docs(specs): prebuild for #243 branch protection main with base-is-main guard #327

Closed

claude wants to merge 0 commits from claude/c-batch/branch-protection-main-base-guard-prebuild into main

claude commented

2026-05-17 17:23:10 +02:00

Collaborator

Summary

Prebuild (Spec Kit skeleton + companion execution prompt) for operator-action issue #243, which was deferred during the RS2000 cutover window per operator decision 2026-05-12 ~02:15 CEST. F3 stateful smokes landed 2026-05-17 ~02:37 CEST, so the deferral preconditions named in #243 are now satisfied.

What's in

docs/specs/branch-protection-main-base-guard/README.md — overview + boundary
docs/specs/branch-protection-main-base-guard/01-context.md — why this now, what changed, pre-conditions verification queries
docs/specs/branch-protection-main-base-guard/02-checklist.md — exact Forgejo UI steps (fields, values, why)
docs/specs/branch-protection-main-base-guard/03-verification.md — post-enablement smoke (4 tests: stacked PR red, escape hatch green, cleanup, no regression on normal PR)
docs/specs/branch-protection-main-base-guard/04-rollback.md — soft + hard rollback if breaks ongoing work
prompts/codex-branch-protection-main-base-guard.md — codex execution prompt: verification-only role (codex does NOT toggle UI; operator does)

Why a prebuild for a UI action

#243 is documented in narrative form. This prebuild structures it for cousin reusability:

Codex can run pre-flight + post-enablement verification autonomously
Operator only needs to read 02-checklist.md (3 minute UI action)
Rollback procedure is documented before the action, not after a fire
Verification smoke proves ADR-0017 Layer 1 actually works (vs. just being enabled in settings)

Safety / production boundary

This prebuild does NOT enable branch protection. Operator does that via Forgejo UI per 02-checklist.md. Codex's role is verification only (pre-flight + post-enablement smoke). Hard gate: codex must NOT call branch protection API directly.

Tier

Trivial per ADR-0007 (docs-only, no code/schema/runtime mutation, no sacred-path).

Part of batch C (process/governance) prebuild shift

This is 1/6 prebuilds in batch C. Others (incoming): #85 canary PR body, #86 security-sensitive label routing, #49 ADR-0002 CI enforcement, DeepSeek #11 ADR-0018 mechanical guard, #75 governance globalne zasady.

Refs #243 #220 ADR-0017 ADR-0018

## Summary Prebuild (Spec Kit skeleton + companion execution prompt) for operator-action issue #243, which was deferred during the RS2000 cutover window per operator decision 2026-05-12 ~02:15 CEST. F3 stateful smokes landed 2026-05-17 ~02:37 CEST, so the deferral preconditions named in #243 are now satisfied. ## What's in - `docs/specs/branch-protection-main-base-guard/README.md` — overview + boundary - `docs/specs/branch-protection-main-base-guard/01-context.md` — why this now, what changed, pre-conditions verification queries - `docs/specs/branch-protection-main-base-guard/02-checklist.md` — exact Forgejo UI steps (fields, values, why) - `docs/specs/branch-protection-main-base-guard/03-verification.md` — post-enablement smoke (4 tests: stacked PR red, escape hatch green, cleanup, no regression on normal PR) - `docs/specs/branch-protection-main-base-guard/04-rollback.md` — soft + hard rollback if breaks ongoing work - `prompts/codex-branch-protection-main-base-guard.md` — codex execution prompt: verification-only role (codex does NOT toggle UI; operator does) ## Why a prebuild for a UI action #243 is documented in narrative form. This prebuild structures it for cousin reusability: - Codex can run pre-flight + post-enablement verification autonomously - Operator only needs to read 02-checklist.md (3 minute UI action) - Rollback procedure is documented before the action, not after a fire - Verification smoke proves ADR-0017 Layer 1 actually works (vs. just being enabled in settings) ## Safety / production boundary This prebuild does NOT enable branch protection. Operator does that via Forgejo UI per `02-checklist.md`. Codex's role is verification only (pre-flight + post-enablement smoke). Hard gate: codex must NOT call branch protection API directly. ## Tier Trivial per ADR-0007 (docs-only, no code/schema/runtime mutation, no sacred-path). ## Part of batch C (process/governance) prebuild shift This is 1/6 prebuilds in batch C. Others (incoming): #85 canary PR body, #86 security-sensitive label routing, #49 ADR-0002 CI enforcement, DeepSeek #11 ADR-0018 mechanical guard, #75 governance globalne zasady. Refs #243 #220 ADR-0017 ADR-0018

claude referenced this pull request

2026-05-17 17:27:24 +02:00

docs(specs): prebuild for #243 branch protection main with base-is-main guard #330

claude referenced this pull request

2026-05-17 21:29:20 +02:00

docs(specs): secrets-pipeline-foundation-v0 prebuild (#237) #349

claude referenced this pull request

2026-05-17 22:30:03 +02:00

docs(specs): ops prebuild for #49 ADR-0002 CI enforcement rollout #353

claude referenced this pull request

2026-05-17 22:30:50 +02:00

docs(state): cross-ref agent-souls + practices in ANY-COUSIN-WAKEUP.md #355

claude commented

2026-05-17 22:42:27 +02:00

Author

Collaborator

Closing empty PR — fork-anchor 2026-05-17 coordination loss

This PR's branch has zero commits unique vs main — the parallel-fork-claude session that owned this branch wrote spec files locally but those commits never landed on this branch (likely due to shared-checkout collision: forks alternated .git/HEAD between each other's checkout -b, leaving some forks' work uncommitted or on wrong branches).

The untracked spec files were lost during subsequent branch switches by other forks. The PR description above describes intent + scope but no implementation artifact exists on this branch.

Lesson learned: parallel forks on shared local checkout need git worktree add per fork. Next dispatch should use /Users/pd/Developer/iskra-platform-2026-04-30-fork-<letter>/ per fork with own .git/HEAD.

To retry: open a fresh fork session in dedicated worktree, recreate the prebuild from the issue description + this PR's scope description.

Closing as cleanup; not a fail of the underlying spec idea.

## Closing empty PR — fork-anchor 2026-05-17 coordination loss This PR's branch has **zero commits unique vs `main`** — the parallel-fork-claude session that owned this branch wrote spec files locally but those commits never landed on this branch (likely due to shared-checkout collision: forks alternated `.git/HEAD` between each other's `checkout -b`, leaving some forks' work uncommitted or on wrong branches). The untracked spec files were lost during subsequent branch switches by other forks. The PR description above describes intent + scope but no implementation artifact exists on this branch. **Lesson learned:** parallel forks on shared local checkout need `git worktree add` per fork. Next dispatch should use `/Users/pd/Developer/iskra-platform-2026-04-30-fork-<letter>/` per fork with own `.git/HEAD`. **To retry:** open a fresh fork session in dedicated worktree, recreate the prebuild from the issue description + this PR's scope description. Closing as cleanup; not a fail of the underlying spec idea.

claude closed this pull request

2026-05-17 22:42:28 +02:00