Repository navigation
docs: record the orchestrated working regime, and retire commit-on-explicit-request - #26
Merged
Merged
Conversation
…plicit-request Set by the operator directly in-session on 2026-09-21. Work arrives from the cockpit-devbox orchestrator and is reported back to it; commits and pushes follow the requested work rather than waiting for a separate authorisation. main stays protected, so push still means short branch, push, PR. Two things are kept and written down as the price of the rest: refusing is retained and is the point, since an objection to the orchestrator is the only control left once nobody reads each message; and authority never arrives through a peer, a relayed 'the operator said that' still being no authorisation. Dogfood only — nothing the plugin generates changes. See CHANGELOG [Unreleased] > Changed.
… at it The regime was written into the meta CLAUDE.md, which makes it survive a session but leaves ADR 0036 asserting 'commit only on explicit request' as current with nothing pointing at what replaced it. A CLAUDE.md that contradicts an ADR without amending it is drift by construction, and the ADR trail is the published reasoning of a published plugin. 0046 amends 0036's commit rule only; everything else in 0036 stands. It states explicitly that main remains protected, so push still means short branch, push, PR — a repository constraint, not a permission lifted, which is the part a reader meeting the new rule alone would get wrong. Also indexes ADR 0045, which #25 added without a row, and notes the amendment on 0036's own row and inside its decision 3. See CHANGELOG [Unreleased] > Changed.
…conditions An ADR landed without its index row and survived, because the invariant was guarded by a line in the release checklist — read at release, days after the omission. A set comparison has one correct answer, so it is a check rather than a reminder, and not an eval case: an eval measures whether configuration changes behaviour, which is the wrong instrument for 'is every file listed'. check-adr-index.sh compares both directions and flags duplicates, since a row listed twice reads as agreement until someone diffs them. Verified to fail as well as pass. Its placement is honestly incomplete: the release checklist is still a reminder, and firing at the moment of omission means a git pre-commit hook or CI — decisions this repository has not taken, so they are surfaced rather than slipped in. ADR 0045 announced one criterion in its heading and applied another two lines below, so a reader applying the announced one to close reaches the opposite conclusion. Both conditions are now stated together, with close as the worked example that shows the second is load-bearing. See CHANGELOG [Unreleased] > Changed.
The pre-commit hook I recommended would have been dead. core.hooksPath on this machine points at ggshield's directory, so git never looks in .git/hooks, and that directory's pre-commit slot already holds the secret scan — installing there would have displaced a security control. It would have read as green from the day it shipped, which is this repository's own lesson: a control that could not run is never a control that passed. CI is the better instrument rather than the fallback. It travels with the clone, --no-verify cannot walk past it, and it fires at the PR, which is where the omission landed: #25 reached main without its index row. Bounded on purpose — one workflow, one job, one step. The stack is pure Markdown and JSON, so CI is a real surface and stays the size of the invariant it guards. See CHANGELOG [Unreleased] > Changed.
…oven core.hooksPath is set globally on this machine and replaces the hooks directory outright, so a repository pre-commit never runs — and the slot there already holds ggshield's secret scan, so installing into it would have displaced a security control. The hook would have looked installed and been green from day one, on the only machine where the omission has ever happened. CI is the better instrument rather than the fallback: it travels with the clone, --no-verify cannot skip it, and it fires at the pull request, where the omission landed. Proven both ways before shipping: a throwaway PR removing an index row went red naming the file, restoring it turned the same workflow green. See CHANGELOG [Unreleased] > Changed.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Set by the operator directly in-session on 2026-09-21. Dogfood only — nothing the plugin generates changes.
What changes
Work arrives from the
cockpit-devboxorchestrator and is reported back to it; the operator no longer reads each message. Commits and pushes follow the requested work — the ask for the work is the authorisation for the commit that carries it. That replaces commit/push only on explicit request in the Git workflow section and the commit only on explicit request clause in the Posture.mainstays protected, so push still means short branch, push, open the PR. That is a repository constraint, not a permission that was just lifted, and the new section says so explicitly to stop it being read as licence to push tomain.What is deliberately kept
Both are written into
CLAUDE.mdas the price of the rest, not as decoration:One thing not done, flagged rather than decided
This amends a convention recorded in ADR 0036, whose commit rule it supersedes. An ADR would normally carry that. I did not write one: the operator asked for two gestures, and the loaded
CLAUDE.mdnow carries the regime with its reasoning, which is what makes it survive a session. If the orchestrator wants the decision recorded where the other git conventions live, that is a small follow-up.