governance: harden effective develop ruleset and remove routine admin bypass

Live Orgmetra governance defect — effective control plane

Protected develop@eb9757f8649aaad026a9865508d9aad50c1a7a4f remains governed by inherited organization ruleset 18156473 — CWL Central required workflows.

Fresh live ruleset retrieval on 2026-09-21 confirms:

required_approving_review_count = 1;
required_reviewers = [];
code-owner review disabled;
last-push approval disabled;
stale-review dismissal on push enabled;
review-thread resolution required;
extra approval for unattributed changes enabled;
merge/squash only;
the seven central required workflows enforced;
deletion and non-fast-forward protection enforced; and
OrganizationAdmin remains an always bypass actor.

Routine administrator bypass, self-approval and bot/model-as-human approval remain non-authorizing.

Current accepted central policy

This issue's older prose treated the absence of an independent human approval as if it were a permanent leaf acceptance requirement. That is no longer the accepted central owner direction.

ContextualWisdomLab/.github#772 now owns the one-human-maintainer governance repair. Its current accepted solo-maintainer contract is:

generic approving-review count 0 while no genuinely independent human reviewer exists;
last-push approval false;
same-author CODEOWNER approval disabled;
no synthetic required reviewers;
stale-review dismissal and review-thread resolution retained;
deterministic central workflows/security/evidence retained;
merge/squash only;
deletion/non-fast-forward protection retained; and
routine bypass actors forbidden, with any emergency path separately governed/time-bounded.

This does not weaken product/security/scientific evidence. It removes only the structurally impossible generic human-approval gate for the accepted one-human-maintainer operating model.

Canonical central owner path

Closed .github#1176 is not the current writer. It explicitly handed the retained governance contract to successor .github#1644 — fix(governance): automate ruleset owner-plane reconciliation.

Fresh central reads show:

protected .github/main@e6334e229581a918e2f22de18733b76fa65d7e71;
#1644 exact head 722fec9de67aece7500993ee2999b21df0fab83b, open · Draft · non-mergeable;
fresh compare against current central main: diverged, 252 ahead / 277 behind, merge base fb17ef556f94f673234aa557254ae52779e9a7b0;
#1644 therefore needs an ordinary/non-force current-main reconciliation before any source integration or live settings apply;
its historical exact-tree GREEN does not transfer to that future reconciled descendant; and
live ruleset 18156473 still has approval count 1 plus OrganizationAdmin/always, so the owner plane has not converged.

#1644 also records the privileged apply boundary: source merge alone cannot mutate live organization settings. Actual reconciliation requires the separately governed owner-plane identity/maintenance path, exact live-state/history verification and post-write audit. Orgmetra must not copy that source or emulate the privileged mutation locally.

Current Orgmetra canary

PR #96 is now exact f2c6e70edcf5c62ae0f848c29efd7bd3b8d45b97, directly based on protected develop@eb9757f..., open · Draft · mergeable=true.

Its current exact-head evidence is useful as a consumer canary but does not change the central policy defect:

Foundation and SAST are terminal success on the exact head;
Security still fails closed at central Dependency Review support and remains owned by .github#810;
CodeQL still reproduces central producer/consumer settlement ordering and remains owned by .github#2040;
Strix's workflow is terminal success but its artifact lacks authoritative repository/PR/exact-head/materialized-scope terminal provenance, so the hollow-success class remains owned by .github#891/#1563;
all visible inline review threads are resolved; and
there is no qualifying human APPROVED review, but under the accepted #772 policy that absence should cease to be a generic merge blocker only after the live ruleset is actually reconciled to approval count 0. Until then it remains a literal live-ruleset blocker, not a product-quality requirement to work around.

A successful/neutral check name is not a substitute for the canonical evidence contract behind that check.

Required repair order

.github#1644 ordinary/non-force reconciles current protected central main, preserving intervening protected changes and retained governance delta.
Reacquire exact-head/current-base central security/review/audit evidence from zero; no historical transfer.
Integrate the canonical owner-plane source normally.
Through the separately authorized owner-plane maintenance path, reconcile live organization ruleset 18156473 to the accepted solo-maintainer contract: approval count 0, no synthetic reviewer, no routine OrganizationAdmin/always, deterministic workflow/thread/deletion/non-fast-forward controls preserved.
Re-read the full live payload/history and run canonical audit.
Re-run an unchanged deterministic-GREEN Orgmetra canary through the ordinary protected path without self-approval or routine bypass.

