settings.template: scope force-push denies to dev/main; allow lease-push on agent branches

Context

Operator-directed (2026-07-04, verbatim substance): "wasn't it you who wanted the anti force push rule? i did not recommend it => we do squash merges from feature branches to dev. it literally does not matter if you force push there." — followed by the explicit direction: ticket + PR for the template, then local overlays follow.

Empirical anchor, same night: PR #14585's one-hunk seam-table conflict had a lint-verified rebase resolution sitting ready on the author's branch, and the blanket deny rule blocked delivering it — the operator had to be pulled into a conflict any agent could clear in seconds. The rule (authored in the #14415 allowlist design) protects nothing real: under squash-merge-to-dev, feature-branch history is discarded at merge; force-pushing a rebased agent/* branch is the NORMAL conflict-resolution path.

The Problem

.claude/settings.template.json deny list (lines 33–34) blanket-blocks all force-pushes:

"Bash(git push* --force*)",
"Bash(git push* -f *)",

This makes rebase-based PR conflict resolution impossible for every agent instance copying the template — while the actual protected surfaces (dev, main) are what the rule exists for.

The Fix

In the template's deny list, replace the two blanket rules with branch-scoped versions, and add the lease-form allow for agent branches:

deny (replace lines 33–34):

"Bash(git push* --force* origin dev*)",
"Bash(git push* --force* origin main*)",
"Bash(git push* -f * origin dev*)",
"Bash(git push* -f * origin main*)",

allow (add):

"Bash(git push --force-with-lease origin agent/*)"

Deliberately narrow: only the --force-with-lease form is allow-listed (bare --force still prompts — lease protects against clobbering a peer's push to the same branch), only agent/* branches. The refspec deny (git push* *:*, the #14419 colon hazard) and the plain dev/main push denies are untouched. The --no-verify deny is untouched (separate concern, not revoked).

Acceptance Criteria

• Template deny list carries the four branch-scoped force rules; the two blanket rules removed.
• Template allow list carries the lease-on-agent entry.
• JSON validity + template↔live-settings shape parity note in the PR (the live settings.json is gitignored per-instance; operators/agents apply the same edit locally — the operator's stated follow-up).
• The guidance prose (line ~63, never-push-dev/main) unchanged — it remains correct.

Out of Scope

The --no-verify deny (sync-guard bypass — separate discussion) · the refspec colon-deny (#14419, stays) · hook/permission behavior for non-Bash tools.

Related

#14415 (the original allowlist design this narrows) · #14419 (the refspec deny, untouched sibling) · PR #14585 (the empirical anchor — conflict resolution blocked by the blanket rule).

Live latest-open sweep: latest 12 checked 2026-07-04T02:55Z — no equivalent. A2A in-flight: no competing claim; operator-directed this minute.

Origin Session ID: a5af7cf6-45a3-42db-8a30-f04f4241a55c Retrieval Hint: "settings template force-push deny scope dev main lease agent branches squash merge"