-mintmaker.sh` | Full Mintmaker workflow. Returns a JSON array with the processed PRs status. |
+| `process-nudge.sh` | Full Nudge workflow. Returns a JSON array with the processed PRs status. |
+| `process-test-fbc.sh` | Test-FBC workflow: Performs the validation and merge of our Test-fbc nudge PR, which will trigger a new catalog build, and automated CI run on it. |
+
+### Data collection
+
+| Script | Purpose |
+|--------|---------|
+| `snapshot-prs.sh` | Combines `list-prs.sh` + `get-pr-status.sh` into a single JSON array snapshot. Used by all three stage scripts. |
+| `list-prs.sh` | Lists open Konflux PRs from all repositories, classified as `mintmaker`, `nudge`, or `test-fbc`. |
+| `get-pr-status.sh` | Fetches full status for one PR: labels, build check results, pending count, components. |
+| `get-component-info.sh` | Static registry of all known components: name, repository, build time, and which components each one nudges. |
+| `get-pr-components.sh` | Identifies which components a PR will rebuild by parsing its Konflux check-run names. |
+| `get-nudge-prs.sh` | Finds open nudge PRs for a given component (ad-hoc helper, not used by the main pipeline). |
+| `check-pipeline-status.sh` | Queries Tekton (`tkn`) for the latest on-push or on-pull-request pipeline run for a component. |
+| `check-merge-safety.sh` | Combines pipeline status (no running on-push) and GitHub check history (last on-push succeeded) to produce a `safe_to_merge` verdict. |
+
+### Actions
+
+| Script | Purpose |
+|--------|---------|
+| `label-pr.sh` | Adds `ok-to-test` or `lgtm` to a PR; also posts `/ok-to-test` comment when adding `ok-to-test`, so that other automations can be triggered. |
+| `merge-pr.sh` | Merges a PR (merge strategy, branch deleted). |
+| `skip-pr.sh` | Marks a PR as permanently skipped: adds `mintmaker-skip` label and posts an explanatory comment. |
+
+### Monitoring
+
+| Script | Purpose |
+|--------|---------|
+| `watcher.sh` | Prints a compact status table of all open Mintmaker and Nudge PRs (repo, PR number, type, branch, OK2TEST, LGTM, HOLD, checks, title). Can be used to monitor and troubleshoot the execution of the main scripts |
+
+## Repositories in scope
+
+| Short name | GitHub repository |
+|------------|------------------|
+| `osc` | openshift/sandboxed-containers-operator |
+| `kata-containers` | openshift/kata-containers |
+| `cloud-api-adaptor` | openshift/cloud-api-adaptor |
+| `compute-artifacts` | openshift/confidential-compute-artifacts |
+| `podvm-scripts` | confidential-devhub/coco-podvm-scripts |
+
+## Usage
+
+### Prerequisites
+
+- `gh` (GitHub CLI) authenticated with write access to all repositories above
+- `jq`
+- `tkn` (Tekton CLI) with access to the `ose-osc-tenant` namespace on the build cluster
+
+> **TODO**: at this time, both `gh` and `tkn` rely on the user's credentials.
+> We need to modify the scripts to use a separate GitHub and Konflux service account.
+
+### Run a full processing pass
 
-**Usage:**
 ```bash
-# For on-push pipelines (default)
-./check-pipeline-status.sh --component COMPONENT_NAME [--namespace NAMESPACE]
-
-# For on-pull-request pipelines (--pr-id is REQUIRED)
-./check-pipeline-status.sh --component COMPONENT_NAME --type on-pull-request --pr-id PR_ID [--namespace NAMESPACE]
+cd scripts/process-konflux-prs
+./process-konflux-prs.sh
 ```
 
-**Options:**
-- `--component COMPONENT_NAME`: Component name (e.g., osc-operator, osc-caa)
-- `--type TYPE`: Pipeline type (on-pull-request or on-push, default: on-push)
-- `--pr-id PR_ID`: PR identifier (REQUIRED for on-pull-request, must match the suffix in the pipelinerun name)
-- `--namespace NAMESPACE`: Konflux namespace (default: ose-osc-tenant)
-
-**Output:** JSON with pipeline status including latest run and all matching runs.
-
-**Example:**
-```bash
-# Check on-push pipeline for osc-operator
-./check-pipeline-status.sh --component osc-operator
-
-# Check on-pull-request pipeline (--pr-id is mandatory to avoid matching runs from different PRs)
-./check-pipeline-status.sh --component osc-caa --type on-pull-request --pr-id abc123
-```
+This will run the full workflow. A report `Konflux-PR-report-YYYYMMDD-HHMMSS.md`
+is written in the current directory.
 
-### 6. get-nudge-prs.sh
-Find nudge PRs for a given component.
+### Dry run (analyse without modifying anything)
 
-**Usage:**
 ```bash
-./get-nudge-prs.sh --component COMPONENT_NAME
+./process-konflux-prs.sh --dry-run
 ```
 
-**Options:**
-- `--component COMPONENT_NAME`: Component name (e.g., osc-operator-bundle, osc-dm-verity-image)
+Performs a fake run, reporting what would be labelled, merged, or skipped, without
+actually doing anything.
 
-**Output:** JSON array of nudge PRs that update the specified component.
+### Monitor the queue continuously
 
-**Important:** Nudge PR titles mention the **source** component (what was rebuilt), not the **target** component (what is being updated). This script handles that automatically by:
-1. Finding all components that nudge the target component
-2. Searching for nudge PRs with titles mentioning those source components
-
-**Example:**
 ```bash
-./get-nudge-prs.sh --component osc-operator-bundle
-# Finds PRs with titles like "chore(deps): update osc-operator" (source component)
-# which update osc-operator-bundle (target component)
+watch -n 300 ./watcher.sh
 ```
 
-### 7. get-component-info.sh
-Get metadata about components (build time, dependencies).
-
-**Usage:**
-```bash
-./get-component-info.sh [--component COMPONENT_NAME]
-```
+### Running individual scripts
 
-**Options:**
-- `--component COMPONENT_NAME`: Get info for a specific component (optional)
+Each script is self-contained and can be called directly:
 
-**Output:** JSON with component metadata including repository, build time, and nudged components.
-
-**Example:**
 ```bash
-# Get all components info
-./get-component-info.sh
-
-# Get specific component info
-./get-component-info.sh --component osc-operator
-```
+# Run the nudge workflow separately (with or without "--dry-run")
+./process-nudge.sh [--dry-run]
 
-## Repository Mapping
+# Full status of one PR
+./get-pr-status.sh --repo osc --pr 2801
 
-The scripts recognize these repository names:
-- `kata-containers` → `https://github.com/openshift/kata-containers`
-- `cloud-api-adaptor` → `https://github.com/openshift/cloud-api-adaptor`
-- `compute-artifacts` → `https://github.com/openshift/confidential-compute-artifacts`
-- `podvm-scripts` → `https://github.com/confidential-devhub/coco-podvm-scripts`
-- `osc` → `https://github.com/openshift/sandboxed-containers-operator`
-
-## Implementation Notes
-
-- The Konflux bot appears as `app/red-hat-konflux` in GitHub (not just `red-hat-konflux`)
-- All PR queries filter by `--author "app/red-hat-konflux"`
-- Enterprise contract checks are excluded from component detection as they are validation checks, not component builds
-- Only checks matching the pattern "Red Hat Konflux / {component-name}-on-pull-request" are considered component builds
-
-## Prerequisites
-
-All scripts require:
-- `gh` (GitHub CLI) - authenticated and configured
-- `jq` - for JSON processing
-
-Scripts that interact with Konflux also require:
-- `oc` (OpenShift CLI) - logged into Konflux cluster
-- `tkn` (Tekton CLI) - for pipeline operations
-
-## Environment Variables
-
-- `GITHUB_TOKEN`: GitHub personal access token (can be set via `gh auth login`)
-- Konflux access: Configure via `oc login` with appropriate service account token
-
-## Integration with process-konflux-prs Skill
-
-These scripts are designed to be called by the `process-konflux-prs` skill.
-The skill's allowed-tools section should be updated to reference these scripts
-instead of individual `gh`, `oc`, and `tkn` commands.
-
-This provides:
-1. **Better isolation**: The skill can only execute these specific scripts
-2. **Easier testing**: Each script can be tested independently
-3. **Better maintainability**: Script logic is separated from skill orchestration
-4. **Consistent output**: All scripts output JSON for easy parsing
-
-## Testing
-
-Test each script individually before using them in the skill:
-
-```bash
-# Test listing PRs
+# All open Mintmaker PRs (raw JSON)
 ./list-prs.sh --mintmaker
 
-# Test getting PR status (replace with actual PR number)
-./get-pr-status.sh --repo osc --pr 2147
+# Snapshot of all Nudge PRs with status
+./snapshot-prs.sh --nudge
 
-# Test component info
-./get-component-info.sh
+# Check whether merging a component is safe right now
+./check-merge-safety.sh --components osc-operator --repo openshift/sandboxed-containers-operator --branch devel
 ```
diff --git a/scripts/process-konflux-prs/check-merge-safety.sh b/scripts/process-konflux-prs/check-merge-safety.sh
index 188f8aa57f7..c0150f393c9 100755
--- a/scripts/process-konflux-prs/check-merge-safety.sh
+++ b/scripts/process-konflux-prs/check-merge-safety.sh
@@ -1,12 +1,20 @@
 #!/bin/bash
-# Check whether it is safe to merge a PR by verifying that no on-push pipeline
-# is currently running for any of the components it would rebuild.
+# Check whether it is safe to merge a PR by verifying:
+#   1. No on-push pipeline is currently RUNNING for any of its components.
+#   2. The last completed on-push pipeline for each component SUCCEEDED.
+#      (Checked via GitHub check-runs on recent commits of the target branch.)
 #
-# Usage: ./check-merge-safety.sh --components "comp1 comp2 ..." [--namespace NAMESPACE]
+# Usage: ./check-merge-safety.sh --components "comp1 comp2 ..."
+#                                [--repo GITHUB_REPO] [--branch BRANCH]
+#                                [--namespace NAMESPACE]
+#
+# --repo and --branch enable check 2 via the GitHub API (e.g. --repo
+# openshift/sandboxed-containers-operator --branch devel).  When omitted,
+# only check 1 (running pipeline detection) is performed.
 #
 # Output: JSON {safe_to_merge: bool, blocking: [{component, pipeline, reason}]}
-#   safe_to_merge: true when no on-push pipeline is running for any component
-#   blocking:      list of components with a running pipeline (empty when safe)
+#   safe_to_merge: true only when all components pass both checks
+#   blocking:      list of blocking conditions (empty when safe)
 
