@ericrisco/rsc 3.0.2 → 3.0.4

package/README.md

@@ -70,20 +70,41 @@ rsc 3.0 fixes all four, by default, with no new commands to learn:
 
 | | What happens | Turn it off |
 | --- | --- | --- |
-| **Main is closed where it matters** | In a project that is complex or in production, the agent never commits on the default branch. It opens a branch on its own (`feat/…`, `fix/…`) and finishes with a pull request. In a project of scripts or research it works on `main`, because a branch there is only ceremony. | Say **«unlock main»**, or `rsc main unlock` |
+| **You decide where each change goes** | Before every change that writes code, the agent asks: a new branch, or straight on `main`? It never opens a branch on its own. In a project that is complex or in production (CI, a deployment, several people), a commit on `main` is refused, and the agent asks whether to open a branch or unlock `main`. | Say **«unlock main»**, or `rsc main unlock` |
 | **One workspace per agent** | If another assistant session is working in the same folder, new work goes to a worktree under `.worktrees/<branch>/`. It stays inside the project, is never committed, and is removed once that branch is merged. | `rsc isolation off` |
 | **The agent picks the method** | A simple change takes Fast-Track (one document, proof for every task). Something big or complex takes the spec-driven chain. The agent decides and says why. You still approve *what* gets built: the spec and the clarifications, then step by step or autopilot. | Ask for the other lane |
 | **Knowledge reaches everyone** | `01-TOOLS/` and `02-DOCS/` travel through one exchange branch, `rsc/knowledge`. They go up when your turn ends and come down into whatever branch each person is on. They reach `main` inside your normal pull requests. | `rsc knowledge-sync off` |
 
+**Commit, push and pull request without a prompt each time.** A harness installed from scratch lets
+the agent run `git commit`, `git push` and `gh pr create` without asking, because those are the steps
+that close every lane. A force-push still asks. The guards still decide: a commit on a closed `main` is
+refused whatever the permission says. It is a project decision, saved as `gitPermissions` in
+`.rsc.json`. A clone gets the same setting. A project adopted before this is left as it was until
+someone runs `rsc git-permissions on`.
+
+| Assistant | Where it goes |
+| --- | --- |
+| Claude Code | `.claude/settings.json` → `permissions.allow` (force-push under `ask`). Claude Code applies it once the folder is trusted. |
+| Codex | `.codex/rules/rsc-git.rules` (`prefix_rule`; force-push → `prompt`). Loaded when the project is trusted. |
+| Gemini | `.gemini/settings.json` → `tools.allowed` |
+| OpenCode | `opencode.json` → `permission.bash` (force-push → `ask`) |
+| Cursor | Not covered: its CLI matches only the first word, so allowing a push would allow every git command. |
+
+```bash
+rsc git-permissions status   # decided or not, and wired per assistant
+rsc git-permissions off      # ask again for commit, push and PR (saved in .rsc.json)
+rsc git-permissions on       # turn it on, also for a project adopted before
+```
+
 **How does it know a project is "complex or in production"?** There are two layers. A hook counts
 what anyone can check: a CI setup, a deployment file (`Dockerfile`, `vercel.json`, `fly.toml`…) or
 at least two people in the last 50 commits. If any of those is there, a commit on the default branch
-is refused before it runs. If none is, the agent decides change by change, using the same rule from
-its skills. If the hook gets it wrong and the project really is simple, «unlock main» opens it for
+is refused before it runs, and the agent asks you whether to open a branch or unlock it. If none is,
+`main` is open, and the agent still asks before each change whether you want a branch. If the hook gets it wrong and the project really is simple, «unlock main» opens it for
 the project. That decision is saved in `.rsc.json`, so the whole team gets it.
 
-Every refusal says how to carry on: which branch to open, how to create the worktree, or how to
-unlock. An agent is never left stuck. The rules only see what the **agent** runs; a person
+Every refusal says how to carry on, and the choice between a branch and unlocking goes back to you.
+An agent is never left stuck. The rules only see what the **agent** runs; a person
 committing in their own terminal is never touched.
 
 **The first session after upgrading** does three things, once:
@@ -446,6 +467,8 @@ new    · clones main    has it all after the first message
   only its `01-TOOLS/` and `02-DOCS/` part, under a `docs(auto) … [skip ci]` message.
 - **Before each message**, what teammates sent is brought into **the branch you are on**, and you are
   told in one line. Only the knowledge folders are touched.
+  A branch you open later catches up on its first message: everything on `rsc/knowledge` since it
+  left `main` comes down, including what you wrote yourself on another branch.
 - **It reaches `main` the normal way.** Your feature branch now carries the team's knowledge, so it
   arrives in `main` inside the pull request you were going to open anyway. There is no extra pull
   request from `rsc/knowledge`, and nobody has to merge it.

