docs(backlog): correct the W0 mechanism and record the protection pass - #91
Merged
Merged
Conversation
W0 is done, and the reason it was filed was wrong. The design claimed cleanroom was protected by a nightowlstudiollc org ruleset, and that creating an equivalent smartwatermelon ruleset was the missing work. Measured: that ruleset is enforcement=disabled and enforces nothing -- repos/nightowlstudiollc/cleanroom/rules/branches/main returns []. Every protected repo in both orgs is protected by classic per-repo branch protection. A ruleset was credited on its name without reading its enforcement field, which is the failure mode this document warns about. The gap was also smaller than reported. The 25 transferred repos were not unprotected -- most carried claude-review / run-review through the transfer intact. The real gap was 9 repos, closed by applying the dotfiles and claude-config exemplar settings per-repo: required check claude-review / run-review, strict, conversation resolution, auto-merge and delete-branch-on-merge on. 33 of 37 non-archived repos now enforce the review check, up from 25. Four repos remain unprotected because they have no review workflow to require; protecting them would enforce nothing. Filed as #89. Org rulesets as the scaling mechanism are filed as #90. W0 leaves the critical path; it now reads W1 -> W2 -> W3, and W2 inherits a largely conformant fleet. Claude-Session: https://claude.ai/code/session_01MM2jf6c7eNN4QMq32GdC5X
twistedmelonman
deleted the
claude/fix-w0-ruleset-correction-1ef43e2a
branch
September 5, 2026 06:45
Closed
4 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
W0 is done — and the reason it was filed was wrong. This corrects the record and documents what was actually applied.
The correction
The design (and #54's outcome comment, and PR #88) claimed
cleanroomwas protected becausenightowlstudiollccarries a "Claude blocking review" org ruleset, and that creating an equivalent onsmartwatermelonwas the missing work. Measured:That ruleset enforces nothing and has since it was created 2026-04-30. Every protected repo in both orgs is protected by classic per-repo branch protection. A ruleset was credited on its name without reading its
enforcementfield — the same label-matching failure this document warns about elsewhere.The gap was smaller than reported
The 25 transferred repos were not unprotected; most carried
claude-review / run-reviewthrough the transfer intact. The real gap was 9 repos, now closed by applying thedotfiles/claude-configexemplar settings per-repo (both exemplars are byte-identical, which made the template unambiguous):claude-review / run-review,strict: truerequired_conversation_resolution: true, 0 approving reviewsenforce_admins: false, force-pushes and deletions offallow_auto_merge: true,delete_branch_on_merge: true33 of 37 non-archived repos now enforce the review check, up from 25. Applied to:
claude-code-workflows-agents,pr-review,repo-template,scripts,dumbify,x-thread-reader,nightowlstudiollc/networth-agent,nightowlstudiollc/.github. Auto-merge additionally enabled on the five that lacked it.Verified by independent re-audit after the writes, not by trusting the write responses.
Deliberately not done
Four repos have no review workflow to require — protecting them would report "protected" while enforcing nothing, which is the false-OK pattern.
smartwatermelon/.githubis already in that state today. Filed as #89.Org rulesets as the scaling mechanism (per-repo does not scale to new repos, and
repo-templatecannot carry protection in the template) filed as #90, with a note to validate against a known-bad case before trusting one.Effect on the plan
W0 leaves the critical path, which now reads W1 → W2 → W3. W2 inherits a largely conformant fleet rather than one it must protect from scratch.
Markdown only; org-migration suite passes (38 tests, unchanged by this diff). Codebase and adversarial reviewers clean.
https://claude.ai/code/session_01MM2jf6c7eNN4QMq32GdC5X