From 63ec047a4248f8d131caeb543378cdcf94e092ee Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Tao=20Bojl=C3=A9n?= Date: Tue, 28 Jul 2026 16:15:05 +0100 Subject: [PATCH 1/2] Clarify approval requirements for routine commands Co-Authored-By: OpenAI Codex --- AGENTS.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/AGENTS.md b/AGENTS.md index ea82166a6..f318f7f1a 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -200,6 +200,8 @@ Two things differ from a local dev setup: ## Human-approval-required actions +Routine local setup and verification commands, including `npm ci`, existing build/test/lint/format/check scripts, and read-only Git commands, do not require approval; the gates below apply to the changes being made, not merely to running commands. + Stop and get explicit human approval before: - Changing license headers, copyright notices, or any legal text (including `LICENSE`). @@ -208,7 +210,7 @@ Stop and get explicit human approval before: - Deleting or renaming an existing GraphQL type or field — this breaks cached Apollo client state and any downstream consumer. Additive changes are usually safe; removals need a migration plan. - Rewiring `server/iocContainer` in a way that changes service lifecycles or startup order — cascading effects on tests and boot. - Auth, session, or request middleware (under `server/api.ts`) — security-sensitive; prefer a small, reviewable PR with explicit callouts. -- Adding, removing, or upgrading any library or package (including transitive dependencies in `package-lock.json`) — confirm licenses are compatible with Apache 2.0 and that there are no known CVEs. +- Adding, removing, or upgrading any dependency (including transitive dependencies in `package-lock.json`) — confirm licenses are compatible with Apache 2.0 and that there are no known CVEs. - Multi-thousand-line diffs — ROOST policy is that reviewers can digest the change. Split into reviewable PRs; regenerated codegen and lockfile bumps are the only exceptions. ## Commit attribution From 07719d7bb689bbc8ae0c4b8d3af8da2d7228766a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Tao=20Bojl=C3=A9n?= Date: Tue, 28 Jul 2026 16:17:54 +0100 Subject: [PATCH 2/2] Refine routine command approval guidance Co-Authored-By: OpenAI Codex --- AGENTS.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/AGENTS.md b/AGENTS.md index f318f7f1a..c3906e604 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -200,7 +200,7 @@ Two things differ from a local dev setup: ## Human-approval-required actions -Routine local setup and verification commands, including `npm ci`, existing build/test/lint/format/check scripts, and read-only Git commands, do not require approval; the gates below apply to the changes being made, not merely to running commands. +Routine local setup and verification commands, including `npm ci` and existing build/test/lint/format/check scripts, do not require approval; the gates below apply to the changes being made, not merely to running commands. Stop and get explicit human approval before: