docs: review and auto-merge tier policy for allow-listed PR classes #2574

Goal

State which pull request classes may be merged without human review and which never may.

Background

main requires zero approving reviews and two checks (base/issue-branch-policy, Core product validation), consistent with the solo-maintainer position. An agent loop beyond draft PRs needs an explicit allow-list, otherwise autonomy is decided ad hoc.

Next-release planning review of 2026-10-14/15 against main at 7faf6dfb. Tracking: #2555.

Prerequisites: #2573.

Scope

• Define allow-listed classes (for example docs-only, test-only, automated dependency-pin bumps) and never-auto classes (workflows, rulesets, release, trust, installer, security).
• Provide a path-based classification function with tests, for use by the loop.
• Document the relationship to docs/review-governance.md and the second-reviewer plan.

Acceptance Criteria

• Policy is documented.
• Classifier has fixtures for each class and for mixed PRs (strictest class wins).
• No change to branch protection settings.

Validation

BASE_CLI_SOURCE_DIR=../base-cli/lib/python \
PYTHONPATH=../base-cli/lib/python:lib/python:cli/python \
python -m pytest <new classifier tests>
git diff --check

Non-Goals

• Do not enable auto-merge.
• Do not weaken review requirements.

Project Fields

• Status: Backlog
• Priority: P2
• Area: Docs
• Initiative: Agentic Coding Platform
• Size: S
• Milestone: v1.13.0
• Category: documentation

Agent Assignment

Assignee: codeforester. Blocked on #2573.

Plan revision (2026-10-16)

This issue is intentionally scheduled for v1.13.0. #2573 remains a prerequisite and #2599 is the security/authority input. The policy must explicitly classify security, credentials, trust, installer, workflow/ruleset, release, and MCP changes as never-auto classes, and must state that an allow-listed path classifier cannot override a sensitive-file or mixed-change finding. This policy is required before any autonomy beyond draft PR preparation; it does not enable auto-merge in this release train.