Morrison-Lab · d-morrison · Sep 2, 2026 · Sep 1, 2026 · Sep 1, 2026 · Sep 1, 2026
diff --git a/AGENTS.md b/AGENTS.md
@@ -558,6 +558,33 @@ This grants no merge authority: the strict merge policy below still applies.
   (`gh issue reopen <issue-number>`) per
   [`revert-merge.md`](shared/workflow/revert-merge.md).
 
+## Only work PRs opened by the user, assigned to the user, explicitly requested by the user, or authored by the Actions app
+
+Before pushing to, editing, commenting on, reviewing, resolving threads on,
+dispatching a paid review of, or merging any PR, resolve the invoking user
+and read the PR's author and assignees.
+Proceed only when the author or one of the assignees is that user (or an
+alias `memories/reviewing-prs.md` lists for that same user), the user
+explicitly asked for work on that PR by name (or, through an explicit
+`chores` call, on the Dependabot/Renovate population), or the author is the
+GitHub Actions app (`github-actions`).
+A mention such as "do not touch" followed by a PR number is not a request, a
+claim comment confers no scope, and a sweep skill's "every open PR" means
+every PR that passes this test.
+An explicit exclusion ("do not touch" followed by a PR number) is a veto: it
+removes that PR before any positive arm is evaluated, the user's own PRs and
+the Actions app's included, and every sweep carries the exclusion list into
+each recheck and each delegated scan.
+A review-only run that CI or a skill invocation dispatched naming the target
+PR (an `@claude review`, a `claude-code-review.yml` run) is that explicit
+request, whoever authored the PR; it reviews and stops there.
+An out-of-scope PR is reported to the user and left untouched.
+When no identity operation is available, fail closed the way `ardia` does:
+leave the author and assignee arms unevaluated, act only on PRs the user
+explicitly asked for or the Actions app authored, and say so in the report.
+`memories/reviewing-prs.md` carries the full rule and its provenance;
+`skills/ardia/SKILL.md` step 1 is the reference implementation.
+
 ## Always arm a persistent PR loop
 
 This applies in any repo, not only Morrison-Lab ones.

diff --git a/CLAUDE.md b/CLAUDE.md
@@ -617,6 +617,8 @@ One to three sentences is enough.
 The trailing marker is required, per the section above: this comment paraphrases the user in the user's own voice under the user's own login, which is the shape most easily read as their own writing.
 Don't quote verbatim — paraphrase so it reads naturally in the PR thread.
 Skip trivial acknowledgments or conversational exchanges with nothing to act on.
+Post it only on a PR that passes `memories/reviewing-prs.md`'s scope test.
+Feedback about an out-of-scope PR, such as a request not to touch it, stays in chat and the session notebook rather than on that PR.
 
 This makes context visible to future @claude sessions, other reviewers, and contributors who only see the PR thread.
 
@@ -930,7 +932,7 @@ The key points, restated here because a bare pointer is invisible to a consumer
   Attribution is a second axis, and it runs before the claim: intersect the merge's own deleted and renamed paths (`git diff --name-status -M "$merge^1" "$merge" | grep -E '^(D|R)'`) with each conflict, and report conflicts caused alongside conflicts found.
   `git show --name-status <merge>` cannot supply that set for a **true** (two-parent) merge --- it prints no file list at all there, and grepping its header for `^[ADMR]` returns three phantom paths.
   It does diff a squash merge normally, so whether it works depends on how the repo merges rather than on the commit in front of you.
-  A conflict you caused on a branch you do not own is an explanatory comment, not a push.
+  A conflict you caused on a PR that fails `memories/reviewing-prs.md`'s scope test is a report to the user, not a comment or a push.
 - **Independent per-PR checking cannot see pair collisions.**
   Every PR can be clean against `main` while two of them conflict with each other.
   Only a pairwise `git merge-tree` between PR heads finds that.
@@ -1817,6 +1819,8 @@ recurred immediately in a `jq` filter reading a PR review body.)
   A peer may have further commits planned, so merging one that just went clean can destroy work it was about to push --- and that is exactly the case where the peer's PR unblocks yours and the temptation is strongest.
   Start the clock at the clean verdict on the current head, which a push resets, rather than at the PR's `updatedAt`, which any comment bumps.
   The threshold is an inference, so confirm it: message the owning session directly when `ListAgents` reaches it, and otherwise post a comment saying you intend to merge and wait a further five minutes for a hold-off.
+  The path applies only to a peer PR that passes `memories/reviewing-prs.md`'s scope test (a peer session under your own login satisfies the author arm).
+  Another lab member's PR that fails the test gets neither the comment nor the merge.
   [`mwc`](skills/mwc/SKILL.md)'s "Another session's PR" section carries the derivation and the pattern/anti-pattern pair (ai-config#2460).
 
