fix(governance): fail fast on P0 approval ruleset drift

[seonghobae]

Warning

Draft-blocked governance candidate. Exact head 883c201a2e1fa272cc1fe4e26f583aaf3b411497 hard-codes two approving reviews and last-push approval. That conflicts with the accepted solo-maintainer contract in #772 and canonical owner-plane reconciler #1644. Do not merge this head or apply its proposed settings.

문제

Live ruleset 18156473 currently has one generic approving-review requirement, no named required reviewers, CODEOWNER review off, last-push approval off, and an OrganizationAdmin/always bypass. The generic approval requirement is structurally unsatisfiable for the scoped solo-maintainer repositories without fake humans, self-approval, or treating bots/models as humans.

This candidate originally treated that state as drift toward two approvals plus last-push approval. Fresh owner review established that direction would deepen the deadlock and is not the canonical remedy.

고유 delta

The only potentially reusable delta is the early review-protection preflight before the organization-wide repository walk. It may be retained only after it derives expected review settings from the canonical #1644 policy/config instead of hard-coding two humans.

현재 head의 변경

• reads the live ruleset once and runs a review-only preflight before the organization repository walk;
• reuses that review check in the broader audit;
• currently encodes required_approving_review_count == 2 and require_last_push_approval == true, which is intentionally blocked.

Historical validation

• uv run pytest -q tests/test_central_required_workflow_ruleset_audit.py tests/test_central_required_workflow_exact_inventory.py tests/test_code_scanning_required_workflow_contract.py tests/test_org_required_workflow_scope_contract.py — 40 passed
• actionlint .github/workflows/audit-central-ruleset.yml
• git diff --check

These results describe only the historical proposal and do not validate the canonical solo-maintainer policy.

다음 조치

Keep this PR Draft. After #1644 reaches protected truth, either:

1. restack only the early-preflight mechanism and derive expectations from the canonical policy/config; or
2. retire this PR if fix(governance): automate ruleset owner-plane reconciliation #1644 or protected main already provides equivalent fail-fast coverage.

Do not set two generic approvals, enable last-push approval, synthesize reviewers, self-approve, use routine administrator bypass, or weaken deterministic workflow/security/SAST/coverage/package/SBOM/provenance/thread/deletion/non-fast-forward controls.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: 6792ad34-214a-4e6e-a768-45665f59e3d0

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Fresh owner-path refresh — 2026-09-06 KST.

This finding remains valid on the current exact #1861 head 883c201a2e1fa272cc1fe4e26f583aaf3b411497. Source re-read of scripts/ci/audit_central_required_workflows.py still hard-codes required_approving_review_count == 2 and require_last_push_approval == true, while live organization ruleset 18156473 remains the bare solo-incompatible count (1, no named required reviewers, CODEOWNER false, last-push false). Applying #1861's proposed 2/true state would worsen the structural deadlock and contradict #772's accepted solo-maintainer owner contract.

Canonical remedy remains #1644: approval count 0, last-push/CODEOWNER false, no synthetic reviewers, with stale-review dismissal, thread resolution, deterministic required workflows/security/SAST/coverage/package/SBOM/provenance, deletion/non-fast-forward, exact-head binding and no routine bypass retained.

Live owner state also moved: #1644 is now f0c97210b127139cfef0b8dac08cb02966bd814e; protected .github/main is fe827e133e7d867015d088777553e22736344c55; fresh compare is diverged, 238 ahead / 7 behind with merge base f250638827f8252b0d9e5cb2601f4d333f96162f. Reconcile #1644 non-force before integration and discard predecessor gate evidence. Current f0c972... exact runs show Ruleset Governance Reconcile, Python Security, Security Scan and SAST successful, while CodeQL PR 33966029195 fails in both compatibility jobs after real runner acquisition at the exact-head verdict-enforcement step, so #1644 is not merge-ready yet.

Retain #1861's early review-drift preflight only if it derives expected values from the canonical solo-maintainer policy/config instead of reasserting two humans. If no unique delta remains after that correction, retire #1861 in favor of the reconciled canonical owner lane. Do not apply 2 approvals / last-push true, use self/model approval, or route around deterministic gates.

[seonghobae]

Wardnet owner-boundary finding: this candidate's asserted target (required_approving_review_count=2 plus require_last_push_approval=true) conflicts with the currently declared solo-maintainer governance contract already recorded in #772 and the canonical owner-plane reconciler #1644. Fresh live organization ruleset 18156473 still has approval count 1, empty required_reviewers, require_code_owner_review=false, and require_last_push_approval=false; Wardnet exact candidates #93/#155 demonstrate deterministic repository/security gates can become GREEN while no eligible independent human approval authority exists. Under the accepted model, self-approval and bot/model-as-human are forbidden, so raising the generic count from 1 to 2 would deepen the structural deadlock rather than fail closed safely.

RED: an audit labels the live solo-compatible direction (approval count 0, deterministic gates retained) as P0 drift and instructs operators to restore two human approvals/last-push approval despite no eligible independent human authority. GREEN: reconcile this audit's approval expectation to the live canonical owner policy from #772/#1644 (generic approval count 0 for the scoped solo-maintainer repositories; no synthetic reviewer; no routine bypass) while continuing to fail closed on deterministic workflow/security/SAST/coverage/package/SBOM/provenance/thread/deletion/non-fast-forward drift. This is a central governance repair; Wardnet source should not work around it.