 set -euo pipefail
 
@@ -14,19 +22,33 @@ SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 
 COMPONENTS=()
 NAMESPACE_ARG=""
+GH_REPO=""
+GH_BRANCH=""
 
 while [[ $# -gt 0 ]]; do
     case $1 in
         --components)
+            [[ $# -ge 2 ]] || { echo "Usage: $0 --components 'comp1 comp2 ...' [--repo GITHUB_REPO] [--branch BRANCH] [--namespace NAMESPACE]" >&2; exit 1; }
             IFS=' ' read -ra COMPONENTS <<< "$2"
             shift 2
             ;;
         --namespace)
+            [[ $# -ge 2 ]] || { echo "Usage: $0 --components 'comp1 comp2 ...' [--repo GITHUB_REPO] [--branch BRANCH] [--namespace NAMESPACE]" >&2; exit 1; }
             NAMESPACE_ARG="--namespace $2"
             shift 2
             ;;
+        --repo)
+            [[ $# -ge 2 ]] || { echo "Usage: $0 --components 'comp1 comp2 ...' [--repo GITHUB_REPO] [--branch BRANCH] [--namespace NAMESPACE]" >&2; exit 1; }
+            GH_REPO="$2"
+            shift 2
+            ;;
+        --branch)
+            [[ $# -ge 2 ]] || { echo "Usage: $0 --components 'comp1 comp2 ...' [--repo GITHUB_REPO] [--branch BRANCH] [--namespace NAMESPACE]" >&2; exit 1; }
+            GH_BRANCH="$2"
+            shift 2
+            ;;
         *)
-            echo "Usage: $0 --components 'comp1 comp2 ...' [--namespace NAMESPACE]" >&2
+            echo "Usage: $0 --components 'comp1 comp2 ...' [--repo GITHUB_REPO] [--branch BRANCH] [--namespace NAMESPACE]" >&2
             exit 1
             ;;
     esac
@@ -37,7 +59,45 @@ if [[ ${#COMPONENTS[@]} -eq 0 ]]; then
     exit 1
 fi
 
+if [[ ( -n "$GH_REPO" && -z "$GH_BRANCH" ) || ( -z "$GH_REPO" && -n "$GH_BRANCH" ) ]]; then
+    echo "Error: --repo and --branch must be supplied together" >&2
+    exit 1
+fi
+
+# Query GitHub for the most recent on-push check-run conclusion for a component.
+# Walks back through the last 20 commits on the branch, stopping at the first
+# commit that has the component's on-push check-run.
+# Returns: "success", "failure", etc. from the check-run conclusion,
+#          "unknown" when no matching check-run exists in the last 20 commits,
+#          or "error" when the GitHub API query itself fails.
+gh_last_push_conclusion() {
+    local gh_repo="$1"
+    local branch="$2"
+    local component="$3"
+    local check_name="Red Hat Konflux / ${component}-on-push"
+
+    local shas
+    shas=$(gh api "repos/${gh_repo}/commits?sha=${branch}&per_page=20" \
+        --jq '.[].sha' 2>/dev/null) || { echo "error"; return; }
+
+    while IFS= read -r sha; do
+        local raw conclusion
+        raw=$(gh api "repos/${gh_repo}/commits/${sha}/check-runs" \
+            2>/dev/null) || { echo "error"; return; }
+        conclusion=$(echo "$raw" | jq -r --arg n "$check_name" \
+            '([.check_runs[] | select(.name == $n)] | .[0].conclusion) // ""') \
+            || { echo "error"; return; }
+        if [[ -n "$conclusion" ]]; then
+            echo "$conclusion"
+            return
+        fi
+    done <<< "$shas"
+
+    echo "unknown"
+}
+
 blocking='[]'
+
 for component in "${COMPONENTS[@]}"; do
     if ! result=$("$SCRIPT_DIR/check-pipeline-status.sh" --component "$component" $NAMESPACE_ARG 2>&1); then
         echo "Warning: failed to check pipeline status for $component: $result" >&2
@@ -46,10 +106,11 @@ for component in "${COMPONENTS[@]}"; do
         blocking=$(echo "$blocking" | jq --argjson e "$entry" '. + [$e]')
         continue
     fi
+
     latest=$(echo "$result" | jq '.latest')
     completion=$(echo "$result" | jq -r '.latest.completionTime // "null"')
 
-    # A pipeline is running when latest is non-null and has no completionTime
+    # Check 1: block if a pipeline is currently running (no completionTime on latest)
     if [[ "$latest" != "null" && "$completion" == "null" ]]; then
         reason=$(echo "$result" | jq -r '.latest.reason // "Running"')
         pipeline=$(echo "$result" | jq -r '.latest.name // "unknown"')
@@ -59,6 +120,31 @@ for component in "${COMPONENTS[@]}"; do
             --arg reason "$reason" \
             '{component: $component, pipeline: $pipeline, reason: $reason}')
         blocking=$(echo "$blocking" | jq --argjson e "$entry" '. + [$e]')
+        # Don't also run check 2 — component is already blocked.
+        continue
+    fi
+
+    # Check 2: block if the last on-push pipeline on the target branch failed.
+    # Requires --repo and --branch; skipped when omitted.
+    if [[ -n "$GH_REPO" && -n "$GH_BRANCH" ]]; then
+        conclusion=$(gh_last_push_conclusion "$GH_REPO" "$GH_BRANCH" "$component")
+        if [[ "$conclusion" == "error" ]]; then
+            entry=$(jq -n \
+                --arg component "$component" \
+                --arg pipeline "GitHub API" \
+                --arg reason "Failed to query on-push pipeline status for branch ${GH_BRANCH}" \
+                '{component: $component, pipeline: $pipeline, reason: $reason}')
+            blocking=$(echo "$blocking" | jq --argjson e "$entry" '. + [$e]')
+        elif [[ "$conclusion" != "success" && "$conclusion" != "unknown" ]]; then
+            check_name="Red Hat Konflux / ${component}-on-push"
+            entry=$(jq -n \
+                --arg component "$component" \
+                --arg pipeline "$check_name" \
+                --arg reason "Last on-push pipeline did not succeed on branch ${GH_BRANCH} (GitHub check: ${check_name}, conclusion: ${conclusion})" \
+                '{component: $component, pipeline: $pipeline, reason: $reason}')
+            blocking=$(echo "$blocking" | jq --argjson e "$entry" '. + [$e]')
+        fi
+        # "unknown" → no on-push run found in last 20 commits → don't block
     fi
 done
 
diff --git a/scripts/process-konflux-prs/get-pr-status.sh b/scripts/process-konflux-prs/get-pr-status.sh
index 741b0a97ec7..4043dab9d52 100755
--- a/scripts/process-konflux-prs/get-pr-status.sh
+++ b/scripts/process-konflux-prs/get-pr-status.sh
@@ -11,7 +11,7 @@
 #                        (enterprise-contract checks with NEUTRAL conclusion are excluded)
 #   build_checks_failed: array of names of build checks that failed (FAILURE conclusion)
 #   pending_checks: integer count of checks still IN_PROGRESS, QUEUED, or PENDING
-#   checks: raw array of all checks (name, status, conclusion, details_url); nulls filtered out
+#   checks: raw array of all checks (name, status, conclusion); nulls filtered out
 
 set -euo pipefail
 
@@ -60,38 +60,62 @@ fi
 # Get PR details
 pr_data=$(gh pr view "$PR_NUMBER" \
     --repo "$REPO_URL" \
-    --json number,title,state,labels,statusCheckRollup,baseRefName)
+    --json number,title,state,labels,statusCheckRollup,baseRefName,headRefOid)
 
-# All checks, with null entries filtered out
+# Normalize all checks: both CheckRun (name/conclusion) and StatusContext (context/state).
+# StatusContext objects have no "name" field — they use "context" instead, and "state"
+# instead of "conclusion". Mapping: FAILURE/ERROR -> FAILURE, PENDING/EXPECTED -> IN_PROGRESS.
 checks=$(echo "$pr_data" | jq '[(.statusCheckRollup // [])[] |
-    select(.name != null) |
-    {
-        name: .name,
-        status: .status,
-        conclusion: (.conclusion // ""),
-        details_url: .detailsUrl
-    }]')
+    if .name != null then
+        {
+            name: .name,
+            status: .status,
+            conclusion: (.conclusion // "")
+        }
+    elif .context != null then
+        {
+            name: .context,
+            status: (if (.state == "PENDING" or .state == "EXPECTED") then "IN_PROGRESS" else "COMPLETED" end),
+            conclusion: (if .state == "SUCCESS" then "SUCCESS"
+                         elif (.state == "FAILURE" or .state == "ERROR") then "FAILURE"
+                         elif (.state == "PENDING" or .state == "EXPECTED") then ""
+                         else .state end)
+        }
+    else empty end]')
 
 # Labels: array of strings
 labels=$(echo "$pr_data" | jq '[(.labels // [])[].name]')
 
 # Build pipeline checks only: "Red Hat Konflux / {component}-on-pull-request[…]"
-# Enterprise-contract checks (containing "enterprise-contract") are excluded —
-# they return NEUTRAL when not required, which is not a failure.
+# Enterprise-contract checks are excluded ONLY when their conclusion is NEUTRAL
+# (not enforced on this branch). A FAILURE conclusion from an enterprise-contract
+# check is a real failure and must block the PR.
 build_checks=$(echo "$checks" | jq '[.[] |
     select(.name | startswith("Red Hat Konflux / ")) |
     select(.name | test("-on-pull-request")) |
-    select(.name | contains("enterprise-contract") | not)]')
+    select((.name | contains("enterprise-contract")) and (.conclusion == "NEUTRAL") | not)]')
+
+# Non-build checks that failed: anything with FAILURE conclusion that is not a
+# Konflux build pipeline check. These block merging and require developer attention.
+other_checks_failed=$(echo "$checks" | jq '[.[] |
+    select(
+        (.name | startswith("Red Hat Konflux / ") and test("-on-pull-request") and (contains("enterprise-contract") | not))
+        | not
+    ) |
+    select(.conclusion == "FAILURE") |
+    .name]')
 
