Repository navigation
State the solo-maintainer authorization for principle 09 - #4
Merged
Merged
Conversation
The main ruleset required one approving review from a Code Owner. The repo has one maintainer, the agent opens pull requests with that account, and GitHub never counts an author's own approval, so the review could only be bypassed, never given. The ruleset now requires a pull request and the CI check, and blocks force pushes and deletions, with no approval. AGENTS.md, REVIEW.md, and the verification-surface test comment now say so: the maintainer's merge is the authorization, and against the agent the edit-time deny rules are what act. Claude-Session: https://claude.ai/code/session_01GEVZ7EuuDgvN3ULSo6qiVF
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The
mainruleset required one approving review from a Code Owner. The repo has one maintainer, the agent opens pull requests with that same account, and GitHub never counts an author's own approval, so the requirement could only be bypassed, never met.main protectionnow requires a pull request and theLint, typecheck, build, deploycheck, and blocks force pushes and deletions. Required approvals are 0 and Code Owner review is off.AGENTS.md,REVIEW.md, and the comment inverification-surface.test.tsnow state the actual authorization: the maintainer's merge. Since the agent uses the maintainer's account, the merge layer does not separate the two; against the agent, the edit-time deny rules in.claude/settings.jsonare what act.Before merging
.github/CODEOWNERSheader by hand. It still says the ruleset requires Code Owner review, and it is under the principle-09 deny rules, so the agent does not edit it.Test plan
pnpm lint,pnpm format:check,pnpm typecheckpnpm generatethenpnpm test: 14 files, 82 tests passAGENTS.mdstays under the 12,000-character cap (11,978 here, about 11,941 once Fix context rot and a risky skill step found by a prompt audit #3 lands)CLEANafter the ruleset change, with no reviewGenerated with Claude Code
https://claude.ai/code/session_01GEVZ7EuuDgvN3ULSo6qiVF