From 0a7833da5e3b9b373984a5738b26bce6d31f27e9 Mon Sep 17 00:00:00 2001
From: unkin-agent <unkin-agent@unkin.net>
Date: Fri, 23 Oct 2026 22:01:54 +1100
Subject: [PATCH] Add agent-sandbox repository

---
 .../unkin/repository/agent-sandbox.yaml       | 20 +++++++++++++++++++
 1 file changed, 20 insertions(+)
 create mode 100644 config/git.unkin.net/unkin/repository/agent-sandbox.yaml

diff --git a/config/git.unkin.net/unkin/repository/agent-sandbox.yaml b/config/git.unkin.net/unkin/repository/agent-sandbox.yaml
new file mode 100644
index 0000000..7ffd1dc
--- /dev/null
+++ b/config/git.unkin.net/unkin/repository/agent-sandbox.yaml
@@ -0,0 +1,20 @@
+description: "Rootless podman sandbox for Claude Code with allowlisted egress"
+private: false
+default_branch: "main"
+default_delete_branch_after_merge: true
+allow_merge_commits: false
+allow_rebase: false
+allow_rebase_explicit: false
+allow_squash_merge: true
+branch_protection:
+  - rule_name: "main"
+    merge_whitelist_teams:
+      - "Owners"
+    enable_push: false
+    status_check_contexts:
+      - "ci/woodpecker/pr/pre-commit"
+      - "ci/woodpecker/pr/lint"
+      - "ci/woodpecker/pr/test"
+      - "ci/woodpecker/pr/build"
+    approval_whitelist_teams:
+      - "Owners"