ops(governance): resolve declared-versus-live central review-policy drift

[seonghobae]

Current governance decision — 2026-09-02

Issue #772 resolves the policy ambiguity this issue originally tracked. The fleet has one human maintainer and no independent human reviewer capacity, so a generic positive human-approval count, last-push approval by another person, or mandatory CODEOWNER approval by the same sole author is structurally unsatisfiable. Do not manufacture independence with bot approvals, service accounts, broadened reviewer credentials, or routine administrator bypasses. Remove the impossible generic human-approval gates while keeping deterministic admission evidence fail-closed.

Target contract:

• required_approving_review_count = 0;
• require_last_push_approval = false;
• require_code_owner_review = false while the sole code owner is also the author;
• required_reviewers = [] unless governance later identifies a genuinely independent human authority;
• required review-thread resolution and stale-review handling remain enabled;
• required OpenCode, Noema, Strix, Security/SAST, Dependency Review, coverage/provenance and other deterministic gates remain authoritative;
• deletion and non-fast-forward protections remain enforced;
• only merge and squash are accepted by the current audit; and
• routine OrganizationAdmin/always bypass is forbidden. Emergency repair belongs to a separately governed, time-bounded, auditable break-glass path.

This does not authorize direct protected-branch writes, self-approval, synthetic approvals, predecessor-evidence transfer, or weaker deterministic workflows.

Fresh live drift

Current consumer read of inherited organization ruleset 18156473 still shows required_approving_review_count = 1, require_last_push_approval = false, require_code_owner_review = false, required_reviewers = [], default-branch-only scope, merge/squash methods, deletion/non-fast-forward protection, and OrganizationAdmin/always bypass.

Current owner-repository ruleset 17921150 has required_approving_review_count = 0, require_last_push_approval = false, require_code_owner_review = false, required_reviewers = [], required review-thread resolution, deletion/non-fast-forward protection, but still allows rebase in addition to merge/squash and still contains OrganizationAdmin/always bypass. Both live rulesets therefore remain out of contract for distinct reasons.

Canonical source lanes

PR #1176 remains the canonical executable audit/documentation writer. Its current writer includes test-first regressions for the solo-maintainer approval/CODEOWNER deadlock followed by production auditor repair in both organization and repository ruleset paths. It preserves current protected-main work through ordinary non-force integration and exact protected-main blobs. Do not persist volatile #1176 head SHAs, protected-main SHAs, run IDs, queue counts, review snapshots, or mergeability here; fetch them live immediately before every action. A full-tree comparison must prove that only intended governance paths differ, and every check/review must belong to the then-current exact head.

PR #1644 is now the canonical source-controlled owner-plane reconciliation lane for actually closing the declared-versus-live settings gap after review. It pins exactly rulesets 17921150 and 18156473, preserves unrelated live controls, projects the full reviewed pull-request policy (including stale-review dismissal and required thread resolution), removes routine bypass actors, binds callable and CLI mutation to an exact protected-main SHA, and uses immutable ruleset history to detect/recover unsafe write races. A newly reproduced delayed-recovery race is covered test-first: an ambiguous recovery PUT must settle against immutable history before any subsequent write, never blind-retry. The privileged apply job remains gated by trusted protected main, explicit CWL_RULESET_RECONCILE_ENABLED=true, the protected ruleset-governance-maintenance environment, and a separately provisioned least-privilege CWL_RULESET_ADMIN_TOKEN.

Source availability is not live convergence. The connected GitHub tool surface still exposes direct ruleset reads but no organization/repository ruleset-settings write action; #1644 supplies the reviewed Actions owner-plane path only after it reaches protected main and the dedicated environment/credential is provisioned. Do not represent live settings as repaired until an authorized controlled apply actually occurs and fresh full-payload reads plus the canonical audit verify both scopes.

