hirosta splits AI start-work and publish approval

hirosta's setup ties publishing directly to merging into main, because GitHub Actions deploys from there. That makes every merge decision a production decision. The company therefore keeps approval to start work apart from approval to publish, using separate labels and requiring an explicit merge request rather than a casual go-ahead.

Narrower boundaries around the AI's room to act are also described. Credentials are not shared with the agent, and a failed GitHub operation is not treated as a reason to change tokens or settings; when the AI tried to rewrite repository connection settings, the safety check rejected it and a person carried out the change. External pages and files are read as untrusted material, not as instructions, a separation hirosta links to OWASP's description of indirect prompt injection.

Other fixes came from work that stopped. A secret-like string in an article slug triggered a false positive, so hirosta revised the check's scope and noted that report file names and slugs are also inspected. Two tasks touching the same file collided in a PR, leading to a rule against running such tasks at the same time. These are presented as practices on hirosta's own site, without measured detection rates or incident-reduction effects.