docs: mark admin-merge policy as transitional solo-owner state (#101)

* docs: mark admin-merge policy as transitional solo-owner state (#93)

The existing "Solo-owner merge policy" section accurately documented
how merges work today, but read as standing policy. From an external
contributor's perspective it could look like the maintainer routinely
bypasses their own gates.

Adds a leading "Transitional" blockquote framing this as a single-owner
workaround, not standing policy, and replaces the closing sentence with
a numbered exit checklist (drop --admin, remove the subsection, update
CODEOWNERS, optionally flip enforce_admins to true). All four changes
land together when a second collaborator is onboarded.

Mechanics of the merge command itself are unchanged.

Closes #93

* chore: bump version to 0.2.11

* docs: make enforce_admins flip required in exit checklist (#93 review)

Code review on #101 pushed back on step 4 of the "When the exemption
ends" checklist: "Optionally flip enforce_admins to true". Leaving it
false in a 2-person setup keeps the admin-bypass door open even after
the single-owner workaround is no longer needed — which defeats the
point of having an exit checklist.

Drops "Optionally" and adds a one-line rationale so a future reader
understands why the flip is non-optional.

Refs #93

Author: constk

CONTRIBUTING.md

@@ -46,15 +46,24 @@ The subject is **lowercase** after the colon. Title Case prose (`Add the thing`)
 
 ### Solo-owner merge policy
 
-This repo runs with a single code owner (`* @constk` in `CODEOWNERS`). GitHub forbids a PR author from approving their own PR, so the standard "1 code-owner review" gate cannot be satisfied without an admin override. While in this state, the **intended workflow is**:
+> **Transitional — only while this repo has a single code owner.** Standard practice is a code-owner review on every PR. The flow below exists because GitHub forbids self-approval, so a single-owner repo cannot satisfy the "1 code-owner review" gate any other way. The exemption is **removed** the moment a second collaborator with merge rights joins.
+
+This repo currently runs with a single code owner (`* @constk` in `CODEOWNERS`). While in this state, the intended merge command is:
 
 ```sh
 gh pr merge <N> --admin --squash --delete-branch
 ```
 
-…for `feat:` / `fix:` / `chore:` PRs, and `--admin --merge` (preserves history) for `release:` PRs. The `enforce_admins: false` line in `.github/branch-protection/{develop,main}.json` is the documented escape hatch — admin merge here is the policy, not a deviation from it.
+…for `feat:` / `fix:` / `chore:` PRs, and `--admin --merge` (preserves history) for `release:` PRs. The `enforce_admins: false` line in `.github/branch-protection/{develop,main}.json` is the documented escape hatch — admin merge here is the documented single-owner workaround, not bypass of the gates (every required status check still has to pass).
+
+**When the exemption ends.** As soon as a second collaborator with merge rights is onboarded:
+
+1. Drop the `--admin` flag from the merge command and adopt standard PR review.
+2. Remove this entire subsection.
+3. Update `CODEOWNERS` to add the new collaborator.
+4. Flip `enforce_admins` to `true` in the branch-protection JSON for both branches. Leaving it `false` would keep the admin-bypass door open even after the single-owner workaround is no longer needed — defeats the point of removing the workaround.
 
-When a second collaborator joins, drop the `--admin` flag and adopt standard PR review. Update this section + `CODEOWNERS` in the same PR.
+All four changes land in a single PR.
 
 ## Line endings (Windows clones)
 

pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "harness-python-react"
-version = "0.2.13"
+version = "0.2.14"
 description = "Production-quality LLM-driven coding harness — Python (FastAPI) backend, Vite + React + TypeScript frontend."
 readme = "README.md"
 requires-python = ">=3.14"