Repository navigation
[Governance Gap] Establish an observable independent-review and CODEOWNERS route #321
Description
Buyer / acquisition outcome
Make Clearfolio's protected-branch review governance deterministic and auditable instead of relying on an implicit or manually discovered reviewer path. A buyer, maintainer, or automation must be able to determine who is eligible to provide a qualifying independent review, how that reviewer is requested, and which exact-head review evidence satisfies the repository's live merge policy without manufacturing approval.
Fresh evidence — 2026-08-10
Protected main is 83ec6f7fe2b04bdcd28bf98ec350e41e55730a18.
Current protected-main docs/repository-metadata.md still records Explicit CODEOWNERS set to transfer team as incomplete. Repository code search does not expose a current CODEOWNERS file.
Three independent Ready/mergeable lanes illustrate the operational gap:
- fix(security): harden audit pseudonymization and refresh Netty evidence #270 exact head
63cdc36b926af8fd03a1ec689a1a6d5d800b8248: exact-head CI, Security Scan, SAST Semgrep, and fuzz successful; review threads resolved/outdated; no qualifying approval. - docs: establish canonical product, architecture, and acquisition spine #305 exact head
5bbe979a256f4f19ba8a416a3f5fdd3e01305dd5: exact-head CI, Security Scan, and SAST Semgrep successful; review threads resolved; no qualifying approval. - fix(openapi): align buyer contract license metadata #316 exact head
b6d79bce1cbbcc34e2743891788d96d40ab42d87: exact-head CI, Security Scan, SAST Semgrep, and fuzz successful; review threads resolved/outdated; no qualifying approval.
Auto-merge is enabled on all three through ordinary repository protection so no branch-protection requirement is bypassed.
Empirical protection proof
After revalidating #316's unchanged exact head and exact-head gates, the normal GitHub merge endpoint was invoked with expected_head_sha=b6d79bce1cbbcc34e2743891788d96d40ab42d87. GitHub rejected the merge with HTTP 405:
At least 1 approving review is required by reviewers with write access.
This proves one approving review from a reviewer GitHub counts as write-authorized is a live protected-merge requirement.
Current reviewer eligibility — central authority resolves the ambiguity
The ordinary request-reviewers API for opencode-agent returned HTTP 422 because it is not an ordinary collaborator. A fresh repository permission probe independently reports collaborator permission none for opencode-agent; the cwl-noema-review mention identity does not expose qualifying repository write permission.
More importantly, the organization-owned governance authority ContextualWisdomLab/.github#772 explicitly records the current CWL separation-of-duties contract:
opencode-agent,cwl-noema-review, andcoderabbitaiare advisory reviewers and do not have repository write permission that GitHub counts for protected-branch approval;- author self-review is non-independent;
- the durable target design is an
independent-reviewershuman team with at least two non-author maintainers and the minimum permission GitHub counts, plus CODEOWNERS/reviewer assignment and reviewer-availability evidence; - automated reviewers must remain read-only/advisory and must not receive broad contents-write authority merely to manufacture approval.
Therefore the earlier hypothesis that a central OpenCode/Noema formal APPROVED review might itself satisfy Clearfolio's write-authorized review rule is now falsified by the central governance contract. Historical PR #107 proves OpenCode can submit a formal review object, but that object is advisory for the protected-review separation-of-duties gate.
Review-delivery control plane is also currently under repair
The central trusted-comment mention route remains useful for advisory exact-head source review, but it is not the counted human-approval route. Fresh central state also shows .github PR #911 repairing a separate live delivery defect: GitHub repository_dispatch.client_payload permits at most ten top-level properties, while the protected-main OpenCode router→wrapper hop carried fourteen. #911 rebuilds that repair on current central main and remains Draft pending its own gates. Thus absence of a current OpenCode queue receipt must not be misclassified as a Clearfolio source defect.
Current exact-head @opencode-agent / @cwl-noema-review invocations on #270/#305/#316 remain advisory review probes only. They do not substitute for the counted human review required by the merge rule.
Required governance contract
- Preserve the observed Clearfolio merge rule: at least one approving review from a reviewer with permission GitHub counts as write-authorized.
- Adopt the organization-level solution from
.github#772rather than granting write authority to advisory bots: an eligible independent human team with backup coverage and minimum counted permission. - Add/update CODEOWNERS or another explicit reviewer-assignment route using verified eligible human/team identities. Do not invent a team slug or reviewer before organization governance creates/verifies it.
