DL-509
The push guard blocks a push or force-push to main, master or the target repo’s default branch for every owner, and a pull request landing by every path (the gh CLI verb, gh api REST endpoints, GraphQL mutations, GitHub MCP tools)
Status: Active (compass-agent proposal, pending Matt, 2026-10-12)
Record: ../../agent/compass-push-guard/design.md#d5-protected-branches-independent-of-the-allowlist