Agent boundaries

Per ADR-0015, agents have full autonomy on a branch and none to merge. This document is the rest of the boundary.

Never, without a human

Boundary	Why
Merge to `main`	The one irreversible step in the loop
Push to `main` directly	Branch protection also forbids it
Spend money	The £0 constraint is a project requirement, not a preference
Run migrations against production	Data loss is not recoverable from a git revert
Create accounts or provision paid services	WI-H04
Contact anyone externally	Email, issue comments on other projects, support tickets
Commit a secret	Even to a private repo, even briefly
Resolve an architectural fork with no ADR	Draft the ADR, label `needs:adr`, stop
Weaken a gate check to get to green	See ci-and-gates.md
Change a Definition of Done	The spec was wrong; that’s a human call

Human-gated work items

These are tracked as work items so they are visible in the backlog, but they are owned by a person.

ID	Issue	Item	Blocks
WI-H01	#9	Email BGG about commercial licensing, get an answer in writing	WI-024 only
WI-H02	#10	Apple Developer Program — $99/year	WI-050, any iOS release
WI-H03	#11	Google Play Developer — $25 one-off	Android store release only
WI-H04	#12	Provision Cloudflare / Neon / Clerk / Sentry accounts and secrets	WI-012 onward
WI-H05	#13	Approve LLM enrichment spend and volume	Paid WI-028 runs

Two of these deserve a note.

WI-H01 gates only the BGG sync worker. Per ADR-0010 the CatalogueSource seam means everything else builds without it, and per ADR-0016 the open-data seeder may remove the need for BGG altogether.

WI-H05 is the spend boundary in practice. Building and testing the enrichment stage against fixtures needs no approval; a paid full-catalogue run does. If you find yourself about to make a paid API call at any volume, that is this boundary — stop.

Apple’s compulsory fee

WI-H02 is not optional once Google sign-in ships on iOS. App Store Guideline 4.8 requires Sign in with Apple wherever third-party social sign-in is offered, and that requires the developer programme. It is the only compulsory spend in the project — see docs/architecture.md §5.

External services and conduct

When a tool fetches from an external source — the open-data seeder in tools/catalogue-forge most of all:

Honour robots.txt and any published rate limit; when none is published, stay conservative and identify the client in the User-Agent.
Prefer a bulk export or a structured API endpoint over scraping rendered pages.
Never work around a block, a CAPTCHA, or an authentication wall.
Record the licence of every record ingested — ADR-0016.

A source whose terms are unclear is a needs:human decision, not an agent’s call. That is the whole reason WI-H01 exists.

When you hit a boundary

Stop. Do not attempt a workaround.
Comment on the issue: what you were doing, which boundary you hit, what you need.
Label needs:human and remove status:in-progress.
Move to the next status:ready item.

Hitting a boundary is a successful outcome, not a failure. The boundaries exist because the alternative — an agent guessing at an irreversible decision — is the expensive case.