fix(governance): automate ruleset owner-plane reconciliation

[seonghobae]

Current authoritative execution receipt — 2026-09-08

• Exact PR head: e35cdc5d6527dfa8634654719a6c3681f16ed82a.
• Current protected base: main@7fd571dbcdbae6acf29d8f4ee704d7ba6297e4db.
• Ordinary adoption commit has parents predecessor 665adfbb220317daf8efae0124d7c2005fc5576b and protected main 7fd571dbcdbae6acf29d8f4ee704d7ba6297e4db.
• Exact tree: 8191b45cb3dbcc6a084107fc61e1c84afdf04f95; protected-main fix(codeql): keep a clean dispatch scan when status publish 403s #2028 CodeQL completed-scan fallback, rerun dispatch, pagination, live-base and required-run binding are preserved without changing the 21-path governance delta.
• Current-tree local GREEN: governance focused 208 passed; owner reconciler 186 passed; full 3149 passed, 1 skipped, 21 subtests; diff check PASS.
• Fresh successor-head hosted state immediately after publication: 10 queued · 2 skipped; exact-head human approval 0, unresolved review threads 0.
• No predecessor hosted check, review, or approval transfers. Ordinary merge and owner-plane apply remain unauthorized until all successor-head deterministic/security/review gates reach truthful terminal acceptance.
• Live ruleset, repository default branch, branch protection, and dependency-graph settings were not mutated. Owner-plane apply remains disabled until this source reaches protected truth and the separately provisioned least-privilege Administration-write environment is actually exposed.

Historical receipts below are retained as provenance and are not current-head acceptance.

Buyer/control-plane outcome

This is the owner-plane writer for the live ruleset drift blocking Orgmetra's ordinary protected merge canary. Source integration alone does not mutate live settings: privileged apply remains disabled unless trusted protected main has CWL_RULESET_RECONCILE_ENABLED=true and the protected ruleset-governance-maintenance environment supplies a separately provisioned least-privilege CWL_RULESET_ADMIN_TOKEN with Administration write authority.

Current exact stack — 2026-09-02

Current exact head: 528139ff3c2a3680d67b8489c38fdb65cd31d98c.

Current protected main: 78271917b526469c559fa75cb5ee39426e5494d1 (#1734). A concurrent writer reconciled this branch without force-push or destructive rebase after protected main advanced: fresh comparison reports behind_by=0, and the effective protected-main-relative diff remains exactly the same 19 ruleset-governance owner paths. The protected #1734 OpenCode superseded-poll retirement delta is preserved rather than overwritten.

Exact-head evidence reset: no predecessor Check evidence transfers across protected-main integration. On current exact head 528139ff…, Ruleset Governance Reconcile run 33636088810 is terminal SUCCESS. Security Scan 33636089120 and SBOM 33636088874 are pending; OSV 33636090369, SAST 33636088896, Python Security 33636089086, Secret Scan 33636088792, Scorecard 33636088771, and CodeQL 33636089031 are queued. Therefore the focused governance result is valid evidence for its own contract only; the PR is not represented as fully merge-ready until the unchanged exact head has terminal required evidence. All materialized inline review threads must remain revalidated against this exact head. Ordinary squash auto-merge remains the intended merge path; administrator bypass and self-approval are not used.

Predecessor #1176 was retired only after verified complete successor transfer of all seven valid changed paths. Four paths are tree-identical here; the audit script has identical content with executable-mode strengthening; and the two differing tests each add the explicit require_code_owner_review = false solo-maintainer assertion. No predecessor Check evidence was transferred.

Completed one-shot source-fix artifacts are absent from the current tree; this lane contains only permanent governance source/tests/docs.

Reviewed implementation boundary

• config/ruleset-governance.json binds exactly repository ruleset 17921150 and organization ruleset 18156473.
• The canonical policy is the solo-maintainer contract: approval count 0, last-push and same-author CODEOWNER approval disabled, no synthetic required reviewers, stale-review dismissal and thread resolution retained, merge/squash only, deletion/non-fast-forward retained, and routine bypass actors forbidden.
• The reconciler validates exact live target identity and invokes the canonical ruleset auditors against projected and post-write live-shaped payloads so unmanaged scope/workflow/protection drift cannot be mislabeled as convergence.
• GitHub exposes no conditional unsafe PUT precondition for these ruleset updates. A second live read detects visible drift but is not represented as compare-and-swap.
• Privileged mutation samples immutable ruleset history before its final live read and binds both CLI and callable mutation paths to an exact protected-main SHA. Ambiguous mutation results are settled from live state plus immutable history rather than blindly retried.
• Collision recovery follows immutable predecessor evidence, preserves newer administrator state, settles ambiguous recovery writes across the bounded observation horizon before any subsequent PUT, and rechecks version state after settlement before trusting the restore.
• Visible current-state changes are checked before a recovery write; protected-main freshness is then checked immediately before that privileged write. Once an earlier PUT may already have been accepted, history settlement and lossless compensation finish without a stale-main veto so an overwritten administrator predecessor is not stranded.
• Privileged non-PR owner-plane runs share one serialized non-cancellable concurrency group; read-only PR validation may supersede itself.
• Pull-request validation uses pinned actions and hash-locked tooling, verifies exact checkout, executes the permanent governance/adversarial suites, and enforces 100% owned statement/branch/docstring gates without persisted checkout credentials.
• The source-derived two-target critical-section bound is 7,680 seconds / 128 minutes; the apply job uses GitHub's documented 360-minute hosted-job ceiling rather than inventing a smaller setup allowance.
• Doctoring records the REST/history authority boundary, timeout/collision semantics, current GitHub Actions execution limits, NIST SP 800-53 Rev. 5 AC-6/CM-3, and Sinan, Shahin, and Gondal (2025) in APA 7th form.

Live drift and acceptance boundary

Live settings must be re-read independently of source integration. The last verified state showed inherited organization ruleset 18156473 with required_approving_review_count=1 and routine OrganizationAdmin/always bypass, while .github repository ruleset 17921150 had approval 0/last-push false/CODEOWNER false but still permitted rebase and routine OrganizationAdmin/always bypass. This PR therefore has not completed settings reconciliation merely by changing source.

Require terminal successor-head security/review evidence before ordinary merge. After source reaches protected main, provision the distinct least-privilege owner-plane identity, enable reconciliation only for a controlled maintenance interval, require exact live payload plus immutable-history convergence, re-run the canonical audit, and prove unchanged deterministic-GREEN ContextualWisdomLab/Orgmetra#88@0dc4f09cc3c87829ea1e3a0e3dc0188df07ad8cd can take the ordinary protected merge path without synthetic approval or routine administrator bypass. Genuine failed/absent required workflows and unresolved required threads remain blocking.

Refs #772, #1176, #1340, #1351, #1669, #1728, #1731, #1734, ContextualWisdomLab/Orgmetra#89.

Summary by CodeRabbit

• 새 기능

  • 저장소 및 조직 규칙 세트를 선언적으로 관리하고 자동 검증·조정하는 거버넌스 기능이 추가되었습니다.
  • PR, 기본 브랜치 변경, 예약 실행 시 규칙 세트 검증이 자동 수행됩니다.
  • 기본 브랜치 보호와 필수 워크플로 정책이 강화되었습니다.
  • 규칙 세트 변경 충돌과 일시적 API 오류를 안전하게 확인하고 복구합니다.

• 문서

  • 필수 워크플로, 적용 범위, 검증 절차 및 운영 정책 문서가 최신화되었습니다.

• 품질 개선

  • 누락·비정상 규칙, 잘못된 병합 방식과 설정을 더 정확히 감지합니다.
  • 검증 결과를 누적해 모든 검사를 완료한 뒤 오류를 보고합니다.

[seonghobae]

Latest-main ordinary-restack receipt — exact head 82ef13ac35e4046e2eafba68bd1650ffc32b3470.

