chore(policy): adopt the autonomous maintainer posture

[ivndev001]

What

One file changed: .maintainer.yml. This is the reconcile case from developerz-ai/developerz.ai#3400 — the committed policy brought to renderAutonomousPolicy's output, as measured by dz enroll on 2026-09-11 and authorized by the repo owner (ivndev001). After this merges, dz enroll developerz-ai/ui-debugger-mcp --posture autonomous should report AI_MANAGED with changes: [].

Nine value changes, nothing else. Each is pinned in the file with its reasoning; the substance:

key	before	after
pr.auto_merge	false	true
pr.wait_for_other_bots	[coderabbit, copilot, dependabot] (default)	[coderabbit, copilot]
handoff.ask_reporter_first	true (default)	false
review.enabled	false	true
review.force	false (default)	true
review.request_changes	true (default)	false
review.approval	true (default)	false
release.manager	"release-please" (default)	"none"
release.channels	[github-release] (default)	[]

version and handoff.mode: fleet are untouched.

Why each change is correct

pr.auto_merge: true — the substantive change, and the point of the exercise. This is what makes the repo actually AI-managed rather than merely AI-assisted: the bot merges its own PRs once they are green. Authorized by the repo owner on 2026-09-11. What stands behind it is the repo's own CI and branch protection, not this line: ci.yml (lint + typecheck + test + build) runs on every PR, and the main-protection ruleset requires a PR into main and blocks force-push and deletion (both verified today). The key only says who may press the button once those gates pass — it grants nothing and enforces nothing by itself.

review.request_changes: false + review.approval: false with enabled/force true — the ADVISORY first pass. The native reviewer runs and comments (force beats the active CodeRabbit incumbent), but never blocks a merge and never approves one. That is the shape wurk has run since 2026-08, and it is deliberately conservative for a first live pass — if the pass earns trust, the two blocking knobs are where it would be switched on.

release.manager: "none" — a CORRECTION, not a downgrade. manager: release-please implies batched release PRs driven by release-please-config.json + .release-please-manifest.json. Neither file exists in this repo, no release-please PR has ever been opened, and releases are cut by .github/workflows/release.yml — v1.9.0, v1.8.0, v1.7.0 and v1.6.0 all exist (verified on the repo today). none means "no release MANAGER", which is what is true here. The same correction developerz-ai/wurk made in its issue #328.

release.channels: [] — removes the agent's independent publish path. In wurk, channels: [github-release] fired on ordinary feature merges and produced seven tags and GitHub Releases marked "Latest" with no gem behind them (wurk#420) — and manager: none alone did not stop it; the channel authorized releasing on its own. release.yml owns the whole lane here too (on: release: published → npm + MCP registry), so there is no channel for the agent to publish on.

handoff.ask_reporter_first: false and dropping dependabot from wait_for_other_bots are the remaining posture alignments. Under mode: fleet the handoff path is real, so the ask is a formality; and dependabot has no .github/dependabot.yml in this repo, so waiting on it would hold a green merge open for a reviewer that is not coming.

Gates

The repo has no check that covers YAML or the policy schema — CI runs lint (biome, TS/JSON only), typecheck, test, build; nothing reads .maintainer.yml. What I ran locally:

• YAML parse asserting the exact nine-value structure with no extra keys: pass
• ajv validation of the file against the published schema https://developerz.ai/schemas/maintainer.v1.json (fetched today; all ten keys and their defaults confirmed against it): pass
• bun run lint: pass (157 files)
• bun run typecheck: pass

CI's own lint/typecheck/test/build run on this PR as usual.

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

Summary by CodeRabbit

• Chores
  • Updated project maintenance workflows for automated pull request handling and review coordination.
  • Adjusted release-management and publishing settings for ongoing project operations.
  • No changes to exported functionality or the end-user experience.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Essentials

Run ID: 1986a199-1acc-4a0a-818e-806928ff84fa

📥 Commits

Reviewing files that changed from the base of the PR and between c5c488b and 3fa24af.

📒 Files selected for processing (1)

• .maintainer.yml

Included review availability: 0 reviews are currently available. Your included PR review attempts over the past 7 days set your current allowance at 2 reviews per hour.

📜 Recent review details

⏰ Context from checks skipped due to timeout. (1)

• GitHub Check: bun (lint + typecheck + test)

---

📝 Walkthrough

Walkthrough

The maintainer policy enables autonomous pull request merging, limits required reviewers, removes reporter confirmation, enables advisory native review, and disables release management and agent publishing channels.

Changes

Maintainer Policy

Layer / File(s)	Summary
Autonomous merge and handoff .maintainer.yml	PR auto-merge is enabled and waits only for CodeRabbit and Copilot. Fleet handoffs no longer request reporter confirmation.
Review and release controls .maintainer.yml	Native review is forced and advisory-only. Release management has no manager, and agent publishing channels are removed.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Feature

Merge Risk: ⚪ Minimal · up to ec317

The autonomous maintainer policy changes have no identified merge-blocking risk.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: adopting an autonomous maintainer posture in the repository policy.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/adopt-autonomous-maintainer-posture

---

_{A rabbit checks the merge gate bright
Review hops in with gentle light
No reporter pause delays the trail
Release carts rest beside the rail
Empty channels hum in quiet delight}

_{Comment @coderabbitai help to get the list of available commands.}

[developerz-ai]

CI is green and the policy change looks correct. Merging requires an approving review — could you take a look? 🤖[bot]

🤖 Posted by developerz.ai — the maintainer agent, not a human.