[kixelated]

Plans the follow-ups of kixelated/quest#229.

Changes

• New land-rules [XS]:
  • quest land resolve refuses a ruleset update rule.
  • The README says the pinned check app must be installed on the repository.
  • The README stops offering GitHub Actions as the push bypass.
• land-adopt resized [S] → [M]:
  • The push bypass is a GitHub App owned by the kixelated account and installed only on this repository.
  • The quest isn't done until a fork PR lands through the gate.
• Helpers epic: land-rules ranks after land-adopt.

Decisions

How should the gate handle a ruleset update rule?

• ✅ Refuse it: drop it from UPHELD. No planned adopter uses it, and the required quest land check already blocks the merge button.
• Uphold it: land only PRs whose auto-merge a bypass actor enabled.
• Accept it only when the gate is the only bypass actor.
• Drop the follow-up.

How do we confirm the GitHub Actions bypass on a user-owned repository?

• ✅ Probe now. A disabled ruleset on kixelated/quest was refused with "Actor GitHub Actions integration must be part of the ruleset source or owner organization". Nothing was created.
• Make it the first step of land-adopt.
• Make it a separate waiting quest.

Where should fork PRs be verified live?

• ✅ In land-adopt, whose done condition is now a landed fork PR.
• A separate quest on a public scratch repository.
• Drop it.

Where does the README note on the installed check app go?

• ✅ With the update fix, in land-rules.
• Fold it into land-adopt.
• Its own [XS] quest.

Which push credential should land-adopt use, given the probe result?

• ✅ A kixelated-owned App installed only on this repository. This was the recommendation; the user chose to go with the recommendations.

quest check and just check pass.

(Written by Claude Opus 5.5)

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-27T17:30:05.564613Z	39b5050	PR opened
🔒 Security Review	✅ Completed 2026-10-27T17:31:24.863848Z	39b5050	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[kixelated]

Automated review by review (OpenAI)

Reviewed commit: 39b5050c86e7c051153c52302a4de5eee3ee6b5a.

No actionable bugs found in this planning-only change. Refusing update is simpler and safer than reconstructing bypass-actor authorization, and making a landed fork PR an adoption completion condition is appropriate given the heads-first push path. The repository-scoped App and base-only credential environment keep the intended privilege boundary explicit.

The previously noted UPHELD.update limitation is now tracked by land-rules, not fixed by this PR; src/cli/land.ts:143 still accepts it. That is an existing deferred issue, not a new finding.

Verification: static GitHub review of all three changed plans, the README setup, and surrounding resolve/fork-push code. No tests, ruleset writes, credential probes, or live fork landing run by me; the adoption test must establish fork push authorization with the actual chosen credential.

[kixelated]

Merge summary for 39b5050:

• Changes:
  • New land-rules [XS]: resolve will refuse ruleset update rules, and the README's gate setup gets fixed.
  • land-adopt is now [M]. Its push bypass is a kixelated-owned App, and it isn't done until a fork PR lands.
• Decisions: the PR body lists them. A disabled probe ruleset on this repository showed that GitHub refuses GitHub Actions as a bypass actor here too.
• Checks:
  • CI passed 4/4.
  • Codex found nothing.
  • The automated review found no bugs.
  • The quest check against origin/main, run with a quest built from the base, passed.

(Written by Claude Opus 5.5)