Acceptance

• Source audit, fixtures, rollout documentation, issue guidance, owner-plane reconciler, and live organization/repository rulesets agree on the satisfiable solo-maintainer policy.
• Tests accept 0 approvals / last-push disabled / CODEOWNER-review disabled and reject a positive generic approval count, synthetic reviewers, CODEOWNER deadlock, routine bypass actors, disabled stale-review dismissal/thread resolution, missing required workflows, deletion/non-fast-forward weakening, undeclared rules, malformed merge-method payloads, or merge-method drift.
• Privileged reconciliation requires an exact protected-main SHA at every callable/CLI mutation boundary, fails closed on visible drift, and never repeats an ambiguous write until immutable history proves the prior outcome.
• The current fix(governance): enforce satisfiable solo-maintainer rulesets #1176 and fix(governance): automate ruleset owner-plane reconciliation #1644 exact heads have terminal current-head deterministic evidence; queued/pending/skipped-required/cancelled/failed/stale evidence is never promoted.
• Final post-change reads prove complete live payloads and inheritance on representative consumers.
• An unchanged deterministic-GREEN sole-maintainer canary (Orgmetra PR 🛡️ Sentinel: [CRITICAL] CI 게이트 우회 방지를 위한 Python JSON 정규화 강제 적용 #88) is no longer blocked solely by nonexistent independent human approval, while real deterministic failures remain blocking.
• No admin bypass, direct protected-branch write, self-approval, synthetic review, force update, or predecessor-evidence reuse is used.

Related owner work: #772, #1200, #1340, PRs #1176/#1644, and Orgmetra #88/#89.

[seonghobae]

Fresh read-only consumer evidence from ContextualWisdomLab/Orgmetra confirms the declared-versus-live review-policy drift remains active and commercially material; no organization ruleset/settings mutation was made from the Orgmetra writer loop.

• consumer protected branch: Orgmetra/develop@9e3e4847510e1e612b48474ba42b177b8ed824df;
• inherited ruleset: 18156473 (source_type=Organization, source ContextualWisdomLab, enforcement active);
• live PR policy still reports required_approving_review_count: 1, require_last_push_approval: false, dismiss_stale_reviews_on_push: true, required_review_thread_resolution: true;
• ruleset still exposes OrganizationAdmin with bypass_mode: always / current_user_can_bypass: always;
• Orgmetra's local governance tracker is ContextualWisdomLab/Orgmetra#89, but the effective settings owner is this organization-level boundary, not an Orgmetra branch.

This is not a request to select a weaker policy or to mutate rules from the consumer. Acceptance remains owner-side: deliberately reconcile declared and live policy through the normal reviewed governance path, then provide a fresh exact ruleset read/audit proving the approved approval count and last-push semantics agree, with no routine bypass and no required-workflow reduction. Until then Orgmetra will continue treating one-approval/no-last-push/bypass-capable settings as non-commercial merge evidence even when GitHub would technically permit a path.

[seonghobae]

2026-09-02 implementation split: #1176 remains the canonical audit/regression/rollout-contract writer; new #1644 is the distinct owner-plane reconciliation mechanism needed to make the declared policy convergent without manual settings edits. #1644 is test-first and binds exactly rulesets 17921150 and 18156473; its PR path is read-only, while any live PUT is gated behind trusted main, protected environment ruleset-governance-maintenance, explicit CWL_RULESET_RECONCILE_ENABLED=true, and a dedicated CWL_RULESET_ADMIN_TOKEN. It performs a second read before mutation to refuse concurrent drift and a third read afterward to require complete editable-payload convergence.

This does not supersede #1176 and does not mark the live settings repaired. Current live organization settings still show approval count 1 plus routine admin bypass; the .github repository ruleset still permits rebase plus routine admin bypass. The owner-plane secret/environment/enable variable remain independently provisioned evidence, not source-code assumptions. Acceptance remains #1644 source evidence → authorized live reconciliation/full read → #1176 current-head audit evidence → unchanged Orgmetra #88 ordinary merge-path canary with deterministic failures still blocking.

[seonghobae]

Fresh Naruon canary evidence (2026-09-02) confirms the declared-versus-live review-policy drift is still effective. ContextualWisdomLab/naruon default/protected branch is develop@042b0c70531b229af3acbd0421a2f23098d848b3. Repository-local ruleset 15586698 is already solo-maintainer-satisfiable (required_approving_review_count=0, no required reviewers/CODEOWNER/last-push approval, required thread resolution retained). However inherited organization ruleset 18156473 still applies to ~DEFAULT_BRANCH with required_approving_review_count=1, required_reviewers=[], require_code_owner_review=false, require_last_push_approval=false, and OrganizationAdmin/always bypass. Naruon PR #1365 is currently open/mergeable at exact head a84a666e5501a43fa010809c1cc00395a9ca9700 with zero unresolved review threads; auto-merge has been enabled so it will remain fail-closed on the live deterministic/approval gates rather than using administrator bypass. Treat this as an additional canary for #1644 after its owner-plane reconciliation lands: the inherited org rule, not Naruon product source or the repository-local PR rule, is the positive-human-approval source that must converge to the accepted count=0 contract while preserving required workflows and thread resolution.