Org rules for the triage flip day: agents push through the broker, and a person's own pushes go through their agent (hq#209) #49

Related issues: the repo-standard Codex issue is setkernel/hq#451, the Merging-line (org rules Codex) issue is #48, the hq flip issue is setkernel/hq#452 and the org-rules flip issue is #49.

One line under "Changes" in rules/org-rules.md for the day setkernel/hq#209's triage switch flips. On private repos, agents push through the broker, and until sk-hand ships a person's own pushes go through their agent. Then no session reads a refused push to a private repo as a bug.

What and why

• hq#209's last box asks for "the same rule in rules/org-rules.md, in one or two lines under 'Changes', keeping the file at 60 lines or fewer". It starts after agent-plugins#36, which edited the same file. Managed settings before the console paste: guard hooks fail closed, 0008 org rules, managedSourcesBehavior, the allow-test-changes rule #36 closed on 2026-10-26, when PR Managed settings before the console paste: guard hooks fail closed, 0008 org rules, managedSourcesBehavior, the allow-test-changes rule #41 merged.
• The rule comes from hq#209:
  • On private repos the employee accounts drop to triage, so a person's own git push there is refused (decision 24, in the "Write access" box; the last box).
  • Agents' pushes go through the push broker (setkernel/sk-ctl#43), through sk-agent's client (setkernel/hq#394).
  • Until sk-hand ships (setkernel/hq#395), a person changes a private repo only through their own agent. This is decision 23, "Switch now; A is in force until B ships" (Raghav's picks).
• The line says who pushes and how: agents through the broker, and a person through their agent. "Private repos:" leaves public repos out, where people push as before (decision 24).
• Raghav's login isn't part of the switch (decision 15, "Keep login, move R3"), so Claude Lead and raghav-dev keep pushing their own branches. The hq amendment says so. One line has no room for it.
• The 60-line limit. tests/run.sh:89 fails the suite above 60 lines. The file is at 60 at fd67fca, and the Merging-line issue ("Drop Codex as a merge requirement: the org rules' Merging line", filed with this one) keeps it at 60. So the two-line opening sentence (rules/org-rules.md:2-3) becomes one line with the same meaning. The file stays at 60, and no line is longer than today's longest, 120 characters (:19).
  • The other option was to add the rule to the end of line 41 (the employee accounts, under "Who did it"). That makes a line of about 235 characters, and hq#209's box asks for "Changes".
• agent-plugins is public, so the switch doesn't change who can push here (decision 24). The rule still belongs in the org rules, because they load into every session in every repo (tests/run.sh:88).
• Claude Lead drafted the line. An agent opens the PR, because Claude Lead doesn't merge its own PRs. The delegation comment ("Still not done") and its correction both keep that rule.

Scope

• One draft PR on setkernel/agent-plugins, branch agent/<this issue>-<slug>, cut from main after the Merging-line issue's PR merges:
  • rules/org-rules.md and tests/run.sh change as in the diff below.
  • managed/settings.json is regenerated with bin/generate. It holds the whole org rules as one JSON line (claudeMd), so the diff below leaves it out.
• The test. Three markers in tests/run.sh check that the regenerated claudeMd carries the new line, as the Org rules: replace 'every PR needs Raghav's review' with the v4 merge quorum #25 and Managed settings before the console paste: guard hooks fail closed, 0008 org rules, managedSourcesBehavior, the allow-test-changes rule #36 markers do for theirs. The edit only adds cases. agent-plugins runs no test-diff guard (its only workflow is .github/workflows/check.yml, and it has no rulesets), so no allow-test-changes line is needed.
• The diff, from git diff on agent-plugins fd67fca with the Merging-line issue's diff applied. It also applies on fd67fca alone and on agent-plugins#46's head (823f02fa).

diff --git a/rules/org-rules.md b/rules/org-rules.md
index ccd2b89..5263880 100644
--- a/rules/org-rules.md
+++ b/rules/org-rules.md
@@ -1,6 +1,5 @@
 # setkernel org rules
-These rules apply to every agent and person in a setkernel repository. Its `AGENTS.md` adds commands,
-layout and traps; where the two disagree, ask.
+For every agent and person in a setkernel repo. Its `AGENTS.md` adds commands, layout and traps; if they disagree, ask.
 ## Tracking work (mandatory)
 Status lives only in GitHub issues on https://github.com/orgs/setkernel/projects/6, never in docs,
 READMEs, code comments or dashboards (https://github.com/setkernel/hq/blob/main/docs/tracking.md).
@@ -35,6 +34,7 @@ Silence is not approval. If a request has readings with different results, ask;
   own; only the merge App merges; Raghav's seat never counts as a Claude reviewer.
   Full rule: setkernel/hq decision 0007 (and `policy/risk.yml` once it exists).
 - A revert is a new forward commit that says what it reverts and why, made only on Raghav's word.
+- Private repos: agents push through the broker; until `sk-hand` ships, a person's own pushes go through their agent.
 - Done means the repo's checks pass on the tree you report (the `verify` skill); a check you could not
   run is reported as not run, with the reason, never as passed.
 ## Who did it
diff --git a/tests/run.sh b/tests/run.sh
index fd0ddb6..9bd69cd 100755
--- a/tests/run.sh
+++ b/tests/run.sh
@@ -104,6 +104,11 @@ for marker in 'Every secret lives in Infisical' 'named with its reason (decision
 done
 expect 1 '^0$' "claudeMd drops Cloudflare or the vault as the home of secrets" -- \
   sh -c "jq -r .claudeMd '$root/managed/settings.json' | grep -c 'Cloudflare or the vault'"
+# The triage flip day's rule for private repos (hq#209 decision 23).
+for marker in 'Private repos: agents push through the broker' 'until `sk-hand` ships' \
+  "a person's own pushes go through their agent"; do
+  expect 0 "$marker" "claudeMd names $marker" -- jq -r .claudeMd "$root/managed/settings.json"
+done
 
 expect 1 "stale: plugins/setkernel/policy/holds.md" "a policy edit without regenerating is drift" -- \
   sh -c "jq '.holds[0].summary = \"changed\"' '$tmp/copy/policy/versions.json' >'$tmp/v.json' && mv '$tmp/v.json' '$tmp/copy/policy/versions.json' && sh '$tmp/copy/bin/generate' --check"

