[Governance] Remove routine administrator bypass from the central control-plane merge path

[seonghobae]

Current governance defect — 2026-09-02

Fresh full-payload reads show two distinct live settings surfaces remain out of the current solo-maintainer contract.

Organization ruleset 18156473 (CWL Central required workflows)

The effective inherited ruleset on Orgmetra develop remains active and default-branch-only, preserves the seven central required workflows plus deletion/non-fast-forward protection, and allows only merge/squash. Its pull-request rule currently has:

• required_approving_review_count = 1;
• dismiss_stale_reviews_on_push = true;
• require_code_owner_review = false;
• require_last_push_approval = false;
• required_review_thread_resolution = true;
• required_reviewers = [];
• require_extra_approval_for_unattributed_changes = true; and
• OrganizationAdmin with bypass_mode = always.

The positive generic approval count is structurally unsatisfiable in the current one-human-maintainer fleet. Per #772/#1351, do not manufacture independence with bot/service-account approval, self-approval, broadened reviewer credentials, or administrator bypass.

.github repository ruleset 17921150 (Lock default branch)

The repository-local ruleset already has approval count 0, last-push approval disabled, CODEOWNER review disabled, required reviewers empty, review-thread resolution enabled, and deletion/non-fast-forward protection. It remains out of contract because:

• it still permits rebase in addition to merge/squash; and
• it still exposes OrganizationAdmin/always bypass.

Current target contract

For the present one-human-maintainer operating model:

• required_approving_review_count = 0;
• require_last_push_approval = false;
• require_code_owner_review = false while the sole code owner is also the author;
• no synthetic required_reviewers merely to recreate unavailable human independence;
• stale-review dismissal and required review-thread resolution remain enabled;
• exact central required workflows and default-branch-only scope remain enforced;
• only merge and squash are accepted;
• deletion and non-fast-forward protection remain enabled; and
• no routine bypass actor exists. Any emergency repair path must be separately activated, time-bounded, attributable, and auditable.

This does not weaken OpenCode, Noema, Strix, Security/SAST, Dependency Review, coverage/provenance, or repository-specific deterministic gates and does not authorize direct protected-branch writes.

Causal owner and authorized mutation boundary

PR #1176 is the canonical source audit / regression / rollout-documentation writer for this contract. It must not be expanded into a fake settings repair when no authorized settings credential exists.

GitHub's current REST contract provides PUT /orgs/{org}/rulesets/{ruleset_id} for an organization ruleset and requires organization Administration: write. Repository rulesets have their corresponding repository administration endpoint. These are privileged owner-plane mutations, not ordinary pull-request source writes.

The currently connected ChatGPT GitHub surface exposes ruleset reads but no ruleset-settings mutation. Protected .github/main separately contains the repository-metadata reconciliation lane introduced by #1576/#1625, but its CWL_REPOSITORY_METADATA_TOKEN is deliberately scoped to repository description/topics/Pages authority and external provisioning remains open in #1579. Do not silently broaden or reuse that credential for organization rulesets. If automated ruleset reconciliation is adopted, provision a separate least-privilege protected-environment GitHub App/token with exactly the organization/repository Administration authority required for these rulesets, unavailable to pull-request code and model processes.

Primary GitHub reference: REST API endpoints for rules — organization rulesets, including the update endpoint and permission contract: https://docs.github.com/en/rest/orgs/rules

Acceptance

1. fix(governance): enforce satisfiable solo-maintainer rulesets #1176's then-current exact head reaches terminal deterministic review/security/quality evidence and its final tree remains limited to intended governance source paths relative to protected main.
2. An authorized owner-plane mutation changes organization ruleset 18156473 to the current target without weakening required workflows, scope, deletion/non-fast-forward protection, stale-review handling, or thread resolution.
3. An authorized owner-plane mutation removes rebase and routine OrganizationAdmin/always bypass from repository ruleset 17921150 while preserving the remaining controls.
4. Fresh full-payload reads prove both rulesets match the target. A settings source file, workflow definition, or successful API status alone is insufficient.
5. An unchanged deterministic-GREEN sole-author canary such as Orgmetra 🛡️ Sentinel: [CRITICAL] CI 게이트 우회 방지를 위한 Python JSON 정규화 강제 적용 #88 can proceed through the ordinary protected merge path without a nonexistent independent human and without administrator bypass.
6. A negative canary remains blocked by any genuine failed/absent required workflow or unresolved required review thread.
7. If emergency bypass capability is retained elsewhere, evidence identifies activation authority, exact SHA, reason, bounded window, and post-event review; steady-state always bypass is absent.