 echo "$pr_data" | jq \
     --argjson checks "$checks" \
     --argjson labels "$labels" \
     --argjson build_checks "$build_checks" \
+    --argjson other_checks_failed "$other_checks_failed" \
     '{
         number: .number,
         title: .title,
         state: .state,
         base_branch: .baseRefName,
+        head_sha: .headRefOid,
         labels: $labels,
         has_ok_to_test: ($labels | any(. == "ok-to-test")),
         has_lgtm: ($labels | any(. == "lgtm")),
@@ -102,6 +126,7 @@ echo "$pr_data" | jq \
             (map(.conclusion == "SUCCESS") | all)),
         build_checks_failed: [$build_checks[] |
             select(.conclusion == "FAILURE") | .name],
+        other_checks_failed: $other_checks_failed,
         pending_checks: ([$checks[] |
             select(.status == "IN_PROGRESS" or
                    .status == "QUEUED" or
diff --git a/scripts/process-konflux-prs/list-prs.sh b/scripts/process-konflux-prs/list-prs.sh
index d4656ae1295..7d4e01e9597 100755
--- a/scripts/process-konflux-prs/list-prs.sh
+++ b/scripts/process-konflux-prs/list-prs.sh
@@ -29,12 +29,16 @@ while [[ $# -gt 0 ]]; do
             PR_TYPE="nudge"
             shift
             ;;
+        --test-fbc)
+            PR_TYPE="test-fbc"
+            shift
+            ;;
         --repo)
             REPO_FILTER="$2"
             shift 2
             ;;
         *)
-            echo "Usage: $0 [--mintmaker|--nudge] [--repo REPO_NAME]" >&2
+            echo "Usage: $0 [--mintmaker|--nudge|--test-fbc] [--repo REPO_NAME]" >&2
             exit 1
             ;;
     esac
@@ -57,9 +61,18 @@ is_mintmaker_pr() {
     [[ "$title" == "chore(deps): update registry.access.redhat.com/ubi9"* ]] && return 0
     [[ "$title" == "chore(deps): update registry.access.redhat.com/ubi10"* ]] && return 0
     [[ "$title" == "chore(deps): update registry.redhat.io/rhel9/rhel-bootc"* ]] && return 0
+    [[ "$title" == "chore(deps): update registry.redhat.io/ubi9"* ]] && return 0
     [[ "$title" == "Update registry.access.redhat.com/ubi9"* ]] && return 0
     [[ "$title" == "Update registry.access.redhat.com/ubi10"* ]] && return 0
     [[ "$title" == "Update registry.redhat.io/rhel9/rhel-bootc"* ]] && return 0
+    [[ "$title" == "Update registry.redhat.io/ubi9"* ]] && return 0
+    [[ "$title" == "chore(deps): refresh rpm lockfiles"* ]] && return 0
+    [[ "$title" == "Update podvm-payload/kata-containers digest"* ]] && return 0
+    [[ "$title" == "chore(deps): update podvm-payload/kata-containers"* ]] && return 0
+    [[ "$title" == "Update podvm-payload/guest-components digest"* ]] && return 0
+    [[ "$title" == "chore(deps): update podvm-payload/guest-components"* ]] && return 0
+    [[ "$title" == "Update config/peerpods/podvm/cloud-api-adaptor digest"* ]] && return 0
+    [[ "$title" == "chore(deps): update config/peerpods/podvm/cloud-api-adaptor"* ]] && return 0
     return 1
 }
 
@@ -95,10 +108,11 @@ for repo_name in "${!REPOS[@]}"; do
         # Determine PR type
         pr_type=""
 
-        # Check if it's a Nudge PR
+        # Check if it's a Nudge PR (or the test-fbc subset of nudge PRs)
         if echo "$labels" | grep -q "konflux-nudge"; then
-            # Skip bundle update PRs
-            if [[ "$title" != "chore(deps): update osc-operator-bundle"* ]]; then
+            if [[ "$title" == "chore(deps): update osc-operator-bundle"* ]]; then
+                pr_type="test-fbc"
+            else
                 pr_type="nudge"
             fi
         # Check if it's a Mintmaker PR
diff --git a/scripts/process-konflux-prs/merge-pr.sh b/scripts/process-konflux-prs/merge-pr.sh
index 97790e264d9..620198458a2 100755
--- a/scripts/process-konflux-prs/merge-pr.sh
+++ b/scripts/process-konflux-prs/merge-pr.sh
@@ -1,6 +1,9 @@
 #!/bin/bash
-# Merge a PR using squash strategy
-# Usage: ./merge-pr.sh --repo REPO_NAME --pr PR_NUMBER
+# Merge a PR using merge strategy
+# Usage: ./merge-pr.sh --repo REPO_NAME --pr PR_NUMBER [--head-sha SHA]
+#
+# When --head-sha is provided, the merge is rejected if the PR's HEAD
+# has changed since the snapshot (prevents merging unchecked commits).
 #
 # Returns JSON: {success, repo, pr, message}
 
@@ -8,6 +11,7 @@ set -euo pipefail
 
 REPO_URL=""
 PR_NUMBER=""
+HEAD_SHA=""
 
 # Repository mapping
 declare -A REPOS=(
@@ -34,6 +38,10 @@ while [[ $# -gt 0 ]]; do
             PR_NUMBER="$2"
             shift 2
             ;;
+        --head-sha)
+            HEAD_SHA="$2"
+            shift 2
+            ;;
         *)
             echo "Usage: $0 --repo REPO_NAME --pr PR_NUMBER" >&2
             exit 1
@@ -48,10 +56,12 @@ fi
 
 REPO_NAME=$(basename "$REPO_URL")
 