• Parents: predecessor 825a7d56441c323a66254f5aadf2b26b625885c4 and protected main@9aad23c09da468716a788cfed65cd44f7d84a284; exact tree 84e04fbc605e5a60b42ed21322e9bd8fd86d2fde.
• Main's merged test(concurrency): assert the real group key and the real cancel flag #1975 changes only strengthen concurrency-contract parsing/tests and are preserved byte-for-byte.
• Exact-head validation: combined focused 279 passed; owner focused 185 passed; reconciler statement/branch 100%; docstrings 100%; full 3120 passed, 1 skipped; diff clean.
• The separate HOME=/tmp false fixture setup is recorded in the PR body; its exact five failures passed under the repository's normal isolated HOME=/root contract, followed by the full GREEN run.
• Unresolved review threads at this fresh read: 0.
• New exact-head hosted security/SAST/CodeQL/reconcile evidence is queued; predecessor evidence is not transferred. No merge, live apply, consumer rerun, bypass, self-approval or force update.

Source writer released again.

[seonghobae]

Read-only adoption-boundary audit at exact head 82ef13a.

This PR is not by itself evidence that Naruon stacked PRs receive enforced central required checks:

• scripts/ci/audit_central_required_workflows.py:272-327 explicitly accepts stacked ruleset 21732164 in evaluate mode, covering non-default branches and only the central OpenCode workflow. tests/test_central_required_workflow_ruleset_audit.py:85-94 and 400-462 exercise that evaluate-only contract; these are not enforcement acceptance tests.
• config/ruleset-governance.json targets only 17921150 and 18156473, not 21732164. The central auditor at lines 157-163 requires default-branch-only scope. The reconciler preserves live conditions rather than adding stacked coverage.
• scripts/ci/reconcile_ruleset_governance.py:498-501 sets required_approving_review_count=0, require_code_owner_review=False, require_last_push_approval=False and required_reviewers=[]. Applying this existing policy is materially different from repairing missing stacked workflow coverage. Pending operator policy/authority decisions must not be bypassed by invoking apply.
• .github/workflows/ruleset-governance-reconcile.yml:135-181 contains the protected-main, enable-variable, protected-environment, dedicated administration credential, exact-revision and post-write verification path. Source presence does not prove credential provisioning or live convergence.

For the Naruon consumer gap, retain the current PRs and require a separately reviewed workflow-only stacked enforcement contract and tests in this canonical owner after the scope/authority decision. Do not broaden the mixed default-branch ruleset, reduce approvals, or copy consumer workflows as a shortcut. No settings, permissions, allowlists or source files were changed during this audit; tests were inspected, not executed. No current-head check or approval is asserted by this comment.

[seonghobae]

Single-writer reacquired because protected main advanced after the last release. Bounded scope: ordinary non-force merge of main@ad0779bee66624c3997947d7691f4b0dbb973be1 into current #1644 head 82ef13ac35e4046e2eafba68bd1650ffc32b3470; preserve #1973 scheduler conflict-admission delta byte-for-byte; rerun current-tree governance, scheduler, coverage/docstring, and full suites; refetch remote head/main before a guarded fast-forward branch update. No ruleset/default-branch/settings mutation, approval, bypass, force-push, or consumer rerun is in this source-writer claim.

[seonghobae]

Latest protected-main adoption receipt — exact head 4556483380bf7e7770bfc5e8c1094ce3350134ed.

• Ordinary two-parent commit preserves predecessor 82ef13ac35e4046e2eafba68bd1650ffc32b3470 and protected main@ad0779bee66624c3997947d7691f4b0dbb973be1; exact tree 4195f8a8a6d77a252650a90fa6ca804c411afceb.
• Main's fix(scheduler): skip review dispatch when the merge tree cannot materialize #1973 scheduler delta is retained byte-for-byte: scripts/ci/pr_review_merge_scheduler_core.py blob cffb52cb…, tests/test_pr_review_merge_scheduler.py blob 8b924291….
• Exact-tree GREEN: governance+merge-scheduler focused 582 passed; governance focused 185 passed; reconciler 396 statements / 154 branches = 100%; interrogate 100%; full 3124 passed, 1 skipped, 21 subtests; diff check clean.
• The first full invocation exposed a local execution-fixture mismatch only: the newly created uv venv had no pip, whereas hosted setup-python does. After seeding pip, the exact failing materializer test and unchanged full tree passed. No source change, suppression, or gate weakening was used.
• Fresh remote readback: head/base/main match the SHAs above, mergeable source tree, unresolved threads 0, approvals 0; new hosted evidence is 12 queued, 1 in_progress, 2 skipped and does not inherit predecessor evidence.

Source writer released. Do not merge or execute live settings reconciliation until this unchanged exact head has terminal required security/CodeQL/reconcile/SBOM/provenance/review evidence and the ordinary protected path is available. No settings, ruleset, default-branch, branch-protection, principal allowlist, consumer head, or run was mutated.

[seonghobae]

SOURCE WRITER CLAIM — protected main advanced to 49eb9e7035a6994fffb5b24bf943156be27a02fb after the prior writer release. I am resuming this existing owner branch only, will ordinary-merge that protected tip without force or delta loss, re-run exact-tree focused/full validation, then advance the existing ref only after a fresh head/base compare. No settings/apply/merge action is included in this claim.

[seonghobae]

SOURCE WRITER RELEASE — exact head 8d0c3e7de921c4e45ebc022b1e035c7f5c1e52fb now ordinarily adopts protected main@49eb9e7035a6994fffb5b24bf943156be27a02fb with parents 4556483380bf7e7770bfc5e8c1094ce3350134ed and 49eb9e7035a6994fffb5b24bf943156be27a02fb; exact tree 14b9a3170fa61391b9a4d949184ea7ab0df2ff56. Exact-tree evidence: focused governance/scheduler/main-delta 813 passed; reconciler 396 statements / 154 branches = 100%; docstrings 100%; full 3124 passed, 1 skipped, 21 subtests; diff check clean. #1979's 13 test-only cancel-in-progress contract deltas are preserved. No predecessor hosted evidence transfers; no live ruleset/default-branch/protection/Actions-variable/security setting was changed. Fresh exact-head hosted gates and current-head review remain required before ordinary merge.

[seonghobae]

Fresh Wardnet canary for this reconciler's current solo-maintainer policy target, without changing .github source or live settings:

• live inherited organization ruleset 18156473 still has required_approving_review_count=1, no required reviewer/team, thread resolution required, and OrganizationAdmin/always bypass;
• ContextualWisdomLab/wardnet#173@7d0006b0f1fd3311c891bf359bd0c3e66a1831ec is unchanged on protected main@a52ccd0a24a727d9349bb32def7713882d8cad1e, GitHub reports mergeable=true, all returned review threads are resolved, and exact-head CI 34025817869, Security Scan 34025817908, SAST Semgrep 34025817866, and CodeQL PR 34025817876 are terminal success; there is no qualifying non-author APPROVED review.

That is a current external validation specimen for the canonical approval count 0 + deterministic gates + thread resolution + no routine bypass policy declared by this PR. After #1644 itself reaches protected truth and owner-plane apply authority is legitimately available, use an unchanged exact-head canary of this class to prove convergence; do not use OrganizationAdmin/always to merge the product PR first.

Current #1644 exact source 8d0c3e7de921c4e45ebc022b1e035c7f5c1e52fb has focused Ruleset Governance Reconcile run 34048013390 terminal success, while Python Security 34048013336, SAST 34048013279, Security Scan 34048013289, and CodeQL PR 34048013338 remain queued. Those current-head queues remain non-passing and should be handled on the central runner/control-plane path rather than by source churn.

[seonghobae]

SOURCE WRITER CLAIM — protected main advanced to 5c60b5d9e8fb8461480d6a30b0b5f149753afb12 after the prior release. Current #1644 exact head is 8d0c3e7de921c4e45ebc022b1e035c7f5c1e52fb; all review threads are resolved and the only new protected delta is #1980's 26-line value assertion for PR-keyed scan cancellation. I am taking this existing owner branch for a bounded ordinary two-parent adoption, preserving every governance delta and reacquiring exact-tree focused/full evidence before any non-force ref update. No settings apply, ruleset change, merge, bypass, or consumer ref action is included.

[seonghobae]

SOURCE WRITER RELEASE — exact head f53a5cada568177525b6f14d6d7b57a342a6b885 now ordinarily adopts protected main@5c60b5d9e8fb8461480d6a30b0b5f149753afb12 with parents 8d0c3e7de921c4e45ebc022b1e035c7f5c1e52fb and 5c60b5d9e8fb8461480d6a30b0b5f149753afb12; exact tree 09da25edae051d71e5a8b8a7d1c0844b612dbad8.

The intervening protected delta is only #1980's 26-line test contract pinning cancel-in-progress as a true value for python-security.yml and sast-semgrep.yml; all governance/reconciler source and every prior semantic delta are unchanged.

Exact-tree evidence:

• focused ruleset/reconciler plus queue contract: 252 passed;
• reconciler: 396 statements / 154 branches = 100%;
• docstrings: 100%;
• full suite: 3125 passed, 1 skipped, 21 subtests passed;
• full coverage: 13,690 statements / 5,558 branches, 0 missed, 100%;
• git diff --check: PASS.

Remote verification confirms the exact tree and both parents. Fresh hosted evidence is 11 queued, 1 skipped; exact-head approvals are 0 and unresolved review threads are 0. No predecessor hosted evidence transfers. No live ruleset/default-branch/protection/Actions-variable/security setting was changed, and no apply, merge, bypass, force-push, or consumer action was performed.

[seonghobae]

SOURCE WRITER CLAIM — protected main advanced to 2396ddcaf4b6c50785548b313ccddfa1784915a2 after the last release. Fresh comparison shows only #1983's rendered run-name matcher repair and #1985's evidence-backed revert of the false merge-conflict review skip, confined to scripts/ci/pr_review_merge_scheduler_core.py and tests/test_pr_review_merge_scheduler.py; #1644 has no head-relative delta in either file. I am taking the existing #1644 owner branch for a bounded ordinary two-parent adoption and fresh exact-tree focused/full verification. No settings apply, merge, bypass, force update, or consumer ref action is included.

[seonghobae]

SOURCE WRITER RELEASE — exact head 3b4140e70ddccab619a7c1c8b39a90e526d5b5c3 now ordinarily adopts protected main@2396ddcaf4b6c50785548b313ccddfa1784915a2 with parents f53a5cada568177525b6f14d6d7b57a342a6b885 and 2396ddcaf4b6c50785548b313ccddfa1784915a2; exact tree 4a0dcee658dc58e924180cba9c831f2c0378d3e0.

The intervening protected delta is exactly #1983's rendered run-name matcher repair and #1985's evidence-backed revert of the false merge-conflict review skip. #1644 had no head-relative changes in either touched file, so both protected deltas were adopted verbatim while every governance/reconciler delta was retained.

Exact-tree evidence:

• combined governance/reconciler/scheduler/queue focused: 581 passed;
• reconciler: 396 statements / 154 branches = 100%;
• docstrings: 100%;
• full suite: 3123 passed, 1 skipped, 21 subtests passed;
• full coverage: 13,675 statements / 5,544 branches, 0 missed, 100%;
• git diff --check: PASS.

Remote verification confirms the exact tree and both parents. Fresh hosted evidence is 13 queued, 2 skipped; exact-head approvals are 0 and unresolved review threads are 0. No predecessor hosted evidence transfers. No live ruleset/default branch/protection/Actions variable/security setting was changed, and no apply, merge, bypass, force-push, or consumer action was performed.

[seonghobae]

SOURCE WRITER CLAIM — protected main advanced to c9052e607e5f3cc76e73207e7786b21500721b79 after the last release. Fresh comparison shows exactly #1987/#1989's fail-closed CodeQL coverage-audit repairs across .github/workflows/audit-central-ruleset.yml, scripts/ci/audit_org_codeql_coverage.py, and their tests. Because the workflow path overlaps #1644 governance scope, I am taking the existing owner branch for a bounded ordinary two-parent adoption, semantic-delta review, and fresh focused/full verification. Current predecessor checks are 13 success, 10 queued, 5 skipped with no failure, but none will transfer to the descendant. No settings apply, consumer rerun, bypass, force push, or gate weakening is authorized.

[seonghobae]

SOURCE WRITER RELEASE — exact head 5f5d7a9e849984c052c72a08eba34f68cb694024 now ordinarily adopts protected main@c9052e607e5f3cc76e73207e7786b21500721b79 with parents 3b4140e70ddccab619a7c1c8b39a90e526d5b5c3 and c9052e607e5f3cc76e73207e7786b21500721b79; exact tree 351629d513f5f79fab79d0374440c348780e78bf.

The intervening protected delta is exactly #1987/#1989's CodeQL coverage-audit repair. The overlapping audit-central-ruleset.yml and audit test merged without conflict; all prior #1644 governance/reconciler/config/docs contracts remain in the main-relative delta.

Exact-tree evidence:

• focused reconciler/ruleset/CodeQL-audit suite: 208 passed
• full suite: 3131 passed, 1 skipped, 21 subtests
• git diff --check: PASS
• local actionlint binary: unavailable, so no actionlint GREEN is claimed

Fresh remote verification: tree and both parents match; PR head points to this commit. Hosted evidence is newly materialized as 13 queued and 2 skipped, with no exact-head approval. Therefore this is not merge-ready and no ruleset/settings apply was attempted. Writer released. No force push, bypass, consumer rerun, or gate weakening.

[seonghobae]

Fresh Context Fabric dependency revalidation (2026-09-08 KST), owner-path evidence only; no central source/ref mutation from the product writer.

Protected .github/main is now exact 78a4937c684a54ca8e415822c913742f41c6efc4. #1644 remains Draft at exact 5f5d7a9e849984c052c72a08eba34f68cb694024, recorded base c9052e607e5f3cc76e73207e7786b21500721b79. Fresh compare 78a4937c...5f5d7a9e is diverged, ahead_by=246, behind_by=2, merge base exactly c9052e607e5f3cc76e73207e7786b21500721b79. The two protected-main commits after the recorded base must be adopted non-force before any old hosted evidence can authorize integration.

Exact current-head workflow reread for 5f5d7a9e...: Ruleset Governance Reconcile 34056427112 SUCCESS; SAST Semgrep 34056427200 SUCCESS; Python Security 34056427080 SUCCESS; Security Scan 34056427109 SUCCESS; CodeQL PR 34056427271 FAILURE. No predecessor result transfers after the required main adoption.

Context Fabric leaf state still requires the accepted owner sequence after this source reaches protected truth: reconcile #1644 non-force from current protected main and reacquire exact-head terminal gates; apply #772's canonical solo-maintainer ruleset repair through the separately authorized Administration-write maintenance path; then #1137 protects CGC/EA main first, switches each default to main, rereads effective ~DEFAULT_BRANCH, and hands fresh protected refs back for dependency-root-first stack reconstruction. Do not use the visible routine admin bypass and do not copy workflows back into obsolete develop merely to manufacture product evidence.

[seonghobae]

Exact-head execution receipt: ordinary parents 665adfbb220317daf8efae0124d7c2005fc5576b + protected main@7fd571dbcdbae6acf29d8f4ee704d7ba6297e4db, exact tree 8191b45cb3dbcc6a084107fc61e1c84afdf04f95. The protected #2028 CodeQL repair is preserved and the governance delta remains 21 paths. Local GREEN: governance focused 208 passed; owner reconciler 186 passed; full 3149 passed, 1 skipped, 21 subtests; diff check PASS. Hosted successor gates are nonterminal, so this COMMENT is evidence only and is not approval or merge authorization.