- Keep OpenCode, Noema, CodeRabbit, GHAS and other automation evidence separate and advisory; they may discover defects but cannot satisfy the counted-human gate by inference.
- Keep exact-head review identity separate from source-head checks, statuses, model judgments, synthetic-merge evidence, and protected-main runtime evidence.
- Preserve stale-review/dismissal behavior and revalidate approving permission/head immediately before merge.
- Keep expected-head-safe auto-merge enabled only through normal protection; no bypass or review-count reduction.
Test / acceptance
- Repository governance docs/tests reflect the observed
1 approving review by a reviewer with write accessrule. - Negative evidence is preserved: author self-review does not qualify;
opencode-agentordinary review request is 422/non-collaborator; advisory bots do not have counted write permission. - Organization governance provides at least two non-author human identities with minimum counted repository permission through an independent-reviewer team or equivalent reviewed mechanism.
- A dry-run/current clean PR proves an eligible independent human approval changes the live protection decision while advisory bot review alone does not.
- A post-approval commit proves stale approval is dismissed/invalidated according to live policy.
- Reviewer permission removal/loss fails closed with an actionable governance blocker.
- CODEOWNERS/reviewer assignment, backup/leave/offboarding, exact-head identity and permission snapshot are documented and auditable.
docs/repository-metadata.md, canonical traceability/governance, and operator guidance are reconciled after the organization route is actually provisioned.- No branch protection, required check, security gate, or review count is weakened merely to merge work.
Dependency / scope
This issue is the Clearfolio leaf view of organization governance issue ContextualWisdomLab/.github#772. .github is read-only to the Clearfolio writer loop. Do not duplicate the central human-team provisioning or grant bots write permission here.
#270/#305/#316 are technically clean candidates whose merges remain locally deferred on the counted-human gate; their auto-merge configuration preserves every normal protection requirement. While organization governance is unresolved, continue every other safe Clearfolio product/security/reliability lane.
Activity
seonghobae commentedon Aug 10, 2026
Additional reviewer-route evidence from fresh central-control-plane inspection:
get_repo_collaborator_permissionreportsopencode-agentpermission=nonefor Clearfolio, consistent with the ordinaryrequest-reviewers422. Do not retry that collaborator API route unless eligibility changes..githubexact head6eb06cdd08c79a06f7b390069d4ffa49e2eb7dbacontainsscripts/ci/opencode_existing_approval_gate.py. The gate explicitly recognizes onlyopencode-agent/opencode-agent[bot]as OpenCode approval publication actors and accepts reuse only when the GitHub review isAPPROVED, itscommit_idequals the exact current head, the body contains the real-model approval marker/result/head/run/attempt, and structured adversarial validation passes. Deterministic/model-unavailable fallbacks are explicitly rejected.The next governance proof therefore stays narrow: central trusted-comment dispatch -> exact-head formal OpenCode review -> ordinary protected merge/auto-merge acceptance, with no branch mutation or policy weakening.
seonghobae commentedon Aug 10, 2026
Fresh counted-review route probe — 2026-08-10
Revalidated the organization-governance candidate route against a new technically clean Clearfolio PR rather than relying on predecessor evidence.
fix(analytics): reject invalid persisted KPI numerics66c7afc6eeb1e5862e414d14e7d236e27553608283ec6f7fe2b04bdcd28bf98ec350e41e55730a18A fresh ordinary GitHub reviewer request to team
independent-reviewersreturned HTTP 422:This confirms that the organization-level target team is still not provisioned as a counted collaborator on Clearfolio. No review rule was weakened and no bot/author identity was substituted. The executable external prerequisite remains the one already defined by
.github#772: provision a genuinely independent human reviewer team with the minimum permission GitHub counts, then request an exact-head approval. Until that happens, clean PRs may remain auto-merge armed but policy-blocked while other product work continues.seonghobae commentedon Aug 12, 2026
Fresh governance probe — 2026-08-12
Protected
mainremains55d7ae8647208e301f282350f076eeddaba61d11. Repository rulesetPRstill requires one approving review and exposes no bypass actor for this account; the organization ruleset still requires the central review/security workflows and resolved review threads.On current Ready PR #401, exact head
3025d5b49f2d03844ecd55c594ddbbb708d3b59fis mergeable and its exact-head CI, Security Scan, SAST Semgrep and fuzz runs are successful. CodeRabbit's review suggestion is incorporated in the current diff and there are no unresolved review threads, but there is no formal approval.I re-tested the organization-authorized team route rather than inventing a reviewer: requesting team
independent-reviewerson unchanged #401 returned GitHub HTTP 422 —Reviews may only be requested from collaborators. One or more of the teams you specified is not a collaborator of the ContextualWisdomLab/clearfolio repository.This falsifies the immediate-remedy hypothesis that the named team is already provisioned for Clearfolio. Keep auto-merge/protection intact and do not retry this route until organization governance changes; the actionable prerequisite remains granting a genuinely independent human reviewer team counted repository permission, then requesting a fresh exact-head review.