-if gh pr merge "$PR_NUMBER" \
-    --repo "$REPO_URL" \
-    --merge \
-    --delete-branch 2>/dev/null; then
+MERGE_ARGS=("$PR_NUMBER" --repo "$REPO_URL" --merge --delete-branch)
+if [[ -n "$HEAD_SHA" ]]; then
+    MERGE_ARGS+=(--match-head-commit "$HEAD_SHA")
+fi
+
+if gh pr merge "${MERGE_ARGS[@]}" 2>/dev/null; then
     echo "{\"success\": true, \"repo\": \"$REPO_NAME\", \"pr\": $PR_NUMBER, \"message\": \"merged\"}" | jq '.'
 else
     MSG=$(gh pr view "$PR_NUMBER" --repo "$REPO_URL" --json state,mergeStateStatus \
diff --git a/scripts/process-konflux-prs/process-konflux-prs.sh b/scripts/process-konflux-prs/process-konflux-prs.sh
new file mode 100755
index 00000000000..2f46dcea905
--- /dev/null
+++ b/scripts/process-konflux-prs/process-konflux-prs.sh
@@ -0,0 +1,246 @@
+#!/bin/bash
+#
+# Orchestrate the Konflux PR processing workflow.
+#
+# This script runs a multi-stage pipeline to process Konflux-generated PRs:
+#
+# 1. Run process-mintmaker.sh to handle dependency update PRs (UBI images, Konflux
+#    references, etc.). These are typically safe and can be labelled/merged quickly.
+#
+# 2. Run process-nudge.sh to handle component nudge PRs. The nudge script itself
+#    skips PRs whose source component is still being rebuilt by an open Mintmaker PR,
+#    so both stages run every pass and nudge applies its own per-component blocking.
+#
+# 3. If the nudge queue is fully drained (all arrays empty) AND no nudges were merged
+#    this run, run process-test-fbc.sh to process osc-operator-bundle test PRs.
+#
+# The script captures JSON output from each stage and formats it into a markdown report
+# that is saved as Konflux-PR-report-YYYYMMDD-HHMMSS.md
+#
+# If SLACK_WEBHOOK_URL is set, a Slack-formatted version of the report is posted to
+# that webhook after the markdown report is generated.
+#
+# Options:
+#   --dry-run    Snapshot all PRs without processing (no labels or merges)
+#
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+
+# Parse command-line arguments
+DRY_RUN=false
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --dry-run)
+      DRY_RUN=true
+      shift
+      ;;
+    *)
+      echo "Unknown option: $1" >&2
+      exit 1
+      ;;
+  esac
+done
+
+# Temporary files to hold JSON results
+MINTMAKER_RESULT=$(mktemp)
+NUDGE_RESULT=$(mktemp)
+TESTFBC_RESULT=$(mktemp)
+
+trap "rm -f $MINTMAKER_RESULT $NUDGE_RESULT $TESTFBC_RESULT" EXIT
+
+# Repository URL mapping
+declare -A REPO_URLS=(
+  ["kata-containers"]="https://github.com/openshift/kata-containers"
+  ["cloud-api-adaptor"]="https://github.com/openshift/cloud-api-adaptor"
+  ["compute-artifacts"]="https://github.com/openshift/confidential-compute-artifacts"
+  ["podvm-scripts"]="https://github.com/confidential-devhub/coco-podvm-scripts"
+  ["osc"]="https://github.com/openshift/sandboxed-containers-operator"
+)
+
+# Build script arguments
+SCRIPT_ARGS=""
+if [ "$DRY_RUN" = true ]; then
+  SCRIPT_ARGS="--dry-run"
+fi
+
+# Step 1: Run mintmaker
+echo "Running mintmaker..." >&2
+"$SCRIPT_DIR/process-mintmaker.sh" $SCRIPT_ARGS > "$MINTMAKER_RESULT"
+
+# Step 2: Run nudge
+echo "Running nudge..." >&2
+"$SCRIPT_DIR/process-nudge.sh" $SCRIPT_ARGS > "$NUDGE_RESULT"
+
+# Check if nudge queues are fully drained (held PRs excluded — they don't block)
+NUDGE_LABELLED=$(jq '.labelled | length' "$NUDGE_RESULT")
+NUDGE_MERGED=$(jq '.merged | length' "$NUDGE_RESULT")
+NUDGE_HELD_BACK=$(jq '.held_back | length' "$NUDGE_RESULT")
+NUDGE_SKIPPED=$(jq '.skipped | length' "$NUDGE_RESULT")
+
+NUDGE_TOTAL=$((NUDGE_LABELLED + NUDGE_MERGED + NUDGE_HELD_BACK + NUDGE_SKIPPED))
+
+# Step 3: If nudge queue is empty, run test-fbc
+# In normal mode: only run if nothing was merged (to avoid pending on-push pipelines)
+# In dry-run: always run if queue would be empty
+if [ $NUDGE_TOTAL -eq 0 ]; then
+  if [ "$DRY_RUN" = true ] || [ "$NUDGE_MERGED" -eq 0 ]; then
+    echo "Nudge queue is empty, running test-fbc..." >&2
+    "$SCRIPT_DIR/process-test-fbc.sh" $SCRIPT_ARGS > "$TESTFBC_RESULT"
+  fi
+fi
+
+format_pr_row() {
+  local repo="${1:-}"
+  local pr="${2:-}"
+  local branch="${3:-}"
+  local components="${4:-}"
+  local reason="${5:-}"
+  # Shorten check names in reason strings:
+  #   - Strip the "Red Hat Konflux / " prefix from all check names
+  #   - Collapse enterprise-contract check names to "conforma (component)"
+  reason=$(echo "$reason" | sed -E \
+    -e 's|Red Hat Konflux / ||g' \
+    -e 's|openshift-sandboxed-containers-enterprise-contract[^ /]* / ([^ ,]+)|conforma (\1)|g')
+
+  local url="${REPO_URLS[$repo]:-}"
+  local link
+  if [ -z "$url" ]; then
+    link="#$pr"
+  else
+    link="[#$pr]($url/pull/$pr)"
+  fi
+
+  if [ -z "$reason" ]; then
+    printf -- '- %s %s/%s (%s)\n' "$link" "$repo" "$branch" "$components"
+  else
+    printf -- '- %s %s/%s (%s)\n  - %s\n' "$link" "$repo" "$branch" "$components" "$reason"
+  fi
+}
+
+print_section() {
+  local title="$1"
+  local json_file="$2"
+  local array_key="$3"
+  local reason_key="${4:-}"
+
+  if [ ! -f "$json_file" ]; then
+    return
+  fi
+
+  local count=$(jq ".$array_key | length" "$json_file")
+  if [ "$count" -eq 0 ]; then
+    return
+  fi
+
+  echo ""
+  echo "### $title ($count)"
+  if [ -z "$reason_key" ]; then
+    jq -r ".${array_key}[] | [.repo, .pr, .base_branch, (.components | join(\", \"))] | @tsv" "$json_file" | \
+      while IFS=$'\t' read -r repo pr branch components; do
+        format_pr_row "$repo" "$pr" "$branch" "$components" ""
+      done
+  else
+    jq -r ".${array_key}[] | [.repo, .pr, .base_branch, (.components | join(\", \")), .${reason_key}] | @tsv" "$json_file" | \
+      while IFS=$'\t' read -r repo pr branch components reason; do
+        format_pr_row "$repo" "$pr" "$branch" "$components" "$reason"
+      done
+  fi
+}
+
+REPORT_FILE="Konflux-PR-report-$(date +%Y%m%d-%H%M%S).md"
+
+# Generate report
+{
+  echo "# Konflux PR Processing Report"
+  echo ""
+  echo "*Generated: $(date '+%Y-%m-%d %H:%M:%S')*"
+  echo ""
+
+  # Mintmaker section
+  echo "## Mintmaker"
+  print_section "Labelled" "$MINTMAKER_RESULT" "labelled" "_label"
+  print_section "Merged" "$MINTMAKER_RESULT" "merged"
+  print_section "Waiting" "$MINTMAKER_RESULT" "waiting" "_wait_reason"
+  print_section "Skipped" "$MINTMAKER_RESULT" "skipped" "_skip_reason"
+  print_section "On hold (do-not-merge/hold)" "$MINTMAKER_RESULT" "held"
+
+  mm_labelled=$(jq '.labelled | length' "$MINTMAKER_RESULT")
+  mm_merged=$(jq '.merged | length' "$MINTMAKER_RESULT")
+  mm_waiting=$(jq '.waiting | length' "$MINTMAKER_RESULT")
+  mm_skipped=$(jq '.skipped | length' "$MINTMAKER_RESULT")
+  mm_held=$(jq '.held | length' "$MINTMAKER_RESULT")
+  echo ""
+  echo "**Mintmaker Summary:** $mm_labelled labelled, $mm_merged merged, $mm_waiting waiting, $mm_skipped skipped, $mm_held on hold"
+
+  echo ""
+  echo "## Nudge"
+  print_section "Labelled" "$NUDGE_RESULT" "labelled" "_label"
+  print_section "Merged" "$NUDGE_RESULT" "merged"
+  print_section "Held back" "$NUDGE_RESULT" "held_back" "_held_reason"
+  print_section "Skipped" "$NUDGE_RESULT" "skipped" "_skip_reason"
+  print_section "On hold (do-not-merge/hold)" "$NUDGE_RESULT" "held"
+
+  nd_labelled=$(jq '.labelled | length' "$NUDGE_RESULT")
+  nd_merged=$(jq '.merged | length' "$NUDGE_RESULT")
+  nd_held=$(jq '.held_back | length' "$NUDGE_RESULT")
+  nd_skipped=$(jq '.skipped | length' "$NUDGE_RESULT")
+  nd_on_hold=$(jq '.held | length' "$NUDGE_RESULT")
+  echo ""
+  echo "**Nudge Summary:** $nd_labelled labelled, $nd_merged merged, $nd_held held back, $nd_skipped skipped, $nd_on_hold on hold"
+
+  # Test-FBC section (if it ran)
+  if [ -f "$TESTFBC_RESULT" ] && [ -s "$TESTFBC_RESULT" ]; then
+    echo ""
+    echo "## Test-FBC"
+    print_section "Labelled" "$TESTFBC_RESULT" "labelled" "_label"
+    print_section "Merged" "$TESTFBC_RESULT" "merged"
+    print_section "Skipped" "$TESTFBC_RESULT" "skipped" "_skip_reason"
+    print_section "On hold (do-not-merge/hold)" "$TESTFBC_RESULT" "held"
+
+    tfbc_labelled=$(jq '.labelled | length' "$TESTFBC_RESULT")
+    tfbc_merged=$(jq '.merged | length' "$TESTFBC_RESULT")
+    tfbc_skipped=$(jq '.skipped | length' "$TESTFBC_RESULT")
+    tfbc_held=$(jq '.held | length' "$TESTFBC_RESULT")
+    echo ""
+    echo "**Test-FBC Summary:** $tfbc_labelled labelled, $tfbc_merged merged, $tfbc_skipped skipped, $tfbc_held on hold"
+  fi
+
+  # Dry-run notice
+  if [ "$DRY_RUN" = true ]; then
+    echo ""
+    echo "---"
+    echo ""
+    echo "⚠️  **DRY RUN** — No PRs were modified. The operations shown above would be performed in normal mode."
+  fi
+} | tee "$REPORT_FILE"
+
+# --- Slack notification ---
+if [ -n "${SLACK_WEBHOOK_URL:-}" ]; then
+  echo "Sending Slack notification..." >&2
+
+  # Convert markdown to Slack mrkdwn:
+  #   - Bold: **text** → *text* (via placeholder to avoid clashing with italic)
+  #   - Italic: *text* → _text_
+  #   - Headers: # text → *text*
+  #   - Links: [text](url) → <url|text>
+  #   - Strip horizontal rules (---)
+  SLACK_MSG=$(sed -E \
+    -e 's/\*\*/\x01/g' \
+    -e 's/\*([^*]+)\*/_\1_/g' \
+    -e 's/\x01/*/g' \
+    -e 's/^#{1,3} (.+)$/*\1*/' \
+    -e 's/\[([^]]+)\]\(([^)]+)\)/<\2|\1>/g' \
+    -e '/^---$/d' \
+    "$REPORT_FILE")
+
+  SLACK_RESPONSE=$(jq -n --arg text "$SLACK_MSG" '{text: $text}' | \
+    curl -s -X POST -H 'Content-type: application/json' -d @- "$SLACK_WEBHOOK_URL")
+
+  if [ "$SLACK_RESPONSE" = "ok" ]; then
+    echo "Slack notification sent." >&2
+  else
+    echo "Warning: Slack notification may have failed: $SLACK_RESPONSE" >&2
+  fi
+fi
diff --git a/scripts/process-konflux-prs/process-mintmaker.sh b/scripts/process-konflux-prs/process-mintmaker.sh
new file mode 100755
index 00000000000..131f0a3b358
--- /dev/null
+++ b/scripts/process-konflux-prs/process-mintmaker.sh
@@ -0,0 +1,314 @@
+#!/bin/bash
+# Full Mintmaker PR processing workflow: skip filter, labelling, merge.
+# Replaces the manual Phase 0 / Phase A / Phase B loop that Claude used to run.
+#
+# Usage: ./process-mintmaker.sh [--dry-run]
+#
+# With --dry-run: analyzes what would be done without performing labels or merges
+#
+# Output: JSON
+#   {
+#     "empty":    true|false,          -- true when no open Mintmaker PRs found
+#     "skipped":  [...],               -- PRs matching a skip pattern (_skip_reason field)
+#     "labelled": [...],               -- PRs that received a new label (_label field)
+#     "merged":   [...],               -- PRs successfully merged this run
+#     "waiting":  [...]                -- PRs that could not be advanced (_wait_reason, _blocking)
+#   }
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+
+# Parse options
+DRY_RUN=false
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --dry-run)
+      DRY_RUN=true
+      shift
+      ;;
+    *)
+      echo "Unknown option: $1" >&2
+      exit 1
+      ;;
+  esac
+done
+
+repo_to_github() {
+    case "$1" in
+        osc)               echo "openshift/sandboxed-containers-operator" ;;
+        cloud-api-adaptor) echo "openshift/cloud-api-adaptor" ;;
+        compute-artifacts) echo "openshift/confidential-compute-artifacts" ;;
+        kata-containers)   echo "openshift/kata-containers" ;;
+        podvm-scripts)     echo "confidential-devhub/coco-podvm-scripts" ;;
+        *)                 echo "" ;;
+    esac
+}
+
+# Returns 0 if the PR title matches a known skip pattern.
+is_skip_pattern() {
+    local title="$1"
+    # go-toolset bare major version (e.g. "v9") — no dots in the version number.
+    if echo "$title" | grep -qE 'ubi[0-9]+/go-toolset' && \
+       echo "$title" | grep -qE '[Tt]ag to v[0-9]+$'; then
+        return 0
+    fi
+    return 1
+}
+
+# ─── snapshot ────────────────────────────────────────────────────────────────
+
+snapshot=$("$SCRIPT_DIR/snapshot-prs.sh" --mintmaker)
+
