chore(governance): protect main and enforce release checks

Live governance authority — 2026-09-24 KST

Fresh protected source remains GitHub-verified main@ca32ae2eb8c5ce73af2769d6a58a7ac714503251, the normal two-parent merge of #726 reviewed source d32a054c361eb9e9ad6e563d4956d8586ed7d38f onto prior protected main@c3a3a42170ac06fbfc5c1a3b32e34827d967b5c9. protected=true is only branch metadata; prior classic branch-protection read showed enabled=false with required-status enforcement off, so the label alone is not stronger governance authority.

Fresh repository-effective ruleset inventory still contains exactly one organization ruleset: 18794436 / CWL Noema central security scan, enforcement=active, target ~DEFAULT_BRANCH. The rule requires repository id 1274066402, .github/workflows/security-scan.yml, refs/heads/main; bypass_actors=[], current_user_can_bypass=never. This proves central Security workflow applicability only. It does not prove pull-request/review count, stale-review dismissal, conversation resolution, non-fast-forward/deletion protection, or independently exercised break-glass behavior.

There are 2 open pull requests, both Draft and neither is protected governance authority:

fix: require canonical governance and normal-merge authority #730 governance/commercial admission candidate exact caeeee70de9221b582cb2b9e0e2c1b77b9c10d27. Predecessor 51d3d1bd77742f5eccf75ce6167faa11cb97f24f reached assigned hosted runners and produced real test-contract REDs after evaluated-base publication authority became canonical: stale five-argument claim-evidence publisher fixtures and GitHub-I/O stubs that still modeled a head-only publication snapshot. Ordinary-forward repairs 314a7db40267889f80caeaa9a9f88fc8c6ba1ae1 and current caeeee70… update only those test seams to the six-argument (repo, pr, verdict, head, token_source, base_sha) contract and exact live {state, head, base} snapshot. A suggested five-argument production fallback was rejected because it would weaken evaluated-base authority parity. Current runs are application CI 35907252412, reviewer-ci 35907252577, required Security Scan 35907252427, and patch-validator-image 35907252418; current observation is nonterminal, so predecessor RED/fixes are not current-head GREEN. The current exact has owner COMMENT only, not self-approval.
docs: converge current commercial authority baseline #729 documentation-authority lane exact ed64dc9bd85244f64c5f0c3a477028e536908246. Predecessor f67cb881c09850cfb92a734fb5c39fc48db04754 also reached assigned runners and its release tests exposed a real archive/current-authority split: the compact active baseline had lost direct PRD/TRD/UML/ERD/CONTEXT_MAP authority pointers, while fix(agent-runtime): bound current workflow-state response #652/fix(state): keep procedural history hashing outside storage transactions #714/fix(policy-approval): keep cryptographic work outside durable transaction #719 historical assertions still read the active index after lineage moved to docs/history/product-technical-gap-baseline-20260921.md. The ordinary-forward successor redirects only historical assertions to the archive, restores the active canonical authority pointers, and moves the baseline/P0 row plus six executable authority fixtures to fix: require canonical governance and normal-merge authority #730 caeeee70…. f67cb881… → ed64dc9… is 8 commits/8 files with no unrelated production-source change. Current runs are application CI 35908370542, reviewer-ci 35908370590, required Security Scan 35908370535, and patch-validator-image 35908370487; current observation is nonterminal. The current exact has owner COMMENT only.

The new assigned-runner failures supersede the earlier positive-unassigned observations for those predecessor heads. They are code/test RCA evidence, not evidence of runner starvation, billing failure, selector failure, or GitHub outage. No rerun/cancel, runner-selector change, no-op wake commit, force-push, destructive rebase, self-approval, or gate weakening was used.

GitHub Release inventory remains a separate evidence class. No version/tag/package/immutable release/SBOM/provenance/reproducibility/rollback completion is asserted without a fresh immutable Release.

Historical GREEN/review evidence is revision-scoped only. It cannot transfer to a moved head, restacked branch, or different protected base.

Acceptance criteria

Live ruleset / branch governance

Preserve dated governance observations rather than treating a protected SHA as evergreen authority.
Fresh-read repository-effective organization rules and separate observed evidence from desired stronger controls.
Keep the observed central Security workflow scoped only to what the live ruleset proves.
Configure and independently verify a rule requiring pull requests for ordinary protected-main changes, with only an explicit auditable break-glass path if authorized.
Require at least one eligible independent non-author approval once a real reviewer route exists and live policy configures that requirement.
Dismiss stale approvals when source head or merge-base changes.
Require conversation resolution.
Prevent force pushes/non-fast-forward protected-main rewrites and protected-branch deletion.
Independently verify administrator/break-glass bypass behavior rather than infer it from the central required-workflow ruleset.

