docs(governance): follow live one-approval merge gate

[seonghobae]

Finding

Live merge authority and Naruon's operational guidance had diverged. The active organization ruleset CWL Central required workflows (id 18156473) requires one approving review and review-thread resolution. The active repository ruleset Lock default branch (id 17214772) independently requires one approving review after the last push, review-thread resolution, and strict required status checks, with no repository-ruleset bypass actor. Current operator guidance must follow those live rules rather than historical zero-approval policy.

This PR repairs Naruon operator guidance only. It does not edit organization/repository rulesets, required workflows, branch protection, robot-review workflow code, approval objects, or Application CI behavior.

TDD provenance

• RED 1: 48e91f941f5152a88082314d067eb874fd4ad6c3 rejects the stale zero-approval instruction token and requires explicit one-approval/non-substitution guidance.
• fixes 276eacfda864f4fd0545bae838bf3598e3becc02, 0710b8f7fe9929f867c0446cf476ef5511385f87, and 27186f5f30033d18b65d8b56b8604789cec1698f align merge policy and the robot-review skill with the live one-approval rule without modifying the rule itself.
• RED 2: e941f04a0310f858da9528db5c834dbf0b8865fe requires the current develop Application CI PR/push targets.
• fixes 634a76af773759eefa1598b6390e0b0eb1f70dfd and 11327e91199bc7c2f6e27775893e3f7e1f9ef2df align the policy with live .github/workflows/app-ci.yml and make the regression exact.
• RED 3: ca6cda3d8c80236037ba255c8ffe82182a427191 requires skipped-required and neutral evidence to remain non-passing and rejects the previous permissive sentence.
• f93edbfc7009662a727c05b7e727ae1efce95da7 makes queued/pending/waiting states explicitly non-passing, keeps skipped-required/neutral evidence non-passing, and limits required-check authorization to exact-current-head terminal success/pass.
• the live repository ruleset was then re-read and showed require_last_push_approval=true; follow-up commits through exact current head f6d4eae54aaa13f156906b0f5dd97e4d067c6dbf preserve that stronger effective rule in the operator policy and its regression contract.

Exact current identity

• protected base: develop@042b0c70531b229af3acbd0421a2f23098d848b3;
• exact current head: f6d4eae54aaa13f156906b0f5dd97e4d067c6dbf;
• branch: fix/merge-gate-live-approval-policy;
• Draft / mechanically mergeable at the latest refetch. Mechanical mergeability is not merge authorization.

Live governance authority

At the latest refetch:

• organization ruleset 18156473: required_approving_review_count=1, stale reviews dismissed on push, review-thread resolution required;
• repository ruleset 17214772: required_approving_review_count=1, require_last_push_approval=true, review-thread resolution required, strict required status checks, no bypass actors;
• current review submissions on this PR: none;
• current inline review threads on this PR: none.

The May 2026 governance implementation plan remains historical evidence rather than current operator authority. If a canonical ruleset owner changes these values later, the live rulesets must be refetched before changing Naruon guidance again.

Current verification state

Hosted exact-head evidence is incomplete and therefore non-passing. For exact head f6d4eae54aaa13f156906b0f5dd97e4d067c6dbf:

• CodeQL PR run 33652841423 completed with startup_failure before useful job execution;
• Application CI 33652838143, Security Scan 33652838100, SAST Semgrep 33652838092, Dependency Review 33652838125, Bandit 33652838209, Docker image validation 33652838367, Scorecard 33652838148, and OSV 33652839047 are queued at the latest refetch;
• queued, startup-failed, absent, cancelled, neutral, skipped-required, stale, predecessor, status-only, model-only, or author-only evidence is not GREEN.

Do not churn this documentation head merely to provoke runner scheduling. Central runner/workflow startup repair belongs to the canonical .github owner path; Naruon should consume fresh exact-head evidence when those workflows actually execute.

Ownership / collision boundary

This lane is independent of externally owned #1543. #1543 changes .github/workflows/pr-governance.yml concurrency behavior and backend/tests/test_release_governance.py; this PR changes only current merge-gate guidance, the robot-review skill, and backend/tests/test_merge_gate_live_ruleset_contract.py. It neither copies nor races #1543's workflow delta.

Merge boundary

Keep Draft until the unchanged exact head has every applicable required check terminal-success, zero valid unresolved findings/threads, and one qualifying independent approval after the last push as required by the effective live rulesets. No force-push, self-approval, bypass/admin merge, review fabrication/dismissal, approval-count reduction, post-last-push-approval weakening, or other gate weakening.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

PR governance metadata gate is not ready for f6d4eae54aaa13f156906b0f5dd97e4d067c6dbf:

• Draft PR: merge automation is paused.
• Required check coverage-evidence is CANCELLED on the current head.
• Required check backend (Python 3.14) is FAILURE on the current head.
• Required check strix is CANCELLED on the current head.