carlos / platform Public

CLAUDE.md: every change lands through a PR (Paul's rule, 2026-08-10)

Nothing merges to main without a pull request — including doc-only edits
and one-line fixes. Stated as binding on agents too: push the branch and
open the PR, never offer a local merge to main as an option.

The reason is timing. ci.yml triggers on pull_request AND on push to main,
so a locally merged change does meet the gate — but only after it is on
main, where a red run is an incident rather than a merge that doesn't
happen.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Paul Campbell 2 months ago bd75edeff89d588bd997d20ac0b1df9ddc81d302 parent 08efc4a

1 file changed, +20 −0

CLAUDE.md +20 −0

diff --git a/CLAUDE.md b/CLAUDE.md

index 7299f57e9..fc66ddc9d 100644

--- a/CLAUDE.md

+++ b/CLAUDE.md

@@ -47,6 +47,26 @@ commands.** The command alone must complete the job — no follow-up SSM

session, AWS console visit, or on-box verb may be required for it to

deliver or verify its result.

+## Every change lands through a PR (Paul's rule, 2026-08-10)

+**Nothing merges to `main` without a pull request.** No local merge to

+`main`, no direct commit to `main`, no fast-forward "it's only a docs

+change" — every change, however small, goes up as a branch and lands

+through a PR. That includes doc-only edits, one-line fixes, and revert

+commits.

+Agents: this rule is on you as much as on people. When work is complete,

+push the branch and open the PR; never offer merging to `main` as an

+option, and never take it if offered. Merging the PR is a human's action.

+The reason is timing, not ceremony. `.github/workflows/ci.yml` triggers on

+`pull_request` *and* on `push` to `main`, so a locally merged change does

+still meet the gate — but only **after** it is on `main`, where a red run

+is an incident to clean up rather than a merge that simply doesn't happen.

+The PR is the one place the gate runs against the merge result while the

+change can still be turned away, and the one place the branch's diff is

+read as a single piece rather than commit by commit.

## Build & test

- `go build ./...`, `go vet ./...`, `go test ./... -count=1` — all clean,