Generated from corpus/lines/software/units/sw.capability.repository-modify-files.yml. Do not edit by hand — run python scripts/generate-corpus-docs.py.

corpus/lines/software/units/sw.capability.repository-modify-files.yml

Title / id: sw.capability.repository-modify-files

id: sw.capability.repository-modify-files
schema_version: corpus-unit.v2
kind: policy
version: 1.0.0
status: active
layer: organization
line: software
depends_on:
- id: org.roles
  version: ^1.0.0
- id: org.tooling-matrix
  version: ^1.0.0
capability_id: repository.modify-files.v1
authority: explicit-delegated-policy
authorized_roles:
- role.implementer
required_bindings:
- active role equals the authoritative workstream active role
- repository target belongs to the authoritative Initiative workstream
- exactly one modify operation
- exact explicit safe repository-relative file paths
permitted_target_kind: repository
permitted_action: modify
forbidden_scope:
- repository control data
- directory-wide or whole-repository scope
- merge
- release
- deploy
- publish
- secrets
- policy changes
- exceptions or overrides
- declared human judgment gates
forbidden_path_prefixes:
- corpus/
- schemas/
- deploy/
- .github/workflows/
- service/conductor/
- secrets/
- credentials/
forbidden_paths:
- AGENTS.md
- docs/software-decisions.md
- docs/authority-model.md
- docs/integration-contract.md
- service/conductor/app.py
- service/conductor/compiler.py
- service/conductor/config.py
- service/conductor/control_plane.py
forbidden_path_markers:
- /.env
- /secrets.
- /secrets/
- /credentials.
- /credentials/
completion_requirements:
- authorization is durably claimed before execution
- a GitHub push event occurs after claim
- the verified commit repository and operation match authorization
- the commit changed-file set exactly equals authorized paths