Introduce session-scoped commit authorization by alexander-yevsyukov · Pull Request #38 · SpineEventEngine/agents

alexander-yevsyukov · 2026-07-23T17:47:24Z

What

guidelines/safety-rules.md adds Session-granted as a third commit-authorization form: it persists across turns, covers only the operations it names, is scoped to the repository and branch it was given on, never covers history-rewriting or publishing operations (git push --force, git rebase, git tag, gh release create, gh pr merge), and suspends on surprise (a secret-scan hit, unexpected working-tree changes, unclear commit scope).
The advice to pin Bash(git commit:*) in permissions.ask is replaced with its opposite, and the pin is removed from this repo's .claude/settings.json. In Claude Code, an ask rule outranks every allow rule from every settings file, so the pin forced a confirmation dialog on each commit — even under a valid grant — and made autonomous sessions impossible.
The rule's echoes in AGENTS.md, CLAUDE.md, and guidelines/quick-reference-card.md are updated to match; claude/commands/version-bumped.md drops its stale reference to the removed settings gate.
.claude/settings.json also redirects plansDirectory to .agents/tasks (separate commit).

Why

Per-turn-only authorization made long autonomous sessions (loops) impossible: a grant given in one prompt was void on the next turn by design, and the harness-side ask pin forced dialogs that no chat authorization can suppress. A session grant makes "you may commit throughout this session" effective across turns while keeping hard limits, per-action confirmation for history-rewriting operations, and the secret-scan PreToolUse gate as the unconditional backstop.

Review notes

Pre-PR checklist ran: version gate not applicable (no root version.gradle.kts), no build applicable (Markdown + JSON only), review-docs returned APPROVE WITH CHANGES with no Must-fix items.
Known follow-ups left for review discussion: a widow-line reflow in safety-rules.md, converging the six near-synonyms for per-prompt authorization on one term, restoring the git prefix in the excluded-ops bullet, and re-adding "section" after the ## Commit authorization mention in version-bumped.md.

🤖 Generated with Claude Code

Per-turn-only authorization made autonomous loop sessions impossible: the safety rules voided any grant on the next turn, and the checked-in "permissions.ask" pin on "git commit" forced a confirmation dialog that no "allow" rule can override ("ask" outranks "allow" in Claude Code). The pin itself was dropped in the previous commit; this one updates the policy texts: - safety-rules.md: add "Session-granted" as a third authorization form: it persists across turns, covers only the operations it names, is scoped to repo and branch, never covers history-rewriting or publishing operations, and suspends on surprise. Replace the advice to pin "git commit" in "permissions.ask" with its opposite. - AGENTS.md, quick-reference-card.md, CLAUDE.md: update the echoes of the rule. - claude/commands/version-bumped.md: drop the stale reference to the settings gate. The secret-scan PreToolUse gate remains the hard backstop. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Copilot

Pull request overview

Introduces a third, session-scoped form of commit authorization in the safety guidelines, and updates repo docs/settings to remove a Claude Code permission pin that prevented autonomous commits under a valid grant.

Changes:

Document “Session-granted” commit authorization, including scope/limits and suspension conditions.
Update quick-reference and repo guidance (AGENTS.md/CLAUDE.md) to reflect the new authorization model.
Remove the Bash(git commit:*)permissions.ask pin from .claude/settings.json and repoint plansDirectory to .agents/tasks.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
`guidelines/safety-rules.md`	Adds session-granted authorization rules and updates guidance about Claude Code permission prompting.
`guidelines/quick-reference-card.md`	Updates the authorization summary to include session grants and exclude CLAUDE/memory sources.
`claude/commands/version-bumped.md`	Updates wording around commit authorization expectations for recovery behavior.
`CLAUDE.md`	Aligns repo-level guidance with the updated authorization model and references safety rules.
`AGENTS.md`	Updates the repo’s “commit and history safety” summary to include session grants and limits.
`.claude/settings.json`	Removes the `permissions.ask` pin for `git commit` and redirects `plansDirectory` to `.agents/tasks`.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

- Restore the "git " prefix in the excluded-operations bullet. - Add the missing comma after "In Claude Code". - Reword the loop-prompt note to drop the ambiguous "current-prompt authorization" phrasing (also fixes the widow line). - Converge on "per-prompt request" in safety-rules.md and AGENTS.md, fixing the non-parallel grammar in the latter. - version-bumped.md: make the recovery sentence a full clause and restore "section" after the heading reference. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit:1c414bdf26

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

- AGENTS.md: a session grant covers only the operations it names, so plain "git push" is grantable; only history rewrites and release operations (force-push, rebase, tag, release, PR merge) always stay per-action. Also list the skill-declared authorization form and reflow the paragraph. - CLAUDE.md: include the skill-declared "## Commit authorization" form in the authorization list. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Copilot

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated 2 comments.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Copilot

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated 3 comments.

Copilot

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated 1 comment.

