branch-discipline

Apply a branch discipline workflow that treats main as read-only and routes every change through a branch and pull request. The agent pulls latest main, creates a branch, pushes it, opens a PR, and waits for CI and user review before merge.

Fix CI failures on the same branch and push again so the PR updates and CI re-runs. Never merge with failing CI, bypass branch protection, or push the fix directly to main to unblock things.

Use a worktree when the checkout is shared by multiple agents or a human working alongside you, to avoid cross-contamination. In an isolated checkout, such as a worker agent with its own clone, a plain branch is sufficient.

Yes, every change including one-line fixes, config edits, docs, and dependency upgrades goes through a branch and PR. The workflow explicitly rejects the rationalization that small changes can skip the process.

Each branch must contain only one concern, so a spec for feature X goes on a dedicated branch like docs/feature-x. Mixing documents into unrelated feature branches confuses reviewers and can require destructive force-push cleanup.

It may not apply in early prototype stages or small repos with no automated tests and mostly config rather than code, where branch and PR overhead adds friction without safety. When in doubt, ask the user.