Protect the workflows the agent shouldn't be allowed to touch

Produce a path-specific CODEOWNERS file and a Path → Rule → Reason table for Tallyline, plus the three branch-protection changes on main without which none of those owners would ever be asked to review.

Today at Tallyline

Yesterday you wrote Patchbot a CLAUDE.md that forbids loosening checks. It's a request, not a control: Patchbot runs with permission prompts switched off, and nothing in the repository refuses the change if it ignores the file. Dana wants proof that the lint incident can't happen again by any route, and Marcus wants it without putting a reviewer on every PR. You've pulled the repository's control files, the branch-protection settings for main, and the commit that started it.

The prompt

Paste this into a new chat in Claude or ChatGPT, then paste the starter files below it.

Act as a repository administrator who just noticed an agent "fixed" a failing lint check by loosening the rule instead of touching the code -- a near-miss that means every protected workflow needs a second look before something bigger slips through the same way.

Context: I'll paste in my repository's file tree (or a rough description of it) and my current CODEOWNERS / branch-protection config, if any.

Do the following, in order:
1. Identify the files and workflows an agent should never be allowed to rewrite just to make a build pass -- security workflows, deployment definitions, shared infrastructure modules, generated artifacts, sensitive configuration.
2. For each one, propose a specific branch-protection rule or CODEOWNERS entry that enforces it.
3. Flag any of those paths that are currently unprotected today, based on what I gave you.

Constraints:
- Only flag a path as unprotected if I actually showed you evidence of that -- don't assume based on typical setups.
- Prefer the smallest rule that closes the gap over a blanket "require review on everything" rule that would create review fatigue.

Output format: a CODEOWNERS-file snippet plus a short table of Path → Rule → Reason.

Starter files

# Code owners for tallyline/tallyline.
# Added 2025-06 when branch protection went on for the SOC 2 audit.
# @tallyline/eng is every engineer (31 people, incl. samkim-tl).
# TODO(sk): split by team once there are teams.

* @tallyline/eng

CLAUDE.md
CODEOWNERS
pyproject.toml                       # ruff + pytest config for billing-api
.patchbot/task-prompt.md             # prepended to every Patchbot run
.github/dependabot.yml
.github/workflows/ci.yml
.github/workflows/deploy.yml
.github/workflows/patchbot.yml
infra/scripts/deploy.sh
infra/terraform/ecs_billing.tf
infra/terraform/iam_patchbot.tf
infra/terraform/rds.tf
migrations/env.py
migrations/versions/                 # 46 revisions
services/billing-api/app/
services/billing-api/tests/
services/pdf-renderer/src/
tools/tally_tools/server.py
web/src/
web/src/api/generated/               # OpenAPI client, rebuilt by make api-client

{
  "required_status_checks": {
    "strict": false,
    "contexts": ["lint", "unit"]
  },
  "enforce_admins": { "enabled": false },
  "required_pull_request_reviews": {
    "required_approving_review_count": 1,
    "require_code_owner_reviews": false,
    "dismiss_stale_reviews": false,
    "require_last_push_approval": false,
    "bypass_pull_request_allowances": {
      "users": [{ "login": "samkim-tl", "type": "User" }],
      "teams": [],
      "apps": []
    }
  },
  "restrictions": null,
  "required_linear_history": { "enabled": true },
  "allow_force_pushes": { "enabled": false },
  "allow_deletions": { "enabled": false }
}

commit 7c41e9a2d0b5f1e8c3a4b6d9e0f1a2b3c4d5e6f7
Author: Sam Kim <sam.kim@tallyline.io>
Date:   Thu Sep 17 10:42:17 2026 +0000

    chore: fix ruff failures (#412)

 pyproject.toml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pyproject.toml b/pyproject.toml
index 3f1c2aa..9be04d1 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -1,9 +1,9 @@
 [tool.ruff]
 line-length = 120
 target-version = "py312"

 [tool.ruff.lint]
 select = ["E", "F", "I", "UP", "B"]
-ignore = ["E501"]
+ignore = ["E501", "E711", "B006"]

 [tool.ruff.lint.per-file-ignores]

The lab

1. Open a fresh chat in Claude or ChatGPT. Paste the Day 3 prompt exactly as written, then the four starter files below it, each under its file name. The trimmed file list is your file tree.
2. Before you read its CODEOWNERS snippet, check whether it noticed the snippet can't work yet. Find require_code_owner_reviews and bypass_pull_request_allowances in the protection export. If the answer proposes owners without changing both, it has written a file GitHub will never consult for Patchbot.
3. Check the 'unprotected today' flags against the evidence. Every path in the trimmed list is unprotected in practice, because the only owner is a 31-person team that includes the account Patchbot acts as. Strike any flag that relies on something not shown, such as an assumed admin list or a ruleset you didn't paste.
4. Push back on review fatigue. Ordinary app code (services/*/app, web/src) should stay under the default owner. The generated client needs a CI drift check, not a human. If the snippet puts platform or security on everything, cut it back to the control-plane paths.
5. Fill in real owners. Create the teams the snippet needs (for example @tallyline/platform for Marcus and @tallyline/security for Dana), give them write access, and give every security-owned path a second owner, because Dana is a team of one and a vacation would block every merge.
6. Write the final artifact: the CODEOWNERS file, the Path → Rule → Reason table, and three lines of branch-protection changes for Marcus to apply. Keep the '*' line first: in CODEOWNERS the last matching pattern wins, so every specific rule has to come after it.

You're done when

• Your branch-protection changes turn on require_code_owner_reviews, dismiss_stale_reviews and require_last_push_approval, and remove samkim-tl from the bypass list.
• pyproject.toml, .github/workflows/, CODEOWNERS, CLAUDE.md and .patchbot/, infra/, tools/tally_tools/ and migrations/ each have a named owner that isn't @tallyline/eng.
• Application code still falls through to the default owner, so most PRs need no extra reviewer.
• Every row in your Path → Rule → Reason table cites a line from the starter files.
• No security-owned path depends on Dana alone.

Your turn

Run 'gh api repos/OWNER/REPO/branches/main/protection' on your own repo and paste the output with your CODEOWNERS file and a trimmed file list. Check require_code_owner_reviews and the bypass list before you write a single owner line.

Stretch

Rewrite the main-branch protection as a GitHub repository ruleset in JSON, with code owner review, last-push approval and an empty bypass list. Then decide whether Tallyline's org admins belong in the ruleset's bypass actors, and write the one-sentence reason Dana will file as SOC 2 evidence.

Why it's built this way

The handbook is explicit: do not allow the agent to rewrite enterprise guardrails simply to make a build pass. The point of naming these files is that the control becomes a named, testable rule instead of a hope.