From ba1515f094c87d0c7ef237e2807001ce530926df Mon Sep 17 00:00:00 2001
From: Ryan Yin <xiaoyin_c@qq.com>
Date: Thu, 29 Oct 2026 21:39:16 +0800
Subject: [PATCH] docs(agents): ask for SSH access instead of falling back

A missing GitHub SSH key is a credential boundary, not a reason to switch transports silently.

Assisted-by: DeepSeek Harness (deepseek-flash)
---
 agents/global-rules.md | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/agents/global-rules.md b/agents/global-rules.md
index d1c44add..a5b38051 100644
--- a/agents/global-rules.md
+++ b/agents/global-rules.md
@@ -165,7 +165,8 @@ For an impactful change, follow these steps in order, scaled to its risk:
   for one-off tools, and the project's existing toolchain (e.g. its flake, `uv`, `pnpm`) for its
   dependencies; ask before creating a flake or installing another way.
 - Use `gh` for authorized GitHub operations; keep SSH for GitHub Git remotes and make sure the
-  Nix-managed `~/.ssh/config` is used.
+  Nix-managed `~/.ssh/config` is used. If SSH authentication is unavailable, stop and ask the user
+  to grant access; do not silently fall back to HTTPS or another credential.
 - Code layout: `~/codes` = personal, `~/work` = work code, `~/src/<repo>` = source checkouts.
 - Agents MUST publish only to repositories that are already public or that the user names, and MUST
   NOT publish content from private repositories or internal sources to a public repository.