+if [ "$(echo "$snapshot" | jq 'length')" -eq 0 ]; then
+    echo '{"empty":true,"skipped":[],"labelled":[],"merged":[],"waiting":[],"held":[]}'
+    exit 0
+fi
+
+# ─── phase 0: skip filter ────────────────────────────────────────────────────
+
+skipped='[]'
+working='[]'
+
+while IFS= read -r pr; do
+    title=$(echo "$pr" | jq -r '.title')
+    if is_skip_pattern "$title"; then
+        repo=$(echo "$pr" | jq -r '.repo')
+        num=$(echo "$pr"  | jq -r '.pr')
+        if [ "$DRY_RUN" = false ] && [ "$(echo "$pr" | jq -r '.has_mintmaker_skip')" = "false" ]; then
+            if "$SCRIPT_DIR/skip-pr.sh" --repo "$repo" --pr "$num" \
+                --reason "go-toolset bare major version tag (e.g. v9) — we pin to full Go version tags like v1.26.x; a correct PR will arrive separately" \
+                >/dev/null 2>&1; then
+                skipped=$(echo "$skipped" | jq --argjson p "$pr" \
+                    '. + [$p + {"_skip_reason":"go-toolset bare major version tag"}]')
+            else
+                skipped=$(echo "$skipped" | jq --argjson p "$pr" \
+                    '. + [$p + {"_skip_reason":"failed to apply mintmaker-skip label"}]')
+            fi
+        else
+            skipped=$(echo "$skipped" | jq --argjson p "$pr" \
+                '. + [$p + {"_skip_reason":"go-toolset bare major version tag"}]')
+        fi
+    else
+        working=$(echo "$working" | jq --argjson p "$pr" '. + [$p]')
+    fi
+done < <(echo "$snapshot" | jq -c '.[]')
+
+# ─── hold filter ─────────────────────────────────────────────────────────────
+
+held='[]'
+non_held='[]'
+while IFS= read -r pr; do
+    if [ "$(echo "$pr" | jq -r '.has_hold')" = "true" ]; then
+        held=$(echo "$held" | jq --argjson p "$pr" '. + [$p]')
+    else
+        non_held=$(echo "$non_held" | jq --argjson p "$pr" '. + [$p]')
+    fi
+done < <(echo "$working" | jq -c '.[]')
+working="$non_held"
+
+if [ "$(echo "$working" | jq 'length')" -eq 0 ]; then
+    jq -n --argjson sk "$skipped" --argjson h "$held" \
+        '{"empty":false,"skipped":$sk,"labelled":[],"merged":[],"waiting":[],"held":$h}'
+    exit 0
+fi
+
+# ─── phase a: labelling (parallel) ───────────────────────────────────────────
+
+labelled='[]'
+tmpdir=$(mktemp -d)
+trap 'rm -rf "$tmpdir"' EXIT
+
+while IFS= read -r pr; do
+    repo=$(echo "$pr" | jq -r '.repo')
+    num=$(echo "$pr"  | jq -r '.pr')
+    has_ok=$(echo "$pr"      | jq -r '.has_ok_to_test')
+    has_lgtm=$(echo "$pr"    | jq -r '.has_lgtm')
+    build_ok=$(echo "$pr"    | jq -r '.build_checks_passed')
+    pending=$(echo "$pr"     | jq -r '.pending_checks')
+    other_n=$(echo "$pr"     | jq -r '.other_checks_failed | length')
+
+    if [ "$has_ok" = "false" ]; then
+        label="ok-to-test"
+    elif [ "$has_lgtm" = "false" ] && [ "$build_ok" = "true" ] && \
+         [ "$pending" -eq 0 ] && [ "$other_n" -eq 0 ]; then
+        label="lgtm"
+    else
+        continue
+    fi
+
+    (
+        success=false
+        if [ "$DRY_RUN" = true ]; then
+            success=true
+        elif "$SCRIPT_DIR/label-pr.sh" --repo "$repo" --pr "$num" \
+               --label "$label" >/dev/null 2>&1; then
+            success=true
+        fi
+
+        if [ "$success" = true ]; then
+            echo "$pr" | jq --arg l "$label" '. + {"_label":$l}' \
+                > "$tmpdir/label-${repo}-${num}.json"
+        else
+            echo "$pr" | jq --arg l "$label" '. + {"_skip_reason":"failed to apply \($l) label"}' \
+                > "$tmpdir/skip-${repo}-${num}.json"
+        fi
+    ) &
+done < <(echo "$working" | jq -c '.[]')
+
+wait 2>/dev/null || true
+
+for f in "$tmpdir"/label-*.json; do
+    [ -f "$f" ] || continue
+    labelled=$(echo "$labelled" | jq --argjson p "$(cat "$f")" '. + [$p]')
+done
+
+for f in "$tmpdir"/skip-*.json; do
+    [ -f "$f" ] || continue
+    p=$(cat "$f")
+    skipped=$(echo "$skipped" | jq --argjson p "$p" '. + [$p]')
+    skip_repo=$(echo "$p" | jq -r '.repo')
+    skip_num=$(echo "$p" | jq -r '.pr')
+    working=$(echo "$working" | jq --arg r "$skip_repo" --argjson n "$skip_num" \
+        '[.[] | select(.repo != $r or .pr != $n)]')
+done
+
+# ─── phase b: merging ────────────────────────────────────────────────────────
+
+merged='[]'
+waiting='[]'
+
+# Eligible = lgtm was already set before this run started
+eligible=$(echo "$working" | jq '[.[] | select(
+    .has_lgtm == true and
+    .build_checks_passed == true and
+    .pending_checks == 0 and
+    (.other_checks_failed | length) == 0
+)]')
+
+# Run safety checks in parallel
+while IFS= read -r pr; do
+    repo=$(echo "$pr"   | jq -r '.repo')
+    num=$(echo "$pr"    | jq -r '.pr')
+    comps=$(echo "$pr"  | jq -r '.components | join(" ")')
+    branch=$(echo "$pr" | jq -r '.base_branch')
+    gh_repo=$(repo_to_github "$repo")
+    (
+        result=$("$SCRIPT_DIR/check-merge-safety.sh" \
+            --components "$comps" --repo "$gh_repo" --branch "$branch" \
+            2>/dev/null) || \
+            result='{"safe_to_merge":false,"blocking":[{"reason":"safety check failed"}]}'
+        echo "$pr" | jq --argjson s "$result" '. + {"_safety":$s}' \
+            > "$tmpdir/safety-${repo}-${num}.json"
+    ) &
+done < <(echo "$eligible" | jq -c '.[]')
+
+wait 2>/dev/null || true
+
+# Merge sequentially; track rebuilt components as a space-separated string
+rebuilt=""
+
+while IFS= read -r pr; do
+    repo=$(echo "$pr" | jq -r '.repo')
+    num=$(echo "$pr"  | jq -r '.pr')
+    safety_file="$tmpdir/safety-${repo}-${num}.json"
+
+    if [ ! -f "$safety_file" ]; then
+        waiting=$(echo "$waiting" | jq --argjson p "$pr" \
+            '. + [$p + {"_wait_reason":"safety check unavailable"}]')
+        continue
+    fi
+
+    pr_full=$(cat "$safety_file")
+    safe=$(echo "$pr_full"     | jq -r '._safety.safe_to_merge')
+    blocking=$(echo "$pr_full" | jq '._safety.blocking')
+    comps=$(echo "$pr_full"    | jq -r '.components | join(" ")')
+
+    # Component conflict: skip if any component already rebuilt this run
+    conflict=false
+    for comp in $comps; do
+        case " $rebuilt " in
+            *" $comp "*) conflict=true; break ;;
+        esac
+    done
+
+    if [ "$conflict" = "true" ]; then
+        waiting=$(echo "$waiting" | jq --argjson p "$pr_full" \
+            '. + [$p + {"_wait_reason":"component already being rebuilt this run"}]')
+        continue
+    fi
+
+    if [ "$safe" != "true" ]; then
+        block_reason=$(echo "$blocking" | jq -r '[.[].reason] | join("; ")')
+        waiting=$(echo "$waiting" | jq --argjson p "$pr_full" --argjson b "$blocking" --arg r "$block_reason" \
+            '. + [$p + {"_wait_reason":$r,"_blocking":$b}]')
+        continue
+    fi
+
+    merge_success=false
+    merge_msg=""
+    if [ "$DRY_RUN" = true ]; then
+        merge_success=true
+    else
+        head_sha=$(echo "$pr_full" | jq -r '.head_sha // ""')
+        result=$("$SCRIPT_DIR/merge-pr.sh" --repo "$repo" --pr "$num" ${head_sha:+--head-sha "$head_sha"} 2>/dev/null) || true
+        if ! echo "$result" | jq -e '.success' >/dev/null 2>&1; then
+            result='{"success":false,"message":"merge command failed"}'
+        fi
+        if [ "$(echo "$result" | jq -r '.success')" = "true" ]; then
+            merge_success=true
+        else
+            merge_msg=$(echo "$result" | jq -r '.message // "unknown error"')
+        fi
+    fi
+
+    if [ "$merge_success" = true ]; then
+        merged=$(echo "$merged" | jq --argjson p "$pr" '. + [$p]')
+        rebuilt="$rebuilt $comps"
+    else
+        waiting=$(echo "$waiting" | jq --argjson p "$pr" --arg m "$merge_msg" \
+            '. + [$p + {"_wait_reason":"merge failed: \($m)"}]')
+    fi
+done < <(echo "$eligible" | jq -c '.[]')
+
+# Remaining PRs: not labelled this run, not eligible → waiting
+labelled_keys=$(echo "$labelled" | jq -r '.[] | "\(.repo)-\(.pr)"')
+eligible_keys=$(echo "$eligible" | jq -r '.[] | "\(.repo)-\(.pr)"')
+
+while IFS= read -r pr; do
+    repo=$(echo "$pr" | jq -r '.repo')
+    num=$(echo "$pr"  | jq -r '.pr')
+    key="${repo}-${num}"
+
+    echo "$labelled_keys" | grep -qx "$key" && continue
+    echo "$eligible_keys"  | grep -qx "$key" && continue
+
+    pending=$(echo "$pr"       | jq -r '.pending_checks')
+    build_ok=$(echo "$pr"      | jq -r '.build_checks_passed')
+    build_names=$(echo "$pr"   | jq -r '.build_checks_failed | join(", ")')
+    other_n=$(echo "$pr"       | jq -r '.other_checks_failed | length')
+    other_names=$(echo "$pr"   | jq -r '.other_checks_failed | join(", ")')
+
+    if [ "$pending" -gt 0 ]; then
+        reason="${pending} check(s) still pending"
+    elif [ "$build_ok" = "false" ]; then
+        reason="build checks failed: ${build_names}"
+    elif [ "$other_n" -gt 0 ]; then
+        reason="developer verification needed — other checks failed: ${other_names}"
+    else
+        reason="not yet eligible"
+    fi
+
+    waiting=$(echo "$waiting" | jq --argjson p "$pr" --arg r "$reason" \
+        '. + [$p + {"_wait_reason":$r}]')
+done < <(echo "$working" | jq -c '.[]')
+
+# ─── output ──────────────────────────────────────────────────────────────────
+
+jq -n \
+    --argjson skipped  "$skipped"  \
+    --argjson labelled "$labelled" \
+    --argjson merged   "$merged"   \
+    --argjson waiting  "$waiting"  \
+    --argjson held     "$held"     \
+    '{"empty":false,"skipped":$skipped,"labelled":$labelled,"merged":$merged,"waiting":$waiting,"held":$held}'
diff --git a/scripts/process-konflux-prs/process-nudge.sh b/scripts/process-konflux-prs/process-nudge.sh
new file mode 100755
index 00000000000..aa465397d45
--- /dev/null
+++ b/scripts/process-konflux-prs/process-nudge.sh
@@ -0,0 +1,407 @@
+#!/bin/bash
+# Full Nudge PR processing workflow: Mintmaker-block filter, hold-back grouping,
+# labelling, and merging.
+# Replaces the manual Phase A / Phase B / Phase C loop that Claude used to run.
+#
+# Usage: ./process-nudge.sh [--dry-run]
+#
+# With --dry-run: analyzes what would be done without performing labels or merges
+#
+# Output: JSON
+#   {
+#     "labelled":  [...],  -- PRs that received a new label (_label field)
+#     "merged":    [...],  -- PRs successfully merged this run
+#     "held_back": [...],  -- PRs intentionally held (lowest-numbered in group) (_held_reason)
+#     "skipped":   [...]   -- PRs blocked for any reason (_skip_reason, optional _blocking)
+#   }
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+
+# Parse options
+DRY_RUN=false
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --dry-run)
+      DRY_RUN=true
+      shift
+      ;;
+    *)
+      echo "Unknown option: $1" >&2
+      exit 1
+      ;;
+  esac
+done
+
+repo_to_github() {
+    case "$1" in
+        osc)               echo "openshift/sandboxed-containers-operator" ;;
+        cloud-api-adaptor) echo "openshift/cloud-api-adaptor" ;;
+        compute-artifacts) echo "openshift/confidential-compute-artifacts" ;;
+        kata-containers)   echo "openshift/kata-containers" ;;
+        podvm-scripts)     echo "confidential-devhub/coco-podvm-scripts" ;;
+        *)                 echo "" ;;
+    esac
+}
+
+empty_result='{"labelled":[],"merged":[],"held_back":[],"skipped":[],"held":[]}'
+
+# ─── phase a: mintmaker-blocked component set ─────────────────────────────────
+
+mm_snapshot=$("$SCRIPT_DIR/snapshot-prs.sh" --mintmaker)
+# Union of components that open Mintmaker PRs will rebuild.
+# Hold PRs are excluded: they are not being processed and should not block nudge PRs.
+mintmaker_components=$(echo "$mm_snapshot" | jq -r '[.[] | select(.has_hold == false) | .components[]] | unique | .[]')
+
+# ─── nudge snapshot ───────────────────────────────────────────────────────────
+
+nudge_snapshot=$("$SCRIPT_DIR/snapshot-prs.sh" --nudge)
+
+if [ "$(echo "$nudge_snapshot" | jq 'length')" -eq 0 ]; then
