From 914ce5a286f2bb9f6a7dafae26a3dd330ee7efde Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Sergio=20Az=C3=B3car?= Date: Wed, 23 Sep 2026 17:17:34 -0300 Subject: [PATCH 1/2] docs: state the solo-maintainer authorization for principle 09 The main ruleset required one approving review from a Code Owner. The repo has one maintainer, the agent opens pull requests with that account, and GitHub never counts an author's own approval, so the review could only be bypassed, never given. The ruleset now requires a pull request and the CI check, and blocks force pushes and deletions, with no approval. AGENTS.md, REVIEW.md, and the verification-surface test comment now say so: the maintainer's merge is the authorization, and against the agent the edit-time deny rules are what act. Claude-Session: https://claude.ai/code/session_01GEVZ7EuuDgvN3ULSo6qiVF --- AGENTS.md | 10 ++++++---- REVIEW.md | 3 ++- tests/verification-surface.test.ts | 4 ++-- 3 files changed, 10 insertions(+), 7 deletions(-) diff --git a/AGENTS.md b/AGENTS.md index 08b2a33..2453b35 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -133,10 +133,12 @@ the verification surface (`tests/`, the lint and format config, `vitest.config.t `.claude/`, `.claude-plugin/`) as owned; `REVIEW.md` states the review rules an agent or a person applies on every change; and `.claude/settings.json` denies the agent editing that surface (leaving `tests/` writable so tests can be added, with deletion caught by the test above), so a person edits -the rest by hand. The external half is a branch ruleset on `main` that requires a pull request, -the `ci` check, and Code Owner review, and blocks force pushes and deletions. Create or verify it with -`gh api repos/sergioazoc/context-architecture/rulesets`; it is the one part of this that lives in the -GitHub settings, not the tree. +the rest by hand. The external half is a branch ruleset on `main` that requires a pull request and +the `ci` check, and blocks force pushes and deletions. It requires no approval: the agent opens pull +requests with the one maintainer's account, and GitHub never counts an author's own approval. The +maintainer's merge is the authorization; against the agent, the edit-time deny rules are what act. +Create or verify it with `gh api repos/sergioazoc/context-architecture/rulesets`; it is the one part +that lives in GitHub settings, not the tree. Principle 04 (legibility at every zoom level) is bound by the `complexity`, `max-depth`, `max-params`, and `max-lines-per-function` rules in `.oxlintrc.json`, kept at `error` and pinned by diff --git a/REVIEW.md b/REVIEW.md index 81afc1a..1add080 100644 --- a/REVIEW.md +++ b/REVIEW.md @@ -8,6 +8,7 @@ important any of the following, and require the fix in the same change. - A new claim left loose: a source of truth, an invariant, a convention, or a boundary added without the mechanism that fails when it stops being true. - The verification surface weakened: a lint rule dropped below `error`, a CI step removed, a test - deleted, or a deny rule loosened, without the Code Owner's approval (principle 09). + deleted, or a deny rule loosened, unless the pull request states it is intended (principle 09). + The maintainer's merge is the only authorization, so the intent must be on the record. - EN and ES out of parity, or an em dash, an emoji, or marketing copy, against the house rules in the root `AGENTS.md`. diff --git a/tests/verification-surface.test.ts b/tests/verification-surface.test.ts index b32ff88..ce78b40 100644 --- a/tests/verification-surface.test.ts +++ b/tests/verification-surface.test.ts @@ -56,8 +56,8 @@ describe('the verification surface is itself bound (principle 09)', () => { // The authorization principle 09 names is declared in the repo: CODEOWNERS marks // the verification surface, and the vitest config keeps collecting every test so a -// deleted test file is not silently uncovered. A branch ruleset that requires Code -// Owner review and the CI check is the external half (see the root AGENTS.md). +// deleted test file is not silently uncovered. A branch ruleset that requires a +// pull request and the CI check is the external half (see the root AGENTS.md). describe('the authorization is declared (principle 09)', () => { it('CODEOWNERS covers the verification surface', () => { const owners = read('.github/CODEOWNERS') From eefdf568b4aa7dbf8c9583a023acf3196af1af0a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Sergio=20Az=C3=B3car?= Date: Wed, 23 Sep 2026 17:22:42 -0300 Subject: [PATCH 2/2] docs: describe the solo-maintainer authorization in the CODEOWNERS header --- .github/CODEOWNERS | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS index 4e74217..9a29f82 100644 --- a/.github/CODEOWNERS +++ b/.github/CODEOWNERS @@ -1,8 +1,9 @@ # Ownership of the verification surface (principle 09). These paths decide what # the repository checks and how, so changing one is authorizing a change to the -# rules themselves. Pairing this with a branch ruleset that requires Code Owner -# review makes the authorization real: an agent can rewrite the code freely, but -# not weaken or delete a check to get a change through. +# rules themselves. With one maintainer, no review is required (GitHub does not +# count an author's own approval): this file declares the surface, the branch +# ruleset requires a pull request and the CI check, and the maintainer's merge is +# the authorization. /tests/ @sergioazoc /.oxlintrc.json @sergioazoc /.oxfmtrc.json @sergioazoc