packages/mosaic/framework/skills/mosaic-gitea/SKILL.md

@@ -11,13 +11,8 @@ Git operations via Mosaic wrapper scripts. Platform-aware (Gitea or GitHub).
 
 Scripts auto-detect platform from git remote. Run from inside the repo directory.
 
-For force-merge (branch protection bypass):
+Credentials come from the framework credentials loader (never from a shared env
-
+file):
-```bash
-GITEA_TOKEN=$(cat ~/.config/mosaic/credentials/gitea.env | grep TOKEN | cut -d= -f2)
-```
-
-Or use the credentials loader:
 
 ```bash
 source ~/.config/mosaic/tools/_lib/credentials.sh
@@ -86,14 +81,10 @@ cd ~/src/<repo>
 ~/.config/mosaic/tools/git/pr-merge.sh -n <pr#> -d
 ```
 
-**Force-merge bypassing branch protection:**
+Branch protection is a gate, not an obstacle: if it blocks a merge, fix the cause —
-
+a failing check, a moved head, or a missing review. Never bypass it with a raw
-```bash
+API call, a shared credential, or `force_merge`. Exceptional cases go to the
-GITEA_TOKEN=$(cat ~/.config/mosaic/credentials/gitea.env | grep TOKEN | cut -d= -f2)
+operator or the coordinating seat, still merged through the wrapper.
-curl -X POST "https://git.mosaicstack.dev/api/v1/repos/<org>/<repo>/pulls/<PR>/merge" \
-  -H "Authorization: token $GITEA_TOKEN" -H "Content-Type: application/json" \
-  -d '{"Do":"squash","force_merge":true}'
-```
 
 ## Notes