On flip day, before the PR is marked ready

• The hq flip issue's PR ("Decision 0007 for the triage flip day", in setkernel/hq) is ready to merge too.
• sk-hand hasn't shipped: hq#395 and setkernel/sk-ctl#64 are still open. If it has shipped, the line records the hand-off instead, as hq#209's last box says.
• main is merged in if it moved, and bin/generate --check prints generated files are current.

Out of scope

• The switch itself. setkernel/hq#444's script makes it, and Raghav runs the apply.
• Decision 0007's amendment. It has its own issue in setkernel/hq, "Decision 0007 for the triage flip day".
• The Merging line. The Merging-line issue changes it.
• The comment on hq#209 that names the four employee accounts. Claude Lead posts it once both flip PRs merge.
• Any other change to the org rules.

Starts after: both of these.

• The flip-day preconditions, all five of the hq flip issue's, each with a link:
  • hq#209's probes pass on 4 of 4 VMs: every one of the 24 rows in hq#445's table says refused or alerted (decisions comment, "Probes before the triage switch").
  • The triage-PR probe has a result, linked from hq#209: can a triage account open a PR from a broker-pushed branch in the same private repo? If the answer is no, this issue waits with the hq flip issue, and Claude Lead takes "who opens PRs on private repos" to Raghav on hq#209 first.
  • The broker is out of shadow: sk-ctl#43's "Shadow first (log only) until a variable says on" box is ticked, and the variable says on.
  • sk-agent's broker client (hq#394) is merged and installed on vega, rigel, lyra and orion, including its "Claims without push" box.
  • The org requires two-factor authentication: gh api orgs/setkernel --jq .two_factor_requirement_enabled prints true. It printed false on 2026-10-27. This is Raghav's org setting.
  • hq#209's "Order" box makes the switch the last step, after these.
• The Merging-line issue ("Drop Codex as a merge requirement: the org rules' Merging line") has merged. Both PRs rewrite claudeMd, so this one starts from main after that merge and reruns bin/generate.
• Then open the PR as a draft. hq#444's full apply waits for it to be open, so it can merge the day the switch flips (hq#444 body, "The full apply").

Acceptance

• The draft PR is open before the switch flips, with the diff above and the regenerated managed/settings.json. git diff --stat against main shows three files, 8 insertions and 3 deletions.
• bin/generate --check prints generated files are current. bash tests/run.sh passes every case, the three new ones included. ShellCheck (-S warning, the file list in check.yml) and jq empty on check.yml's JSON list pass. wc -l < rules/org-rules.md is 60 or less. git diff --check is clean. The check workflow is green on the head.
• The PR body says Closes setkernel/agent-plugins#<this issue> and Refs setkernel/hq#209, and gives each check with its exact result.
• Two non-author agent approvals, each submitted after the final head was pushed (setkernel/hq#434).
• Merged with squash on flip day. agent-plugins allows only squash merges (gh api repos/setkernel/agent-plugins: allow_squash_merge true, the other two false). gh pr view shows MERGED afterwards.
• A comment on setkernel/hq#332 says the next console paste carries this line, with a link to the merge commit.

Owner steps (Raghav)

• His code-owner review. agent-plugins' branch protection wants one, and .github/CODEOWNERS:2 names only him. It also dismisses stale reviews, so his review has to come after the final head. Two agent approvals alone leave the PR blocked. Claude Lead never posts an approval from his account.
• Raghav's approve step. His delegation ends at 17:31 UTC on 27 Oct. On any later flip day, this R3 PR needs his approve step again.
• The console paste. After the merge, Raghav pastes managed/settings.json into the Claude org console (README.md:35-36). Until he does, sessions keep the old rules and don't know a refused push is expected. The paste carries the whole file, so it goes with the list on setkernel/hq#332. This issue closes when the PR merges, and hq#332 tracks the paste.

Checked on the draft (a scratch copy of agent-plugins fd67fca, which is main on 27 Oct at 06:04 UTC, with the Merging-line issue's diff applied, on the Mac):

• The diff applies. bin/generate --check printed generated files are current, and bash tests/run.sh printed 775/775 passed (772 before, plus the three new cases).
• With the new line taken out and bin/generate rerun, the three new cases fail (771/775 passed).
• ShellCheck 0.11.0 and jq empty passed. The file is 60 lines, the longest line is 120 characters, and git diff --check is clean.
• Not run: claude plugin validate ., because the plugin doesn't change.

Risk: R3. This is policy text, and the org rules put policy in R3 (rules/org-rules.md:33, fd67fca). It needs two non-author agent approvals on the head commit, green CI and Raghav's code-owner review. Until 17:31 UTC on 27 Oct, his delegation lets Claude Lead make the merge once those are in. After that, R3 needs Raghav's approve step again. Nothing runs differently until the console paste.

Parent: setkernel/hq#209 (the last box). Refs setkernel/hq#445, setkernel/sk-ctl#43, setkernel/hq#394, setkernel/hq#395, setkernel/sk-ctl#64, setkernel/hq#444, setkernel/hq#434, setkernel/hq#332.

— Claude Lead