[kyle-sexton]

No related issue: owner decision Q681 (2026-10-22, confirmed in the poteto session) to remove protected-path blocking until throughput is tuned, and harden later.

Summary

The owner's direction, relayed by GitHub Support and confirmed in this session: "Don't restrict what bots can edit: the hooks, the plugins, the skills, the scripts, the workflows. ... harden it all later as long as there's no external threat." The PR review lanes flag risky changes; the owner approves or rejects at review.

Fix

• docs/conventions/pr-pipeline.yaml: merge.diff-check.high-path-floor: false. The comment above it states the decision and that true restores the floor. floor-paths and floor-script-scopes stay listed, so switching back is one line.
• docs/conventions/pr-pipeline/README.md: the sentence naming this repository's value.
• Changelog fragment under .changes/pr-pipeline/.

Still in force: the non-author verifier verdict, both AI review lanes, ci-status, the post-merge revert breaker, the cost hold (cost-review-required, which applies whatever high-path-floor says), the external-author and provenance holds, the kill switch, and rate and admission caps.

Not changed here: the local babysit lane keeps the rest of its fixed floor (babysit_risk.py HIGH_FLOOR) with the switch false, as the README describes. Removing that needs a code change and is a separate follow-up.

Verification

• The pre-push check-affected.sh passed on the branch.
• CI's config schema check (pr-pipeline.schema.json) runs on the PR.

Related

#8270 (the floor switch), #8835 (floor revisit)

🤖 Generated with Claude Code

[kyle-sexton]

Decision recorded. The owner confirmed (2026-10-22, Q681, "Yes, I agree") the direction to remove protected-path blocking until throughput is tuned and to harden later. The PR review lanes flag risky changes, and the owner approves or rejects at review. Kept: holds on anything not filed or started by the owner, an org member or the org's Apps; cost changes flagged for the owner; intent changes and very high security findings to the owner; rate, capacity and admission caps.

[kyle-sexton]

Superseded by #9280, which cuts the babysit HIGH_FLOOR down to the external-effect paths the owner kept (settings, .gitmodules, CODEOWNERS, package manifests, release and id-token workflows, the trusted-trigger check). Turning high-path-floor off would also switch off that kept set. Closing, as agreed with the session that opened this PR.