Do not direct-push, self-approve, synthesize approval, reuse reviewer/model credentials, broaden CWL_REPOSITORY_METADATA_TOKEN, use current_user_can_bypass=always, or lower deterministic gate requirements to make the control plane pass.

[seonghobae]

Fresh downstream control-plane evidence from ContextualWisdomLab/Orgmetra confirms the same routine-admin bypass class is not limited to the central repository's local ruleset.

• Orgmetra default branch: develop@9e3e4847510e1e612b48474ba42b177b8ed824df.
• Effective inherited organization ruleset: 18156473 — CWL Central required workflows, enforcement=active, condition ref_name.include=["~DEFAULT_BRANCH"].
• Its PR rule requires 2 approving reviews, dismiss_stale_reviews_on_push=true, require_last_push_approval=true, required_review_thread_resolution=true, and extra approval for unattributed changes; it also requires the central workflow set and blocks deletion/non-fast-forward updates.
• The same live ruleset payload nevertheless exposes bypass_actors=[{actor_type:"OrganizationAdmin", bypass_mode:"always"}] and current_user_can_bypass="always".
• Oldest Orgmetra root PR ⚡ Bolt: JSON 파싱 성능 최적화 #40 is exact head 8d8896b14db10a5a4981f0b9e209ea00ee3be64c, all applicable exact-head product/Foundation/Recovery/SAST/Security workflows GREEN, all fetched threads resolved, but zero qualifying independent APPROVE. The Orgmetra loop deliberately refuses to use the administrator bypass as a substitute.

This is downstream evidence for the existing governance owner boundary, not a request for an Orgmetra-local workaround. Acceptance should prove that the normal OrganizationAdmin path cannot bypass the inherited organization ruleset's review/workflow evidence on product repositories, or that any emergency capability is separately activated, time-bounded and auditable rather than always available. No central source/ref/workflow/settings mutation was attempted from the Orgmetra writer.

[seonghobae]

Fresh realized central-merge evidence — PR #1363 (2026-08-28)

This is a realized instance of the policy weakness already owned here, not a duplicate issue and not evidence that the central merge scheduler ignored its own approval guard.

• Immediately before merge, ContextualWisdomLab/.github#1363 was at exact head c5772d8efa237aec163ee89162bc4d74f944faad against protected main@17052a7ca3c16db90932a4d6036b43165ddee418.
• GitHub's Reviews API contains no APPROVED review for that PR. The only formal non-comment verdict is OpenCode CHANGES_REQUESTED submitted at 2026-08-27T22:35:08Z for predecessor head b4919d36f63e835b2503d9d8c1e882bb755b4c6a; it is not exact-current-head approval evidence.
• GitHub recorded a merged event at 2026-08-28T03:16:45Z with actor seonghobae, producing protected main@d8216dee3f3b67aee20a28c244ae5420bfdeacb2. The PR payload reports auto_merge: null.
• The freshly refetched repository ruleset 17921150 still has required_approving_review_count: 0, require_last_push_approval: false, OrganizationAdmin/always, and current_user_can_bypass: always.
• Direct classic branch-protection detail remains unreadable to this integration (HTTP 403), so this evidence does not claim which GitHub UI/API bypass option was selected. It proves the commercially material outcome: central control-plane source reached protected main without any exact-head formal approval, while the visible repository policy did not require one.

The central scheduler source on the integrated tree still checks has_current_head_approval() before direct or auto merge, so the smallest causal owner boundary is effective repository/organization merge policy and administrator bypass governance, not a relaxation or rewrite of the scheduler gate.

Acceptance should now include a negative central-repository canary proving an otherwise merge-ready exact head cannot merge with zero exact-head approvals, plus a supported settings read showing that OrganizationAdmin cannot use an always-on normal path around the required review/check evidence. Do not revert #1363 blindly, fabricate an approval, lower downstream review requirements, or treat this comment as retrospective approval evidence.

