[dmccoystephenson]

Summary

• A standalone paragraph is added to the generated template's Phase 8, directly after the do-not-auto-merge path list, stating the precedence rule as a rule: a protected-path match is a property of the change, a run-level merge pre-authorization (--allow-merge, a merge allow-list, a standing "you may merge" instruction) is a property of the run, and the path match wins when they disagree. The PR is left open with a comment naming the matched path, and only an authorization given with sight of that path (the existing codeowner exception) clears the hold.
• A matching Edge cases entry is added, so the rule is reachable from both directions as do-not-auto-merge path rules conflict with a run-level --allow-merge grant, with no stated precedence #123 requests.
• Before this change the only statement of the rule sat inside the "Standing merge authorization does not satisfy the anchor gate" paragraph, which is framed around the UNVERIFIED-anchor case (added by PR Harden Phase 8's rebase fence and state the merge-authorization precedence rule #119 for Phase 8 doesn't state whether operator merge pre-authorization outranks a required-but-unrunnable anchor #118). A cycle handling a protected-path match on an anchor-green PR had no instruction to find there, and the triage note on A blanket merge pre-authorization does not resolve a do-not-auto-merge path match, and Phase 8 does not say so #142 records a headless run resolving that state from judgment alone.

No placeholder is added, no Step is added or removed, and no phase is renumbered, so the Step 4 table and README's "What it does" list are unchanged.

Closes #123
Closes #142

Research grounding

No RESEARCH.md finding applies directly. The do-not-auto-merge list itself came from §2 (PR #30), but which authorization outranks it is a safety-precedence question, not an empirical one, and no finding in RESEARCH.md addresses it. For that reason no Implementations entry is added.

Doc sync check

• Every {{placeholder}} added or changed has a corresponding Step 4 substitution-table row (none added; check_docs.py passes)

Test plan

• python3 scripts/check_docs.py: "Doc consistency check passed."
• python3 -m unittest discover -s tests: Ran 42 tests, OK
• UNVERIFIED (behavioral): no /create-dev-loop validation run was performed. This PR came from a headless Gardener dispatch whose sandbox has no second repo to generate against, and Step 6 would create a GitHub repo, which is outside what the dispatch may do ([self-audit] The repo's own validation anchor is structurally unrunnable in a headless dispatch, so template changes can never merge autonomously #109). None of the five checklist items in CLAUDE.md's "Testing changes" were exercised. Per the loop's rules this PR is handed to a human rather than auto-merged. The change is two prose sentences and adds no placeholders or fences, so a reviewer can check it by reading it.

Retrofit

Per CLAUDE.md's "Promoting a rule into the template": the skills that reported this gap in #123 and #142 likely need a retrofit pass. They are asn1c-dev-loop, foodspoilage-dev-loop, repo-quality-dashboard-dev-loop, parpt-dev-loop, kreatures-dev-loop, barony-dev-loop, medieval-cookery-dev-loop, primordial-rise-shared-dev-loop, primordial-rise-backend-dev-loop, and the kfe-*-dev-loop skills split from kfe-docs-dev-loop. More generally, every generated skill that predates this change and carries a do-not-auto-merge list needs it.

gardener interface

Steps 3, 5, and 6 are not touched; this is not a breaking change for gardener. It does settle how a generated skill treats gardener's --allow-merge grant when a protected path matches: the grant does not clear the hold.

This PR description was drafted during a Gardener session (https://github.com/Stephenson-Software/gardener).