package/manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "3.0.2",
+  "version": "3.0.4",
   "counts": {
     "skills": 270,
     "agents": 33,
@@ -1911,7 +1911,7 @@
     },
     {
       "id": "ftd",
-      "description": "Use for ordinary authorised change — the default lane once the decisor has ruled out a question and not selected the chain. Keeps one feature document per feature in 02-DOCS holding intent, scope, checklist, evidence and next step, checks tasks off only against observed proof, and branches when the work writes code. NOT the ten-phase chain (that is `sdd`), NOT the classification itself (that is the decisor in `suggest`), NOT a request for information, which writes nothing.",
+      "description": "Use for ordinary authorised change — the default lane once the decisor has ruled out a question and not selected the chain. Keeps one feature document per feature in 02-DOCS holding intent, scope, checklist, evidence and next step, checks tasks off only against observed proof, and asks whether to branch before the work writes code. NOT the ten-phase chain (that is `sdd`), NOT the classification itself (that is the decisor in `suggest`), NOT a request for information, which writes nothing.",
       "tags": [
         "ftd",
         "lane",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ericrisco/rsc",
-  "version": "3.0.2",
+  "version": "3.0.4",
   "description": "A guided harness builder that turns your goal into a minimal, verified AI-agent setup using strict best practices.",
   "type": "module",
   "bin": {

package/scripts/install-apply.js

@@ -24,6 +24,7 @@ import {
 } from '../targets/memory.js';
 import { wireUpdate, unwireUpdate, updateManagedPaths, updateArtifactsPresent } from '../targets/update-wiring.js';
 import { wireKnowledge, unwireKnowledge, knowledgeManagedPaths, knowledgeArtifactsPresent } from '../targets/knowledge-wiring.js';
+import { wireGitPermissions, unwireGitPermissions, gitPermissionsPath } from '../targets/git-permissions.js';
 
 const ROOT = join(dirname(fileURLToPath(import.meta.url)), '..');
 const CLI_VERSION = JSON.parse(readFileSync(join(ROOT, 'package.json'), 'utf8')).version;
@@ -104,6 +105,7 @@ export function managedPathsForInstall({ skillIds, agentIds = [], target, home,
   if (policy?.memory !== false) out.push(...memoryManagedPaths(target, cwd));
   out.push(...updateManagedPaths(target, cwd));
   out.push(...knowledgeManagedPaths(target, cwd));
+  if (gitPermissionsPath(target, cwd)) out.push(gitPermissionsPath(target, cwd)); // backed up before it is merged into
   if (targetHasAgents(target)) {
     const state = readState(paths.stateFile);
     const explicit = [...new Set([...(state.explicitAgents || readManifest(cwd)?.agents || []), ...agentIds])];
@@ -196,7 +198,7 @@ export function hydrateLocalDecisions(cwd, manifest) {
 // into codex on a machine that already had claude is adding, not replacing. Union, sorted
 // where order carries no meaning, so the file stays diffable and a merge conflict stays
 // readable.
-export function recordInManifest({ cwd, target, skillIds, agentIds = [], catalogVersion = CLI_VERSION, dropTarget, onboarding }) {
+export function recordInManifest({ cwd, target, skillIds, agentIds = [], catalogVersion = CLI_VERSION, dropTarget, onboarding, gitPermissions }) {
   const prev = readManifest(cwd) || { targets: [], skills: [], agents: [], ownSkills: [], optOuts: [] };
   const { optOuts, tier } = localDecisions(cwd);
   const union = (a, b) => [...new Set([...(a || []), ...(b || [])])].sort();
@@ -215,6 +217,7 @@ export function recordInManifest({ cwd, target, skillIds, agentIds = [], catalog
     tier: tier ?? prev.tier ?? null,
     optOuts: optOuts ?? projectOptOuts(prev.optOuts),
     memory: prev.memory,
+    gitPermissions: gitPermissions ?? prev.gitPermissions,
     onboarding: onboarding ?? prev.onboarding,
   });
 }
@@ -225,6 +228,11 @@ export async function applyInstall({ skillIds = [], agentIds = [], target, home,
   // declaration is the only thing that knows what the team decided) from a built machine (the
   // local markers are the authority, and a pull must not overwrite them).
   const fromScratch = !existsSync(join(cwd, '.rsc'));
+  // Git permissions are on for a project adopted from scratch (no manifest yet); an older project
+  // keeps what it declared, and absent means "never decided": nothing is added or removed there.
+  const declaredGit = readManifest(cwd)?.gitPermissions;
+  const newProject = !existsSync(join(cwd, '.rsc.json'));
+  const gitPermissions = newProject ? true : declaredGit;
   const paths = targetPaths(target, home, cwd);
   const plan = planInstall({ skillIds, target, home, cwd, hooks: policy?.alwaysOn !== false });
   // What this pass prunes, decided BEFORE the backup so the backup holds it: a skill link this
@@ -312,6 +320,8 @@ export async function applyInstall({ skillIds = [], agentIds = [], target, home,
   // the memory, so the memory's policy does not decide it: wired wherever the assistant can run it.
   const knowledgeResult = wireKnowledge(target, cwd);
   state.knowledge = { mode: knowledgeResult.mode, reason: knowledgeResult.reason || null, paths: knowledgeResult.paths };
+  if (gitPermissions === true) state.gitPermissions = wireGitPermissions(target, cwd);
+  else if (gitPermissions === false) { unwireGitPermissions(target, cwd); state.gitPermissions = { mode: 'off' }; }
   const context7OptOut = join(cwd, '.rsc', '.no-context7');
   if (policy?.context7 === false) {
     mkdirSync(dirname(context7OptOut), { recursive: true });
@@ -339,7 +349,7 @@ export async function applyInstall({ skillIds = [], agentIds = [], target, home,
   writeState(paths.stateFile, state);
   mkdirSync(dirname(versionFile(cwd)), { recursive: true });
   writeFileSync(versionFile(cwd), CLI_VERSION + '\n');
-  recordInManifest({ cwd, target, skillIds, agentIds, onboarding });
+  recordInManifest({ cwd, target, skillIds, agentIds, onboarding, gitPermissions });
   // The worktree cleanup's trigger. It lives in `.git/hooks/`, which is NOT cloned, so it has to be
   // (re)written by every operation that touches a user's repo — install, sync and repair all land
   // here. Target-agnostic on purpose: it is a git hook, not an assistant hook, and a cleanup that
@@ -613,6 +623,7 @@ export function removeTargetInstall({ target, home, cwd = process.cwd() }) {
   unwireMemory(target, cwd);
   unwireUpdate(target, cwd);
   unwireKnowledge(target, cwd);
+  unwireGitPermissions(target, cwd);
   rmSync(paths.stateFile, { force: true });
   const gitignore = join(cwd, '.gitignore');
   if (existsSync(gitignore)) {
@@ -723,6 +734,7 @@ export async function purge({ home, cwd = process.cwd(), withDocs = false, dryRu
       removed.push(...unwireMemory(target, cwd));
       removed.push(...unwireUpdate(target, cwd));
       removed.push(...unwireKnowledge(target, cwd));
+      removed.push(...unwireGitPermissions(target, cwd));
     } else {
       removed.push(...memoryArtifactsPresent(target, cwd));
       removed.push(...updateArtifactsPresent(target, cwd));

package/scripts/lib/manifest-file.js

@@ -15,7 +15,7 @@ import { join } from 'node:path';
 export const MANIFEST = '.rsc.json';
 export const manifestPath = (cwd = process.cwd()) => join(cwd, MANIFEST);
 
-const KEYS = ['version', 'targets', 'skills', 'agents', 'ownSkills', 'catalogVersion', 'tier', 'optOuts', 'memory', 'onboarding'];
+const KEYS = ['version', 'targets', 'skills', 'agents', 'ownSkills', 'catalogVersion', 'tier', 'optOuts', 'memory', 'gitPermissions', 'onboarding'];
 
 export function readManifest(cwd = process.cwd()) {
   const file = manifestPath(cwd);
@@ -38,6 +38,8 @@ export function readManifest(cwd = process.cwd()) {
     tier: raw.tier ?? null,
     optOuts: raw.optOuts || [],
     memory: raw.memory ?? undefined,
+    // true on a project installed from scratch since 3.0.3; absent on older ones; false once turned off.
+    gitPermissions: typeof raw.gitPermissions === 'boolean' ? raw.gitPermissions : undefined,
     onboarding: raw.onboarding ?? undefined,
   };
 }

package/scripts/rsc.js

@@ -44,7 +44,7 @@ if (['--version', '-v', 'version'].includes(rawArgv[0])) {
 const GLOBAL_VALUE_FLAGS = new Set([
   '--target', '--technical-level', '--accompaniment', '--project-kind', '--goal', '--goal-base64', '--software-scope', '--accept-plan',
 ]);
-const COMMANDS = new Set(['onboard', 'reassess', 'add', 'install', 'consult', 'catalog', 'audit', 'list', 'doctor', 'memory', 'knowledge-sync', 'main', 'isolation', 'sync', 'backups', 'restore', 'upgrade', 'registry', 'worktrees', 'capabilities', 'sello', 'repair', 'uninstall', 'purge']);
+const COMMANDS = new Set(['onboard', 'reassess', 'add', 'install', 'consult', 'catalog', 'audit', 'list', 'doctor', 'memory', 'knowledge-sync', 'git-permissions', 'main', 'isolation', 'sync', 'backups', 'restore', 'upgrade', 'registry', 'worktrees', 'capabilities', 'sello', 'repair', 'uninstall', 'purge']);
 function positionalTokens(input) {
   const out = [];
   for (let i = 0; i < input.length; i++) {
@@ -832,6 +832,36 @@ async function main() {
       process.exitCode = 2;
       return;
     }
+    case 'git-permissions': {
+      // On for a project installed from scratch: the agent commits, pushes and opens the PR without a
+      // prompt each time (a force-push still asks; the guards still apply). A PROJECT decision, saved as
+      // `gitPermissions` in `.rsc.json` so a clone gets the same; an older project starts undecided.
+      const sub = argv[1] || 'status';
+      const root = process.cwd();
+      const { readManifest, writeManifest } = await import('./lib/manifest-file.js');
+      const { gitPermissionsWired, GIT_PERMISSION_TARGETS } = await import('../targets/git-permissions.js');
+      if (sub === 'on' || sub === 'off') {
+        const current = readManifest(root);
+        if (!current) { say('No .rsc.json here: install the harness first (`npx @ericrisco/rsc onboard`).'); process.exitCode = 2; return; }
+        writeManifest(root, { ...current, gitPermissions: sub === 'on' });
+        for (const t of targets) await syncInstalled({ target: t, cwd: root });
+        say(sub === 'on'
+          ? 'rsc git-permissions on: the agent may git commit, git push and gh pr create without asking (a force-push still asks; Cursor is not covered). Commit .rsc.json so the team gets the same decision.'
+          : 'rsc git-permissions off: commit, push and PR ask again, as the assistant does by default. Commit .rsc.json so the team gets the same decision.');
+        return;
+      }
+      if (sub === 'status') {
+        const declared = readManifest(root)?.gitPermissions;
+        return void say(JSON.stringify({
+          declared: declared === undefined ? 'undecided' : declared,
+          wired: Object.fromEntries(targets.filter((t) => GIT_PERMISSION_TARGETS.includes(t)).map((t) => [t, gitPermissionsWired(t, root)])),
+          notCovered: targets.filter((t) => !GIT_PERMISSION_TARGETS.includes(t)),
+        }, null, 2));
+      }
+      say('Use: npx @ericrisco/rsc git-permissions on|off|status');
+      process.exitCode = 2;
+      return;
+    }
     case 'memory': {
       const sub = argv[1] || 'status';
       const root = process.cwd();

package/skills/ftd/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: ftd
-description: "Use for ordinary authorised change — the default lane once the decisor has ruled out a question and not selected the chain. Keeps one feature document per feature in 02-DOCS holding intent, scope, checklist, evidence and next step, checks tasks off only against observed proof, and branches when the work writes code. NOT the ten-phase chain (that is `sdd`), NOT the classification itself (that is the decisor in `suggest`), NOT a request for information, which writes nothing."
+description: "Use for ordinary authorised change — the default lane once the decisor has ruled out a question and not selected the chain. Keeps one feature document per feature in 02-DOCS holding intent, scope, checklist, evidence and next step, checks tasks off only against observed proof, and asks whether to branch before the work writes code. NOT the ten-phase chain (that is `sdd`), NOT the classification itself (that is the decisor in `suggest`), NOT a request for information, which writes nothing."
 tags: [ftd, lane, default, feature-document, evidence]
 recommends: [worktrees, debug, verify]
 profiles: [minimal, core, full]
@@ -53,14 +53,16 @@ the chain: a result asserted without evidence is treated as not done.
 
 ## Isolation
 
-Where the work runs depends on the project, judged change by change (team-safe-default):
+Where the work runs is the person's call, asked change by change — never a branch opened on your own:
 
-- **Complex or in production** (deploys, CI, several people committing, a protected default branch)
-  → a branch, never the default branch. Open it yourself, named by intent, and close it with a pull
-  request. Something unrelated to the current branch gets its own branch from the default one.
-- **Simple** (scripts, research, personal) → the default branch is fine.
+- **Before each change that writes code**, ask in one line: «¿Lo hago en una rama nueva o directamente
+  en `<default branch>`?». A branch is named by intent and closes with a pull request.
+- **Default branch closed for the agent** (rsc refuses the commit there: CI, a deployment or several
+  people committing) → ask: «¿Abro una rama o desbloqueo `<default branch>`?». Unlocking is
+  `rsc main unlock`, a project decision; never run it without that answer.
+- **Docs, wiki or config only** → no question, no branch.
 - **Another session working in this same folder** → a worktree in `.worktrees/<branch>/`, never a
-  branch switch under the other session. rsc tells you when that is the case.
+  branch switch under the other session. Not a question: rsc tells you when that is the case.
 
 A worktree only when another session is there: alone, setting one up costs more than it protects.
 

package/skills/implement/SKILL.md

@@ -45,9 +45,9 @@ back — you do not write feature code anyway.
 4. **Read the register.** Open `02-DOCS/wiki/harness/user-profile.md` and read `technical_level`.
    It picks technical terms or plain words with analogies at each checkpoint (see "Checkpoints"
    below). No profile yet → use analogies, and ask before any irreversible step.
-5. **Confirm isolation.** Implementation happens on a feature branch or worktree, never directly on
-   the default branch. If you are on `main`/`master`, stop and hand to `worktrees` before the first
-   commit.
+5. **Confirm isolation.** On `main`/`master`, stop before the first commit and ask the person: a
+   feature branch, or straight on the default branch (`worktrees`)? Never branch on your own; another
+   session in this folder makes the worktree mandatory.
 6. **Scan the tasks for independence.** Mark which tasks share files/state and which are disjoint.
    Disjoint clusters are candidates for `parallel`; everything else runs in order.
 
@@ -314,7 +314,7 @@ outranks the plan, and the plan outranks your in-the-moment preference.
 - **Unresolved `analyze` findings** (contradiction between constitution ↔ spec ↔ plan ↔ tasks) →
   resolve them before any code; they will only get more expensive after the diff exists.
 - **A task forces a constitution violation** → surface it, stop, kick it back to `analyze`/`plan`.
-- **You're on the default branch** → stop before the first commit; hand to `worktrees`.
+- **You're on the default branch** → stop before the first commit and ask: branch or default branch (`worktrees`).
 - **A test won't go red** (wrong reason — import error, syntax) → fix the test before trusting it.
 - **The combined suite is red after a parallel merge** → do not checkpoint as done; debug with
   `debug` before continuing.

package/skills/suggest/SKILL.md

@@ -32,9 +32,9 @@ Big, or decisions that affect each other → **SDD**: enter the chain; the perso
 clarify, then picks manual or autopilot. Say which and why in one line; switch if asked.
 → `../ftd/SKILL.md` · `../sdd/SKILL.md`.
 
-**Where.** Complex or in production → never commit on the default branch: branch yourself, close with
-a PR. Simple → the default branch. Another session in this checkout → `.worktrees/<branch>`. «desbloquea
-main» = `rsc main unlock`; «no uses worktrees» = `rsc isolation off`.
+**Where.** Before each change that writes code, ask: a branch, or straight on the default branch? Never
+branch on your own. Default branch closed (CI, deploy, team) → ask: a branch, or `rsc main unlock`?
+Another session in this checkout → `.worktrees/<branch>`; «no uses worktrees» = `rsc isolation off`.
 
 Judge the **meaning**, not the wording: the trigger is semantic in any language. A bug fix restoring
 intended behaviour is `debug`. Autopilot consent covers a whole run — advance without re-asking.

package/skills/worktrees/SKILL.md

@@ -27,11 +27,12 @@ constitution → specify → clarify → plan → tasks → analyze → [ worktr
 
 ## The one rule that defines this step
 
-**Never run `implement` on the default branch.** The moment a plan is about to become commits, the
-work belongs in isolation. If `git rev-parse --abbrev-ref HEAD` says `main` or `master`, you stop
-and create the isolated workspace *first* — before the first edit, not after the diff already exists
-on the wrong branch. Recovering a half-built feature off `main` is strictly more expensive than
-branching one command earlier.
+**Never run `implement` on the default branch without asking.** The moment a plan is about to become
+commits, if `git rev-parse --abbrev-ref HEAD` says `main` or `master`, you stop and ask the person
+*first* — «¿rama nueva o directamente en `main`?» — before the first edit, not after the diff already
+exists. Never branch on your own; if rsc refuses commits there (closed default branch), the question
+is «¿abro una rama o desbloqueo `main`?». The one exception is another session in this folder: then
+the worktree is mandatory, not a question.
 
 ## The decision: branch vs. worktree
 

package/targets/branch-guard.mjs

@@ -152,14 +152,16 @@ async function othersHere({ root, here, sessionId, self }) {
 }
 
 async function trunkDenial({ root, here, sessionId, self, trunk, policy }) {
-  // Where the branch goes depends on rule B: alone → this same folder; with company → .worktrees/.
+  // Where a branch would go depends on rule B: alone → this same folder; with company → .worktrees/.
+  // Whether to branch at all is the person's call: the agent asks, it never branches on its own.
   const others = existsSync(join(root, '.rsc', '.no-worktree-isolation')) ? [] : await othersHere({ root, here, sessionId, self });
-  const where = others.length
-    ? 'Another session is working in this folder, so open it as a worktree inside the project: `git worktree add .worktrees/<branch> -b feat/<what-you-are-doing>` and commit inside `.worktrees/<branch>/`'
-    : 'You are the only session here, so stay in this same folder, no worktree: `git switch -c feat/<what-you-are-doing>` (or fix/…, docs/…) and commit there';
-  return `This project keeps its default branch "${trunk}" closed for the agent (it looks complex or in production: ${policy.signals.join(', ')}). ` +
-    `Do this work on a branch instead. ${where}; it reaches "${trunk}" through a pull request. ` +
-    'If this project is actually simple and the person asks to unlock it, run `npx @ericrisco/rsc main unlock` (a project decision, saved in .rsc.json).';
+  const branch = others.length
+    ? '`git worktree add .worktrees/<branch> -b feat/<what>` and commit inside `.worktrees/<branch>/` (another session is working in this folder)'
+    : '`git switch -c feat/<what>` in this same folder, no worktree';
+  return `This project keeps its default branch "${trunk}" closed for the agent (it looks complex or in production: ${policy.signals.join(', ')}), so this commit was not made. ` +
+    `Do not choose for the person: ask them in one line whether to open a branch for this change or to unlock "${trunk}". ` +
+    `Branch → ${branch}; it reaches "${trunk}" through a pull request. ` +
+    'Unlock → only on their explicit answer, `npx @ericrisco/rsc main unlock` (a project decision, saved in .rsc.json), then commit again.';
 }
 
 async function isolationDenial({ root, here, sessionId, self }) {

package/targets/git-permissions.js

@@ -0,0 +1,151 @@
+// Git permissions: on a harness installed from scratch, the agent may `git commit`, `git push` and
+// `gh pr create` without asking — the three steps that close every lane (branch → commit → push →
+// PR). A force-push still asks wherever the assistant can say so. The guards are untouched: a commit
+// on a closed default branch is still denied by branch-guard, whatever the permission says.
+//
+// A PROJECT decision, recorded as `gitPermissions` in `.rsc.json`: true on a brand-new project, absent
+// on one adopted before this existed (nothing changes there until `rsc git-permissions on`), false
+// after `rsc git-permissions off`. Only rsc's own entries are ever added or removed; whatever the
+// person allowed or denied stays exactly as it was.
+//
+// Cursor is left out on purpose: its CLI matches only the first word (`Shell(git)`), so allowing a
+// push there would allow every git and gh command, `reset --hard` and `repo delete` included.
+import { appendFileSync, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { execFileSync } from 'node:child_process';
+import { dirname, isAbsolute, join, relative, resolve, sep } from 'node:path';
+
+export const GIT_PERMISSION_TARGETS = Object.freeze(['claude', 'codex', 'gemini', 'opencode']);
+
+const CLAUDE_ALLOW = ['Bash(git commit *)', 'Bash(git push *)', 'Bash(gh pr create *)'];
+// `ask` beats `allow` in Claude Code, and applies to any subcommand of a chain.
+const CLAUDE_ASK = ['Bash(git push --force*)', 'Bash(git push -f*)', 'Bash(git push * --force*)', 'Bash(git push * -f*)'];
+const GEMINI_ALLOW = ['run_shell_command(git commit)', 'run_shell_command(git push)', 'run_shell_command(gh pr create)'];
+// OpenCode: the last matching rule wins, so the force-push asks come after the allows.
+const OPENCODE_BASH = [
+  ['git commit', 'allow'], ['git commit *', 'allow'], ['git push', 'allow'], ['git push *', 'allow'], ['gh pr create *', 'allow'],
+  ['git push --force*', 'ask'], ['git push -f*', 'ask'], ['git push * --force*', 'ask'], ['git push * -f*', 'ask'],
+];
+const CODEX_RULES = `# rsc-git-permissions:managed — written by rsc; \`rsc git-permissions off\` removes it.
+# Commit, push and open a PR without asking; a force-push still asks (the strictest match wins).
+prefix_rule(pattern = ["git", "commit"], decision = "allow", justification = "rsc: close the lane — commit")
+prefix_rule(pattern = ["git", "push"], decision = "allow", justification = "rsc: close the lane — push the branch")
+prefix_rule(pattern = ["gh", "pr", "create"], decision = "allow", justification = "rsc: close the lane — open the PR")
+prefix_rule(pattern = ["git", "push", ["--force", "-f", "--force-with-lease"]], decision = "prompt", justification = "rsc: a force-push rewrites the remote")
+`;
+
+const FILES = Object.freeze({
+  claude: '.claude/settings.json',
+  codex: '.codex/rules/rsc-git.rules',
+  gemini: '.gemini/settings.json',
+  opencode: 'opencode.json',
+});
+
+const git = (cwd, args) => {
+  try { return execFileSync('git', args, { cwd, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim(); } catch { return null; }
+};
+const rel = (cwd, path) => relative(cwd, path).split(sep).join('/');
+
+/** A file rsc created is kept out of git with the local exclude; one the project tracks is merged into, never hidden. */
+function excludeIfNew(cwd, path) {
+  if (git(cwd, ['rev-parse', '--is-inside-work-tree']) !== 'true') return;
+  if (git(cwd, ['ls-files', '--', rel(cwd, path)])) return;
+  const value = git(cwd, ['rev-parse', '--git-path', 'info/exclude']);
+  if (!value) return;
+  const file = isAbsolute(value) ? value : resolve(cwd, value);
+  const pattern = `/${rel(cwd, path)}`;
+  mkdirSync(dirname(file), { recursive: true });
+  const body = existsSync(file) ? readFileSync(file, 'utf8') : '';
+  if (!body.split('\n').includes(pattern)) appendFileSync(file, `${body && !body.endsWith('\n') ? '\n' : ''}${pattern}\n`);
+}
+
+function readJson(path) {
+  if (!existsSync(path)) return {};
+  try {
+    const value = JSON.parse(readFileSync(path, 'utf8'));
+    return value && typeof value === 'object' && !Array.isArray(value) ? value : null;
+  } catch { return null; }
+}
+
+const writeJson = (path, value) => { mkdirSync(dirname(path), { recursive: true }); writeFileSync(path, `${JSON.stringify(value, null, 2)}\n`); };
+const addAll = (list, items) => [...(Array.isArray(list) ? list : []), ...items.filter((i) => !(list || []).includes(i))];
+const dropAll = (list, items) => (Array.isArray(list) ? list.filter((i) => !items.includes(i)) : list);
+
+export function gitPermissionsPath(target, cwd = process.cwd()) {
+  return FILES[target] ? join(cwd, ...FILES[target].split('/')) : null;
+}
+
+/** Add rsc's entries. `{ mode: 'wired' | 'unsupported' | 'config-invalid', path }`. */
+export function wireGitPermissions(target, cwd = process.cwd()) {
+  const path = gitPermissionsPath(target, cwd);
+  if (!path) return { mode: 'unsupported', path: null };
+  if (target === 'codex') {
+    mkdirSync(dirname(path), { recursive: true });
+    writeFileSync(path, CODEX_RULES);
+    excludeIfNew(cwd, path);
+    return { mode: 'wired', path };
+  }
+  const existed = existsSync(path);
+  const config = readJson(path);
+  if (!config) return { mode: 'config-invalid', path }; // never overwrite a file we cannot read
+  if (target === 'claude') {
+    config.permissions ||= {};
+    config.permissions.allow = addAll(config.permissions.allow, CLAUDE_ALLOW);
+    config.permissions.ask = addAll(config.permissions.ask, CLAUDE_ASK);
+  } else if (target === 'gemini') {
+    config.tools ||= {};
+    config.tools.allowed = addAll(config.tools.allowed, GEMINI_ALLOW);
+  } else if (target === 'opencode') {
+    config.permission ||= {};
+    if (typeof config.permission.bash === 'string') return { mode: 'config-invalid', path }; // a blanket rule is the person's call
+    const bash = config.permission.bash && typeof config.permission.bash === 'object' ? config.permission.bash : {};
+    // Re-inserted so the asks stay after the allows (OpenCode: the last matching rule wins).
+    for (const [pattern] of OPENCODE_BASH) delete bash[pattern];
+    for (const [pattern, action] of OPENCODE_BASH) bash[pattern] = action;
+    config.permission.bash = bash;
+    config.$schema ||= 'https://opencode.ai/config.json';
+  }
+  writeJson(path, config);
+  if (!existed && target !== 'claude') excludeIfNew(cwd, path);
+  return { mode: 'wired', path };
+}
+
+/** Remove rsc's entries, and nothing else. Returns the paths it touched. */
+export function unwireGitPermissions(target, cwd = process.cwd()) {
+  const path = gitPermissionsPath(target, cwd);
+  if (!path || !existsSync(path)) return [];
+  if (target === 'codex') {
+    if (!readFileSync(path, 'utf8').includes('rsc-git-permissions:managed')) return [];
+    rmSync(path, { force: true });
+    return [path];
+  }
+  const config = readJson(path);
+  if (!config) return [];
+  if (target === 'claude' && config.permissions) {
+    config.permissions.allow = dropAll(config.permissions.allow, CLAUDE_ALLOW);
+    config.permissions.ask = dropAll(config.permissions.ask, CLAUDE_ASK);
+    for (const k of ['allow', 'ask']) if (Array.isArray(config.permissions[k]) && !config.permissions[k].length) delete config.permissions[k];
+    if (!Object.keys(config.permissions).length) delete config.permissions;
+  } else if (target === 'gemini' && config.tools) {
+    config.tools.allowed = dropAll(config.tools.allowed, GEMINI_ALLOW);
+    if (Array.isArray(config.tools.allowed) && !config.tools.allowed.length) delete config.tools.allowed;
+    if (!Object.keys(config.tools).length) delete config.tools;
+  } else if (target === 'opencode' && config.permission?.bash && typeof config.permission.bash === 'object') {
+    for (const [pattern, action] of OPENCODE_BASH) if (config.permission.bash[pattern] === action) delete config.permission.bash[pattern];
+    if (!Object.keys(config.permission.bash).length) delete config.permission.bash;
+    if (!Object.keys(config.permission).length) delete config.permission;
+  } else return [];
+  writeJson(path, config);
+  return [path];
+}
+
+/** Whether rsc's entries are all there, for `status` and `doctor`. */
+export function gitPermissionsWired(target, cwd = process.cwd()) {
+  const path = gitPermissionsPath(target, cwd);
+  if (!path || !existsSync(path)) return false;
+  if (target === 'codex') return readFileSync(path, 'utf8').includes('rsc-git-permissions:managed');
+  const config = readJson(path) || {};
+  if (target === 'claude') return CLAUDE_ALLOW.every((r) => config.permissions?.allow?.includes(r));
+  if (target === 'gemini') return GEMINI_ALLOW.every((r) => config.tools?.allowed?.includes(r));
+  if (target === 'opencode') return OPENCODE_BASH.every(([p, a]) => config.permission?.bash?.[p] === a);
+  return false;
+}

package/targets/hook-once.mjs

@@ -97,8 +97,8 @@ Classify this turn before acting, and name the lane in one line.
 - Authorises a change? YOU pick the lane, say it and why: simple -> FTD (one
   feature document, tasks checked off against observed proof); big or
   interlocking decisions -> SDD (spec + clarify approved, then autopilot or not).
-- Complex/production: no commits on the default branch, branch + PR. Simple:
-  default branch. Another session here: .worktrees/<branch>.
+- Code change? Ask first, every time: a branch or the default branch? Never
+  branch on your own. Another session here: .worktrees/<branch>.
 Method: \`ftd\` · chain: \`sdd\` · full decisor in the always-on \`suggest\` body.
 =================================================
 `;

package/targets/knowledge-sync.mjs

@@ -104,7 +104,7 @@ const worktreeBlob = (root, path) => (existsSync(join(root, path)) ? line(root,
 function readState(root) {
   let s = {};
   try { s = JSON.parse(readFileSync(join(root, '.rsc', STATE), 'utf8')); } catch { /* first run */ }
-  return { announced: false, seen: null, queue: [], ours: [], notices: [], lastFetch: 0, snap: null, head: null, ...s };
+  return { announced: false, seenBy: {}, queue: [], ours: [], notices: [], lastFetch: 0, snap: null, head: null, ...s };
 }
 