Second realized merge — PR #1364

A second central merge reproduced the same outcome less than 30 minutes later:

• ContextualWisdomLab/.github#1364 exact head 9505a5b457380fc72a846ab0f8253e7533f57d69 was merged at 2026-08-28T03:46:01Z by seonghobae, producing protected main@f8823a544c3c4c046977f8511f683e85f83eb496; the PR again reports auto_merge: null.
• The Reviews API again contains no APPROVED review. Its only formal non-comment verdict is OpenCode CHANGES_REQUESTED on predecessor head b7167a65e2d2b8eae8f41fc8f565573b096d8723.
• Ruleset 17921150 remains unchanged with zero required approvals, no last-push approval, and the always-on OrganizationAdmin path.

This repeated protected-main outcome strengthens the required owner action: enforce the intended exact-head independent-review policy at the effective repository/settings boundary before treating later central merges as defensible governance evidence.

Third realized merge — PR #1370

The catalog-envelope runtime repair reproduced the same governance outcome:

• ContextualWisdomLab/.github#1370 exact head 0f40d415b112ca0055f5db5b2f434788b08f01f1 was merged at 2026-08-28T04:19:09Z by seonghobae, producing protected main@24ee38b097dbfc1a895e1199ade48cff36431d05.
• The Reviews API contains no APPROVED or CHANGES_REQUESTED verdict for that exact head; every recorded review is COMMENTED.
• A fresh post-merge refetch still showed exact-head workflow runs in queued or cancelled states. Those states are not passing release evidence and cannot substitute for an independent exact-head formal verdict.

This is the third realized protected-main merge in the same session without exact-head formal approval. It does not change the previously identified causal owner boundary: effective repository/organization approval requirements and the routine OrganizationAdmin bypass path must be repaired and proven with a negative merge canary.

[seonghobae]

Fresh governance evidence on 2026-08-28 UTC:

• PR fix(strix): qualify contextual gateway model for LiteLLM #1373 exact head 5d55d5369faebdc9c16f92f743a3bad41069a214 merged at 2026-08-28T05:07:21Z as protected main@8f84b661e468de451ba5c076dc938f342bf52d70.
• Reviews API contains six submissions, all COMMENTED; there is no APPROVED or CHANGES_REQUESTED formal verdict on that exact head.
• The active repository ruleset remains 17921150 (Lock default branch).
• The merge integrated the valid LiteLLM child-model qualification, but also retained raw bearer transport through GITHUB_ENV; canonical PR fix(review): keep gateway bearer out of step environments #1369 now supersedes that credential boundary at exact head 986cfc2faa1ede59d5e6e21209bf87db3679ad47 through a normal two-parent merge with current main.

This is another observed merge-without-formal-approval event, not retrospective approval evidence. #1369 remains unmerged pending fresh exact-head gates and independent review.

[seonghobae]

Fresh realized central-merge evidence — PR #897 (2026-08-29)

This is another realized instance of the existing effective-policy/admin-bypass owner boundary, not a duplicate issue and not retrospective approval evidence.

• ContextualWisdomLab/.github#897 advanced to exact final head 49f3237067d2eeb82cd5e8fb4761f92fc0f2b07e and GitHub records it merged at 2026-08-29T13:11:38Z, producing merge commit b18ee32057c991428973e99a6ce84702123771cb.
• The retrievable PR Reviews API contains no APPROVED submission and no review bound to exact final head 49f3237.... The latest formal OpenCode verdicts before the final synchronization were CHANGES_REQUESTED on predecessor heads, including d240ba4657300bb7e127fa0b539516a9a48cee4a.
• Exact-final-head Security Scan run 33254377258 was created/started at 2026-08-29T13:11:21Z and concluded cancelled at 13:11:43Z; the merge timestamp falls inside that non-passing interval. Later final-head workflow successes began after the merge and therefore are post-merge evidence, not admission evidence.
• This comment does not infer which UI/API bypass option or credential path was used. The existing acceptance requirement remains: reconstruct the actual merge decision through audit log / Rule Insights, remove or constrain routine always-on administrator bypass, and prove a negative canary cannot merge with missing exact-head approval or a required current-head check still cancelled/queued/failed.