🤖 Generated with Claude Code

---

drafted by Claude on behalf of Daniel Stephenson

[dmccoystephenson]

Self-review rubric (one intrinsic pass, anchored on the CI run on head and on check_docs.py output):

• Scope: PASS. One file (create-dev-loop.md), +3 lines. Both hunks cover do-not-auto-merge path rules conflict with a run-level --allow-merge grant, with no stated precedence #123/A blanket merge pre-authorization does not resolve a do-not-auto-merge path match, and Phase 8 does not say so #142: the Phase 8 rule and its Edge cases mirror.
• Tests-new: N/A. No executable code changed.
• Tests-fix: N/A as an executable experiment. The change is template prose and no unit test reaches it. Regression evidence would come from a /create-dev-loop run, which was not performed (see Behavioral validation).
• Sibling structure: PASS. The new Edge cases line follows the **<condition>:** <instruction> form of its neighbours, and the Phase 8 paragraph follows the bold-lead-sentence form of the paragraphs around it.
• Sibling renames: N/A. Nothing renamed.
• Docs (Phase 7 table pass performed here): PASS. Rows checked: README.md (Step list unchanged; Phase 8 precedence is not described there), RESEARCH.md (no finding cited as implemented; no Implementations entry owed), CONTRIBUTING.md, SECURITY.md (its statement that the universal baseline "holds regardless of what the target repo says" is consistent with, and not weakened by, the new rule), .github/PULL_REQUEST_TEMPLATE.md, .github/ISSUE_TEMPLATE/*.md, scripts/README.md, CLAUDE.md. No row needed a correction.
• Issue resolution: PASS. do-not-auto-merge path rules conflict with a run-level --allow-merge grant, with no stated precedence #123 asks for an explicit precedence rule plus an Edge cases entry, and both were added. A blanket merge pre-authorization does not resolve a do-not-auto-merge path match, and Phase 8 does not say so #142 asks for a standalone Phase 8 sentence covering a blanket pre-authorization meeting a path match, plus an Edge cases entry, and both were added.
• CI: PASS. doc-consistency passed on the PR head.
• Placeholder parity: PASS. No new placeholder. check_docs.py prints "Doc consistency check passed."
• README Step parity: PASS. No Step changed.
• Fence escaping: PASS. No fence added.
• Phase numbering: PASS. No phase renumbered. The new Edge cases entry cites "Phase 8", which is correct.
• Version comments: N/A. Header untouched.
• Research grounding: PASS. The PR body states that no finding applies directly and gives the reason.
• No back-ported specifics: PASS, with a note. --allow-merge is named only as an example of a dispatch-time flag. The template already names gardener tend as its example of a headless dispatch.
• gardener interface: PASS. Steps 3, 5, and 6 are untouched, and the body says so.
• Retrofit note: PASS. The body names the reporting skills.
• Behavioral validation: FAIL. This is UNVERIFIED: no /create-dev-loop run was possible in this headless dispatch ([self-audit] The repo's own validation anchor is structurally unrunnable in a headless dispatch, so template changes can never merge autonomously #109). So this PR is not auto-merged.

Judgment call flagged for the human reviewer:

• CLAUDE.md says merge authorization "belongs in gardener, never here". This change was judged to be on the template side of that line. It governs how a generated skill interprets a grant it has been handed, not when or whether gardener issues one, and the existing "Standing merge authorization does not satisfy the anchor gate" paragraph (PR Harden Phase 8's rebase fence and state the merge-authorization precedence rule #119) already sets that precedent. A reviewer who reads the boundary differently may prefer the rule to live in gardener's dispatch preamble.
• create-dev-loop.md:489 — "The grant can widen how much merges without review" could be tightened in review if the phrasing reads awkwardly.

Summary: this is a small, mechanically clean prose change, handed off as UNVERIFIED because the repo's behavioral anchor cannot run headlessly.

This review comment was drafted during a Gardener session (https://github.com/Stephenson-Software/gardener).

---

drafted by Claude on behalf of Daniel Stephenson

[dmccoystephenson]

Triage skip reasons for this cycle (Phase 1 auditability):

