@nanocollective/roster 0.1.0-alpha.19 → 0.1.0-alpha.20

package/dist/cli.js

@@ -1460,6 +1460,9 @@ var PLAN_LIMIT = /upgrade to github (pro|team)|make this repository public/i;
 function isPlanLimit(error) {
   return PLAN_LIMIT.test(error ?? "");
 }
+function gateOn(org) {
+  return org.review_gate === true || org.review_gate === "on";
+}
 function judgeGate(r) {
   if (isPlanLimit(r.error)) {
     return {
@@ -1793,7 +1796,8 @@ function buildPlan(ws, org, handle, opts, parseYaml) {
     labels,
     secrets,
     warnings,
-    skipGate: opts.reviewGate === false,
+    // Off unless org.yaml turns it on. See gateOn.
+    skipGate: opts.reviewGate === false || !gateOn(org),
     commits
   };
 }
@@ -3753,6 +3757,16 @@ async function checkOrgOnline(ws, org) {
   return out;
 }
 async function checkReviewGates(ws, org, composer) {
+  if (!gateOn(org)) {
+    return [
+      {
+        scope: "workspace",
+        id: "review-gate",
+        level: "ok",
+        title: "review gate is off: staff are told to leave merging to you, and GitHub does not enforce it"
+      }
+    ];
+  }
   const repos = new Set(
     (org.repos ?? []).filter((r) => r.role === "product").map((r) => `${org.org}/${r.name}`)
   );
@@ -4937,6 +4951,11 @@ agent:
   #   options:
   #     provider: openrouter
 
+# Have GitHub require a reviewed pull request before anything merges into a product repo.
+# Off by default: on private repos GitHub only enforces it on a paid plan. Staff are told to
+# leave merging to you either way. See docs/security.md.
+review_gate: false
+
 defaults:
   model: ${o.model}
   timeout_minutes: 90

package/docs/doctor-codes.md

@@ -39,7 +39,7 @@ ran at all.
 | `workflows` | No workflow in the repo is failing run after run. Reported for the ops repo here, and for each brain repo under its staff member. |
 | `workflows.failing` | **fail.** A workflow that is not one of roster's callers has failed at least its last two runs, with the date it started. Skipped and cancelled runs are stepped over. This is the canary that goes red and stays red, because whatever would have said so broke with it. |
 | `budget` | Trailing 30-day spend against a `budget` in `org.yaml`, for the org here and for a staff member under their name. A warning when it is past, never a failure, and only read when a budget is set. Cost comes from each run's record, so it says how many runs it could price. See [cost](cost.md#budgets). |
-| `review-gate` | One per product repo. **fail** when nothing requires a pull request on its default branch, or a staff App can bypass the rule; a warning when a PR is required with no approving review, when the repo is private on GitHub Free (which can't enforce the rule), or when the settings cannot be read. See [security](security.md#the-review-gate). |
+| `review-gate` | Off unless `review_gate: true` is in `org.yaml`, and then a note that it is off. When on, one per product repo. **fail** when nothing requires a pull request on its default branch, or a staff App can bypass the rule; a warning when a PR is required with no approving review, when the repo is private on GitHub Free (which can't enforce the rule), or when the settings cannot be read. See [security](security.md#the-review-gate). |
 | `upgrade` | The tenant is in sync with the framework. |
 | `upgrade.stale` | Generated files are behind. `roster upgrade --apply`. |
 | `upgrade.owned` | **fail.** A framework-owned file was edited in the tenant. Move the change upstream or the next upgrade reverts it. |

package/docs/org-yaml.md

@@ -39,6 +39,7 @@ defaults:
   mention_timeout_minutes: 90
 
 budget: 300
+review_gate: true
 
 staff:
   - { handle: cto, dir: technology, name: Chief Technology Officer, schedule: "0 7 * * 1-5" }
@@ -61,6 +62,7 @@ repos:
 | `ops_dir` | no | Directory name of the ops repo in the runner checkout. Defaults to `roster-ops`. |
 | `experiment_private` | no | Whether the fact that this org is agent-run is itself private. Read by the guardrails fragment. |
 | `budget` | no | USD over any trailing 30 days, for the whole org. See [below](#budget). |
+| `review_gate` | no | `true` to have GitHub require a reviewed pull request before anything merges into a product repo. Off by default, because private repos need a paid plan for it. See [security](security.md#the-review-gate). |
 
 ### `human` and `humans`
 

package/docs/security.md

@@ -55,21 +55,24 @@ The rule: **the default branch of every product repo requires a pull request wit
 approving review, and no staff App is on the list of who may bypass it.** A ruleset or classic
 branch protection both count.
 
-`roster doctor` reads it for every `role: product` repo in `org.yaml` and every repo a staff
+**It is off unless you turn it on**, with `review_gate: true` in `org.yaml`. Without it, staff
+are told to leave merging to you, and on Pip they always have, but GitHub does not stop them.
+Most orgs keep product repos private on the Free plan, where GitHub cannot enforce the rule.
+
+With it on, `roster doctor` reads it for every `role: product` repo in `org.yaml` and every repo a staff
 member `works_in`, as `review-gate`. It fails when nothing requires a PR or a staff App can
 bypass the rule, and warns when a PR is required with no approval, since then whoever opened
 it can merge it.
 
-`roster hire --apply` adds a ruleset named `roster: review before merge` to each product repo
+With it on, `roster hire --apply` adds a ruleset named `roster: review before merge` to each product repo
 that does not already require an approving review, and leaves anything stricter alone. Pass
 `--no-review-gate` to skip it. The ruleset lets repository admins bypass it only by merging a
 pull request, so your own merge is still the approval (GitHub will not let you approve your
 own PR) and an App, which is never an admin, cannot merge at all.
 
 **On GitHub Free, private repos can't have this rule.** GitHub only enforces rulesets and
-branch protection on private repos for paid plans, so `review-gate` warns instead. Make the
-product repo public or move the org to GitHub Team. Until then, staff can merge their own pull
-requests.
+branch protection on private repos for paid plans. To use the gate there, make the product repo
+public or move the org to GitHub Team.
 
 To set it by hand: repo **Settings -> Rules -> Rulesets -> New branch ruleset**, target the
 default branch, tick **Require a pull request before merging** with one required approval, and

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nanocollective/roster",
-  "version": "0.1.0-alpha.19",
+  "version": "0.1.0-alpha.20",
   "description": "An agent-run org, powered by GitHub. Scaffold AI staff members whose brain is a repo.",
   "type": "module",
   "bin": {