Keeping plansDirectory = .agents/tasks is the maintainer's deliberate choice: approval artifacts stay visible beside the durable notes they precede. The dual-file convention now keys on lifecycle, not location: task files are committed, frontmatter-carrying, and meaningfully named; plan-mode files are untracked, frontmatter-less, and random-named, and are never staged, committed, or renamed. Task discovery explicitly skips files without status frontmatter. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

- Use code spans and exact command names for operations in the session-grant limits and the AGENTS.md parenthetical. - "add ... to permissions.ask" instead of "pin ... into". - Reflow the session-grant examples so each quoted phrase stays on one line. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Copilot

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated no new comments.

Copilot

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated 1 comment.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Copilot

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (1)

guidelines/safety-rules.md:76

This list item wraps so the last line is just `git push --force`. (a runt/widow-like line), which makes the bullet harder to scan. Reflow so the final command stays on the same line as the preceding clause.

 - It covers only the operations it names: `git commit` does not
imply `git push`, and `git push` does not imply
`git push --force`.

alexander-yevsyukovand others added 2 commits July 23, 2026 18:33

Have Claude plans under .agents/tasks
575e85f

CopilotAI review requested due to automatic review settings July 23, 2026 17:47

Copilotstarted reviewing on behalf of alexander-yevsyukov July 23, 2026 17:47 View session

CopilotAI reviewed Jul 23, 2026
View reviewed changes

Comment threadguidelines/safety-rules.md Outdated
Comment threadguidelines/safety-rules.md Outdated
Comment threadguidelines/safety-rules.md Outdated
Comment threadclaude/commands/version-bumped.md Outdated

alexander-yevsyukovand others added 2 commits July 23, 2026 18:51

Merge remote-tracking branch 'origin/master' into relax-commit-policy
2d4c150

CopilotAI review requested due to automatic review settings July 23, 2026 17:51

Copilotstarted reviewing on behalf of alexander-yevsyukov July 23, 2026 17:52 View session

chatgpt-codex-connectorBot reviewed Jul 23, 2026
View reviewed changes

Comment thread.claude/settings.json
Comment threadAGENTS.md Outdated
Comment threadCLAUDE.md Outdated

CopilotAI reviewed Jul 23, 2026
View reviewed changes

Comment threadAGENTS.md Outdated
Comment threadguidelines/safety-rules.md Outdated

CopilotAI review requested due to automatic review settings July 23, 2026 17:55

Copilotstarted reviewing on behalf of alexander-yevsyukov July 23, 2026 17:55 View session

Use the user-instructed label in the session-grant cross-reference
02c1370
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

CopilotAI reviewed Jul 23, 2026
View reviewed changes

Comment threadguidelines/safety-rules.md Outdated
Comment threadguidelines/safety-rules.md Outdated
Comment threadAGENTS.md Outdated

CopilotAI review requested due to automatic review settings July 23, 2026 17:58

Copilotstarted reviewing on behalf of alexander-yevsyukov July 23, 2026 17:59 View session

CopilotAI reviewed Jul 23, 2026
View reviewed changes

Comment threadguidelines/safety-rules.md

CopilotAI review requested due to automatic review settings July 23, 2026 18:02

Copilotstarted reviewing on behalf of alexander-yevsyukov July 23, 2026 18:03 View session

CopilotAI reviewed Jul 23, 2026
View reviewed changes

CopilotAI review requested due to automatic review settings July 23, 2026 18:04

Copilotstarted reviewing on behalf of alexander-yevsyukov July 23, 2026 18:05 View session

CopilotAI reviewed Jul 23, 2026
View reviewed changes

Comment thread.agents/tasks/README.md Outdated

Add a colon before the plansDirectory snippet
3cf3dd2
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

CopilotAI review requested due to automatic review settings July 23, 2026 18:08

Copilotstarted reviewing on behalf of alexander-yevsyukov July 23, 2026 18:09 View session

alexander-yevsyukov self-assigned this Jul 23, 2026

alexander-yevsyukov requested a review from armiol July 23, 2026 18:10

alexander-yevsyukov added this to v2.0 Jul 23, 2026

alexander-yevsyukov moved this to 🏗 In progress in v2.0 Jul 23, 2026

armiol approved these changes Jul 23, 2026
View reviewed changes

CopilotAI reviewed Jul 23, 2026
View reviewed changes

alexander-yevsyukov merged commit fefe0ed into masterJul 23, 2026
1 check passed

alexander-yevsyukov deleted the relax-commit-policy branch July 23, 2026 18:12

github-project-automationBot moved this from 🏗 In progress to ✅ Done in v2.0 Jul 23, 2026

Uh oh!

Conversation

alexander-yevsyukov commented Jul 23, 2026

What

Why

Review notes

Uh oh!

CopilotAI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

chatgpt-codex-connectorBot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

CopilotAI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

CopilotAI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

CopilotAI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

CopilotAI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

CopilotAI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

CopilotAI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants