docs(agents): record code-owner gate hold for solo maintenance

[seonghobae]

Policy record

Document the current organization operating constraint in the central agent entrypoint:

• code-owner review requirements remain disabled while the organization has only one maintainer;
• agents must not add CODEOWNERS-based merge gates or re-enable code-owner requirements until multiple independent maintainers exist;
• this does not remove the existing latest-pusher independent approval, required workflow, security, or unresolved-thread protections.

Scope

Exactly one Markdown file changes: AGENTS.md.

This clean PR supersedes #726, whose branch accumulated unrelated Strix dependency-lock changes. No workflow, dependency, branch-protection setting, or runtime code is changed by this PR.

[coderabbitai]

Warning

Review limit reached

@seonghobae, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 2 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 49ec5f51-e81f-4af4-8591-9ccb099f2de0

📥 Commits

Reviewing files that changed from the base of the PR and between 3f65dbe and 0ef292d.

📒 Files selected for processing (1)

• AGENTS.md

---

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@opencode-agent Please review exact head 0ef292d6a826dc074824edf85bbb4e1166914868 after #731 and #736 repair the central dependency baseline and current-head checks rerun. This is a one-file policy record only; confirm it does not weaken latest-pusher approval, required workflows, security gates, or unresolved-thread protection. Submit APPROVE only if no blocker remains.

[seonghobae]

@cwl-noema-review Please independently review exact head 0ef292d6a826dc074824edf85bbb4e1166914868 after the central dependency baseline is repaired. Confirm the solo-maintainer CODEOWNERS hold is documentation-only and preserves every other merge protection; submit APPROVE only if no blocker remains.

[seonghobae]

@coderabbitai review

Please independently review exact head 0ef292d6a826dc074824edf85bbb4e1166914868. This is a one-file governance documentation change recording the temporary solo-maintainer CODEOWNERS hold without weakening latest-pusher approval, required workflow, security, or unresolved-thread protections.

[coderabbitai]

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

target='0ef292d6a826dc074824edf85bbb4e1166914868'

printf '%s\n' '== Checked-out commit =='
git rev-parse HEAD
printf '%s\n' '== Requested commit object =='
git rev-parse "${target}^{commit}"
printf '%s\n' '== Commit metadata =='
git show -s --format='%H%nParents: %P%nSubject: %s' "$target"

printf '%s\n' '== Changed files relative to first parent =='
git diff-tree --no-commit-id --name-status -r "$target"

printf '%s\n' '== Exact patch =='
git diff "${target}^" "$target" -- AGENTS.md

printf '%s\n' '== AGENTS.md policy context =='
rg -n -C 8 -i 'CODEOWNERS|code.owner|latest.pusher|independent approval|required workflow|security|unresolved.thread|merge gate' AGENTS.md

Length of output: 3672

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

repo='ContextualWisdomLab/.github'
org='ContextualWisdomLab'

printf '%s\n' '== Repository default branch =='
gh api "repos/${repo}" --jq '.default_branch'

printf '%s\n' '== Repository rulesets =='
gh api "repos/${repo}/rulesets" --paginate \
  --jq '.[] | {id, name, target, enforcement, conditions, rules: [.rules[].type]}' \
  || printf '%s\n' 'Repository rulesets could not be read.'

printf '%s\n' '== Organization rulesets =='
gh api "orgs/${org}/rulesets" --paginate \
  --jq '.[] | {id, name, target, enforcement, conditions, rules: [.rules[].type]}' \
  || printf '%s\n' 'Organization rulesets could not be read.'

printf '%s\n' '== Default-branch protection =='
default_branch="$(gh api "repos/${repo}" --jq '.default_branch')"
gh api "repos/${repo}/branches/${default_branch}/protection" \
  --jq '{
    required_status_checks,
    required_pull_request_reviews,
    required_signatures,
    enforce_admins,
    required_linear_history,
    allow_force_pushes,
    allow_deletions,
    required_conversation_resolution
  }' \
  || printf '%s\n' 'Classic branch protection could not be read or is not configured.'

Length of output: 2034

---

@seonghobae I found one blocker. I cannot approve this commit.

AGENTS.md Lines 8-12 records the CODEOWNERS hold. It does not state that latest-pusher independent approval, required workflows, security gates, and unresolved-thread protection remain required.

Add an explicit preservation statement. For example:

This hold does not remove or weaken latest-pusher independent approval, required workflows,
security gates, or unresolved-thread protection. Those protections remain required.

The commit hash and scope are correct. 0ef292d6a826dc074824edf85bbb4e1166914868 changes only AGENTS.md.

I could not independently verify the effective GitHub protection configuration. The GitHub API returned HTTP 403 for organization rulesets and branch protection. The Markdown-only diff cannot modify those settings.

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.