• A Stage A documentation sweep of README.md, SECURITY.md, CONTRIBUTING.md, RESEARCH.md (Implementations entries against merged PRs Broaden Step 2 to find the PR template under every accepted spelling #108–Name broken-link docs by repo-relative path, not basename #169), .github/PULL_REQUEST_TEMPLATE.md, .github/ISSUE_TEMPLATE/*.md, and scripts/README.md was run against create-dev-loop.md first. It found no drift, so it produced no PR.
• Stage B was not selected. tests/test_check_docs.py (42 tests) already has fixture cases for every function in scripts/check_docs.py, including their failure branches, after PRs Add check_placeholders cases for conditionals, section bounds, and trimming #155–Add extract_template_body edge cases and main() tests #159.
• CLAUDE.md still links gardener under the old dmccoystephenson owner #106 was deferred because its fix is an edit to CLAUDE.md, which is agent-loaded config and harness-blocked for this loop. It is left for a human.
• [self-audit] The repo's own validation anchor is structurally unrunnable in a headless dispatch, so template changes can never merge autonomously #109 was deferred because it is a process question about this repo's validation anchor and needs an owner decision.
• Unverified: whether an in-checkout .worktrees/ survives gardener's refresh (git clean -fdx) #114 was deferred because confirming it requires observing gardener's refresh behavior, which this sandbox cannot do.
• The >50-deleted-lines do-not-auto-merge heuristic misfires on extraction refactors, test migrations, and generated artifacts #124–Phase 3: classifiers also reject shell-variable loops and $-anchored sed, not just $(...) #165 (the remaining template-rule / process items: The >50-deleted-lines do-not-auto-merge heuristic misfires on extraction refactors, test migrations, and generated artifacts #124, Negated closing keywords in PR bodies still auto-close issues #125, grep is not on tend's allow-list, so generated validation checklists and verify-by-removal assertions cannot run headlessly #127, An approval-gated CI run reads as 'no checks reported', which is neither the green nor the red Phases 1 and 4 branch on #129, A restricted fetch refspec also blocks checking out an existing remote branch, with an error that reads as 'branch does not exist' #130, Test the mechanism, not the stochastic outcome, when a mock cannot exercise an acceptance criterion #131, Phase 4 verifies backward 'Closes #N' references but not forward 'a follow-up issue has been filed' promises #133, Phase 5's read-only 'gh api .../pulls/<n>/comments --jq' is refused by the attribution hook as an unsigned post #135, Tests-fix has no path for a scope-blind anchor, only for an anchor that cannot run #140, Upstream COMMANDS.md is trusted as source, but it can disagree with the command class it documents #141, Stage A sweeps fix the instances named, not the class — and a prose grep is treated as a CI-strength anchor #143–Phase 5: compress the review wait for a single autonomous run with no reviewer assigned or requested #150, Dispatched runs can load an installed skill copy older than the rules merged in the skill's repo #158, Phase 3: classifiers also reject shell-variable loops and $-anchored sed, not just $(...) #165) were deferred because each is a separate template-behavior change. Each would end in the same UNVERIFIED hand-off ([self-audit] The repo's own validation anchor is structurally unrunnable in a headless dispatch, so template changes can never merge autonomously #109), so batching them into this PR would only enlarge an unmergeable diff. do-not-auto-merge path rules conflict with a run-level --allow-merge grant, with no stated precedence #123 and A blanket merge pre-authorization does not resolve a do-not-auto-merge path match, and Phase 8 does not say so #142 were picked because they are one precedence gap reported twice.

This comment was drafted during a Gardener session (https://github.com/Stephenson-Software/gardener).

---

drafted by Claude on behalf of Daniel Stephenson

[Copilot]

🟡 Changes recommended

The protected-path guidance leaves authorization ambiguous for resumed PRs and conflicts on whether a path-specific authorization permits merging under a blanket grant.

2 open issues

• Tie blanket grants to explicit authorization of the matched path · New
• Allow hand-off exceptions for path-specific codeowner authorization · New

What changed in this PR

This PR clarifies the generated dev-loop skill’s merge rules for protected paths, addressing the ambiguity reported in #123 and #142.

Changes:

• Adds a standalone Phase 8 rule stating that protected-path holds take precedence over pre-diff blanket merge grants.
• Adds a matching Edge cases entry directing the loop to leave the PR open and identify the protected path.
• Leaves placeholders, Steps, phase numbering, and installation paths unchanged.

File	Description
create-dev-loop.md	Adds protected-path authorization precedence guidance to Phase 8 and Edge cases.

_{Review effort: Balanced}