[mvalancy]

Matthew authorized permanently leaving administrator enforcement disabled on dev, with a high testing bar for agent admin integration. This makes that authority discoverable in AGENTS.md and CLAUDE.md, records one canonical playbook and dated lesson, and updates the validation ledger with the completed PR #157 integration. The authority covers dev only; it does not authorize release/deployment, identity or credential changes, force pushes, or further protection changes.

The playbook requires a reviewable PR, independent review of the exact diff, appropriate passing gates, exact source/base/result provenance, retained failures and cleanup evidence, and final branch CI before issue closure. Documentation-only reuse requires an exhaustive changed-path/mode/blob comparison; a filename extension alone is insufficient. Admin integration is explicitly distinguished from a GitHub non-author approval.

Validation on f94ca2ade6e6f5749119a9e5058688d374a5169c:

• Exactly six reviewed Markdown files changed from actual dev merge 9068cd3; all 677 other tracked paths, modes, object types and blob IDs match. The complete unchanged inventory SHA-256 is a571807c958367d5506889447575e1383cd438b3926f2cedb1f0cbb6bc37bbbf. That base's full tree equals fully validated application head 385e7679.
• Independent policy/delta review, local link validation and git diff --check pass. No application, dependency, workflow, script or test code changed.
• Runtime evidence is final PR CI and supported-Node/installer CI. Actual 9068cd3 push checks also pass static/unit/build/audit/database and the Node matrix; its browser run was superseded/cancelled by the final documentation merge and is not counted as complete.
• The documentation-only exception reuses the fully passing runtime evidence above. Applicable CI on the final resulting dev head must pass before Core validation sweep: reliable test evidence, data durability, authorization, and CI #156/Bound test timeouts across owned child processes #162 close.

The already-authorized repository setting changed only enforce_admins.enabled: true → false; independent read-back verified all other fields unchanged. This PR changes documentation only. Remaining named-status enforcement is tracked separately in #187.

Merged through the authorized native admin operation at ef495eff15ed7aac51e72dc7a1db1bb96d2b3695, parents 9068cd3 + reviewed f94ca2a. Its complete tree equals the reviewed policy head: 6bdd9d820f98b9882c3dcf6a110badd88bfe78bc. Final push CI and supported-Node/installer CI both passed on that actual commit. The redundant policy-PR CI was cancelled after exact ancestry/tree verification; it is not counted as passed. Every applicable final-branch check passed; independent artifact inspection confirms clean unchanged ef495ef and browser case counts 6/42/27/3 plus three graph-effects cases. The validated dev closeout is recorded in #156; main/release promotion is separate work.

Final evidence: browser artifact 12537396736, source fingerprint e375ead712ec55ec23749d7b90d852f056a873e78d851bc76d320c4033a6921d. Strict reports contain zero failed/warned/skipped cases, no timeout/evidence errors, and clean unchanged start/end source. Complete closeout record.

[mvalancy]

Independent agent review of exact head f94ca2ade6e6f5749119a9e5058688d374a5169c against 9068cd31824991330c6d92196654e53e04e29063: no blocking finding. This is transparent review evidence, not a GitHub non-author approval.

I independently compared the complete tracked trees, including path, file mode, type and blob: exactly the six reviewed Markdown files changed; all 677 other entries are identical. The base tree equals the fully validated application tree at 385e7679. git diff --check and the reviewed local links pass; no application, dependency, workflow, script, test or runtime-asset change is present.

The guidance accurately records the owner's standing dev-only admin authorization. It preserves every other protection, excludes main/releases/deployments and identity/scope expansion, distinguishes admin authority from reviewer approval, restricts the same-account SSH fallback to an evidenced credential workflow-scope limitation, and requires independent review, source provenance, appropriate validation and final branch CI. The ledger's new dated disposition matches the actual 9068cd3 merge and independently inspected prior results; historical pending statements are clearly labeled.

Runtime evidence is reused from exact 385e7679 because of the exhaustive documentation-only proof: CI, Comprehensive, and browser artifact. That includes 603 unit passes/26 DB-gated skips, 161 harness passes, nine real database/MCP contracts, and strict browser groups of 6/42/27/3 passes plus three living-graph checks. I did not rerun application tests for this documentation change. Post-merge CI on the resulting latest dev head must still pass before issue #156 closes. No deployment, hosted acceptance, full-image security clearance or non-author approval is implied.

[github-actions]

🧪 Comprehensive Test Suite

• Unit suites (Node 22.18.0 & 24.x) — core, web, server, mcp-server: ✅ passed
• Installer & deploy config: ✅ passed

Full-stack smoke gate runs in the CI workflow.