From 9b68a60e2f3730461054bc599e5d326dd86c696a Mon Sep 17 00:00:00 2001 From: Claude Date: Wed, 14 Oct 2026 08:19:31 +0000 Subject: [PATCH 1/2] governance(AGENTS.md PD15): carve the fleet-write relay's refresh stroke out of the release.yml dispatch prohibition Ruling record 6160857949 (letter A): the reserved act becomes dispatching release.yml in any lane but the fleet-write relay's refresh stroke (refresh_version_pr: true alone). Every other reserved act is unchanged. The words added are exactly that clause; the rest of the paragraph is a forced re-flow at its own typeset width (118 B). AGENTS.md stays at 1116 lines against its ceiling of 1116. Claude-Session: https://claude.ai/code/session_01B7mrh59UAGffd7s9asUfoY Co-authored-by: Claude --- AGENTS.md | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/AGENTS.md b/AGENTS.md index 30727c2c0b..a97b70a43a 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -304,15 +304,15 @@ localStorage / auth gotchas. `.objectui-sha` pin bumps, version reconciliation, writing changesets, compiling release notes when asked, and *verifying* release state (`npm view`, `git ls-remote --tags`) are ordinary tasks. What is reserved is the **release act itself**: ⛔ running `changeset publish` / `pnpm run release`, ⛔ pushing a version tag, ⛔ - cutting a GitHub Release, ⛔ pushing a runtime image, ⛔ `workflow_dispatch`-ing `release.yml` or any other - publish-capable workflow, ⛔ **approving a pending `release` environment deployment** (ADR-0125: that click IS - the publish authorisation, and a deployment waiting for hours is the system working, not a state you clear), and - ⛔ merging — or queueing, or arming auto-merge on — the **Version Packages** PR (`chore: version packages`). - That PR is bot-authored and standing-open by design: it is regenerated six-hourly by `release.yml`'s `version-pr` - job — never on a push to `main`; push drives the publish lane — so "green, current, and nobody has objected" - is its permanent resting state, not a signal that it is due. When you find a publish nobody ordered — a tag or - an npm version that simply appeared — ⛔ do not "repair" it with a counter-publish: file it as an incident for - the maintainer. + cutting a GitHub Release, ⛔ pushing a runtime image, ⛔ `workflow_dispatch`-ing `release.yml` in any lane but + the fleet-write relay's refresh stroke (`refresh_version_pr: true` alone), or any other publish-capable workflow, + ⛔ **approving a pending `release` environment deployment** (ADR-0125: that click IS the publish authorisation, + and a deployment waiting for hours is the system working, not a state you clear), and ⛔ merging — or queueing, + or arming auto-merge on — the **Version Packages** PR (`chore: version packages`). That PR is bot-authored and + standing-open by design: it is regenerated six-hourly by `release.yml`'s `version-pr` job — never on a push to + `main`; push drives the publish lane — so "green, current, and nobody has objected" is its permanent resting + state, not a signal that it is due. When you find a publish nobody ordered — a tag or an npm version that simply + appeared — ⛔ do not "repair" it with a counter-publish: file it as an incident for the maintainer. **The existence of a path to a release is not authorization to walk it, and the YAML is not a barrier that holds against you.** The publish job is triggered by the **push that lands the Version Packages PR** and held at From e7712a4402550e361e9c849a09ebee2d036fb768 Mon Sep 17 00:00:00 2001 From: Claude Date: Wed, 14 Oct 2026 08:33:46 +0000 Subject: [PATCH 2/2] governance(AGENTS.md PD15): align the bold lead with the amended reserved-act list The lead read "... or triggers a release workflow", which forbade the fleet-write relay's refresh stroke that the amended list admits. It now reads "... or triggers a release". The list stays the definition: every other release.yml lane and every other publish-capable workflow is still reserved by name. Ruling record 6160857949 (letter A: one rule text that matches one mechanism); the seat's answer to the report's open question chose this option. AGENTS.md stays at 1116 lines. Claude-Session: https://claude.ai/code/session_01B7mrh59UAGffd7s9asUfoY Co-authored-by: Claude --- AGENTS.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/AGENTS.md b/AGENTS.md index a97b70a43a..19f3a79d3b 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -299,7 +299,7 @@ localStorage / auth gotchas. approval, or a Tier S merge without a PASS record is a seat violation, filed and rolled back. No seat judges this. 15. **⛔ A version release is performed by the maintainer, by hand — no AI seat publishes, tags, cuts a Release, or - triggers a release workflow, and none merges the Version Packages PR.** A rule that binds every seat lives here, + triggers a release, and none merges the Version Packages PR.** A rule that binds every seat lives here, not only in a lane-specific skill file. **Release-adjacent work stays open to every seat**: the release board, `.objectui-sha` pin bumps, version reconciliation, writing changesets, compiling release notes when asked, and *verifying* release state (`npm view`, `git ls-remote --tags`) are ordinary tasks. What is reserved is the