design_docs/ is tier:1 and inside the T1 perimeter — a design amended itself with no human approval nf-w8jx ← Beads

Twinned from https://github.com/cfsh/ninefold/issues/706 by tools/beads/import_github.py's reconcile pass.

@aedanpope, 2026-08-07: *"make changes to design/ t2"*, and on the follow-up he took both halves: design docs become tier:2 AND leave the Tier-1 auto-merge perimeter.

What is true today

CHARTER.md:148 — *"Tier 1 = docs / test-only / tooling scripts / pure-logic+tests"* — so a design doc lands tier:1. And nflib.perimeter.GOVERNANCE denies design_docs/PRINCIPLES.md only, not design_docs/*.

| PR | tier | merged by | |---|---|---| | #681 design 004 | tier:1 | merged:approved | | #685 design 005 | tier:1 | merged:approved | | #697 design 005 A1 | tier:1 | ⚠️ merged:t1 |

#697 amended design 005 and merged with no human approval. That doc is currently steering nf-dev-f5-owner and its implementation chunk (#686) is priority:next. A design that can amend itself on a bot verdict is the studio's direction being set without a human in it.

Two changes, and they are not the same lever

⚠️ tier:2 alone would not have stopped #697. tier:N is advisory — the reviewer's risk class, telling a human how much care to take. merge_pr.py reads only merged:t1/merged:approved; nothing mechanical keys off tier:N. Auto-merge is decided by the perimeter. Both are wanted, for different reasons:

1. tier:2 for design_docs/* — CHARTER's Tier-1 definition lumps design docs in with docs. A design doc is not documentation *about* the system, it is a decision that binds future work. Same reasoning GOVERNANCE already applies to notes/reviewer.md and notes/merging.md: *"not documentation about the system, they are part of it."*
2. design_docs/* into GOVERNANCE — so a design change always needs @aedanpope's approval. design_docs/PRINCIPLES.md is already denied, so this generalises an exclusion the file already makes; the narrow version is what let #697 through. That is the *"exclusion that holds only by falling through 'anything unmatched'"* hazard the perimeter's own comments warn about, landing on the one path that most obviously binds.

design_docs/README.md is an index — decide deliberately whether it follows the same rule rather than letting it fall through either way.

⚠️ Widening GOVERNANCE shrinks what Tier-1 can auto-merge. It was measured at 1 of 6 open PRs already (all five refusals governance), so expect the yield to drop further. That is the trade being bought on purpose.