+    echo "$empty_result"
+    exit 0
+fi
+
+# Component names sorted by length descending to prefer more specific matches
+# (e.g. "osc-caa-webhook" before "osc-caa") when searching PR titles.
+all_components=$("$SCRIPT_DIR/get-component-info.sh" | \
+    jq -r '[.[].name] | sort_by(-length) | .[]')
+
+tmpdir=$(mktemp -d)
+trap 'rm -rf "$tmpdir"' EXIT
+
+labelled='[]'
+merged='[]'
+held_back='[]'
+skipped='[]'
+held='[]'
+working='[]'
+
+# ─── filter hold PRs ─────────────────────────────────────────────────────────
+
+while IFS= read -r pr; do
+    if [ "$(echo "$pr" | jq -r '.has_hold')" = "true" ]; then
+        held=$(echo "$held" | jq --argjson p "$pr" '. + [$p]')
+    else
+        working=$(echo "$working" | jq --argjson p "$pr" '. + [$p]')
+    fi
+done < <(echo "$nudge_snapshot" | jq -c '.[]')
+
+if [ "$(echo "$working" | jq 'length')" -eq 0 ]; then
+    echo "$empty_result" | jq --argjson h "$held" '. + {"held":$h}'
+    exit 0
+fi
+
+# Re-assign nudge_snapshot to only non-hold PRs for the rest of the pipeline
+nudge_snapshot="$working"
+working='[]'
+
+# ─── filter mintmaker-blocked PRs ─────────────────────────────────────────────
+
+while IFS= read -r pr; do
+    title=$(echo "$pr" | jq -r '.title')
+
+    # Identify source component from PR title (longest match first)
+    source_comp=""
+    while IFS= read -r comp; do
+        [ -z "$comp" ] && continue
+        if echo "$title" | grep -qiE "${comp}($|[^[:alnum:]-])"; then
+            source_comp="$comp"
+            break
+        fi
+    done <<< "$all_components"
+
+    if [ -n "$source_comp" ] && \
+       echo "$mintmaker_components" | grep -qx "$source_comp"; then
+        skipped=$(echo "$skipped" | jq --argjson p "$pr" \
+            --arg r "source component '$source_comp' is being rebuilt by an open Mintmaker PR" \
+            '. + [$p + {"_skip_reason":$r}]')
+        continue
+    fi
+
+    working=$(echo "$working" | jq --argjson p "$pr" '. + [$p]')
+done < <(echo "$nudge_snapshot" | jq -c '.[]')
+
+if [ "$(echo "$working" | jq 'length')" -eq 0 ]; then
+    echo "$empty_result" | jq --argjson sk "$skipped" --argjson h "$held" '. + {"skipped":$sk,"held":$h}'
+    exit 0
+fi
+
+# ─── group by target components, process each group ──────────────────────────
+
+group_keys=$(echo "$working" | \
+    jq -r '[.[].components | sort | join(",")] | unique | .[]')
+
+while IFS= read -r group_key; do
+    if [ -z "$group_key" ]; then
+        while IFS= read -r pr; do
+            skipped=$(echo "$skipped" | jq --argjson p "$pr" \
+                '. + [$p + {"_skip_reason":"no components detected"}]')
+        done < <(echo "$working" | jq -c '[.[] | select((.components | length) == 0)] | .[]')
+        continue
+    fi
+
+    # PRs in this group, sorted by PR number (ascending); lowest = held-back
+    group=$(echo "$working" | jq --arg k "$group_key" \
+        '[.[] | select((.components | sort | join(",")) == $k)] | sort_by(.pr)')
+    count=$(echo "$group" | jq 'length')
+
+    hb_pr=$(echo "$group"     | jq '.[0]')
+    hb_repo=$(echo "$hb_pr"   | jq -r '.repo')
+    hb_num=$(echo "$hb_pr"    | jq -r '.pr')
+    hb_branch=$(echo "$hb_pr" | jq -r '.base_branch')
+    comps_str=$(echo "$hb_pr" | jq -r '.components | join(" ")')
+    gh_repo=$(repo_to_github "$hb_repo")
+
+    if [ "$count" -eq 1 ]; then
+        # ── single-PR group (solo or held-back whose peers have all merged) ──
+
+        pr="$hb_pr"
+        has_ok=$(echo "$pr"    | jq -r '.has_ok_to_test')
+        has_lgtm=$(echo "$pr"  | jq -r '.has_lgtm')
+        build_ok=$(echo "$pr"  | jq -r '.build_checks_passed')
+        pending=$(echo "$pr"   | jq -r '.pending_checks')
+        other_n=$(echo "$pr"   | jq -r '.other_checks_failed | length')
+        is_osc_devel=false
+        [ "$hb_repo" = "osc" ] && [ "$hb_branch" = "devel" ] && is_osc_devel=true
+
+        # Merge safety must pass before we label or merge a solo PR
+        safety=$("$SCRIPT_DIR/check-merge-safety.sh" \
+            --components "$comps_str" \
+            --repo "$gh_repo" --branch "$hb_branch" \
+            2>/dev/null) || \
+            safety='{"safe_to_merge":false,"blocking":[{"reason":"safety check failed"}]}'
+        safe=$(echo "$safety" | jq -r '.safe_to_merge')
+
+        if [ "$safe" != "true" ]; then
+            blocking=$(echo "$safety" | jq '.blocking')
+            block_reason=$(echo "$blocking" | jq -r '[.[].reason] | join("; ")')
+            skipped=$(echo "$skipped" | jq --argjson p "$pr" --argjson b "$blocking" --arg r "$block_reason" \
+                '. + [$p + {"_skip_reason":$r,"_blocking":$b}]')
+            continue
+        fi
+
+        if [ "$has_ok" = "false" ]; then
+            label_success=false
+            if [ "$DRY_RUN" = true ]; then
+                label_success=true
+            elif "$SCRIPT_DIR/label-pr.sh" --repo "$hb_repo" --pr "$hb_num" \
+                    --label ok-to-test >/dev/null 2>&1; then
+                label_success=true
+            fi
+            if [ "$label_success" = true ]; then
+                labelled=$(echo "$labelled" | jq --argjson p "$pr" \
+                    '. + [$p + {"_label":"ok-to-test"}]')
+            else
+                skipped=$(echo "$skipped" | jq --argjson p "$pr" \
+                    '. + [$p + {"_skip_reason":"failed to apply ok-to-test label"}]')
+            fi
+            continue
+        fi
+
+        # ok-to-test is already set; check if checks are passing
+        if [ "$pending" -gt 0 ] || [ "$build_ok" != "true" ] || [ "$other_n" -gt 0 ]; then
+            pending_str=$(echo "$pr" | jq -r '.pending_checks')
+            build_failed=$(echo "$pr" | jq -r '.build_checks_failed | join(", ")')
+            other_names=$(echo "$pr" | jq -r '.other_checks_failed | join(", ")')
+            if [ "$pending_str" -gt 0 ]; then
+                reason="${pending_str} check(s) still pending"
+            elif [ "$build_ok" != "true" ]; then
+                reason="build checks failed: ${build_failed}"
+            else
+                reason="developer verification needed — other checks failed: ${other_names}"
+            fi
+            skipped=$(echo "$skipped" | jq --argjson p "$pr" --arg r "$reason" \
+                '. + [$p + {"_skip_reason":$r}]')
+            continue
+        fi
+
+        if [ "$is_osc_devel" = "true" ]; then
+            skipped=$(echo "$skipped" | jq --argjson p "$pr" \
+                '. + [$p + {"_skip_reason":"waiting for auto-merge"}]')
+        elif [ "$has_lgtm" = "false" ]; then
+            label_success=false
+            if [ "$DRY_RUN" = true ]; then
+                label_success=true
+            elif "$SCRIPT_DIR/label-pr.sh" --repo "$hb_repo" --pr "$hb_num" \
+                    --label lgtm >/dev/null 2>&1; then
+                label_success=true
+            fi
+            if [ "$label_success" = true ]; then
+                labelled=$(echo "$labelled" | jq --argjson p "$pr" \
+                    '. + [$p + {"_label":"lgtm"}]')
+            else
+                skipped=$(echo "$skipped" | jq --argjson p "$pr" \
+                    '. + [$p + {"_skip_reason":"failed to apply lgtm label"}]')
+            fi
+        else
+            if [ "$DRY_RUN" = false ]; then
+                head_sha=$(echo "$pr" | jq -r '.head_sha // ""')
+                result=$("$SCRIPT_DIR/merge-pr.sh" --repo "$hb_repo" --pr "$hb_num" \
+                    ${head_sha:+--head-sha "$head_sha"} 2>/dev/null) || true
+                if ! echo "$result" | jq -e '.success' >/dev/null 2>&1; then
+                    result='{"success":false,"message":"merge command failed"}'
+                fi
+                if [ "$(echo "$result" | jq -r '.success')" = "true" ]; then
+                    merged=$(echo "$merged" | jq --argjson p "$pr" '. + [$p]')
+                else
+                    msg=$(echo "$result" | jq -r '.message // "unknown error"')
+                    skipped=$(echo "$skipped" | jq --argjson p "$pr" --arg m "$msg" \
+                        '. + [$p + {"_skip_reason":"merge failed: \($m)"}]')
+                fi
+            else
+                # In dry-run, assume merge would succeed
+                merged=$(echo "$merged" | jq --argjson p "$pr" '. + [$p]')
+            fi
+        fi
+
+    else
+        # ── multi-PR group ────────────────────────────────────────────────────
+
+        # Safety check once for the whole group (uses held-back PR's branch/repo)
+        safety=$("$SCRIPT_DIR/check-merge-safety.sh" \
+            --components "$comps_str" \
+            --repo "$gh_repo" --branch "$hb_branch" \
+            2>/dev/null) || \
+            safety='{"safe_to_merge":false,"blocking":[{"reason":"safety check failed"}]}'
+        safe=$(echo "$safety"    | jq -r '.safe_to_merge')
+        blocking=$(echo "$safety" | jq '.blocking')
+
+        # Label ok-to-test on all non-held-back PRs that need it, but only
+        # when safe — osc/devel PRs auto-merge on ok-to-test, so labelling
+        # before the safety check could bypass the guard.
+        if [ "$safe" = "true" ]; then
+            while IFS= read -r pr; do
+                repo=$(echo "$pr" | jq -r '.repo')
+                num=$(echo "$pr"  | jq -r '.pr')
+                [ "$repo" = "$hb_repo" ] && [ "$num" = "$hb_num" ] && continue
+                if [ "$(echo "$pr" | jq -r '.has_ok_to_test')" = "false" ]; then
+                    label_success=false
+                    if [ "$DRY_RUN" = true ]; then
+                        label_success=true
+                    elif "$SCRIPT_DIR/label-pr.sh" --repo "$repo" --pr "$num" \
+                            --label ok-to-test >/dev/null 2>&1; then
+                        label_success=true
+                    fi
+                    if [ "$label_success" = true ]; then
+                        labelled=$(echo "$labelled" | jq --argjson p "$pr" \
+                            '. + [$p + {"_label":"ok-to-test"}]')
+                    else
+                        skipped=$(echo "$skipped" | jq --argjson p "$pr" \
+                            '. + [$p + {"_skip_reason":"failed to apply ok-to-test label"}]')
+                    fi
+                fi
+            done < <(echo "$group" | jq -c '.[]')
+        fi
+
+        # Process each PR in the group
+        while IFS= read -r pr; do
+            repo=$(echo "$pr"    | jq -r '.repo')
+            num=$(echo "$pr"     | jq -r '.pr')
+            branch=$(echo "$pr"  | jq -r '.base_branch')
+            has_ok=$(echo "$pr"  | jq -r '.has_ok_to_test')
+            has_lgtm=$(echo "$pr" | jq -r '.has_lgtm')
+            build_ok=$(echo "$pr" | jq -r '.build_checks_passed')
+            pending=$(echo "$pr"  | jq -r '.pending_checks')
+            other_n=$(echo "$pr"  | jq -r '.other_checks_failed | length')
+            is_osc_devel=false
+            [ "$repo" = "osc" ] && [ "$branch" = "devel" ] && is_osc_devel=true
+
+            # Held-back PR: register and skip
+            if [ "$repo" = "$hb_repo" ] && [ "$num" = "$hb_num" ]; then
+                held_back=$(echo "$held_back" | jq --argjson p "$pr" \
+                    '. + [$p + {"_held_reason":"waiting for peer PRs to merge first"}]')
+                continue
+            fi
+
+            # PRs without ok-to-test: handled by labelling loop when safe,
+            # otherwise record as skipped with blocking reason
+            if [ "$has_ok" != "true" ]; then
+                if [ "$safe" != "true" ]; then
+                    block_reason=$(echo "$blocking" | jq -r '[.[].reason] | join("; ")')
+                    skipped=$(echo "$skipped" | jq --argjson p "$pr" --argjson b "$blocking" --arg r "$block_reason" \
+                        '. + [$p + {"_skip_reason":$r,"_blocking":$b}]')
+                fi
