fix(sdd-execute): set push-to-pull-request-branch protected-files policy to fallback-to-issue

[norrietaylor]

Follow-up to #319 (CodeRabbit finding). create-pull-request sets protected-files: policy: fallback-to-issue, but push-to-pull-request-branch relied on gh-aw's unset-policy push default — so a /revise that must touch a protected file the PR already changed could silently drop the edit instead of pushing the branch + opening a review issue (ADR 0001 hand-off). Mirror create-pull-request across all 3 execute tiers.

Prompt/config-only; recompiled locks (contract check passes, 0 compile errors). After merge: retag v0.3.0.

🤖 Generated with Claude Code

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 23450a92-4efc-412e-86ef-5f9196d4a50c

📥 Commits

Reviewing files that changed from the base of the PR and between cd22320 and 90405c1.

📒 Files selected for processing (6)

• .github/workflows/sdd-execute-haiku.lock.yml
• .github/workflows/sdd-execute-haiku.md
• .github/workflows/sdd-execute-opus.lock.yml
• .github/workflows/sdd-execute-opus.md
• .github/workflows/sdd-execute-sonnet.lock.yml
• .github/workflows/sdd-execute-sonnet.md

---

📝 Walkthrough

Summary by CodeRabbit

• Chores
  • Updated GitHub Actions workflow configurations for automated agent execution pipelines, including refined settings for how protected files are handled during pull request operations.

Walkthrough

Three SDD workflow source files (sdd-execute-haiku.md, sdd-execute-opus.md, sdd-execute-sonnet.md) each add policy: fallback-to-issue under push-to-pull-request-branch.protected-files, with comment updates. The three corresponding compiled .lock.yml files are regenerated with new heredoc marker IDs and updated safe-output config payloads.

Changes

SDD Workflow Protected-Files Policy and Lock Regeneration

Layer / File(s)	Summary
Add fallback-to-issue policy in workflow source files .github/workflows/sdd-execute-haiku.md, .github/workflows/sdd-execute-opus.md, .github/workflows/sdd-execute-sonnet.md	Each file's push-to-pull-request-branch safe-output block gains an explicit protected-files.policy: fallback-to-issue (previously implicit/default), with inline comments updated to describe the fallback behavior when a protected file must be edited.
Regenerated lock files .github/workflows/sdd-execute-haiku.lock.yml, .github/workflows/sdd-execute-opus.lock.yml, .github/workflows/sdd-execute-sonnet.lock.yml	All three compiled lock files are regenerated: gh-aw-metadata hashes, GH_AW_PROMPT_* heredoc marker IDs around <safe-output-tools> and prompt stream boundaries, GH_AW_SAFE_OUTPUTS_CONFIG_* heredoc IDs with the updated safeoutputs/config.json payload, GH_AW_MCP_CONFIG_* gateway heredoc IDs, and the GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG inlined JSON string are all refreshed to match the new source configuration.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Possibly related PRs

• norrietaylor/spectacles#53: Wires push-to-pull-request-branch support for /revise and its commit behavior, directly related to the safe-output configuration block being modified here.
• norrietaylor/spectacles#319: Also sets protected-files.policy/protected_files_policy to fallback-to-issue in push-to-pull-request-branch and regenerates the same workflow lock/prompt/config artifacts.

Poem

🐇 A policy set, no more default guess,
fallback-to-issue when files need a press,
lock files reborn with new marker IDs,
haiku, opus, sonnet all updated with ease.
The rabbit hops on, configs all blessed! 🌟

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and specifically describes the main change: setting the protected-files policy to fallback-to-issue for push-to-pull-request-branch across the execute tiers.
Description check	✅ Passed	The description is directly related to the changeset, explaining the context from PR #319, the bug being fixed, and the solution applied across all three execute tiers.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/execute-push-protected-policy

---

_{Comment @coderabbitai help to get the list of available commands.}