 **One standing exception: PRs targeting `Morrison-Lab/ai-config` carry a standing `mwc` grant**, with no per-session re-issue and no `enable-mwc` step --- `hooks/no-unauthorized-merge.py` reads the merge's target repo off the command.

diff --git a/codex-skills/ardia/SKILL.md b/codex-skills/ardia/SKILL.md
@@ -1,6 +1,6 @@
 ---
 name: "ardia"
-description: "Drive all open PRs to clean."
+description: "Drive every in-scope open PR to clean."
 ---
 
 # ardia (Codex wrapper)

diff --git a/memories/MEMORY.md b/memories/MEMORY.md
@@ -13,7 +13,7 @@ index in that directory.
 | File | Title | Covers |
 |------|-------|--------|
 | [`preferences.md`](preferences.md) | User preferences (cross-workspace) | Standing working rules: never-assume/always-verify, record learnings as you go, cite sources for tool-behavior claims, issue-first, and the ARDI / fully-clean definitions. |
-| [`reviewing-prs.md`](reviewing-prs.md) | Reviewing someone else's PR | Leftover-artifact findings follow what the PR is landing, owner scope vs the author's mechanical box, review-only is not ARDI, and post every finding already in hand, split from `preferences.md` at the 1200-line gate (UCD-SERG/shigella#31). |
+| [`reviewing-prs.md`](reviewing-prs.md) | Reviewing someone else's PR | Leftover-artifact findings follow what the PR is landing, owner scope vs the author's mechanical box, review-only is not ARDI, post every finding already in hand, and only work PRs opened by the user, assigned to the user, explicitly requested by name, or authored by the Actions app (a sweep's "every open PR" is not a scope grant; UCD-SERG/serodynamics 2026-09-01), split from `preferences.md` at the 1200-line gate (UCD-SERG/shigella#31). |
 | [`github.md`](github.md) | GitHub PR/issue queue management | Operational write-action checklist, stale remotes, the GII startup sweep, stacked-PR pitfalls, consumer enumeration (`gh search code`), secondary rate limits, and `gh pr edit`. The `gh` CLI itself, GitLab, remote-session bash access, and consumer-CI content now live in their own split files (linked at the top). |
 | [`gh-cli.md`](gh-cli.md) | GitHub CLI (`gh`) | The `gh` CLI behavior, rate limits, pagination, handling `GH_PAGER`, GraphQL vs REST pools, and fallback strategies. Split out of `github.md`. |
 | [`github-remote-sessions.md`](github-remote-sessions.md) | GitHub access from bash in remote/web sessions | What a remote or web session can reach on GitHub from bash when `gh`/`glab` are absent: session-scope 403s, the MCP-then-`add_repo`-then-`git ls-remote` ladder, the proxy's push-but-not-delete rule, and GitHub Pages policy denials. Split out of `github.md` (ai-config#694 pattern) at the 1200-line gate. |

diff --git a/memories/github.md b/memories/github.md
@@ -65,8 +65,16 @@ Moved to [`gh-cli.md`](gh-cli.md).
 
 When starting a GII loop, do a cleanup pass before diving into ARDI:
 
-1. **List all open PRs** with `mcp__github__list_pull_requests`. Look for
-   stale bot-opened PRs that target the same issues as the queue.
+1. **List all open PRs** with `mcp__github__list_pull_requests` (fields
+   `number,title,user,assignees`).
+   Keep the full list for step 3's issue-coverage detection, which only reads
+   it, and apply `reviewing-prs.md`'s scope test (opened by or assigned to the
+   invoking user, explicitly requested, or authored by the GitHub Actions app)
+   immediately before every mutation in steps 2 through 4 (the close in step
+   2, the close and the note in step 3, the merge in step 4): an out-of-scope
+   PR is reported to the user rather than closed, commented on, or merged
+   into, and an issue it already covers is left to it rather than grabbed.
+   Look for stale bot-opened PRs that target the same issues as the queue.
 2. **Close empty PRs** — bot-opened branches with no commits (e.g. a `@claude`
    task run that posted a comment but never pushed code). Check `get_commits`
    on each PR before closing.