Repository-owned governance audit

Keep current truth and stronger target policy separate.
Keep formal reviews, checks/statuses, scanners, model judgements, merge authority, release, deployment and production evidence as distinct classes.
Preserve fail-closed behavior when live governance evidence is absent, malformed, stale or inconsistent.
Bind repository-side merge admission to exact target PR/head/base workflow provenance, exact required-check name, exact GitHub Actions producer slug/App id, exact check status/conclusion enum identity, exact pull-request identity serialization, canonical organization-owned required-workflow source metadata, exact review-to-head identity, exact evaluated-base formal Noema review authority, injected-publisher evaluated-base parity, GitHub REST review/status chronology, fail-closed same-suite Check Run chronology, and exact-one Noema marker-like review-envelope authority.
Revalidate the fresh-evaluated base SHA immediately before the SHA-bound normal merge write.
Protect all 38 authority-bearing production functions changed by fix: require canonical governance and normal-merge authority #730 with the repository-owned direct-JSDoc executable scope contract.
Merge fix: require canonical governance and normal-merge authority #730 only after unchanged current exact caeeee70de9221b582cb2b9e0e2c1b77b9c10d27 receives formal current-head Noema merge-authority approval and all applicable hosted gates are terminal GREEN; predecessor review/GREEN and owner COMMENT are not merge authority.
Re-run the protected-source read-only governance audit against the exact then-current protected Noema main, exact current central workflow source and fresh live ruleset evidence; retain its bounded receipt rather than editing historical results.
Run the protected-main governance operator under an authorized live credential and retain bounded evidence for controls not provable from the read-only API surface.

Behavioral proof for stronger target policy

Pending/failed/absent/stale required evidence cannot merge.
Source-head or merge-base movement invalidates predecessor approval once live policy is configured to dismiss stale reviews.
Author/self/model/status/check evidence cannot satisfy independent approval once live policy requires it.
Normal direct push, force push/non-fast-forward rewrite and protected-main deletion are rejected.
Break-glass use, if any, is attributable, bounded and independently reviewed.

Current blocker boundary

Repository source and read-only governance observations remain executable. Live configuration of stronger organization/repository protection and credentialed operator proof requires an authorized governance path; that blocks only claims requiring those controls. Current hosted waits and formal/current-head review waits are evidence waits, not permission to weaken the central Security rule, manufacture reviewer/App authority, force-update protected history, or treat predecessor results as current governance proof.

Implementation gate: PR #31

PR #31 adds a fail-closed npm run governance:audit before the hourly maintainer can dispatch review or merge. It reads every active rule applying to main and requires:

active pull_request, required_status_checks, non_fast_forward, and deletion rules;
stale-review dismissal and review-thread resolution;
squash compatibility;
strict current-base enforcement;
integration-pinned verify, reviewer, scorecard, osv-scan, trivy-fs, and dependency-review contexts.

The audit uses only the maintainer App's existing Metadata read permission and deliberately does not grant Administration permission. It emits artifacts/governance/main-governance-audit.json and blocks all autonomous write actions on missing or drifting governance.

This does not close #27 by itself: an operator still must create the ruleset and independently review/document bypass actors and the break-glass procedure. After configuration, attach a PASS audit artifact and direct-push rejection evidence here.

2026-08-05 exact-head evidence from PR #64 confirms this governance gap remains live. Head 9182ca9656982fae0c1aa380535927894cf121ba has successful ci, reviewer-ci, central Security Scan, CodeRabbit status success, and zero unresolved review threads. A GraphQL enablePullRequestAutoMerge attempt was rejected with Pull request is in clean status, which is GitHub's response when the PR is immediately mergeable rather than held behind required branch rules. No manual merge was performed because the project policy still requires an independent exact-head approval and enforceable repository rules. Acceptance evidence for this issue should include a ruleset that makes the same clean PR eligible for auto-merge instead of immediate unguarded merge, plus a failed merge attempt for a PR with a missing required check or approval.

