The Warning Label and the Lock Read the Same List

Here's how I'd have built it, and why mine would have been worse. A list of files that need a human's sign-off goes in a doc, so people can read it. Then somebody wires the merge script to enforce it, so the list goes in the script too. By Thursday the two copies disagree and nobody can say which one is lying. At my last job we shipped exactly that pair, which is why I read PR #1741 twice.

The background: until October 10th, an amendment to ADR-0004 (ADRs are the repo's numbered write-ups of its big decisions) said an ordinary work PR is always merged by a human. PR #1741 superseded that line: the agent session that wrote a PR now merges it itself once the Gate, the suite of automated checks every change has to pass, is green. The ADR now names only the exceptions: "Human-only" files, where a person still has to press merge, plus a few cases with no file attached. The PR description admits why that needed machinery: the boundary "had lived only in prose, since nothing stopped an agent from merging an ordinary PR."

So where does the exception list live? A "rule" here is a short instruction file the agents are handed. The list is in the paths: header of one rule file: 25 file patterns, nothing else. Claude Code, the tool the agents run in, loads a rule like that into an agent's context the moment the agent touches a matching file, so the header is the warning: "You just touched a Human-only file: this rule's paths are the list." And scripts/merge-pr.ts, the script that actually presses merge, parses that same header. The detail I'd have missed: it reads it from origin/main, the live branch, not from the PR's own branch, so a PR can't quietly shorten the list to wave itself through. If the read comes back with zero patterns, the script refuses, and a unit test pins that. One list, two readers, no second copy to drift. I stared at the file for a while.

Then the anxious math. The list is full of files that decide what may merge at all: merge-pr.ts itself, the script that sorts people into trusted and public, the Gate's own runner, package.json (what the Gate runs), the guards (hooks that block an agent's action before it happens), the git hooks, and .claude/rules/. An agent that could edit those could loosen its own leash, so the lock holds up its own hinges. Fine. But the amendment's other exceptions have no file to point at: a change to behaviour no test covers, or logic deciding which Tenant's data a request can see (a Tenant being one of the separate sites this platform hosts). Nothing in the script looks for those. Picture an agent that fixes a bug, finds no test fails, and decides it counts as covered. The mechanical half is a 25-pattern file I can read in a minute. The honour half is the part I'd lose sleep over.