+                continue
+            fi
+
+            # PRs with ok-to-test but checks not passing
+            if [ "$build_ok" != "true" ] || [ "$pending" -gt 0 ] || [ "$other_n" -gt 0 ]; then
+                if [ "$pending" -gt 0 ]; then
+                    reason="${pending} check(s) still pending"
+                elif [ "$build_ok" != "true" ]; then
+                    build_failed=$(echo "$pr" | jq -r '.build_checks_failed | join(", ")')
+                    reason="build checks failed: ${build_failed}"
+                else
+                    other_names=$(echo "$pr" | jq -r '.other_checks_failed | join(", ")')
+                    reason="developer verification needed — other checks failed: ${other_names}"
+                fi
+                skipped=$(echo "$skipped" | jq --argjson p "$pr" --arg r "$reason" \
+                    '. + [$p + {"_skip_reason":$r}]')
+                continue
+            fi
+
+            # osc/devel: auto-merge, only ok-to-test needed
+            if [ "$is_osc_devel" = "true" ]; then
+                skipped=$(echo "$skipped" | jq --argjson p "$pr" \
+                    '. + [$p + {"_skip_reason":"waiting for auto-merge"}]')
+                continue
+            fi
+
+            if [ "$safe" != "true" ]; then
+                block_reason=$(echo "$blocking" | jq -r '[.[].reason] | join("; ")')
+                skipped=$(echo "$skipped" | jq --argjson p "$pr" --argjson b "$blocking" --arg r "$block_reason" \
+                    '. + [$p + {"_skip_reason":$r,"_blocking":$b}]')
+                continue
+            fi
+
+            # Apply lgtm + merge in same run (intentional for multi-PR groups)
+            if [ "$has_lgtm" = "false" ]; then
+                label_success=false
+                if [ "$DRY_RUN" = true ]; then
+                    label_success=true
+                elif "$SCRIPT_DIR/label-pr.sh" --repo "$repo" --pr "$num" \
+                        --label lgtm >/dev/null 2>&1; then
+                    label_success=true
+                fi
+                if [ "$label_success" = true ]; then
+                    labelled=$(echo "$labelled" | jq --argjson p "$pr" \
+                        '. + [$p + {"_label":"lgtm"}]')
+                else
+                    skipped=$(echo "$skipped" | jq --argjson p "$pr" \
+                        '. + [$p + {"_skip_reason":"failed to apply lgtm label"}]')
+                    continue
+                fi
+            fi
+            if [ "$DRY_RUN" = false ]; then
+                head_sha=$(echo "$pr" | jq -r '.head_sha // ""')
+                result=$("$SCRIPT_DIR/merge-pr.sh" --repo "$repo" --pr "$num" \
+                    ${head_sha:+--head-sha "$head_sha"} 2>/dev/null) || true
+                if ! echo "$result" | jq -e '.success' >/dev/null 2>&1; then
+                    result='{"success":false,"message":"merge command failed"}'
+                fi
+                if [ "$(echo "$result" | jq -r '.success')" = "true" ]; then
+                    merged=$(echo "$merged" | jq --argjson p "$pr" '. + [$p]')
+                else
+                    msg=$(echo "$result" | jq -r '.message // "unknown error"')
+                    skipped=$(echo "$skipped" | jq --argjson p "$pr" --arg m "$msg" \
+                        '. + [$p + {"_skip_reason":"merge failed: \($m)"}]')
+                fi
+            else
+                # In dry-run, assume merge would succeed
+                merged=$(echo "$merged" | jq --argjson p "$pr" '. + [$p]')
+            fi
+        done < <(echo "$group" | jq -c '.[]')
+    fi
+done <<< "$group_keys"
+
+# ─── output ──────────────────────────────────────────────────────────────────
+
+jq -n \
+    --argjson labelled  "$labelled"  \
+    --argjson merged    "$merged"    \
+    --argjson held_back "$held_back" \
+    --argjson skipped   "$skipped"   \
+    --argjson held      "$held"      \
+    '{"labelled":$labelled,"merged":$merged,"held_back":$held_back,"skipped":$skipped,"held":$held}'
diff --git a/scripts/process-konflux-prs/process-test-fbc.sh b/scripts/process-konflux-prs/process-test-fbc.sh
new file mode 100755
index 00000000000..5b8e7f19e3b
--- /dev/null
+++ b/scripts/process-konflux-prs/process-test-fbc.sh
@@ -0,0 +1,182 @@
+#!/bin/bash
+# Test-FBC PR processing workflow.
+# Handles "chore(deps): update osc-operator-bundle" PRs, which are deliberately
+# excluded from the regular nudge flow and should only run when the Mintmaker
+# and Nudge queues are fully drained.
+#
+# Usage: ./process-test-fbc.sh [--dry-run]
+#
+# With --dry-run: analyzes what would be done without performing labels or merges
+#
+# Output: JSON
+#   {
+#     "empty":    true|false,
+#     "labelled": [...],
+#     "merged":   [...],
+#     "skipped":  [...]
+#   }
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+
+# Parse options
+DRY_RUN=false
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --dry-run)
+      DRY_RUN=true
+      shift
+      ;;
+    *)
+      echo "Unknown option: $1" >&2
+      exit 1
+      ;;
+  esac
+done
+
+repo_to_github() {
+    case "$1" in
+        osc)               echo "openshift/sandboxed-containers-operator" ;;
+        cloud-api-adaptor) echo "openshift/cloud-api-adaptor" ;;
+        compute-artifacts) echo "openshift/confidential-compute-artifacts" ;;
+        kata-containers)   echo "openshift/kata-containers" ;;
+        podvm-scripts)     echo "confidential-devhub/coco-podvm-scripts" ;;
+        *)                 echo "" ;;
+    esac
+}
+
+snapshot=$("$SCRIPT_DIR/snapshot-prs.sh" --test-fbc)
+
+if [ "$(echo "$snapshot" | jq 'length')" -eq 0 ]; then
+    echo '{"empty":true,"labelled":[],"merged":[],"skipped":[],"held":[]}'
+    exit 0
+fi
+
+labelled='[]'
+merged='[]'
+skipped='[]'
+held='[]'
+
+# Process each PR sorted by number (oldest first)
+while IFS= read -r pr; do
+    repo=$(echo "$pr"    | jq -r '.repo')
+    num=$(echo "$pr"     | jq -r '.pr')
+    branch=$(echo "$pr"  | jq -r '.base_branch')
+
+    if [ "$(echo "$pr" | jq -r '.has_hold')" = "true" ]; then
+        held=$(echo "$held" | jq --argjson p "$pr" '. + [$p]')
+        continue
+    fi
+    has_ok=$(echo "$pr"  | jq -r '.has_ok_to_test')
+    has_lgtm=$(echo "$pr" | jq -r '.has_lgtm')
+    build_ok=$(echo "$pr" | jq -r '.build_checks_passed')
+    pending=$(echo "$pr"  | jq -r '.pending_checks')
+    other_n=$(echo "$pr"  | jq -r '.other_checks_failed | length')
+    comps_str=$(echo "$pr" | jq -r '.components | join(" ")')
+    gh_repo=$(repo_to_github "$repo")
+
+    safety=$("$SCRIPT_DIR/check-merge-safety.sh" \
+        --components "$comps_str" \
+        --repo "$gh_repo" --branch "$branch" \
+        2>/dev/null) || \
+        safety='{"safe_to_merge":false,"blocking":[{"reason":"safety check failed"}]}'
+    safe=$(echo "$safety" | jq -r '.safe_to_merge')
+
+    if [ "$safe" != "true" ]; then
+        blocking=$(echo "$safety" | jq '.blocking')
+        block_reason=$(echo "$blocking" | jq -r '[.[].reason] | join("; ")')
+        skipped=$(echo "$skipped" | jq --argjson p "$pr" --argjson b "$blocking" --arg r "$block_reason" \
+            '. + [$p + {"_skip_reason":$r,"_blocking":$b}]')
+        continue
+    fi
+
+    if [ "$has_ok" = "false" ]; then
+        if [ "$build_ok" != "true" ] || [ "$other_n" -gt 0 ]; then
+            if [ "$build_ok" != "true" ]; then
+                failed=$(echo "$pr" | jq -r '.build_checks_failed | join(", ")')
+                reason="build checks failed: ${failed}"
+            else
+                other_names=$(echo "$pr" | jq -r '.other_checks_failed | join(", ")')
+                reason="developer verification needed — other checks failed: ${other_names}"
+            fi
+            skipped=$(echo "$skipped" | jq --argjson p "$pr" --arg r "$reason" \
+                '. + [$p + {"_skip_reason":$r}]')
+            continue
+        fi
+        label_success=false
+        if [ "$DRY_RUN" = true ]; then
+            label_success=true
+        elif "$SCRIPT_DIR/label-pr.sh" --repo "$repo" --pr "$num" \
+                --label ok-to-test >/dev/null 2>&1; then
+            label_success=true
+        fi
+        if [ "$label_success" = true ]; then
+            labelled=$(echo "$labelled" | jq --argjson p "$pr" \
+                '. + [$p + {"_label":"ok-to-test"}]')
+        else
+            skipped=$(echo "$skipped" | jq --argjson p "$pr" \
+                '. + [$p + {"_skip_reason":"failed to apply ok-to-test label"}]')
+        fi
+        continue
+    fi
+
+    if [ "$pending" -gt 0 ] || [ "$build_ok" != "true" ] || [ "$other_n" -gt 0 ]; then
+        if [ "$pending" -gt 0 ]; then
+            reason="${pending} check(s) still pending"
+        elif [ "$build_ok" != "true" ]; then
+            failed=$(echo "$pr" | jq -r '.build_checks_failed | join(", ")')
+            reason="build checks failed: ${failed}"
+        else
+            other_names=$(echo "$pr" | jq -r '.other_checks_failed | join(", ")')
+            reason="developer verification needed — other checks failed: ${other_names}"
+        fi
+        skipped=$(echo "$skipped" | jq --argjson p "$pr" --arg r "$reason" \
+            '. + [$p + {"_skip_reason":$r}]')
+        continue
+    fi
+
+    if [ "$has_lgtm" = "false" ]; then
+        label_success=false
+        if [ "$DRY_RUN" = true ]; then
+            label_success=true
+        elif "$SCRIPT_DIR/label-pr.sh" --repo "$repo" --pr "$num" \
+                --label lgtm >/dev/null 2>&1; then
+            label_success=true
+        fi
+        if [ "$label_success" = true ]; then
+            labelled=$(echo "$labelled" | jq --argjson p "$pr" \
+                '. + [$p + {"_label":"lgtm"}]')
+        else
+            skipped=$(echo "$skipped" | jq --argjson p "$pr" \
+                '. + [$p + {"_skip_reason":"failed to apply lgtm label"}]')
+        fi
+        continue
+    fi
+
+    if [ "$DRY_RUN" = false ]; then
+        head_sha=$(echo "$pr" | jq -r '.head_sha // ""')
+        result=$("$SCRIPT_DIR/merge-pr.sh" --repo "$repo" --pr "$num" \
+            ${head_sha:+--head-sha "$head_sha"} 2>/dev/null) || true
+        if ! echo "$result" | jq -e '.success' >/dev/null 2>&1; then
+            result='{"success":false,"message":"merge command failed"}'
+        fi
+        if [ "$(echo "$result" | jq -r '.success')" = "true" ]; then
+            merged=$(echo "$merged" | jq --argjson p "$pr" '. + [$p]')
+        else
+            msg=$(echo "$result" | jq -r '.message // "unknown error"')
+            skipped=$(echo "$skipped" | jq --argjson p "$pr" --arg m "$msg" \
+                '. + [$p + {"_skip_reason":"merge failed: \($m)"}]')
+        fi
+    else
+        # In dry-run, assume merge would succeed
+        merged=$(echo "$merged" | jq --argjson p "$pr" '. + [$p]')
+    fi
+done < <(echo "$snapshot" | jq -c 'sort_by(.pr) | .[]')
+
+jq -n \
+    --argjson labelled "$labelled" \
+    --argjson merged   "$merged"   \
+    --argjson skipped  "$skipped"  \
+    --argjson held     "$held"     \
+    '{"empty":false,"labelled":$labelled,"merged":$merged,"skipped":$skipped,"held":$held}'
diff --git a/scripts/process-konflux-prs/snapshot-prs.sh b/scripts/process-konflux-prs/snapshot-prs.sh
index ba4dcde2483..b120ec081bc 100755
--- a/scripts/process-konflux-prs/snapshot-prs.sh
+++ b/scripts/process-konflux-prs/snapshot-prs.sh
@@ -5,8 +5,9 @@
 # Usage: ./snapshot-prs.sh --mintmaker|--nudge [--repo REPO_NAME]
 #
 # Output: JSON array of PR status objects:
-#   [{repo, pr, title, components, build_checks_passed, build_checks_failed,
-#     pending_checks, has_ok_to_test, has_lgtm, has_mintmaker_skip}, ...]
+#   [{repo, pr, title, head_sha, components, build_checks_passed,
+#     build_checks_failed, pending_checks, has_ok_to_test, has_lgtm,
+#     has_mintmaker_skip}, ...]
 
