The safeguard

The same five protections are on from the start, for every person and every agent. They hold with no yokoten init and no setting.

1. Lose your work: no force push, no hard reset, no deleting .git or its history. No wiping the home folder or a system folder, no disk command (mkfs, dd onto a disk), and no root (sudo, su): the owner runs what needs root.
2. Leak a secret: no key, token, email address or home path in a commit or a post.
3. Publish for you: no tag, no release, no package publish, no making a repo public.
4. Run code from the internet unread: no download piped into a shell.
5. Take the safeguard apart: no turning off a check or a hook; a worker cannot edit CI or the rules, and you review a lead’s change to them.

When it stops something, it shows the same four parts:

yokoten stopped this: creating the tag v1.2.0 [release]

  Why       Only the owner decides when to release.

  Instead   Stop and tell the owner: only the owner creates the tag, with the
            steps in How to release; do not look for another way.

  More      https://github.com/yokoten-labs/yokoten/blob/main/docs/guide.md#how-to-release

The first line names the exact tag, file or branch, and the rule. Why says what could go wrong. Instead says the safe way, in words a beginner can use without reading code. More links the rule. Only the owner makes the changes in the fifth protection; an agent asks the owner.