seonghobae commentedon Aug 20, 2026
Fresh Clearfolio counted-review reproduction — 2026-08-20 KST
The first governance boundary remains reviewer-team repository eligibility rather than Clearfolio source or exact-head validation.
Current clean candidate #432 is Ready/mergeable at exact head
103536cc1537b2f44d6b0b518d446e0e6cd2ee82over protectedmain@06633a25109c62e24a7015ae04fb9f6e0a246f7e. Exact-head CI, Security Scan, SAST Semgrep, and fuzz are terminal-success; current review threads are empty; auto-merge is enabled through ordinary protection; the Reviews API contains no qualifying independentAPPROVEDreview.A fresh normal request for team
independent-reviewerson this unchanged exact head returned GitHub HTTP 422:This reproduces the organization-level defect in
.github#772directly on Clearfolio after repository-owned gates became GREEN. No self-approval, author-equivalent credential, bot/model substitution, admin bypass, or review-rule weakening was attempted.The smallest valid owner remedy remains provisioning genuinely independent non-author human reviewer(s), preferably through the existing team, with only the minimum repository/custom-role permission GitHub demonstrably counts. GREEN proof is a successful team review request plus a counted formal approval on the then-unchanged exact head. Any head/base movement invalidates this evidence and requires a fresh request, approval, and check set.
seonghobae commentedon Aug 22, 2026
Fresh 2026-08-22 evidence from buyer-visible PR #494: exact head
681e6fe89f8c5c348bffab3c8d4eeaf334298e29is Ready/mergeable after a test-first repair replacing awaited recursive conversion polling with constant-depth iterative polling. Current-head CI, Security Scan, SAST Semgrep, and fuzz are all terminal-success; all inline review threads are resolved/outdated. A review request to teamindependent-reviewerson this unchanged head still fails HTTP 422 (Reviews may only be requested from collaborators). No self-approval or protection bypass was attempted. This remains a concrete leaf proof that #321/.github#772 reviewer-team provisioning is required before protected integration.seonghobae commentedon Aug 22, 2026
Fresh Clearfolio counted-review reproduction — 2026-08-22 KST
Revalidated the buyer-visible viewer candidate #417 rather than transferring prior reviewer evidence.
444822facd7703b35fd5a1576b7fd44f3f8c49a4;main@06633a25109c62e24a7015ae04fb9f6e0a246f7e;UPIMvnjyP1sTXhIy1wqD02, root2:2, still exposes the Clearfolio token palette and desktop loading/ready/failed plus mobile-loading/tablet-two-pane states; this PR does not alter those UI states;.storybookdirectory and no rootpackage.json, so Storybook is not represented as implemented evidence for this metadata-only slice.Immediately after refetching the unchanged head, a normal request for team
independent-reviewersreturned GitHub HTTP 422:This is a fresh repository-eligibility failure, not transferred evidence from earlier probes. No author/model approval, protection bypass, or review-rule weakening was attempted. The owner remedy remains to provision genuinely independent non-author human reviewers through
independent-reviewers(or an equivalent audited team) with only the minimum repository/custom-role permission GitHub counts for protected approval, then request a new review on the unchanged exact head.seonghobae commentedon Aug 23, 2026
Fresh 2026-08-23 reviewer-provisioning evidence from buyer-facing design PR #489: after repairing current-head Storybook review findings, the unchanged exact PR head is
db23649a2f736689066d705a4b15eb6aadde6a19. A normal review request for teamindependent-reviewerswas attempted on that exact head and GitHub rejected it with HTTP 422:Reviews may only be requested from collaborators. One or more of the teams you specified is not a collaborator of the ContextualWisdomLab/clearfolio repository.This re-confirms the issue's existing separation-of-duties conclusion: the product lane can repair source/design findings, but the counted independent human-review route cannot be established from repository code or advisory-bot authority. Required external action remains provisioning an actual non-author human team with the minimum repository/custom-role permission GitHub counts for protected review; do not grant advisory bots broad contents-write authority and do not weaken review protection.
seonghobae commentedon Aug 23, 2026
Fresh 2026-08-23 review-gate reproduction on buyer-facing design-system PR #489:
b397ad7b76a9f85f0bd7a907e621680bb1dd02fbagainstmain@06633a25109c62e24a7015ae04fb9f6e0a246f7e;32621783971, Security Scan32621784036, SAST Semgrep32621783959, and Storybook Design System32621784058are terminal-success;97150885549checked out the exact PR SHA, ran 51 Python design-system contracts, built Storybook, and ran all 10 Chromium Storybook tests successfully;aria-labelledbyanalysis thread was verified against that real axe-enabled Storybook run and resolved as non-actionable; current inline review threads are therefore resolved;UPIMvnjyP1sTXhIy1wqD02, node2:2, still exposes the viewer state matrix and local brand/ink/muted/background/panel/line/danger/focus token authority used by this Storybook slice;APPROVEDreview.Immediately after re-reading the unchanged head and evidence, a normal request for team
independent-reviewerswas attempted again. GitHub returned HTTP 422:Reviews may only be requested from collaborators. One or more of the teams you specified is not a collaborator of the ContextualWisdomLab/clearfolio repository.This is now the first remaining merge boundary for #489. Do not grant contents-write authority to advisory bots or weaken protection. Provision the independent human team (at least two non-author maintainers for backup coverage) with the minimum repository/custom-role permission GitHub counts for protected approval, then request a fresh review on the unchanged latest head and revalidate all live gates before merge.
seonghobae commentedon Aug 24, 2026
Correction + fresh #489 governance evidence — 2026-08-24 KST
This corrects the 2026-08-23 #489 evidence that treated Devin's
aria-labelledbyconcern as non-actionable solely because the axe-enabled Storybook run was green.WAI-ARIA 1.2 is normative here: a plain
divhas implicitgenericsemantics, andgenericis name-prohibited, soaria-labelledbyon that wrapper was a real standards defect even though the predecessor automated scan did not surface it.The defect was repaired test-first on PR #489:
4dead75656dc8f1f2a985a10e04cbf81123d97c3added a contract requiring a semantic nameable preview region; exact-head Storybook Design System run32681567018failed as expected.accbe898f22d2ace9ea4cc02a5aa6c247c64be59addsrole="region"while retainingaria-labelledby="preview-title".bbbe0979107b5ac1942b6d0f37de4579655ac09e, including the WAI-ARIA 1.2 rationale and fresh 2026-08-24 Figma traceability.32681615488, Security Scan32681615532, SAST Semgrep32681615480, and Storybook Design System32681615524are all terminal-success.APPROVEDreview.Immediately after re-reading the unchanged current head, a normal request for team
independent-reviewerswas attempted again. GitHub returned HTTP 422:Reviews may only be requested from collaborators. One or more of the teams you specified is not a collaborator of the ContextualWisdomLab/clearfolio repository.Therefore the source/design defect has been removed, but the first external merge boundary remains unchanged: provision genuinely independent non-author human reviewers through
independent-reviewers(or an equivalent audited team) with only the minimum repository/custom-role permission GitHub counts for protected approval. Then request a fresh review on the unchanged latest head and revalidate every live required gate before merge. No self-approval, bot write escalation, review-rule weakening, or protection bypass was used.seonghobae commentedon Aug 28, 2026
Fresh 2026-08-28 evidence from security PR #356: exact head
83a9415d71ab25dd0df31ec0955b965d77b95c15remains unchanged and ahead ofmain@06633a25109c62e24a7015ae04fb9f6e0a246f7eby 10 / behind 0, with an effective diff limited toTenantContext.javaplus its focused authority-invariant regression. Current inline review threads are empty. The sole OpenCodeCHANGES_REQUESTEDreview cited failed checks on predecessor45c35e34...and has now been dismissed explicitly as predecessor-head evidence; this does not manufacture or substitute for human approval. Live organization ruleset18156473and repository ruleset13042993each require 1 approving review on the default branch, with the organization rule also dismissing stale reviews on push and requiring thread resolution. A normal request for teamindependent-reviewerson unchanged #356 head again failed HTTP 422 (Reviews may only be requested from collaborators). Required external action remains unchanged: provision the human independent-review team to Clearfolio with the minimum repository/custom-role permission GitHub counts for PR approval; keep advisory bots read-only and do not use OrganizationAdmin bypass.