Acceptance criteria

Effective default-branch PR enforcement remains protected.
Deterministic central workflow identities and their underlying evidence contracts remain material and exact.
Thread resolution, stale-review handling as applicable, deletion and non-fast-forward protection remain enforced.
Self-approval, bot-as-human approval and synthetic reviewers remain unused.
Generic human approval count is not structurally impossible for the actual maintainer model; under current accepted #772 policy that means count 0 while no independent eligible human exists.
OrganizationAdmin/always is not a routine bypass path.
Central owner source and live ruleset state converge through #1644's successor/current-main path, not through an Orgmetra leaf workaround.
Any central policy/workflow or Orgmetra head change invalidates stale canary evidence and requires fresh exact-head verification.
No release/version/tag is authorized until one exact integrated protected head satisfies governance, product, security, recovery and release evidence.

Keep this issue open until the live owner plane converges and an ordinary protected Orgmetra canary proves the resulting path. A source-only central PR, a green check label or an administrator merge is not completion.

Fresh owner-boundary verification on develop@9e3e4847510e1e612b48474ba42b177b8ed824df still reports protected: true while the effective branch-protection payload remains protection.enabled=false, required-status enforcement off, and required contexts/checks empty. This is therefore still an enforceability defect, not a CI-result defect. The currently available GitHub write surface in this Orgmetra loop exposes repository/branch/file/PR/issue mutations but no branch-protection or ruleset mutation endpoint, so there is no safe in-loop settings repair path to execute without bypassing the owner-control boundary. Acceptance remains unchanged: configure an enforcing branch protection/ruleset with PR-only integration, current-head required gates, independent non-author approval, stale-approval dismissal, required conversation resolution, and no routine force-push/delete/admin bypass; then refetch this exact payload (or equivalent ruleset evidence) and close only after enforcement is proven.

Fresh owner-control evidence (2026-08-23): develop remains at 9e3e4847510e1e612b48474ba42b177b8ed824df. GitHub still reports the branch as protected: true while its effective protection payload has protection.enabled=false, required-status enforcement off, and empty required contexts/checks. New PR #92 demonstrates that exact-head Foundation/SAST/Security/Recovery and feature-specific workflows materialize normally, so the first causal boundary remains repository branch/ruleset configuration rather than CI generation. Acceptance remains unchanged: enforce PR-only integration, exact-head required checks, qualifying independent non-author approval with stale-approval dismissal, resolved conversations, and no force-push/delete/admin bypass. Current connected GitHub actions expose no branch-protection/ruleset mutation path, so no weaker workflow workaround was introduced.

Fresh owner-boundary evidence (2026-08-23): develop remains 9e3e4847510e1e612b48474ba42b177b8ed824df. The live branch API still reports protected: true while the effective payload remains protection.enabled: false, required-status enforcement off, and required contexts/checks empty. This run also produced a fresh independent feature lane proving that exact-head gates themselves are functioning: PR #93 at bbb106aceeda3a3ac2ebf5caead9e174a9dbe21f has terminal-success Performance Context Evidence Quality 32615403552, Foundation CI 32615403537, Recovery 32615403519, SAST 32615403551, and Security 32615403560; its focused job checked out that exact SHA and passed 44 installed-wheel tests at exact 100% owned statement/branch coverage. Therefore the first causal boundary remains repository branch/ruleset configuration, not CI generation. #93, like the older GREEN root lanes, has no qualifying independent non-author APPROVE and was not merged. The currently available GitHub write surface exposes no branch-protection/ruleset mutation action; do not substitute workflow weakening or direct integration. Acceptance remains: configure an enforcing PR-only rule/ruleset with current-head required checks, independent non-author approval and stale-approval dismissal, required conversation resolution, and no force-push/delete/routine admin bypass; then prove enforcement with a fresh live read before closing this issue.

Fresh owner-control evidence from PR #97 (197bd12d39c35628430f18eae27c72294cfdcd03): Workforce Intelligence 32631272145, Foundation 32631272173, People API 32631272138, Job-Analysis API 32631272099, Recovery 32631272124, SAST 32631272130, and Security 32631272143 are all terminal success on the unchanged exact head. Workforce exact-head job 97174360178 checked out that SHA, passed 186 HRIS-kernel tests, 785 owned statements / 318 branches at 100% statement+branch coverage (vacancy.py 80 / 30 at 100%), and clean checkout. PR #97 is now non-draft, mergeable, and has no submitted review/unresolved thread, but remains intentionally unmerged because there is no qualifying independent non-author APPROVE and the live develop branch payload still needs enforceable protection per this issue. These GREEN results are evidence only; they are not a substitute for required settings-level enforcement.

Fresh owner-control evidence: develop@9e3e4847510e1e612b48474ba42b177b8ed824df remains the live base while PR #98 feat(document-records): add governed HR document evidence is now ready-for-review and mergeable at exact head 9aeeb204acce429f85b028029c9531a5b05f37e1. Exact-current-head Document Record Evidence Quality 32633266715, Foundation CI 32633266676, Recovery Rehearsal 32633266737, SAST Semgrep 32633266694, and Security Scan 32633266778 are all terminal success; the focused installed-wheel lane passed 22 tests with 119 owned statements / 22 branches at exactly 100% statement/branch coverage and a clean checkout. Fresh review/thread reads show no submitted review and no unresolved thread, so there is still no qualifying independent non-author approval. This is additional buyer-impact evidence only, not a substitute for enforceable protection: the owner acceptance criteria in this issue remain unchanged, and no workflow-based protection simulation or bypass was introduced.

Fresh owner-control evidence from PR #99 (feat/employment-compensation-core): exact head ba8c8c086bf71fc6eaf0dc2d79c4755e9286f7cd is mergeable and now ready-for-review after all applicable exact-head runs reached terminal GREEN — Employment Compensation Core Quality 32640401074, Foundation CI 32640401069, Recovery Rehearsal Quality 32640401059, Job-Analysis API Quality 32640401052, SAST Semgrep 32640401088, Security Scan 32640401080. Fresh review/review-thread queries are empty, but there is still no qualifying independent non-author approval. The live develop branch endpoint continues to report protected:true while effective protection shows enabled:false, required-status enforcement off, and empty required contexts/checks. Therefore #99 remains intentionally unmerged; this is additional concrete buyer-impact evidence for this repository-governance owner boundary, not a request to weaken or emulate protection in workflow code.

Fresh owner-boundary verification on develop@9e3e4847510e1e612b48474ba42b177b8ed824df still returns protected:true while effective enforcement remains protection.enabled=false, required-status enforcement off, and required contexts/checks []. Current exact-head work reinforces that this is settings/ruleset ownership, not a missing-CI problem: PR #99 at 9484b733b1349588ba1482d19a5c255fec1cf2e6 has feature/Foundation/SAST/Security/Recovery/related quality workflows materialized but currently queued/pending after a real compensation-integrity repair; PR #46 at 049a4f3898a739838d09cca74a79aad7ed4218b5 likewise has its exact-head quality suite materialized after a review-driven public-contract repair. Neither lane is allowed to inherit predecessor GREEN or merge. The connected GitHub surface still exposes no branch-protection/ruleset mutation endpoint, so do not replace settings enforcement with workflow simulation. Acceptance remains PR-only integration, exact-current-head required gates, qualifying independent non-author approval with stale-approval dismissal, required conversation resolution, and no routine force-push/delete/admin bypass; close only after a fresh live settings/ruleset read proves enforcement.

Fresh owner-control correction/evidence:

PR fix(compensation): add employment-scoped bitemporal base compensation #99's earlier 09dc313... GREEN/ready evidence is now predecessor-only. Fresh exact-head execution at 9484b733b1349588ba1482d19a5c255fec1cf2e6 exposed two Orgmetra-owned failures: Compensation Quality 32647916839 skipped canonical migration 0002 in its focused harness and failed on missing is_operational_uuid(uuid); Recovery 32647916853 failed deterministic manifest validation after compensation workflow/schema/docs drift. Root repairs are now on the same canonical branch: 6247c6f94439ca980d3b2ba3b2c6178167730cc1 loads migration 0002 in the focused PostgreSQL harness, and current exact head e4ee0e20ed363233f7d5a526961ae1288b058c2f reseals the exact manifest evidence. New exact-head workflows are materialized but still queued/pending, so fix(compensation): add employment-scoped bitemporal base compensation #99 is correctly Draft and not currently merge-ready.
PR docs: maintain durable product-technical gap baseline #100 exact head d1ae16efcfa03c1a21c0ca9d0a91dcfdfa456a89 now has Foundation 32647321201, Recovery 32647321198, SAST 32647321199, and Security 32647321197 terminal GREEN, all four verified Codex defect threads resolved, no current unresolved defect, and has been advanced to ready-for-review. It still has no qualifying independent non-author APPROVE.

The repository-level protection defect itself is unchanged: develop remains externally marked protected while the effective payload has protection disabled, status enforcement off, and an empty required-check set. These PR states are evidence for restoring actual enforcement, not substitutes for it.

Fresh owner-control evidence: new Orgmetra-only PR #103 (feat(hris): add governed Employment work-capacity review) is now at exact head af7dd8c4bda2fe177ebcb11590dd0775ccc4ef42 against unchanged develop@9e3e4847510e1e612b48474ba42b177b8ed824df. The lane is intentionally Draft because its exact-head Employment Work Capacity Review/Foundation/Recovery/SAST/Security runs are currently queued/pending and therefore non-passing. A self-review regression also closed signed negative-zero ambiguity so zero capacity has one canonical 0.0000 representation. This is another buyer-facing lane whose future merge must remain contingent on qualifying independent non-author approval plus actually enforceable develop protection; exact-head CI is evidence for restoring protection, not a substitute for the missing repository/ruleset enforcement.

Fresh owner-control evidence, 2026-08-24: develop remains 9e3e4847510e1e612b48474ba42b177b8ed824df; GitHub still reports the branch as protected while the effective protection payload remains disabled with required-status enforcement off and no required contexts/checks. PR #99 was found stale-Draft despite unchanged exact head fff082f56e34e47cb83a19316d132c5638d3b633, all eight applicable exact-head workflows terminal GREEN, no qualifying APPROVE/CHANGES_REQUESTED, and only informational unresolved threads; it has been restored to ready-for-review, not merged. New Orgmetra PR #104 is Draft at exact head 4c42b422fbca9d4bc79c04b67f778632d0be2aca; its dedicated qualification-rule review/Foundation/Recovery/SAST/Security workflows are materialized but queued, so no predecessor evidence is promoted. This reinforces the acceptance requirement here: enforce protection at the repository/ruleset owner boundary rather than simulating it in feature workflows.

Fresh owner-control evidence (2026-08-24): live develop is still 9e3e4847510e1e612b48474ba42b177b8ed824df. GitHub still reports protected:true while the effective payload remains protection.enabled=false, required-status enforcement off, and required contexts/checks empty. This run also corrected PR #99 from stale Draft back to ready-for-review on unchanged exact head fff082f56e34e47cb83a19316d132c5638d3b633, whose Compensation/Foundation/Recovery/SAST/Security/Job-Analysis/Requisition/Selection exact-head gates are all terminal GREEN. PR #104 is likewise unchanged, ready/mergeable and all exact-head gates GREEN at d92ac4cb798b3bd32b632c0ab677c03f944070e4, but has no qualifying independent non-author approval. New stacked descendant #105 is intentionally Draft and therefore not merge evidence; its focused qualification-rule persistence contract is GREEN only on descendant head 168f19402b3b17762cfe60f8a0e93c649a082989 and must be retargeted/revalidated after #104 integrates. These facts continue to isolate the first repository-level blocking boundary to enforceable branch/ruleset configuration plus independent-review capacity, not CI generation. Acceptance remains: enforce PR-only integration, current-head required checks, qualifying independent non-author approval with stale-approval dismissal, resolved conversations, and no force-push/delete/routine admin bypass; then refetch live enforcement before closing this issue. The currently exposed GitHub write actions still provide no branch-protection/ruleset settings mutation path, so no workflow workaround or protection weakening was introduced.

Fresh 2026-08-24 owner-control evidence: develop remains 9e3e4847510e1e612b48474ba42b177b8ed824df; branch API still reports protected:true while effective protection remains enabled:false, required-status enforcement off, required contexts/checks []. New stacked PR #106 (feat/position-reporting-persistence) is currently Draft/mergeable at exact head c5dd5e5890ecd0c8961da17ff64d99d210d5703f on parent #94 3f67182bb3065f2fc8fd974bfdd75a390d8a8fdc; its exact-current-head Position Reporting Persistence Quality run 32682659998 is queued/non-passing, and #106 has no submitted review or review thread. Parent #94 remains unchanged, open/non-draft/mergeable with its own exact-head GREEN evidence but no qualifying independent non-author approval. This new lane does not relax the #89 acceptance criteria: no PR may treat queued/stack-predecessor evidence as passing, inherit parent reviews/checks, or merge while independent approval and enforceable protection are absent.

Fresh Orgmetra evidence update: stacked PR #106 feat/position-reporting-persistence advanced from 4544d8ae5d6ed8a751dab1cab5af1f27623e32f2 to 61611908b49a5ff74f2b7f10a2883a2572070b54 after an exact-head hosted failure exposed a stale concurrency fixture. Run 32685226593, job 97308992905, checked out 4544d8ae…; persistence and immutable review-binding steps passed, but Verify concurrent cycle prevention failed before the concurrency boundary because the fixture created Position anchors without the newly required staffable PositionVersion coverage (position-reporting endpoints require staffable PositionVersion coverage for the entire effective interval). The smallest owner-local repair 61611908… adds active PositionVersion fixtures for both concurrent endpoints, preserving the production coverage guard and graph-serialization logic. New exact-head run 32688382859 is currently queued and therefore non-passing. #106 remains Draft/stacked behind #94 and inherits no predecessor evidence. Separately, #99 unchanged exact head fff082f56e34e47cb83a19316d132c5638d3b633 was restored from stale Draft to ready-for-review only after revalidating all exact-head workflows GREEN and current unresolved threads as informational; it still has no qualifying independent non-author APPROVE. Effective develop enforcement remains protection.enabled=false, required-status enforcement off, contexts/checks empty, so neither state change authorizes merge.

Fresh Orgmetra owner-boundary evidence (2026-08-24): develop remains 9e3e4847510e1e612b48474ba42b177b8ed824df; GitHub still reports protected:true while effective branch protection is enabled:false, required-status enforcement off, contexts/checks empty. No qualifying independent APPROVE is currently present on open PRs.

Stacked PR #106 is now at exact head c35ad114edbce7a4ebafcea793748493f1346351 on parent #94 3f67182bb3065f2fc8fd974bfdd75a390d8a8fdc. Its predecessor fixture-repair head 61611908b49a5ff74f2b7f10a2883a2572070b54 achieved terminal GREEN in Position Reporting Persistence Quality run 32688382859 / job 97317512146, including the two-session cycle regression. Fresh review found the persistence trigger did not validate the governed audit reason, so a syntactically valid immutable audit event with orgmetrareason=unrelated_change could satisfy the other persistence checks. Regression commit 2af25408d95ac9bb362f318d218af507c0861f8b was added first; its hosted run 32692438893 was cancelled by subsequent head advancement and is not treated as terminal RED evidence. Root repair ef8c7776b2520e6839c14da8122aacfe3f6ad1e4 now requires exact reason approved_reporting_line_change; ADR/traceability are aligned through current head. Exact-current-head run 32692576503 is still pending/non-passing, so #106 remains Draft and cannot inherit #94 checks/reviews.

This evidence does not substitute for the acceptance criteria above: independent non-author approval plus actually enforced branch/ruleset protection are still required before any GREEN root PR is merged.

Fresh owner-control evidence (2026-08-24): develop remains 9e3e4847510e1e612b48474ba42b177b8ed824df; GitHub still reports protected:true while the effective payload remains protection.enabled=false, required-status enforcement off, contexts/checks []. Stacked PR #106 is now unchanged at c35ad114edbce7a4ebafcea793748493f1346351; its exact-current-head Position Reporting Persistence Quality run 32692576503 has completed successfully. That GREEN is lane-local stack evidence only. Parent #94 remains the dependency root at 3f67182bb3065f2fc8fd974bfdd75a390d8a8fdc, open/ready/mergeable but without qualifying independent non-author approval, so #106 correctly remains Draft and cannot inherit #94 checks/reviews. After #94 actually integrates, #106 still requires fresh develop retarget plus Foundation/SAST/Security/Recovery/product evidence on the resulting exact head. This new GREEN evidence strengthens the case for restoring actual enforceable branch protection; it is not a substitute for protection or independent approval.

2026-09-02 current-evidence update: canonical GOV-01 writer ContextualWisdomLab/.github#1644 has been reconciled non-force onto protected .github/main@9330d41c92b1e6ab35261f3f5189936ea1ad8bff with two-parent merge head 545f315c8a19d683f5fbc67c46819dc268bd35a6. Fresh comparison is behind_by=0 and the effective diff remains exactly the 19 ruleset-governance owner paths; latest protected-main Dependency Review/CI-audit changes and completed PR #1714/#1715 source-fix removals are preserved. All predecessor Check evidence was reset: exact-head Ruleset Governance Reconcile, CodeQL, Security Scan, OSV, SAST, SBOM, Secret Scan, Python Security, and Scorecard runs are currently queued and therefore are not passing evidence. Do not merge or mutate live settings until terminal exact-head evidence and ordinary protection permit it; no administrator bypass or self-approval is authorized.

Supersedes the immediately prior GOV-01 evidence note: ContextualWisdomLab/.github#1644 has now been non-force reconciled onto protected .github/main@78271917b526469c559fa75cb5ee39426e5494d1 (#1734) at exact writer head 528139ff3c2a3680d67b8489c38fdb65cd31d98c. Fresh comparison is behind_by=0 and still exactly the 19 ruleset-governance owner paths, preserving #1734's OpenCode poll-retirement repair. Exact-head Ruleset Governance Reconcile 33636088810 and the security fleet have re-materialized but remain queued/pending, so no predecessor GREEN transfers and GOV-01 remains open. Live rulesets also still show the unresolved settings drift: organization ruleset 18156473 requires one approval and has OrganizationAdmin/always; .github ruleset 17921150 still permits rebase and OrganizationAdmin/always.

2026-09-02 current-owner refresh: ContextualWisdomLab/.github#1644 has already been reconciled non-force with protected .github/main@78271917b526469c559fa75cb5ee39426e5494d1 (#1734). Its current exact head is 528139ff3c2a3680d67b8489c38fdb65cd31d98c; fresh comparison is ahead-only with behind_by=0 and retains exactly the 19 ruleset-governance owner paths, so the protected #1734 OpenCode superseded-poll fix is preserved rather than overwritten. Exact-head Ruleset Governance Reconcile run 33636088810 is terminal SUCCESS; Security Scan/SBOM remain pending and OSV/SAST/Python Security/Secret/Scorecard/CodeQL remain queued, so no predecessor or focused-only evidence is promoted to full merge/release authority. Ordinary squash auto-merge is enabled on #1644, but GitHub still reports it blocked. Source integration is still not live-settings convergence: the last verified inherited org ruleset retained approval count 1 and routine OrganizationAdmin/always, while the .github repo ruleset retained rebase and routine admin bypass. SEC-01's canonical current owner is Draft .github#1725@58a0b4c8ecc3073a64bd91457101229a21f020d4, which carries the authenticated HTTP-200-only Dependency Review boundary, least-privilege reusable-caller permissions, and immutable repo/base/head validation; its exact-head security fleet is still non-terminal. Keep #89 open until protected source integration, separately governed settings apply, live payload/history convergence, canonical audit, and unchanged Orgmetra #88 ordinary-path proof are all complete.

2026-09-08 current governance incident evidence: central .github#2028 was squash-merged as protected main@7fd571dbcdbae6acf29d8f4ee704d7ba6297e4db at 03:07:12Z even though GitHub records no APPROVED review and two exact-head P1 provenance threads remain unresolved. The merge commit is verified, but the merged statusless CodeQL fallback binds only pagination/live base/required-run title and does not by itself prove protected workflow source, trusted actors, successful validate-dispatch, exact required job identity, or one unexpired SARIF artifact. This is direct evidence that current live merge admission does not enforce the commercialization policy's independent-approval and complete-thread-resolution boundary; it does not by itself prove which bypass mechanism was used.

Canonical corrective owner .github#1902 has now non-force integrated that protected main at exact head 61b88b84a0e0eb325f09a4a8c8b947b1ce888e4d. Its tree preserves complete pagination and adds protected-source/actor/creator/required-run-job/SARIF provenance plus deterministic multi-language settlement. #1902 is Ready, mergeable, behind 0, and has zero unresolved source threads, but its new exact-head Security/SAST/Python Security/CodeQL runs are queued or pending and there is no qualifying current-head independent approval. Therefore neither #2028 nor #1902 is yet evidence that GOV-01 or the Orgmetra canary path is repaired. Keep #89 open through source correction, live ruleset convergence, canonical audit, and unchanged #88 ordinary-path proof.

Governance canary update: current Organization review owner #96 is exact 0262d70eaac37e2ab4096c67894a0bae71a4b1d2, Draft/mergeable on protected develop@eb9757f8649aaad026a9865508d9aad50c1a7a4f. Fresh #283 has real hosted RED→causal GREEN but the final descendant still has nonterminal required lanes and no qualifying independent APPROVED review. Active ruleset 18156473 still requires one approval plus seven central workflows, stale-review dismissal and resolved threads. No self-approval, bot-as-human approval, OrganizationAdmin bypass or gate weakening is used; the structural solo-human approval problem remains central .github#772 ownership.

Governance canary correction for current #96@6573a6293db49632c525f0979973377869b4817c:

The Strix snapshot in the issue body is now historical. Run 34427956795, job 102719245996, completed SUCCESS and uploaded artifact 10136631500 (sha256:ee4f6d58e682783cd388a32c9d7fb6af79c05e1613e4d5622118a248eac3434e). Immutable inspection shows a substantive package-specific report and valid SARIF 2.1.0 with zero results, rather than the earlier 307-byte template-only shape.

This still does not satisfy the underlying evidence contract required by .github#891: no machine-readable terminal receipt binds repository + PR + exact source head + exact live base + the four materialized changed-file identities/content digests + scanner/run identity + report/SARIF digests/finding set. The new central canary is .github#891 comment 5613170518.

The governance conclusion is unchanged: a GitHub required-workflow SUCCESS is not sufficient when its canonical evidence contract is incomplete. #96 therefore remains Draft. Security remains fail-closed at .github#810, CodeQL remains non-passing at .github#2040, and fresh review still has no qualifying independent APPROVED. Ruleset 18156473 must not be bypassed to convert those states into merge evidence.

Current-canary correction after #290 repair: #96 has advanced by ordinary commits to exact 81ed7555fd030967356c5ff9d1c698b6070e2e8a on unchanged protected develop@eb9757f8649aaad026a9865508d9aad50c1a7a4f, and remains open · Draft · mechanically mergeable. #290 adds a nested runtime-integrity guard: an exact built-in datetime with caller-defined tzinfo must be rejected before datetime equality can execute utcoffset(). Test-first d2969bb..., minimal source repair 03b0d865..., then package/TRACEABILITY/ADR doctoring through 81ed7555...; no hosted RED is claimed for the superseded test-only head. Current exact-head Foundation 34439908483, Security 34439908493, SAST 34439908512, and CodeQL 34439908521 are queued, so predecessor evidence is historical only. Fresh review before these commits had no qualifying independent APPROVED. Keep the existing central .github#810/#891/#2040/#772 ownership and no-bypass policy; this correction does not authorize merge.

Final current-canary correction for this pass: #96 is now exact 70212e6e00e0e3c0104b2444aadd7ac01880847b on unchanged protected develop@eb9757f8649aaad026a9865508d9aad50c1a7a4f, still open · Draft · mechanically mergeable. #290's reachable repair checks only the mutable retained recorded_at nested timezone type before datetime equality; the duplicate issuance-state check was removed in 5ffdf0d... because issuance validation already proves and closure-privately retains that value, avoiding an unreachable branch under the mandatory 100% branch-coverage contract. Current exact-head Foundation 34440405579, Security 34440405530, SAST 34440405543, and CodeQL 34440405532 remain queued. No independent approval or predecessor verdict is transferred; existing .github#810/#891/#2040/#772 ownership and no-bypass policy remain unchanged.

Current governance-canary correction: PR #96 has advanced ordinary-forward to exact f2c6e70edcf5c62ae0f848c29efd7bd3b8d45b97 on unchanged protected develop@eb9757f8649aaad026a9865508d9aad50c1a7a4f and now carries #279–#291. #291 adds a test-first same-instant/different-fixed-offset datetime replacement regression (4bf2c141...) and minimal datetime-only identity repair (1d5f423f...) with package/TRACEABILITY/ADR doctoring through f2c6e70e.... No hosted RED is claimed for the superseded test-only head. Current exact-head Foundation 34441833963 is queued with job 102758308481 still runner_id=0/no steps; Security 34441833987 and SAST 34441834059 are queued, CodeQL 34441833995 pending. No predecessor verdict transfers and no qualifying independent APPROVED exists; visible #96 review threads are resolved.

Fresh ruleset 18156473 remains active with one approving review, stale-review dismissal on push, review-thread resolution, extra approval for unattributed changes, merge/squash only, the seven protected-central workflows, deletion/non-fast-forward protection, and OrganizationAdmin/always bypass. The bypass remains non-authorizing for this ordinary product PR and was not used.

Governance canary correction: live #96 is f2c6e70edcf5c62ae0f848c29efd7bd3b8d45b97 directly on protected develop@eb9757f8649aaad026a9865508d9aad50c1a7a4f. Current-head Foundation 34441833963/102758308481 and SAST 34441834059 are SUCCESS. Security 34441833987 is FAILURE only at the exact-base/head Dependency Review availability probe (HTTP 403, curl 0; .github#810 current canary 5613994010). CodeQL 34441833995 is non-passing: both compatibility consumers failed while dispatch 102763941196 remains queued (.github#2040 current canary 5613996039). Noema 34441832326/102761043453 and Strix 34441832410/102760977777 remain in progress at contextual-orchestrator sidecar provisioning. No qualifying independent APPROVED review exists.

Fresh ruleset 18156473 remains active with 1 required approval, stale-review dismissal on push, review-thread resolution, extra approval for unattributed changes, merge/squash only, the seven protected-central required workflows, deletion protection and non-fast-forward protection. OrganizationAdmin/always bypass still exists but is not merge evidence and was not used. Protected .github/main is cb0872c9a20d5584703dffacca65c096fc034c6c; merged #1938 Strix queue coalescing is current infrastructure truth but does not itself satisfy .github#891 terminal Strix receipt semantics. Dependency Review availability remains .github#810; CodeQL settlement remains proposed .github#2040, whose recorded base predates current protected main and must be non-force adopted by its canonical writer.

Fresh effective-governance correction. Protected develop remains eb9757f8649aaad026a9865508d9aad50c1a7a4f; current #96 is exact f2c6e70edcf5c62ae0f848c29efd7bd3b8d45b97, open · Draft · mechanically mergeable. The older issue-body canary at 6573a629... and its in-progress Strix snapshot are historical only.

Current #96 exact evidence: Foundation 34441833963/102758308481 SUCCESS; SAST 34441834059 SUCCESS; Noema 34441832326 SUCCESS. Security 34441833987 is terminal FAILURE only at fail-closed Dependency Review HTTP 403, still canonical .github#810. CodeQL 34441833995 is terminal FAILURE because Python/Actions consumers enforced before producer dispatch 102763941196 later started and succeeded, still canonical .github#2040. Strix 34441832410/102760977777 is GitHub SUCCESS but its exact artifact 10139235414 (sha256:c56b080f7357b5e9187f2d5d55396f61bbaa223e0e1cd27ea5acfe0fccde8c3e) is semantically hollow: the report is a 437-byte generic no-vulnerability template and there is no machine-readable repo/PR/head/live-base/materialized-scope/report/SARIF/finding-set terminal receipt. Treat it as non-authorizing; exact canary is .github#891 comment 5614504202, implementation handoff .github#1563 comment 5614507024.

Fresh ruleset 18156473 is still active on the default branch and still requires one approving review, dismisses stale reviews on push, requires thread resolution, requires extra approval for unattributed changes, permits only merge/squash, enforces the seven central workflows, and blocks deletion/non-fast-forward. OrganizationAdmin remains bypass_mode=always and current_user_can_bypass=always; no bypass is used. Fresh #96 review enumeration still has no qualifying APPROVED review.

Protected central .github/main is now cb0872c9a20d5584703dffacca65c096fc034c6c after #1938. That queue-coalescing integration does not satisfy #891's terminal-evidence contract. Keep .github#772/#810/#891/#2040 as canonical governance/control-plane owners; do not manufacture human approval, synthesize verdicts, or move these central defects into Orgmetra source.

Fresh governance authority correction: issue body snapshots that identify #96 as 6573a629... and central .github/main as f578d8d... are historical, not current.

Current protected Orgmetra truth remains develop@eb9757f8649aaad026a9865508d9aad50c1a7a4f. Canonical Organization review PR #96 is unchanged at exact f2c6e70edcf5c62ae0f848c29efd7bd3b8d45b97, open · Draft · mechanically mergeable. Foundation and SAST are current-head SUCCESS; Noema is current-head SUCCESS. Security is non-passing on the open central Dependency Review HTTP-403 availability incident .github#810; CodeQL is non-passing on open central settlement owner .github#2040; Strix workflow is mechanically SUCCESS but its current terminal artifact is non-authorizing under open .github#891 because it lacks the authoritative exact-head/live-base/materialized-scope/finding-set receipt and reverted to generic/template no-finding evidence. Fresh reviews still contain no qualifying independent APPROVED review.

Protected central .github/main is now cb0872c9a20d5584703dffacca65c096fc034c6c (merged #1938 Strix push-scan coalescing). This queue/concurrency repair does not satisfy .github#891's PR terminal evidence contract, and open implementation PR #1563 remains unmerged on an older protected base. CodeQL PR #2040 is likewise still unmerged on recorded base 7fd571db...; central owner writers must non-force adopt/adapt intervening protected truth rather than leaf repositories copying those branches.

Live inherited ruleset 18156473 still requires one approving review, stale-review dismissal, review-thread resolution, extra approval for unattributed changes, merge/squash only, and the seven protected central workflows; deletion and non-fast-forward protection remain active. OrganizationAdmin/always bypass is still present and unused. Canonical solo-maintainer policy repair .github#772 remains open. No normal Orgmetra merge is authorized by this correction.

2026-09-12 GOV-01 owner checkpoint

Canonical owner .github#1644 has been non-destructively reconciled to current protected .github/main@cb0872c9a20d5584703dffacca65c096fc034c6c.

New exact owner head: 702446b51691db0460e87729e7250b99853026b1.
Ordinary two-parent merge; branch update force=false.
Fresh compare: behind 0; effective protected-main-relative delta remains the same 21 governance paths.
Exact-head hosted evidence is reset and had not materialized immediately after publication; predecessor GREEN is not transferred.
Orgmetra's inherited live organization ruleset 18156473 was independently re-read this run and still has approval count 1 plus routine OrganizationAdmin/always bypass. Therefore source reconciliation is not live-settings reconciliation.

GOV-01 remains open until #1644 reaches protected truth, the separately provisioned least-privilege owner-plane identity performs the guarded reconciliation, live payload/history converge, the canonical audit passes, and an unchanged Orgmetra canary succeeds through the ordinary protected path without self-approval or routine admin bypass.

Navigation Menu

Repository navigation

governance: harden effective develop ruleset and remove routine admin bypass #89

Live Orgmetra governance defect — effective control plane

Current accepted central policy

Canonical central owner path

Current Orgmetra canary

Required repair order

Acceptance criteria

84 remaining items

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

governance: harden effective develop ruleset and remove routine admin bypass #89

Description

Live Orgmetra governance defect — effective control plane

Current accepted central policy

Canonical central owner path

Current Orgmetra canary

Required repair order

Acceptance criteria

Activity

seonghobae commented on Aug 23, 2026

seonghobae commented on Aug 23, 2026

seonghobae commented on Aug 23, 2026

seonghobae commented on Aug 23, 2026

seonghobae commented on Aug 23, 2026

seonghobae commented on Aug 23, 2026

seonghobae commented on Aug 23, 2026

seonghobae commented on Aug 23, 2026

seonghobae commented on Aug 23, 2026

seonghobae commented on Aug 23, 2026

seonghobae commented on Aug 24, 2026

seonghobae commented on Aug 24, 2026

seonghobae commented on Aug 24, 2026

seonghobae commented on Aug 24, 2026

seonghobae commented on Aug 24, 2026

84 remaining items

seonghobae commented on Sep 2, 2026

seonghobae commented on Sep 2, 2026

seonghobae commented on Sep 2, 2026

seonghobae commented on Sep 8, 2026

seonghobae commented on Sep 9, 2026

seonghobae commented on Sep 10, 2026

seonghobae commented on Sep 10, 2026

seonghobae commented on Sep 10, 2026

seonghobae commented on Sep 10, 2026

seonghobae commented on Sep 10, 2026

seonghobae commented on Sep 10, 2026

seonghobae commented on Sep 10, 2026

seonghobae commented on Sep 12, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions