Document GitHub enforcement ruleset for Agent-Analysis verification (Sprint 1)

[Lvvphole]

Sprint 1 — GitHub Merge Enforcement (Epic 1)

Sprint goal: convert the existing local verification harness into a GitHub-enforceable PR gate without changing core runtime authority rules.

Context

The agent-analysis-verification workflow already exists and is merged to main (commit 0974d8b). It runs on PRs to main, installs backend/requirements-dev.txt, runs python -m pytest -q, and runs git diff --check, exposing the stable required-check job name agent-analysis-verification.

The remaining Sprint 1 gap was documentation so the advisory check can be made a required, blocking gate. This PR is docs-only.

Changes

• docs/github_enforcement.md (new) — required branch ruleset for main: require PR before merge, require the agent-analysis-verification status check, require branch up to date, require conversation resolution, restrict deletions, block force pushes, empty bypass list. Explicitly notes that CI does not fake a harness PASS (no self-certification).
• README.md — new "GitHub enforcement" section stating the check is advisory until required, that merge stays human-controlled, and linking the ruleset doc.

Verification

256 passed, 1 warning in 3.20s      # cd backend && python -m pytest -q
diff-check-clean                     # git diff --check (exit 0)

Guardrails honored

• No merge / deploy / force-pass endpoint added; no auto-merge / auto-deploy behavior.
• No existing gate weakened; no backend code touched.
• No out-of-scope work (no Postgres, sandbox, async workers, auth, object storage, live providers).
• Merge remains gated and human-controlled.

Notes

• The merged workflow file is Agent-Analysis-Verification.yml (filename case differs from the original handoff's agent-analysis-verification.yml); the GitHub required-check identifier is the job name agent-analysis-verification, which is correct. Left untouched to keep the PR minimal.
• Artifact upload (PBI 1.4) intentionally deferred: no harness CLI yet emits a verifier_report.json in CI, and faking one would violate the no-self-certification rule.

🤖 Generated with Claude Code

---

Generated by Claude Code

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 386a3bb2c4

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Pin required check to the GitHub Actions source

When adding this required status check, also document the expected source as the GitHub Actions app rather than leaving the ruleset at "any source". GitHub rulesets allow write-scoped users or integrations to set commit statuses when any source is accepted, so a write-capable actor could post a passing agent-analysis-verification status for the PR head without this workflow passing, defeating the no-self-certification gate the doc is meant to enforce.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Require bypass protection for classic branch rules

Because this section presents classic branch protection as an equivalent setup path, it needs the classic-only Do not allow bypassing the above settings option as well. Classic branch protection defaults let admins and custom bypass roles ignore required checks unless that option is enabled, so someone following the Branches path can still merge with a pending or failing agent-analysis-verification check despite the later "no actor may bypass" claim.

Useful? React with 👍 / 👎.