Laptop policy, CI review, human merge
Local rules travel with the repo — ownership stays human
1
Developer laptop
.grok/config.toml deny rules · AGENTS.md
local policy
↓
2
CI runner
grok -p headless · read-only or yolo + deny
automated review
↓
3
Human merge gate
PR check · approve or reject
human ownership
headless needs a permission plan
Same deny baseline on laptop and CI. Headless never invents a safety story.