From 30a26d9dcb62bc2e270400a9112b1319314bf78f Mon Sep 17 00:00:00 2001 From: Diego Rodrigues de Sa e Souza Date: Tue, 1 Sep 2026 03:40:33 -0300 Subject: [PATCH] =?UTF-8?q?docs(agents):=20protected-surface=20merge=20rul?= =?UTF-8?q?e=20=E2=80=94=20operator=20approval=20for=20agent-instruction?= =?UTF-8?q?=20files=20(#12253)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit PR #11770 (2026-09-01) added a CLAUDE.md section instructing every AI agent to clone and execute a third-party setup script; a merge campaign swept it into the release branch with no human risk review (reverted in #12249). Review focus now carries the rule: PRs touching CLAUDE.md / AGENTS.md / GEMINI.md / llm.txt / skills SKILL.md files are HOLD until explicit per-PR operator approval — CI validates code, not instruction-surface intent. --- AGENTS.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/AGENTS.md b/AGENTS.md index 7b0030b56f..cfab8d4ce1 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -494,6 +494,12 @@ Why this matters: fixing bug A while opening bug B is worse than not fixing at a pipeline, and A2A skills. - Do not close a contributor pull request after using its code; merge it through GitHub so the contributor receives credit. +- **Never merge a PR that touches an agent-instruction surface without explicit operator + approval** — `CLAUDE.md`, `AGENTS.md`, `GEMINI.md`, `llm.txt` (+ mirrors) and + `skills/**/SKILL.md` are executed as authority by every AI session; a merged instruction + compromises every future agent run. Check with `gh pr diff --name-only` before any + merge. Incident record: PR #11770 (2026-09-01) told agents to execute a third-party + setup script and was swept in by a merge campaign; reverted in #12249. ---