[roanny]

The round the operator ordered on 2026-11-11 ("fleet autonomy"), commissioned by coabana-workspace: this repository's scaffolding normalized so its session works without stopping for him. Scaffolding only; no page, script or CI job changed. Shape follows the pilot, Coabana/looker-mcp-server#391.

What changed, per step

1. .claude/settings.json deny floor. Group A names the env files that hold secrets instead of ./.env.*, so a .env.example would be readable and committable; group B's shell readers follow the same names. Group C no longer denies deleting a remote branch; every force and + form, git reset --hard, git clean -f and gh pr merge stay. Lists still sorted, JSON valid.
2. Authorization text. .claude/rules/git-hygiene.md: the § Round authorization paragraph replaced by § Authorization, the authorization shared block copied verbatim between its markers, followed by § This repository (landing convention, gate commands, the acts that stay the operator's here: a landing that changes what a visitor sees, since Pages publishes it and the public site is this repository's PRO, and renaming or removing the Search Console file). "A session never pushes to main on its own" re-titled "Only a green head reaches main" (the admin-bypass rule itself is unchanged). "No remote-ref deletion" became "Remote branches": the session deletes its own landed or superseded branches. The block's hash is registered in .claude/.shared-blocks.sha256 in the file's format. .claude/CLAUDE.md's index line for git-hygiene.md follows.
3. release block. Not applicable: this repository has no /release and does not carry the block.
4. Deny-list narration. § The deny floor of git-hygiene.md, which enumerated the deny list, is now one sentence pointing at the file. No !-line, card-per-act or sandbox-rerun prose existed elsewhere (AGENTS.md, .claude/CLAUDE.md, README.md checked).
5. Claude workflows. Not applicable: there is no claude-code-review.yml or claude.yml (the standard gives sites no automated review).

Deny patterns

Removed:

• Read(./.env.*)
• Bash(* */.env.* *), Bash(* */.env.*), Bash(* .env.* *), Bash(* .env.*)
• Bash(git push --delete*), Bash(git push -d*), Bash(git push * --delete*), Bash(git push * -d*), Bash(git * push --delete*), Bash(git * push -d*), Bash(git * push * --delete*), Bash(git * push * -d*)

Added:

• Read(./.env.local), Read(./.env.*.local)
• Bash(* */.env.local *), Bash(* */.env.local), Bash(* */.env.*.local *), Bash(* */.env.*.local)
• Bash(* .env.local *), Bash(* .env.local), Bash(* .env.*.local *), Bash(* .env.*.local)

Kept: Read(./.env) and the .env shell readers, every other group A–C pattern.

Not changed, and why

• No PRO deny by name. This repository's PRO is the public site, reached by git push origin <branch>:main. That same command lands the scaffolding and Dependabot heads the session lands on its own, and no pattern can tell a head that changes the pages from one that does not; a deny on it would stop reversible work (constitution clause 13). The guard stays the written rule in § This repository, with the rulesets and Validate as the floor.
• No other secret env names. .gitignore names none and the tree has no env file; the site has no secrets.
• Dates in git-hygiene.md (the Dependabot standing authorization of 2026-09-23) left as they were; outside this round's scope.
• AGENTS.md's sentence "a change a visitor would see never lands without the operator's word" kept: it is this repository's PRO rule, consistent with the remainder.

For the owning session to verify

• Validate green on this head (shared blocks: rules-discipline, markdown-docs, authorization all ok locally).
• That § This repository says what the operator wants about landings: non-visible heads (.github/, .claude/) land on the session's own; a visible change waits in the queue for his word.
• The session's memory landing-needs-explicit-word asks for a card per landing; under the shared block his acts are queued and presented once. Reconcile it in that session (memory is not writable from this run).

🤖 Generated with Claude Code