diff --git a/memories/preferences.md b/memories/preferences.md
@@ -318,7 +318,7 @@
   Merge the most-isolated PR (disjoint files) FIRST --- it rides through without a re-resync; sequence foundational/big same-file PRs LAST so lighter PRs rebase onto simpler `main`.
   An agent watching a PR must POLL its own `mergeable`/`mergeStateStatus` on EVERY watch tick (a newly-appearing conflict from someone else's merge is NOT a CI event, so a CI-completion monitor never fires on it), and on catching one immediately `git fetch origin main && git merge origin/main`, resolve, re-run checks, push --- staying in the watch loop until the PR is merged or closed (clean regresses to CONFLICTING when main moves).
   The coordinator's nudge is only a backstop for a genuinely-dead agent. (Learned on sparta 2026-07-01 merging the movement cluster.)
-  Beyond same-file collisions: after ANY merge that advances the base (`main`), proactively re-sync EVERY trailing open PR branch and resolve conflicts --- don't wait for a branch to show DIRTY or for the next review trigger.
+  Beyond same-file collisions: after ANY merge that advances the base (`main`), proactively re-sync EVERY trailing open PR branch that passes `memories/reviewing-prs.md`'s scope test and resolve conflicts (an out-of-scope branch is reported to the user and left untouched) --- don't wait for a branch to show DIRTY or for the next review trigger.
   In R packages the recurring conflicts are DESCRIPTION `Version:` (bump above main) and NEWS.md (union-merge, keeping both sides' bullets and one subsection per heading); the `@claude` bot auto-syncs non-conflicting branches but does NOT resolve these real DESCRIPTION/NEWS conflicts.
   Sequential merges cascade version-check reds and NEWS/DESCRIPTION conflicts down the whole stack of trailing PRs, so keeping them all synced after each merge keeps the queue mergeable; parallelize with worktree-isolated workers, capped at ~3 concurrent to respect shared CI runners. (Learned on ucdavis/bcs.)
   **The DESCRIPTION half of this cascade is obsolete once a repo adopts `Morrison-Lab/gha`'s new `bump-dev-version`/`version-check` capabilities (gha#390, tracking gha#388)** --- PRs stop touching `Version:` at all, so there's no version-bump conflict left to cascade down the stack.
@@ -397,8 +397,10 @@
   The existing instruction already covered this; the gap was execution discipline in a fast multi-merge loop, not missing guidance --- re-read this bullet at the top of every "pick the next backlog item" cycle.
   In a multi-AGENT pipeline, UMS runs at BOTH levels: each subagent runs UMS once ITS PR merges (it stops after reporting CLEAN, so the coordinator resumes it post-merge with a "your PR merged, run UMS" nudge --- or the agent-launch spec bakes in a final UMS step), and the coordinator runs its own UMS for the cross-PR orchestration learnings no single subagent can see (merge-order sequencing, conflict-cascade handling, pipeline mechanics).
   Each agent writes its OWN memory file plus one MEMORY.md index line to keep the conflict surface small; avoid rewriting shared memory bodies concurrently. (Learned on sparta 2026-07-01.)
-- After ANY PR merges to main (under mwc, post-merge, or manual merge), IMMEDIATELY and autonomously sweep all open PRs in the repository for merge conflicts (`gh pr list --state open --json number,title,headRefName,mergeable,mergeStateStatus`).
-  For any PR reporting `CONFLICTING` or `UNKNOWN`, fetch main, test the merge, resolve the conflict in an isolated worktree, and push the sync commit proactively without waiting for the user to point it out or ask for it. (Learned on ai-config, 2026-08-24: "cai: you should have checked PR conflicts on your own".)
+- After ANY PR merges to main (under mwc, post-merge, or manual merge), IMMEDIATELY and autonomously sweep all open PRs in the repository for merge conflicts (`gh pr list --state open --json number,title,headRefName,author,assignees,mergeable,mergeStateStatus`).
+  Filter that list by `memories/reviewing-prs.md`'s scope test first (opened by or assigned to the invoking user, explicitly requested by name, or authored by the GitHub Actions app);
+  an out-of-scope conflicting PR is reported to the user and left untouched.
+  For any in-scope PR reporting `CONFLICTING` or `UNKNOWN`, fetch main, test the merge, resolve the conflict in an isolated worktree, and push the sync commit proactively without waiting for the user to point it out or ask for it. (Learned on ai-config, 2026-08-24: "cai: you should have checked PR conflicts on your own".)
 - Keep it simple.
   Don't over-explain or ask permission for straightforward fixes --- just do them.
 - Don't re-ask a decision that's already settled and built.
@@ -531,9 +533,12 @@
   Both additions were already on `main` in fuller form, and the diff had also rewritten three *correct* relative links into broken ones --- the `check-links.py` failure being blamed on that session all along.)
 
 - **Don't touch anyone else's branch.**
-  **Do:** only push to or modify branches I created in my own worktree.
-  **Don't:** push commits, force-push, checkout, or edit branches belonging to another session or user --- even if the content looks worth keeping or the branch looks abandoned.
-  If a branch needs work that isn't mine, flag it and let the owner handle it. (User directive, 2026-08-19.)
+  **Do:** only push to or modify branches I created in my own worktree, or a PR branch that passes `memories/reviewing-prs.md`'s scope test (opened by me, assigned to me, explicitly requested, or the Actions app's) and carries no live claim from another session.
+  **Don't:** push commits, force-push, checkout, or edit branches belonging to another session or user that fail that test --- even if the content looks worth keeping or the branch looks abandoned.
+  If a branch needs work that isn't mine, flag it and let the owner handle it.
+  A live claim on an in-scope branch still means waiting for it to expire, per `claim-pr`.
+  (User directive, 2026-08-19.
+  The scope-test carve-out follows the 2026-09-01 directives in `reviewing-prs.md`.)
 - **A delegated subagent runs in the parent session's working tree, so the "Use ONE worktree per branch/PR" rule above governs your own agents, not only other sessions.**
   The remedy is already written down: [`gip`](../skills/gip/SKILL.md) says to
   give every subagent `isolation: "worktree"`, and