How to build a company brain, part 5: sharing it with the whole company through GitHub

Everyone does the same five things, person or agent: pull the latest version, start a branch, commit one unit of work at a time, open a pull request, merge it the same day. Small merges made often keep the conflicts small.

There are five, and they live in AGENTS.md so every agent reads them before it touches anything.

• Stay in sync. Pull at the start of every session and every 15 minutes after that. An agent working from a stale copy will repeat yesterday's facts and sound sure about them.
• Never write on main. Every task starts on its own branch, named after the person, the kind of work and the topic. For example "anna/research/waitlist".
• Commit small. One commit per unit of work: a filed batch, a new version, a decision. Each one gets a line in the change log.
• Merge the same day. A branch that lives for a week has drifted, and merging it hurts.
• Check before you sync. The file headers are filled in, the lint check passes and the log line is written.

Some pages shouldn't change without a person looking. At Kranich, a pull request that touches the decision log, a frozen spec or a page someone has marked as verified gets the label "needs-founder" and waits. A decision written by an agent always starts as "proposed", and only the founder accepts it. The decision row and the knowledge page it changes travel in the same pull request, so the two can't disagree.

GitHub does the enforcing in two parts. A branch protection rule on main requires a pull request with an approving review. A CODEOWNERS file names the founder as owner of the decisions folder and the other held paths, and the option "Require review from Code Owners" means a pull request touching those paths can't merge until the founder approves it.

Three things from GitHub's docs are worth knowing before you rely on this. On a private repository both features need a paid plan: Pro, Team or Enterprise. The free plan only has them on public repositories. People with admin rights skip the rule by default, until you switch on "Do not allow bypassing the above settings". And the label is only a flag for humans. The agent adds it, and CODEOWNERS is what blocks the merge.

Most conflicts in a brain are boring. Two agents appended a line to the same log, or both rebuilt the same index file. For the logs, Git has a built-in "union" merge rule that you set once in a .gitattributes file. It keeps the lines from both sides and leaves no conflict markers. Git's own documentation warns that the order of the added lines can come out mixed, so I'd only use it for append-only files where every line carries its own date. Generated files such as an index aren't merged at all. They get rebuilt after the merge.

There's a catch. The union rule applies when the merge happens on your machine. GitHub's merge button has not honoured it: a community request open since December 2021 asks for exactly that. So the last step before an agent opens a pull request is to merge the latest main into its branch locally. By the time the pull request reaches GitHub the logs are already combined.

A real conflict is two people changing the same paragraph in different ways. That one isn't settled automatically. It becomes a pull request that shows both versions, and a person picks. Nothing gets overwritten silently.

Goal: write the Git rules for this brain and tell me how to enforce them on GitHub.

Inputs: this repository. The founder's GitHub username is <username>.

Do this:
1. Add these rules to AGENTS.md: pull at session start and every 15 minutes; never commit on main; one branch per task named <who>/<kind>/<topic>; one commit per unit of work with one line in log.md; merge the latest main into the branch locally before opening a pull request; merge through a pull request the same day.
2. Add the rule that a pull request changing decisions/, a frozen spec or a file marked verified gets the label needs-founder and waits for the founder's approval.
3. Create .github/CODEOWNERS that makes the founder the owner of decisions/, the frozen spec paths and .github/ itself.
4. Add a .gitattributes line that gives log.md the union merge rule.
5. Tell me, click by click, how to add a branch protection rule for main that requires a pull request with one approval, requires review from Code Owners, and does not allow bypassing.

Constraints: do not push, merge or change any GitHub setting yourself. If you are not sure where a setting sits in GitHub's current interface, say so and link the GitHub Docs page.

Definition of done: the three files are on a new branch, and I have the list of settings to click through.