Goal and scope
Resolve #1015 by adopting the change policy proposed in #1109, adjusted to how Phlo is actually run. The maintainer decided this on 30 October 2026: Phlo has one developer and no second reviewer, and approvals are often given to coding agents outside the PR. Non-goals: no ruleset, environment, or release-control changes.
Change map and risk
Docs only:
docs/contributing/change-policy-proposal.md→change-policy.md, rewritten as adopted policy. The material-change definition, PR record, squash-body expectation, and lockstep release-qualification rule are carried over from the proposal.- New on top of the proposal: approval given to an agent outside GitHub counts and need not be repeated in the PR. Approval to do the work doesn't cover publishing, deploying, releasing, or shared-settings changes. Automated reviews supply evidence, not accountability. The ruleset stays at zero required approvals, because a sole author cannot approve their own PR.
security/release-candidate-ruleset.json:required_approving_review_count1 → 0 andrequire_last_push_approvaltrue → false, so the tracked copy matches the live ruleset and the policy. It isn't applied automatically; recreating the ruleset from the old file would have blocked every merge.CONTRIBUTING.md,.github/CODEOWNERSheader, and the PR template now point at the adopted policy. The template no longer asks for a recorded approver in the PR.
Verification
-
python3 scripts/check_markdown_links.py→ all tracked Markdown links resolve (the policy now uses relative links, so the checker covers them). -
pytest tests/tooling/test_pr_validation.py tests/tooling/test_release_candidate_gate.py→ 195 passed. -
codespellon the changed files → clean. -
Not applicable: documentation and policy change.
Recovery and maintainer decisions
Decision recorded: single-maintainer model adopted by @iamgp. Revisit if another contributor with write access joins. A revert restores the proposal text.
Activity
303
phlo-agent[bot]8h agoReview of docs: adopt single-maintainer change policy at 6776395
Docs-only, and the content matches the maintainer decision recorded in #1015 on 30 October 2026: material-change criteria, PR record, squash-body expectation, lockstep release qualification, approval given to an agent outside GitHub, and zero required approvals. No test, migration, or release-note coverage is expected for this change. Two non-blocking findings.
1. The adopted policy contradicts the tracked ruleset definition (medium).
docs/contributing/change-policy.md (GitHub enforcement, lines 91–97) states that the PR validation and merge queue ruleset requires zero approvals, and explains that a required approval would block every merge for a sole author. The repository's tracked copy of that same ruleset, security/release-candidate-ruleset.json (lines 22–29), sets required_approving_review_count: 1 and require_last_push_approval: true. docs/contributing/ci.md (lines 147–152) warns that importing the file can change review requirements, but nothing reconciles the file with the now-adopted policy.
The file is unchanged by this PR, but this PR is what makes zero approvals binding, so the only machine-readable definition of the named ruleset now encodes the configuration the policy forbids. A maintainer who recreates the ruleset from that file, or applies more than the build-concurrency setting while following ci.md, enables an approval gate that halts all merges. Reconciling the two parameters to 0/false in the tracked file, or marking it illustrative in the policy, would close the gap.
2. Internal links in the new policy escape the link checker (low).
Repository files are linked as https://github.com/phlohouse/phlo/blob/main/... in docs/contributing/change-policy.md (lines 15–20, 57, 80–83, 106). scripts/check_markdown_links.py (lines 43–46) returns early for any target with a scheme, so the verification recorded in the PR body does not cover those links, and a later rename — exactly what this PR does to the proposal file — would break them silently. They also send readers on tags or non-main branches to main. Sibling pages (CONTRIBUTING.md, verification-matrix.md, ci.md) use relative links, which the checker covers and the docs build resolves.
Checked, no problem found: no remaining references to the deleted docs/contributing/change-policy-proposal.md in CONTRIBUTING.md, .github/CODEOWNERS, the PR template, ci.md, verification-matrix.md, process-settings.md, engineering-map.md, docs/index.md, AGENTS.md, .agents/skills/, or the phlo-github skills. Every entry in .github/CODEOWNERS names @iamgp, as the policy claims, and docs/contributing/meta.json does not reference the deleted page.
Not verified: PR checks were still running when I reviewed (mergeable_state: unstable, no commit statuses yet), so I did not see the documentation build lane finish. The live ruleset settings can only be confirmed from an administrator view of repository settings. Note that #1015's original outcome asked for independent review and a second owner for release and security surfaces; this policy records the maintainer's contrary decision, so the issue closes on that decision rather than those criteria.
github.comment.notice: falsein.github/pr-lens.ymlturns this note off