Inkspan release issue ContextualWisdomLab/inkspan#118 treats an unexplained protected control-plane admission that lacks then-required review/gate evidence as a downstream release blocker. Do not fabricate a review for #897, weaken downstream gates, or treat the later successful runs as if they preceded the merge.

[seonghobae]

Fresh operational reproduction — 2026-08-30

The routine administrator bypass is no longer only a settings-level risk; it was used twice on the central control plane while exact-head governance evidence was non-passing.

• #1430 merged as protected-main commit 755fe8e15cce451b61d36332db93072fbe325d49. Its merge commit records an admin bypass past opencode-review; Reviews API has no APPROVED review on head ffeb56d592e680a6bae78ed165c42d1e635a269a, and two review threads were still unresolved at merge/close.
• #1429 merged as protected-main commit dc2ed58f7976940f75ed57f73ecffbd7253b348b. Its merge commit explicitly records admin bypass past opencode-review, noema-review, and strix. Reviews API has only COMMENTED reviews and no approval on exact head c0350870a8fac09bf0fdad0639156753076b1a1a. The head's strix status is failure, linked to run 33303987644; job 99238309140 subsequently rejected the dispatch because the PR was already closed, and job 99238337353 also failed to publish the non-success status through the configured credential.

This is non-passing provenance even where the merged source tree is useful. It demonstrates that ruleset 17921150's OrganizationAdmin/always path can bypass current-head review, required security-review status, and thread-resolution evidence on the repository that owns those controls. Do not count either merge as an acceptance canary for #1340.

[seonghobae]

Fresh realized bypass evidence — PRs #1436 and #1434 (2026-08-30)

Two more central control-plane changes reached protected main through explicit bypass commits while the qualifying review contract was non-passing. This records admission provenance separately from whether the source changes are useful.

• #1436 exact head 307086967519e29107c6a37dd1b821fbd417dc22 merged as main@1d7f441a56ae43cf0b9d10b8958242ea64679444. The commit message explicitly says Bypass-merge: opencode-review required check is structurally deadlocked. Reviews API contains only two COMMENTED Devin submissions and no APPROVED review. One current review thread remained unresolved at merge/close. The TDD change itself is narrow and causal (gateway preflight max_tokens synchronized from 16 to 4096 while reasoning-only output remains fail-closed), but that does not retroactively supply independent approval or thread-resolution evidence.
• #1434 exact head 3f6c92fec9d9fb1988494ab2b0a26f8f31ef7915 merged as protected main@e36a1f716d2ba0334c0e40597d7f9a90eee9cb14. Its commit message explicitly records bypassing opencode-review/noema-review/strix. Reviews API contains seven submissions, all COMMENTED, and no APPROVED review. The PR expanded from a ZDR citation into 18 files, including required Strix workflow behavior, an unconditional orchestrator/auto → orchestrator/free switch, family-cap changes, smoke/quick-gate changes and ADR amendments. The PR body itself says the family-cap mitigation was not verified on a live hosted run.
• The unconditional free-only switch is now contradicted by open Draft #1437 head 49227aadaad3f928fa48a8dcd3a4ad27cf1cd631, which implements the prior review acceptance contract: select orchestrator/free only when live free_family_diversity >= 2, otherwise retain orchestrator/auto, with negative fixtures. This is a source-policy contradiction to converge, not evidence that fix(zdr): cite NVIDIA's own Trial ToS for the nvidia_nim not-ZDR classification #1434's bypassed admission was acceptable.

Protected main is now e36a1f716d2ba0334c0e40597d7f9a90eee9cb14. These events reinforce the existing acceptance criterion: a useful/deadlock-breaking patch still needs a separately activated, time-bounded and audited emergency path; routine OrganizationAdmin/always cannot stand in for exact-head checks, independent approval or resolved-thread evidence.

[seonghobae]

Additional realized bypass — PR #1440 (2026-08-30)

#1440 exact head 28e9cb4f6f84cc050b6a39f2e7bb3a7d0913887e merged as protected main@2c725dd928c884db2ea0d5d1e3442d54e6f3d7d4.