2026-08-09 fresh feasibility probe confirms #27 is still live. PR #76 remains open at exact head e0106ce16b7b8b493f46bf075ec5baf58762bd95; its pull-request-triggered ci (31252585269), reviewer-ci (31252585267), and Security Scan (31252585268) are all terminal-success, its visible review threads are resolved, and it has no eligible independent APPROVED review. Immediately after refetching that live state, enablePullRequestAutoMerge again returned GitHub GraphQL UNPROCESSABLE: Pull request is in clean status rather than arming an approval/check-gated auto-merge. This is an empirical current-state signal that main still is not holding this clean PR behind an enforceable auto-merge-compatible required-rule set. No merge or protection bypass was attempted. Acceptance still needs live ruleset configuration plus direct-push/force-push/deletion rejection and break-glass evidence, not another repository code workaround.

2026-08-09 repository-owned governance-audit and guidance gap

PR #87 now closes two repository-owned governance detection/documentation gaps while remaining dependency-ordered on #76.

Current exact identity:

predecessor/base fix(security): update transitive nanoid for CVE-2026-67213 #76: e0106ce16b7b8b493f46bf075ec5baf58762bd95;
fix(governance): audit independent approval requirement #87 current head: e68e0a4bb319cd52c52b6641ae5f1fdd3312811b;
compare: 5 commits ahead / 0 behind with merge base exactly equal to the fix(security): update transitive nanoid for CVE-2026-67213 #76 head;
unique diff relative to fix(security): update transitive nanoid for CVE-2026-67213 #76 is limited to AGENTS.md, scripts/lib/main-governance-audit.mjs, and test/main-governance-audit.test.ts.

The governance evaluator requires at least one active pull-request rule with a positive required_approving_review_count, while retaining require_code_owner_review: false. A zero-approval ruleset fails closed with independent_approval_not_required; formal review evidence remains separate from checks, statuses, scanners, and model judgement.

A fresh read-only comparison against central .github tip 6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba also found that Noema's AGENTS.md overstated Security Scan behavior: the live central workflow selects bases main, master, or develop, so a feature-base stacked PR can legitimately have no Security Scan run, and the live Trivy hard gate is fixable MEDIUM/HIGH/CRITICAL, not only CRITICAL/HIGH. PR #87 adds a deterministic repository-guidance regression and corrects those Noema-owned instructions. Central .github remains read-only.

Current exact-head verification for #87 is green where event-eligible: application ci run 31336097264 and reviewer-ci run 31336097263 are terminal-success. Application CI checked out the exact head, passed 62 test files / 648 tests at configured 100% statement/branch/function/line coverage, and found 0 npm audit vulnerabilities. The central Security Scan remains absent by feature-base event selection and is therefore defer_until_trigger, never passing scanner evidence. Formal reviews and inline review threads remain absent.

This still does not close #27. Noema cannot create or prove the live main ruleset with the currently available repository write path; direct-push/force-push/deletion and break-glass rejection remain unproven, and no qualifying independent non-author approval exists. After #76 integrates, #87 must be refreshed/retargeted to an eligible protected base and receive fresh current-head application/reviewer/security evidence before merge consideration. Keep #27 open.

Fresh live-governance evidence from the current repository state changes one premise of this issue but confirms the acceptance gap remains real.

Observed against protected main e359e7d750a1b4ea54294848117b11bfa03586eb:

GET /repos/ContextualWisdomLab/noema/branches/main reports protected: true, but the exposed classic protection payload is enabled: false with required-status-check enforcement off and no contexts/checks.
The active inherited organization ruleset visible for Noema is ruleset 18794436, CWL Noema central security scan. It targets ~DEFAULT_BRANCH, has no bypass actors (current_user_can_bypass: never), and its only rule is the required workflow ContextualWisdomLab/.github/.github/workflows/security-scan.yml@main.
There is currently no visible active pull-request rule requiring an independent approval, stale-review dismissal, conversation resolution, force-push/deletion protection, or an auditable break-glass actor. Therefore those chore(governance): protect main and enforce release checks #27 acceptance criteria remain FAIL CLOSED rather than unverified-by-API.

This means the repository can now distinguish two facts explicitly: the central Security Scan workflow is live-enforced by organization ruleset, while the broader independent-review / PR-only / stale-review / conversation / branch-mutation governance contract required by this issue is not presently enforced by the visible live rules. PR #90 remains repository-owned audit/documentation work, but merging source cannot itself create the missing GitHub ruleset controls.

No existing green check, model review, COMMENTED review, or repository audit should be promoted to the missing governance evidence.

Fresh live-governance correction (2026-08-11 UTC): the repository connector now exposes the effective organization ruleset directly, so the older “connector cannot expose live rulesets” premise is stale. Ruleset 18794436 (CWL Noema central security scan) is active on ~DEFAULT_BRANCH, has no bypass actors (current_user_can_bypass=never), and its only configured rule is the required workflow ContextualWisdomLab/.github/.github/workflows/security-scan.yml@refs/heads/main. The currently observed live ruleset does not contain a pull-request/review-count rule, stale-review-dismissal rule, conversation-resolution rule, or an independently counted approval requirement.