 set -euo pipefail
 
@@ -17,7 +18,7 @@ REPO_FILTER=""
 
 while [[ $# -gt 0 ]]; do
     case $1 in
-        --mintmaker|--nudge)
+        --mintmaker|--nudge|--test-fbc)
             PR_TYPE="$1"
             shift
             ;;
@@ -33,7 +34,7 @@ while [[ $# -gt 0 ]]; do
 done
 
 if [[ -z "$PR_TYPE" ]]; then
-    echo "Usage: $0 --mintmaker|--nudge [--repo REPO_NAME]" >&2
+    echo "Usage: $0 --mintmaker|--nudge|--test-fbc [--repo REPO_NAME]" >&2
     exit 1
 fi
 
@@ -50,13 +51,16 @@ while IFS= read -r pr; do
     entry=$(echo "$status" | jq --arg repo "$repo" \
         '{repo: $repo, pr: .number, title: .title,
           base_branch: (.base_branch // ""),
+          head_sha: (.head_sha // ""),
           components: (.components // []),
           build_checks_passed,
           build_checks_failed: (.build_checks_failed // []),
+          other_checks_failed: (.other_checks_failed // []),
           pending_checks,
           has_ok_to_test,
           has_lgtm,
-          has_mintmaker_skip: ((.labels // []) | any(. == "mintmaker-skip"))}')
+          has_mintmaker_skip: ((.labels // []) | any(. == "mintmaker-skip")),
+          has_hold: ((.labels // []) | any(. == "do-not-merge/hold"))}')
     snapshot=$(echo "$snapshot" | jq --argjson e "$entry" '. + [$e]')
 done < <(echo "$prs" | jq -c '.[]')
 
diff --git a/scripts/process-konflux-prs/watcher.sh b/scripts/process-konflux-prs/watcher.sh
new file mode 100755
index 00000000000..482eb63c128
--- /dev/null
+++ b/scripts/process-konflux-prs/watcher.sh
@@ -0,0 +1,18 @@
+#!/bin/bash
+# Call this (possibly with 'watch') to keep an eye on PRs that the skill will process
+jq -rs 'add' \
+    <(./snapshot-prs.sh --mintmaker | jq '[.[] | .+{type:"mintmaker"}]') \
+    <(./snapshot-prs.sh --nudge     | jq '[.[] | .+{type:"nudge"}]') |   { printf 'REPO\tPR #\tTYPE\tBRANCH\tOK2TEST\tLGTM\tHOLD\tCHECKS\tTITLE\n'; jq -r '.[] | [
+    .repo,
+    (.pr | tostring),
+    .type,
+    .base_branch,
+    (if .has_ok_to_test then "X" else "-" end),
+    (if .has_lgtm then "X" else "-" end),
+    (if .has_hold then "X" else "-" end),
+    (if (.pending_checks > 0) then "pending(\(.pending_checks))"
+     elif (.other_checks_failed | length) > 0 then "other_fail(\(.other_checks_failed | length))"
+     elif .build_checks_passed then "pass"
+     else "FAIL" end),
+    .title
+  ] | @tsv'; } |   column -t -s $'\t'