 function writeState(root, s) {
@@ -375,30 +375,35 @@ export function applyIncoming(root, s) {
   if (!branch || branch === 'HEAD') return said;
   const tip = line(root, ['rev-parse', '--verify', '--quiet', `refs/remotes/origin/${KNOWLEDGE_BRANCH}`]);
   if (!tip) return said;
-  if (!s.seen || !line(root, ['rev-parse', '--verify', '--quiet', `${s.seen}^{commit}`])) {
-    s.seen = line(root, ['merge-base', 'HEAD', tip]) || tip;
+  // Per branch, not per repo: a branch opened from main after the last sync starts behind what
+  // rsc/knowledge already has, and a single "last seen" made it look up to date (2026-10-06). A branch
+  // seen for the first time catches up from where it left rsc/knowledge.
+  s.seenBy = s.seenBy && typeof s.seenBy === 'object' ? s.seenBy : {};
+  let seen = s.seenBy[branch];
+  if (!seen || !line(root, ['rev-parse', '--verify', '--quiet', `${seen}^{commit}`])) {
+    seen = line(root, ['merge-base', 'HEAD', tip]) || tip;
   }
-  if (s.seen === tip) return said;
+  if (seen === tip) { s.seenBy[branch] = tip; return said; }
   const paths = [...KNOWLEDGE];
-  const theirs = git(root, ['rev-list', `${s.seen}..${tip}`, '--', ...paths]).split('\n').filter(Boolean)
-    .filter((c) => !s.ours.includes(c));
-  if (!theirs.length) { s.seen = tip; return said; }
+  const commits = git(root, ['rev-list', `${seen}..${tip}`, '--', ...paths]).split('\n').filter(Boolean);
+  if (!commits.length) { s.seenBy[branch] = tip; return said; }
 
-  const know = zlist(git(root, ['diff', '--name-only', '--no-renames', '-z', s.seen, tip, '--', ...paths]))
+  const know = zlist(git(root, ['diff', '--name-only', '--no-renames', '-z', seen, tip, '--', ...paths]))
     .filter(isKnowledge).slice(0, MAX_FILES);
-  const who = authorsOf(root, theirs);
   const closed = branch === defaultBranch(root) && trunkClosed(root);
+  const touchedBy = (f) => git(root, ['rev-list', `${seen}..${tip}`, '--', f]).split('\n').filter(Boolean);
   const take = [];
   const clash = [];
   for (const f of know) {
     const incoming = blob(root, tip, f);
     const mine = worktreeBlob(root, f);
     if (mine === incoming) continue;
-    const base = blob(root, s.seen, f);
+    const base = blob(root, seen, f);
     // On a closed trunk HEAD lags behind on purpose (what came in was not committed), so only the
     // working tree says whether you touched it (review H2).
     if (mine === base && (closed || blob(root, 'HEAD', f) === base)) take.push(f);
-    else clash.push(f);
+    // Touched here and changed only by your own uploads: your newer version, not a clash.
+    else if (touchedBy(f).some((c) => !s.ours.includes(c))) clash.push(f);
   }
 
   if (take.length) {
@@ -414,12 +419,16 @@ export function applyIncoming(root, s) {
     } else {
       git(root, ['--literal-pathspecs', 'reset', '--quiet', '--', ...take]); // updated, not staged
     }
-    said.push(`📥 Traídos ${theirs.length} cambio(s) de conocimiento de ${who}: ${listed(take)}.`);
+    const from = [...new Set(take.flatMap(touchedBy))];
+    const theirs = from.filter((c) => !s.ours.includes(c));
+    const who = theirs.length ? authorsOf(root, theirs) : 'ti, desde otra rama';
+    said.push(`📥 Traídos ${from.length} cambio(s) de conocimiento de ${who}: ${listed(take)}.`);
   }
   if (clash.length) {
+    const who = authorsOf(root, [...new Set(clash.flatMap(touchedBy))].filter((c) => !s.ours.includes(c)));
     said.push(`${who} cambió ${listed(clash)}, que tú también has tocado. No lo traigo solo: tu versión sigue intacta.`);
   }
-  s.seen = tip;
+  s.seenBy[branch] = tip;
   return said;
 }
 

package/targets/team-safe-start.mjs

@@ -101,8 +101,9 @@ export function teamSafeAnnouncement(root) {
     return `
 ===== rsc 3.0 · equipo seguro por defecto =====
 ACTION: díselo a la persona en pocas líneas, una vez, antes de su petición:
-1. En proyectos complejos o con producción, el agente no trabaja en la rama principal: abre ramas y
-   cierra con PR. En proyectos sencillos trabaja en la principal. Para abrirla: «desbloquea main».
+1. Antes de cada cambio de código, el agente pregunta: ¿rama nueva o directamente en la principal?
+   Nunca abre una rama por su cuenta. Si la principal está cerrada (CI, despliegue o equipo), pregunta
+   si abre una rama o la desbloquea («desbloquea main»).
 2. Si otra sesión de un asistente está trabajando en esta misma carpeta, el trabajo nuevo va a un
    worktree en .worktrees/<rama>/. Para no hacerlo: «no uses worktrees».
 3. El agente elige solo entre FTD (lo sencillo) y SDD (lo grande o complejo) y lo dice; se puede