[danathar-atomic-hive]

Summary

GitHub already requires a pull request to main to be up to date with main, and to pass its tests that way, before it can merge. That setting was turned on on 2026-10-07. The repository's copy of the branch rules, the agent guide and the runbook still said it was off. This pull request brings them in line with what GitHub actually enforces.

Agents read these documents. Before this change, the guide warned them about a failure GitHub now prevents, and didn't tell them what really happens now: after each merge, the other open pull requests are blocked as "behind main" until they are updated. The stored copy was also risky, because re-applying it with the documented command would have turned the setting off again. Nothing changes on GitHub, which already has this setting.

This is option A on #760, which the owner approved.

Refactor

Claims: .github/rulesets/main.json, docs/multi-agent.md ("Staying out of each other's way"), docs/ai-ops-runbook.md ("main is red", first paragraph), docs/branch-protection.md (required_status_checks bullet), and tests/test_multi_agent_doc.py (Ruleset.test_test_is_required_against_the_latest_main).

• .github/rulesets/main.json: strict_required_status_checks_policy is now true, and require_extra_approval_for_unattributed_changes: true is added. Compared field by field with gh api repos/Danathar/atomic-image-builder/rulesets/23966555, the only difference left is required_reviewers: [], which GitHub adds on its side and which is empty. Applying the file with the PUT in docs/branch-protection.md now changes nothing.
• docs/multi-agent.md: the paragraph "Expect two green pull requests to be red together" becomes "Expect a pull request to fall behind main". It says the check is strict and what that costs (each merge makes the other open pull requests stale). It keeps the feat: read back the record every merged agent pull request leaves #632/docs: add .claude/risk-config.json, the risk tiers in a form a program reads #636 incident as the reason strict is on.
• docs/ai-ops-runbook.md: the "main is red" section no longer says two pull requests that each pass alone can fail together on main. The feat: read back the record every merged agent pull request leaves #632/docs: add .claude/risk-config.json, the risk tiers in a form a program reads #636 history stays, dated before strict.
• docs/branch-protection.md: the required_status_checks bullet now says the check is strict. The rule list the doc test compares (BOLD_LEAD) is unchanged.
• tests/test_multi_agent_doc.py: the test now pins True and the new sentence. Its comment says turning strict off means the page has to warn about pair failures again.

.claude/checkpoint.md's 2026-10-03 entry still mentions the "unstrict test check". It is a dated record of that day, so it is left as written.

No overlap with #759's hunks: #759 edits docs/ai-ops-runbook.md at lines 26–36 and 111+, and this pull request edits lines 39–46.

Tier 4 under docs/risk-tiers.md (.github/rulesets/**).

How it was checked

• python3 -m unittest discover -s tests: 2540 tests, OK (50 skipped).
• ruff check . (0.17.0): clean. git diff --check: clean.
• Mutation: setting strict_required_status_checks_policy back to false in the file fails test_test_is_required_against_the_latest_main.
• Live check: gh api repos/Danathar/atomic-image-builder/rules/branches/main reports ruleset 23966555 with strict true.

Closes #760

---

Filed by architect agent (ACMM L6 — full mode)

🤖 Generated with Claude Code

— hive: agent=architect backend=claude model=claude-opus-5-5 effort=high claude=2.1.301