docs(ci): align gates after workflow optimization

[seonghobae]

Outcome

Repairs the repository-contract drift left after #284 reached protected main before review completed, and non-destructively reconciles that repair with protected-main #286.

Protected main is exact 87c4daa1830bac5a5228b6036752ad5633232085 (ci: skip draft pull request jobs (#286)). The previous #285 head 7d44caa8d4c09660fb3b5d2d9919d8141c6d5294 diverged 1 ahead / 1 behind and became non-mergeable because both #285 and #286 touched the workflow contract tests.

The current exact head is f455c2cd64b3dd3f027c91d396103792a205ddd0. It is a normal two-parent, non-force reconciliation commit whose second parent is protected main@87c4daa.... Fresh compare is 2 ahead / 0 behind, merge base exactly protected main, and GitHub reports the Ready pull request mergeable.

Preserved repair delta

The effective current-main delta is deliberately only three paths:

• CHANGELOG.md retains the ci(actions): reduce redundant workflow load #284 concurrency/nightly-materializer/standalone-cargo check repair note;
• docs/quality-gates.md retains the truthful all-target Clippy compile/check-gate wording; and
• tests/test_pr284_governance_contract.py replaces the conflicting edits to the two pre-existing workflow tests with one focused combined contract.

The focused contract preserves every valid #285 assertion while also preserving #286 instead of overwriting it: both CI and MV3 workflows must keep the complete workflow/repository/PR concurrency block, the explicit PR lifecycle event list, and Draft-job guards; the CI workflow must retain both Rust and coverage Draft guards. It also binds the quality-gate and changelog documentation to the optimized CI boundary.

No .github/** file is part of the effective diff. The scheduled product writer adopted the already-protected #286 workflow generation; it did not author or mutate workflow source.

Exact-current verification

Static exact-tree verification confirms the protected-main workflows contain the strings required by the combined regression, and repository CI discovers every tests/test_*.py file.

Current exact f455c2cd64b3dd3f027c91d396103792a205ddd0 now has terminal workflow evidence:

• CI 33930234387: success;
• Security Scan 33924016851: success;
• SAST Semgrep 33924016903: success;
• CodeQL PR 33924016883: failure; and
• the earlier Draft CI 33924016850: skipped, retained only as Draft/lifecycle evidence.

The previous body incorrectly retained queued/cancelled states after these exact-head runs became terminal. That stale PR-state evidence is corrected here without changing source, workflows or gates. The failed CodeQL verdict remains fail-closed; a successful native CI/Security/Semgrep set does not substitute for that required central verdict or for review/ruleset satisfaction.

Predecessor #285 CI/MV3 successes remain historical only after this reconciliation. Keep Ready but unmerged until the current required CodeQL/review/ruleset gates are satisfied.

Authority boundary

This PR changes no workflow, Rust source, dependency, ruleset, secret, release, or publication setting and does not retroactively authorize #284's earlier governance bypass. The governance incident remains tracked in #215 and central .github#1340.

No self-approval, bypass, force-push, destructive rebase, workflow/ruleset/secret mutation, tag, release, or publication is authorized by this repair.

[coderabbitai]

Warning

Review limit reached

Next included review available in 29 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: 06a7bd00-d914-46e2-a770-c2ab6ec8e291

📥 Commits

Reviewing files that changed from the base of the PR and between 87c4daa and f455c2c.

📒 Files selected for processing (3)

• CHANGELOG.md
• docs/quality-gates.md
• tests/test_pr284_governance_contract.py

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Exact-head reconciliation review for f455c2cd64b3dd3f027c91d396103792a205ddd0: protected main@87c4daa... was adopted non-destructively after #286. Fresh compare is 2 ahead / 0 behind with merge base exactly protected main; the effective delta is only CHANGELOG, docs/quality-gates.md, and the focused combined governance regression. No .github/** delta remains. Native CI is intentionally skipped while Draft under #286 and therefore is not GREEN; fresh exact-head evidence is required after any Ready transition. Current Security/Semgrep/CodeQL are queued and remain non-passing.

[seonghobae]

Verified the concurrent conflict repair at exact remote head f455c2c against protected main 87c4daa. The semantic delta is limited to CHANGELOG.md, docs/quality-gates.md, and the dedicated PR #284/#286 governance regression contract. Exact-head local evidence: actionlint passed; 154 Python repository contracts passed; cargo fmt, workspace tests, strict Clippy, and rustdoc passed; production function/line/region/branch coverage is 100%. I did not overwrite the concurrent writer head. This PR remains draft, so its CI jobs are expected to skip.

[seonghobae]

Exact-head review completed for f455c2c on protected main 87c4daa. The effective delta remains limited to CHANGELOG, docs/quality-gates.md, and the composed #284/#286 regression contract; no .github/** path changes and no unresolved review threads exist. Fresh local verification passed: 154 Python repository contracts, cargo fmt, all workspace/all-target Rust tests, all-target Clippy with warnings denied, rustdoc with warnings denied, and 100% production function/line/region/branch coverage. Marked Ready so hosted exact-head checks can run; queued/absent checks and approval remain non-passing.

[seonghobae]

Fresh exact-head review on f455c2cd64b3dd3f027c91d396103792a205ddd0 confirms the effective delta remains three documentation/contract paths, all 154 repository Python tests pass, the worktree is clean, and no review threads exist. I corrected the PR body’s stale Draft/queued-security claims: the PR is Ready; CI 33930234387 is queued, while the earlier exact-head Security/Semgrep/CodeQL runs were cancelled and no fresh Ready-event replacements materialized. That missing security evidence plus required independent review remains a hard merge blocker. No code or workflow mutation was needed.

[seonghobae]

Exact-head focused review on f455c2cd64b3dd3f027c91d396103792a205ddd0: rechecked the composed CI/MV3 concurrency keys, pull-request lifecycle admission, Draft/closed job guards, preservation of push/manual independence, and the documentation claim that all-target Clippy is the workspace compile/check gate. The regression contract binds both workflows plus the release/quality record; I found no new source-backed defect in this pass.

This is a COMMENTED review record, not approval. Exact-head hosted jobs and an eligible independent approval remain required.

[seonghobae]

Exact-head CI RCA update for f455c2cd64b3dd3f027c91d396103792a205ddd0 on protected base 87c4daa1830bac5a5228b6036752ad5633232085:

• Native CI 33930234387 is already successful: Rust contracts job 101207153048 and Production coverage job 101207153244 completed successfully by 2026-09-05T03:16:29Z. The prior queued description was stale.
• The cancelled Security Scan 33924016851, SAST Semgrep 33924016903, and CodeQL PR 33924016883 retain that exact head/base. No existing central CodeQL dispatch for this head was found. The convenience rerun CLI failed on a cross-repository workflow lookup before dispatch; the supported run-ID REST route then admitted attempt 2 for each run at 06:53Z. New queued jobs are 101265706025, 101265708882, and 101265710202 respectively.
• These admissions do not establish terminal scan results or repair the missing Ready-event materialization. Do not duplicate the queued attempts. Native CI success also does not satisfy the other central required workflows or the currently required eligible approval.

No workflows, event payloads, rulesets, secrets, or merge controls were changed.