• The merge commit again explicitly records Bypass-merge.
• Reviews API contains zero review submissions: no APPROVED, CHANGES_REQUESTED or even COMMENTED review on the exact head.
• At fresh refetch, exact-head Python Security run 33307905631 and Hourly NVIDIA NIM Review Repair run 33307873473 were still in_progress; predecessor runs also include cancelled SAST/CodeQL/Python/Security/SBOM/OSV evidence. Pending/cancelled evidence is non-passing and cannot be retroactively satisfied by post-merge completion.
• The source change is a narrow TDD response to exact operational evidence: it surfaces bounded per-route preflight diagnostics and raises the separate gateway curl bound from 30s to 120s after a healthy route was observed being cut off at 30.0s. That causal utility does not provide admission approval or terminal exact-head evidence.

This is the third explicit bypass merge in the current sequence (#1436, #1434, #1440). Repeatedly labeling the same steady-state OrganizationAdmin/always path as a structural deadlock does not make it emergency-only, time-bounded or independently audited. The issue acceptance criteria remain unchanged.

[seonghobae]

Additional realized bypass evidence — PRs #1439, #1435, #1448 and #1451 (2026-08-30)

Four further central changes reached protected main without a qualifying approval. Admission provenance remains separate from whether a source change is useful.

• #1439 exact head a9ffa981f1638e46403e80b612fbd9db3b167c22 merged at 11:05:51 UTC as main@71abbd1a. Its commit explicitly records Bypass-merge. The only Reviews API submission is COMMENTED at 11:06:19 UTC, after the merge; there was no approval at admission.
• #1435 exact head 8388cd7c352f82dbbb7716ff54729b0a69a03241 merged as main@8b3235d2. All seven formal submissions are COMMENTED; none is APPROVED. Current-head thread PRRT_kwDOS_C14s6dgZuS remained unresolved and identifies an executable pytest-module runtime-policy bypass. Canonical corrective #1450 now owns that defect with RED→GREEN coverage; the original merge is not acceptance evidence.
• #1448 exact head 17e90ad8180dba80519df0b1c42d5b654805bd90 merged at 12:15:28 UTC as main@702392a2. Reviews API has one COMMENTED submission and no approval. The request-shape fix has focused security/quality success, but that does not satisfy the independent approval rule.
• #1451 exact head 34c883565e4538dbf7f90760a9c93ec373678989 merged at 12:19:44 UTC as main@1d8e8724. Reviews API has one COMMENTED submission and no approval. Exact-head SAST run 33310974525 was cancelled; the later push-triggered security/SBOM/CodeQL/SAST jobs were still queued at admission. Its pagination invariant repair is preserved by fix(pingora): enforce runtime policy on executable test modules #1450, but neither source usefulness nor later completion is admission evidence.

No retrospective approval, status-only evidence, or post-merge run is being promoted into admission evidence.

[seonghobae]

Additional realized bypass evidence — PR #1452 (2026-08-30)

#1452 exact final head cabbe0c160a7acb4d534407e0e55e24fee5fbc1c merged at 2026-08-30T14:54:45Z as protected main@1ff8268255b061461d9d49b4cab4febf9a8e7bfa. The merge commit explicitly records a bypass merge.

Admission evidence was non-passing:

• Reviews API has no APPROVED or CHANGES_REQUESTED submission bound to exact final head cabbe0c1...; the only exact-head review is the author's COMMENTED submission at 14:49:32Z.
• Three current review threads remained unresolved at merge/close.
• Current-head dependency-review, Trivy, OSV, Python Security, CodeQL, Noema and OpenCode/coverage jobs were still non-terminal and were cancelled or skipped when the PR closed. For example, Security Scan run 33317919854 had its dependency-review, Trivy, OSV and Scorecard jobs cancelled at 14:54:48Z, three seconds after merge; CodeQL run 33317919865 was likewise cancelled at 14:54:48Z.
• Predecessor OpenCode CHANGES_REQUESTED reviews do not transfer to this final head, and later post-close workflow activity is not admission evidence.

The source change may be useful and has separate local/general-quality evidence, but that does not manufacture an independent exact-head approval, thread resolution, or terminal required evidence at admission. This is another realized instance of the existing OrganizationAdmin/always owner boundary. Acceptance remains removal or precise constraint of routine bypass plus a negative canary proving protected main cannot merge without exact-head approval, resolved threads, and terminal passing required gates.