Operational consequence: formal independent approval is not a current merge requirement merely because older Noema issue/PR prose says it is. Checks, reviews, scanner evidence, and model judgement remain separate evidence, but merge classification must follow the live ruleset actually observed at decision time. #90 therefore must not be merged on the assumption that its positive-review-count policy describes current governance; it remains a proposed/hardening contract until live policy is deliberately changed by authorized governance action.

This does not close #27: the broader desired controls (PR-only flow/direct-push rejection, review/conversation semantics if intentionally adopted, force-push/deletion behavior, and behavioral proof) remain unproven or absent. It does remove the stale “live ruleset unavailable / approval necessarily blocks every merge” conclusion from current queue decisions.

Fresh 2026-08-12 live-governance revalidation after protected-main advance: main is now exact cd40474b258f9512d93ce82f5375071ce1f78762. The repository rulesets endpoint still returns exactly one active applicable organization ruleset, CWL Noema central security scan (id=18794436). Exact detail still targets ~DEFAULT_BRANCH, has no bypass actors, reports current_user_can_bypass="never", and contains only the required workflow .github/workflows/security-scan.yml from central repository id 1274066402 at refs/heads/main. Central .github remains exact 6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba.

Operational consequence remains unchanged and should govern current merge classification: independent formal approval is not presently an enforced live merge requirement. Approval/review-count, PR-only, stale-review dismissal, conversation-resolution, force-push, and deletion rules remain desired target controls, not observed current rules. The required central Security Scan is the enforced live rule. Repository-local ci/reviewer-ci remain quality evidence and should still be required by Noema's own acceptance contract where applicable, but missing APPROVED review must not be fabricated as a live ruleset blocker. Re-evaluate every merge candidate against this fresh live state and its current exact head/base; old PR-body governance claims are stale.

Fresh live-governance evidence (2026-08-25): the repository-effective ruleset inventory is now readable for ContextualWisdomLab/noema. On protected main@2c83355529447248c246805d1954f268e027d2ab, GET /repos/ContextualWisdomLab/noema/rulesets returned one active organization-sourced branch ruleset: id 18794436, name CWL Noema central security scan, source ContextualWisdomLab, enforcement active (created/updated 2026-07-10). This supersedes the issue body's statement that no ruleset inventory read is available.

The current connector still does not expose the ruleset-detail payload through the supported fetch surface, so this observation does not establish bypass actors, approval counts, stale-review dismissal, conversation resolution, non-fast-forward/deletion controls, or the exact required-check rule body. Those details remain fail-closed/non-authoritative until a supported detail read or behavioral proof is retained. Do not infer stronger governance from the inventory row alone.

2026-09-23 fresh commercial-governance authority update: source lane #730 current is e58f41198f6f723c0318c075e8869edff1395c4f. Focused review found a test-contract false confidence in the malformed-successor Noema review fixture: its supposed predecessor approval still used the rejected bare credential form, so null assertions could pass for the wrong reason. RED 9ed61359102d3604dfa700ce57462a1f717d684c requires that predecessor alone establish approve; repair 60005b02ef3ab790b8a936c127a32dad2ac45b7b canonicalizes predecessor/malformed-successor fixture serialization; e58f4119… records the Proposed decision. Production admission remains d303a9ed… and was not weakened. Documentation lane #729 current is 59ce2fbb5df3c123b0d8f9be8d9a1f51fac0247d: all executable authority fixtures now bind e58f4119…, but active baseline/P0 still presents d64cf54f…, so #729 remains RED. This source/test/docs work does not close issue #27 live ruleset, PR/review/conversation/history/deletion/bypass control-plane evidence.

2026-09-23 KST documentation-authority follow-up: #729 current exact 6a866eb87d38ef86d320ea137de1a0512b4f2073 repairs an archive-split regression that left protected-lineage executable tests reading the shortened active commercial register. RED b145ab8b74130c0ff65c4dbf4b46d509f4ea0219 makes reader ownership executable; protected-lineage assertions now read docs/history/product-technical-gap-baseline-20260921.md, while live workflow/concurrency admission and current governance authority remain bound to active docs/product-technical-gap-baseline.md. The active register/P0 row now follows #730 current e58f41198f6f723c0318c075e8869edff1395c4f. This does not close issue #27 control-plane evidence (ruleset, PR/review/conversation/history/deletion/bypass) and is not merge/release authority; #729 current hosted gates are still nonterminal.

2026-09-23 KST commercial-authority successor update: #730 current exact is 58fe85603548b3a901fb668bc971dd19a5b5d694. RED c20214d4f91c37c921ea0ab3c0a22d4aebc158d7 demonstrated that the whitespace-permissive Noema marker grammar accepted publisher-invalid extra-space/newline variants; production repair 7bca1164cc2ccd880810e13a25cfdc24dea37c76 now admits only the literal single-line publisher marker serialization, and current doctoring records the decision/TRACEABILITY. #729 current 58bb3862affeaea57fb3dd7864b5b29aaf784e94 ordinary-forward converges the active baseline/P0 row and authority fixtures to that exact contract. This is source/test/documentation evidence only: issue #27 still owns live ruleset, pull-request, review/conversation, history, deletion and bypass control-plane evidence; no external admin control, hosted terminal GREEN, release or deployment authority is created.

2026-09-23 KST fresh commercial-readiness finding: #730 current RED e003ec81fe7f9d3890b54cac2525fdbe6c01c360 adds a regression contract for Noema formal-review live-base authority. ADR-0003 already records that head and base identities can diverge without a head change. The current commercial loop binds workflow/check evidence to PR/head/base and revalidates the evaluated base before merge, but its Noema review parser binds the formal review only to reviewer identity + review.commit_id/head + exact marker/credential/state. Reviewer ReviewManifest already contains base_sha; publisher body and publication preflight do not carry/revalidate it. The live repository-effective ruleset 18794436 contains only the central Security Scan required-workflow rule and therefore does not supply stale-review dismissal. GitHub documents merge-base-change approval dismissal only when the corresponding stale-review/most-recent-review policy is enabled. Consequently an approval evaluated against base A can remain application-level Noema authority after base moves to B with unchanged head unless Noema itself binds the reviewed base.

RED e003ec81… is one added hostile contract file only (58fe8560… -> e003ec81…, +86/-0). Minimum causal GREEN: thread manifest.base_sha through reviewer publication, exact-serialize it in the publisher-owned suffix next to credential/marker, re-read live {state, head, base} immediately before review POST, and require current snapshot baseSha in parseNoemaReviewDecision. This is repository-side review admission evidence only; issue #27 retains live governance policy authority and the existing unchecked live-policy acceptance item for stale-approval dismissal remains unchanged. No self-approval, force update, rerun/cancel, runner change, or gate weakening was used.

2026-09-23 commercial successor update: #730 current source/test/doc exact 11f3b6dda190f4a70dcc09951bf2009330f6e320 ordinary-forward closes the Noema review live-base authority gap. The review protocol now requires exact reviewer/login/state/commit_id plus the evaluated base SHA in publisher-owned serialization; publisher revalidates live state/head/base immediately before posting. A focused test-contract false confidence was also repaired at 36d5264b…: the legacy head-only negative fixture now passes the current base explicitly to the four-argument parser instead of returning null through argument misbinding. #729 current dd68d2f0fc5ae94b4a3b4407ee508f7cf92e031f converges the active commercial baseline/P0 row and five sibling authority fixtures to the same #730 exact/evaluated-base contract. This does not transfer live ruleset/pull-request/review/conversation/history/deletion/bypass authority from issue #27, and source convergence is not hosted/review merge authority.

Current authority supersession — 2026-09-24 KST

This comment supersedes only the exact-head/run fields in the issue body; it does not replace the issue’s governance acceptance history or owner boundary.

Fresh independent review of #730 predecessor caeeee70de9221b582cb2b9e0e2c1b77b9c10d27 found a valid test-contract RED in reviewer/tests/test_github_io.py: production publish_verdict() now raises Noema refused stale-revision review publication: ..., while the test still matched the obsolete refused stale-head text. Ordinary-forward repair c3ff399e2b150383768ff8b278b136b25f48e806 fixed that expectation; preservation inspection then caught one unrelated assertion changed by the whole-file write, and 09e795db5801b4d2cd8453f0e0d2f06b30189d59 immediately restored it without force. Exact compare caeeee70… → 09e795db… is 2 commits / 1 file / net +1/-1, so the final tree changes only the stale-publication regex. Production governance/publication authority is unchanged.

Current #730 exact is therefore 09e795db5801b4d2cd8453f0e0d2f06b30189d59, Draft/open/mergeable on protected source main@ca32ae2eb8c5ce73af2769d6a58a7ac714503251. Fresh runs are ci 35931729399, reviewer-ci 35931729461, required Security Scan 35931729476, and patch-validator-image 35931729396; all are currently queued. Owner evidence is COMMENT only. A fresh current-exact independent/formal Noema review has been requested and predecessor review evidence is not current merge authority.

#729 remains ed64dc9bd85244f64c5f0c3a477028e536908246 but is now an explicit stale-authority RED because its active baseline/P0 row and six executable authority fixtures still consume #730 caeeee70…. Its archive/current ownership repair remains valid; it requires ordinary-forward convergence to #730 09e795db… plus fresh hosted/review evidence before any merge consideration.

Issue #27 continues to own ruleset/pull-request/review/conversation/history/deletion/bypass control-plane authority. No self-approval, force update, destructive rebase, rerun/cancel substitution, no-op wake commit, runner-selector change, or gate weakening was used.

#729 stale-authority RED repaired — current exact `08e6322`

The stale #729 state recorded in the preceding authority comment is now ordinary-forward repaired. #729 moved from ed64dc9bd85244f64c5f0c3a477028e536908246 to 08e63220aa06dd1d7c758cacbbe3bf7782c5c6e2 by one non-force commit. Exact compare is 7 files only: active docs/product-technical-gap-baseline.md (+3/-3) plus the six executable authority fixtures. The active open-lane marker, P0 governance candidate, successor/post-#726/review-head/review-state/Commit Status/current-authority fixtures now all consume #730 current exact 09e795db5801b4d2cd8453f0e0d2f06b30189d59; the extra baseline delta only records that 09e795db… is the preservation repair for the stale-publication expectation.

No historical archive, production governance implementation, provider/domain/quarantine/outbound authority, or issue #27/#29/#73 ownership moved. #729 remains Draft/open/mergeable. Its current exact hosted runs (ci 35933606197, reviewer-ci 35933606111, required Security Scan 35933606225, patch-validator-image 35933606091) are queued/nonterminal, and the owner exact-head review is COMMENT only. A fresh independent current-head review was requested for 08e63220…; predecessor review/check evidence is not merge authority.

#730 remains 09e795db5801b4d2cd8453f0e0d2f06b30189d59, Draft/open/mergeable with its hosted runs still queued. Issue #27 continues to own ruleset/pull-request/review/conversation/history/deletion/bypass control-plane authority. No self-approval, force update, destructive rebase, rerun/cancel substitution, no-op wake commit, runner-selector change, or gate weakening was used.

Hosted-evidence refresh — unchanged #729 exact `08e63220aa06dd1d7c758cacbbe3bf7782c5c6e2`

Fresh exact-head re-read after the independent-review request shows a newer same-head pull-request run set: ci 35937027430, reviewer-ci 35937027412, required Security Scan 35937027485, and patch-validator-image 35937027246. All four are queued/nonterminal. The #729 source head did not move, all visible review threads remain resolved, and CodeRabbit accepted the explicit current-head review command; no completed independent/formal current-head review is present yet.

This supersedes only the #729 hosted run IDs in the immediately preceding comment. It does not change the repaired authority tuple, issue #27 ownership, or merge conditions. No rerun/cancel, no-op wake commit, runner-selector change, self-approval, force update, or gate weakening was used.

2026-09-24 KST authority supersession after hosted exact-head execution.

#730 predecessor 09e795db5801b4d2cd8453f0e0d2f06b30189d59 received assigned hosted runners. Application CI 35931729399 failed the direct-JSDoc contract fixture because its declaration parser stopped at the function token and therefore misclassified an already-documented export function latestCheckRunsBySuite(...). reviewer-ci 35931729461 ran 733 tests successfully but failed the configured 100% coverage gate at the production default publisher branch (cli.py:403) and evaluated-base review-body serialization (github_io.py:766). These are repository-owned test/evidence-contract REDs, not runner-assignment failures.

Ordinary-forward #730 repair is now 17b3191d16ffccb956275b66b071d727b207be2b: the JSDoc oracle binds optional export/async modifiers to the declaration, and two focused reviewer regression tests cover default publisher evaluated-base propagation and base-SHA review-body serialization. Production merge/review/workflow authority is unchanged. New exact-head runs ci 35954334468, reviewer-ci 35954334550, Security Scan 35954334682, patch-validator-image 35954334496 are nonterminal and therefore not GREEN.

#729 08e63220aa06dd1d7c758cacbbe3bf7782c5c6e2 still names predecessor #730 09e795db…; it is now an explicit stale docs-to-code authority lane and must converge only after the current #730 exact is stable. Issue #27 continues to own ruleset/pull-request/review/conversation/history/deletion/bypass control-plane authority; this source repair does not create admin, release, deployment, or foreign-owner evidence.

Current source supersession (2026-09-24 KST): governance-admission candidate #730 is now 1cfc08e0be9b922ba332825f1327a728afd28a8c on protected base main@ca32ae2eb8c5ce73af2769d6a58a7ac714503251. Predecessor 17b3191d… reached assigned hosted execution; reviewer-ci and patch-validator succeeded and CI exposed one repository-owned direct-JSDoc test-oracle RED. The ordinary-forward repair changes only test/commercial-readiness-production-docstrings.test.ts (+1/-1), accepting concrete status|chronology contract vocabulary without production/governance weakening. Fresh current-head hosted runs are nonterminal and current formal review authority is not yet satisfied, so no Ready/normal-merge authority is asserted. #729 remains a stale downstream documentation-authority consumer until this foundation exact is stable.

2026-09-24 KST supersession — source authority moved again without changing protected main@ca32ae2eb8c5ce73af2769d6a58a7ac714503251. #730 current exact is now 2f5adbfe1690025d1bacb565923e0d5681531b13. Fresh independent review on predecessor 1cfc08e0… found the production-docstring semantic oracle admitted generic keyword-only JSDoc. Test-first lineage is RED af1bfe80… → insufficient two-term repair 485c443e… → follow-up RED 17298a42… (Returns the current status still false-passed) → final action+authority/evidence-boundary GREEN 64ebbaa7… → current Proposed doctoring 2f5adbfe…. Production merge-admission behavior and the 38-function scope did not change. Current hosted runs are ci 35979311598, reviewer-ci 35979311601, required Security Scan 35979311592, patch-validator-image 35979311612, all nonterminal at this observation. The predecessor inline finding is resolved, but this exact still lacks current-head independent/formal review and hosted terminal GREEN. #729 remains 08e63220…, hosted GREEN but source-stale because it consumes an older #730 authority; do not transfer that GREEN to its future convergence successor. No self-approval, rerun/cancel substitution, force update, selector change, no-op wake commit, or gate weakening was used.

Current-source supersession, 2026-09-24 KST: #730 advanced ordinary-forward from 2f5adbfe1690025d1bacb565923e0d5681531b13 to 660a8cc2f860c3dc7e3e2e9ea5e5034997b9e389 after a separate owner audit found that the production-docstring oracle could treat a semantic JSDoc followed by an unrelated block comment as direct. RED ed80b497c00a22be89a9d11085b8a3ce0fdd9baa fixes the hostile case in evidence; GREEN 291a60ce77587e647a3bf09e90cbc5eddfc99b09 requires the JSDoc's first closing delimiter to be exactly the trimmed declaration-prefix end; 660a8cc2… records Proposed doctoring. Compare 2f5adbfe… → 660a8cc2… is 3 commits / 2 files and does not change production merge-admission source or the 38-function scope. New exact hosted runs ci 35985432304, reviewer-ci 35985432309, required Security Scan 35985432272, patch-validator-image 35985432318 are nonterminal; fresh current-head independent review was requested. #729 08e63220… remains source-stale against this #730 exact despite predecessor GREEN and is not merge authority. No self-approval, gate weakening, rerun/cancel substitution, force update, or release claim.

Live authority supersession — #730은 ordinary-forward로 current exact **7f9d1264c513934cb55eeaa7a02ce506eac16a61**까지 전진했습니다. Fresh independent review가 predecessor 660a8cc2…의 direct-JSDoc oracle에서 line-comment JSDoc-lookalike false PASS를 확인했고, RED ddcc8ad0… → GREEN fc4f1b6c… → Proposed doctoring/current 7f9d1264…로 수리했습니다. 660a8cc2… → 7f9d1264…는 3 commits / 2 files이며 production source와 38-function scope, merge-admission authority는 unchanged입니다. #729 08e63220…는 네 hosted workflow가 GREEN이지만 active #730 exact authority가 stale하므로 merge authority가 아닙니다. Current #730 hosted gates와 fresh current-head independent/formal review는 별도 evidence이며 predecessor GREEN/review를 재사용하지 않습니다. 이 comment는 release/deployment 또는 stronger live governance completion을 주장하지 않습니다.

2026-09-24 KST additive supersession — current open authority has moved again; prior body exacts remain historical point-in-time receipts.

Protected source is still GitHub-verified main@ca32ae2eb8c5ce73af2769d6a58a7ac714503251; classic protection remains disabled/required-status enforcement off, so this does not broaden live governance claims.
fix: require canonical governance and normal-merge authority #730 is now Draft at exact 8bb181f5c51c814507df2721bc69567e36f190ae. Fresh owner audit found a declaration-token false PASS in the direct-JSDoc oracle: predecessor 7f9d1264… located function declarations with raw-text regex and could mistake template-literal function ... text for the production declaration. RED 223187b1… fixes the hostile case; GREEN 42183f7d… binds declaration authority to an actual TypeScript FunctionDeclaration AST node; current 8bb181f5… adds Proposed doctoring. 7f9d1264… → 8bb181f5… is ordinary-forward 3 commits / 2 files and does not change production merge-admission source or the 38-function scope.
Fresh fix: require canonical governance and normal-merge authority #730 exact runs are ci 35996542730, reviewer-ci 35996542701, Security Scan 35996542754, patch-validator-image 35996542750; all are nonterminal. Owner evidence is COMMENT only. No current-head formal Noema approval is asserted.
docs: converge current commercial authority baseline #729 remains Draft at 08e63220aa06dd1d7c758cacbbe3bf7782c5c6e2. Its four hosted workflows are historical GREEN for that revision, but its active authority fixtures consume a fix: require canonical governance and normal-merge authority #730 predecessor, so it is stale against 8bb181f5… and must not merge or reuse predecessor GREEN as successor evidence.

No force/destructive update, self-approval, rerun/cancel substitution, selector change, no-op wake commit, gate weakening, release/deployment claim, or foreign-owner authority transfer is introduced by this supersession.

Additive supersession — #730 current governance candidate is now 4ba169dd652c547786a314b7b0129fa11d563086. Fresh owner audit found a direct-JSDoc comment-token false PASS in predecessor 08fcf733…: raw-text matching could treat /** ... */ text nested inside a regular block comment as JSDoc. RED 19ba7993…; GREEN 15d54e25… binds comment identity to TypeScript leading-comment tokens on the actual top-level declaration; current adds Proposed doctoring. Production governance behavior is unchanged. #729 remains stale until this exact is hosted-stable/current-head-reviewed.

Navigation Menu

Repository navigation

chore(governance): protect main and enforce release checks #27

Live governance authority — 2026-09-24 KST

Acceptance criteria

Live ruleset / branch governance

Repository-owned governance audit

Behavioral proof for stronger target policy

Current blocker boundary

Implementation gate: PR #31

2026-08-09 repository-owned governance-audit and guidance gap

81 remaining items

Current authority supersession — 2026-09-24 KST

#729 stale-authority RED repaired — current exact `08e6322`

Hosted-evidence refresh — unchanged #729 exact `08e63220aa06dd1d7c758cacbbe3bf7782c5c6e2`

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

chore(governance): protect main and enforce release checks #27

Description

Live governance authority — 2026-09-24 KST

Acceptance criteria

Live ruleset / branch governance

Repository-owned governance audit

Behavioral proof for stronger target policy

Current blocker boundary

Activity

seonghobae commented on Aug 3, 2026

Implementation gate: PR #31

seonghobae commented on Aug 5, 2026

seonghobae commented on Aug 9, 2026

seonghobae commented on Aug 9, 2026

2026-08-09 repository-owned governance-audit and guidance gap

seonghobae commented on Aug 11, 2026

seonghobae commented on Aug 11, 2026

seonghobae commented on Aug 11, 2026

seonghobae commented on Aug 24, 2026

81 remaining items

seonghobae commented on Sep 23, 2026

seonghobae commented on Sep 23, 2026

seonghobae commented on Sep 23, 2026

seonghobae commented on Sep 23, 2026

seonghobae commented on Sep 23, 2026

seonghobae commented on Sep 23, 2026

Current authority supersession — 2026-09-24 KST

seonghobae commented on Sep 24, 2026

#729 stale-authority RED repaired — current exact 08e6322

seonghobae commented on Sep 24, 2026

Hosted-evidence refresh — unchanged #729 exact 08e63220aa06dd1d7c758cacbbe3bf7782c5c6e2

seonghobae commented on Sep 24, 2026

seonghobae commented on Sep 24, 2026

seonghobae commented on Sep 24, 2026

seonghobae commented on Sep 24, 2026

seonghobae commented on Sep 24, 2026

seonghobae commented on Sep 24, 2026

seonghobae commented on Sep 24, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

#729 stale-authority RED repaired — current exact `08e6322`

Hosted-evidence refresh — unchanged #729 exact `08e63220aa06dd1d7c758cacbbe3bf7782c5c6e2`