From eb9781ed6ed1fce85de55211ec65c8c53163be00 Mon Sep 17 00:00:00 2001
From: "anthropic-code-agent[bot]" <242468646+Claude@users.noreply.github.com>
Date: Thu, 2 Jul 2026 14:40:37 +0000
Subject: [PATCH 1/2] Initial plan


From 630577da20b1082852a2c2ac40699ac92e1dbc9c Mon Sep 17 00:00:00 2001
From: "anthropic-code-agent[bot]" <242468646+Claude@users.noreply.github.com>
Date: Thu, 2 Jul 2026 14:42:24 +0000
Subject: [PATCH 2/2] docs: scope direct-push guidance to non-bypass users

Clarify that branch protection blocks direct pushes for non-bypass
users only; admins retaining the bypass (enforce_admins OFF) can still
push directly but should prefer PRs to preserve the required-check gate.

Closes #191

Agent-Logs-Url: https://github.com/BigSimmo/Database/sessions/50ee625e-b9ae-4c5d-8c25-e6182e321abe

Co-authored-by: BigSimmo <87357024+BigSimmo@users.noreply.github.com>
---
 docs/process-hardening.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/process-hardening.md b/docs/process-hardening.md
index d41ba98b21..842265f386 100644
--- a/docs/process-hardening.md
+++ b/docs/process-hardening.md
@@ -73,7 +73,7 @@ This document turns the current process review into phased, durable repo practic
 
 - CI is now two parallel PR jobs instead of one serial 6-7 minute job: `verify` (runtime alignment, edge typecheck, CI-safe production readiness, lint, typecheck, unit tests with coverage gate, build — ~3 min) and `ui-smoke` (Chromium Playwright smoke against its own dev server — ~4.5 min). Wall-clock PR feedback drops to the slower of the two, and a flaky smoke rerun no longer repeats lint/typecheck/tests/build.
 - The deployment boot smoke and full browser matrix remain gated to `main`, `release/*`, manual dispatch, and the weekly schedule — they are deliberately not PR gates.
-- **Required-check debt (the reason #131/#133 merged red): `main` has no branch protection.** The intended configuration is a ruleset/branch protection on `main` requiring `verify`, `ui-smoke`, and `Gitleaks`, with "require branches up to date" left OFF (strict up-to-dateness would force constant rebases across the many concurrent agent branches). Until that is applied in repo settings, CI remains advisory. Note: once applied, direct pushes to `main` are blocked; all work must land via PR.
+- **Required-check debt (the reason #131/#133 merged red): `main` has no branch protection.** The intended configuration is a ruleset/branch protection on `main` requiring `verify`, `ui-smoke`, and `Gitleaks`, with "require branches up to date" left OFF (strict up-to-dateness would force constant rebases across the many concurrent agent branches). Until that is applied in repo settings, CI remains advisory. Note: once applied, direct pushes to `main` are blocked for non-bypass users; repository admins retaining the bypass (`enforce_admins` OFF) can still push directly but should prefer PRs to preserve the required-check gate.
 - If `ui-smoke` proves flaky as a required check, demote it to advisory (remove from required contexts) rather than tolerating red merges — the deterministic `verify` gate stays required regardless.
 
 ## CSS cascade layering (2026-07-02)