Repository navigation
[Phase 3 gate] Human sign-off: final PR-limit caps + exempt list + rollout scope #566
Description
Why this gate exists
Epic #505 carries an explicit prerequisite:
Human sign-off on the final numeric limit, the exempt-actor list, and the rollout scope before Story 3 flips enforcement on a live repo.
Phase 2 is now delivered and inert — it changes no behavior yet:
- [Phase 2a] Encode the PR-limit config as a machine-readable single source of truth #507 (closed, PR feat: implement issue #507 — [Phase 2a] Encode the PR-limit config as a machine-readable single source of truth #562) added the machine-readable config
standards/pr-limits.json(provisional numbers per ADR §6). - [Phase 2b] Source-side admission gate: pre-open open-PR-count guard + bats #561 (closed, PR feat: implement issue #561 — [Phase 2b] Source-side admission gate: pre-open open-PR-count guard + bats #565) added the source-side admission-gate library
scripts/lib/pr-limit-gate.sh+ tests. It is a reusable library; nothing calls it yet.
Story 3 (#508) is the apply path that actually enforces the cap — i.e. wires the guard into the live PR-creating automation. Per ADR §2–§3 there is no native GitHub surface to toggle, so enforcement means calling plg_admission_gate from the PR-creation engine, which lives in petry-projects/.github-private (the dev-lead / initiative-driver reusables) — a different repo than this one's dev-lead can author. So #508 is not a clean in-repo auto-cascade story; it needs human decisions and a deliberate cross-repo apply.
Decisions required before #508 proceeds
- Final caps — accept the provisional ADR §6 numbers now in
standards/pr-limits.json(org-wide automation cap 18; per-source dev-lead 9 / claude 4 / initiative-driver 5) or adjust. - Exempt actors / labels — confirm the list:
dependabot[bot],OrganizationAdmin,@petry-projects/org-leads,dependabot-automerge-petry, + thesecuritylabel. - Rollout scope — pilot on a single repo first (epic default) vs. org-wide.
- Apply mechanism — how the cross-repo wiring into
.github-privateis authored and landed.
How to release
Close this issue once the above are decided (and the config updated to the signed-off numbers). #508 is blocked_by this gate, so closing it lets the initiative-driver release #508 with an ADR-faithful, signed-off scope.
Opened to honor the epic #505 human-sign-off prerequisite and to pause the otherwise-automatic cascade at the enforcement step. The in-flight auto-released #508 dev-lead run was cancelled because it would have churned on the pre-ADR premise (applying via scripts/apply-repo-settings.sh, which the ADR ruled out) and cannot perform the cross-repo wiring.
Activity
don-petry commentedon Jul 1, 2026
Dev-Lead: this is a human sign-off gate — pausing, not implementing
An automated dev-lead run was assigned to this issue, but #566 is by design a human sign-off gate, not a code task. I am deliberately not self-approving it, because doing so would fabricate the very human decision this gate exists to require. Concretely, I have made no config change and have not closed this issue.
Why an agent must not auto-release this
standards/pr-limits.jsonstill carries"status": "provisional"with a note that every value is pending human sign-off.docs/initiatives/pull-request-limits-adr.md§6) marks all caps and the exempt list as "PROPOSALS, NOT FINAL … deferred to human sign-off."Flipping the config to signed-off and closing this would let #508 (
blocked_bythis gate) release with a sign-off that no human actually gave. That is the opposite of what the gate is for.The four decisions a human needs to make
standards/pr-limits.json(org-wide automation cap 18; per-source dev-lead 9 / claude 4 / initiative-driver 5), or adjust.dependabot[bot],OrganizationAdmin,@petry-projects/org-leads,dependabot-automerge-petry, + thesecuritylabel.petry-projects/.github-private(callingplg_admission_gatefrom the PR-creation engine) is authored and landed. Note this repo'sdev-leadcannot author into.github-private.How to release (unchanged from the issue)
A human with authority over epic #505: once you've decided the above, either (a) update
standards/pr-limits.jsonto the signed-off numbers and set its status to signed-off, then close this issue, or (b) tell me the decisions and I'll prepare the config edit for your review (I still will not close the gate on my own authority).No files were modified by this run. The gate remains open.
test(pr-limits): strictly assert status=signed-off
feat(pr-limits): sign off cap at 50 as a single org-wide soft ceiling (…
don-petry commentedon Jul 1, 2026
Sign-off recorded (2026-07-01)
standards/pr-limits.jsonvia PR feat(pr-limits): sign off cap at 50 as a single org-wide soft ceiling #570 (status: signed-off).dependabot[bot],OrganizationAdmin,@petry-projects/org-leads,dependabot-automerge-petry, +securitylabel).This gate stays open until the .github-private apply (#1003) lands, since #508 is blocked on it. Closing it then will release the downstream doc (#509) + measure (#510) stories.
don-petry commentedon Jul 1, 2026
Sign-off complete and the apply path has landed:
Enforcement is now on main in .github-private but activates only once the change promotes through the dev-lead channels (ring0 → stable) via the normal canary-rollout soak — it's a no-op today (41/50 counted) so riding the standard soak is safe. Unblocking #508.