From 5d673c48a4e348e81050d38fdf84f3c928afe9bd Mon Sep 17 00:00:00 2001 From: Jonathan Springer Date: Wed, 16 Sep 2026 13:37:30 +0100 Subject: [PATCH] docs(agents): forbid direct pushes to main Three session commits (65743e8, 5cab1c2, 2a94003) bypassed review and the required CI gates because branch protection does not enforce rules on administrators (enforce_admins=false). Make the policy explicit in AGENTS.md: all work - code, CI, docs, tooling - lands via branch + PR; AI agents open the PR and stop; merging is the maintainer's call. Signed-off-by: Jonathan Springer --- AGENTS.md | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/AGENTS.md b/AGENTS.md index 1150420..88cdf09 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -67,6 +67,15 @@ uses line-length 120, target py311. ## Contribution workflow +- **NEVER push directly to `main`** - no exceptions for maintainers, admins, + or AI agents. Every change (code, tests, CI, docs, tooling) lands on a + branch and merges via pull request: direct pushes bypass review and the + required CI gates. If something lands on `main` by mistake, revert or fix + through a PR - never fix forward with another direct push. +- AI agents: commit to a branch, push it, open the PR, and stop there. + Never merge the PR and never push to `main`, even when asked to "ship", + "deliver", or "publish" - the PR is the deliverable; merging is the + maintainer's call. - Open an issue before a PR (bugs and features both). Do not implement issues labeled `triage` until a maintainer scopes them. - PRs target `main`; fill in the PR template.