[glyad]

Refs #1

Bootstrap the public MIT Web Components 2.0 governance system, with humans limited to product management and AI responsible for engineering. Includes the product charter, Git Flow policies, Issue forms, native Issue association, CI evidence, dependency handoff and release prerequisites. No components, package publication or release are implemented.

The required independent check is bound to App 5210232. Protected target updates require that App through PRs, without bypassing approval, CI or resolved conversations. The control worker is disabled until independently reviewed safeguards in control PR #4 are merged and verified.

Consolidated validation: seven governance/handoff regression tests, including fork-promotion rejection, Issue reference matching, both workflow extensions, failure evidence, candidate state changes and distinct commit history. The control PR adds live Issue-link and final PR-state authorization with 25 tests.

Automatic Copilot reviews are disabled in both repositories. No new paid review or spending-limit increase is authorized. Current-head independent approval and live deployment verification remain pending; Phase 0 is not complete.

[Copilot]

Copilot review overview

🟡 Changes recommended

Approval-gate trust and commit-binding defects undermine the required independent review guarantee.

Review effort: Balanced
Findings: 2 · 4

Open (6)

• PR-controlled workflow can impersonate the trusted verifier · New
• Manual dispatch can attach approval to an unreviewed commit · New
• Dependabot updates cannot satisfy governance requirements · New
• Missing edited trigger leaves governance checks stale · New
• Hard-coded reviewers ignore the configured authoritative allowlist · New
• Commented review incorrectly overrides an existing approval · New

What changed in this PR

Establishes the Phase 0 governance foundation for shell-web-components under Issue #1, without adding components or publishing a package.

Changes:

• Documents AI-operated engineering, Git Flow, security and release policies.
• Adds governance validation, evidence artifacts and an independent AI review gate.
• Introduces contribution templates and dependency-update configuration.

File	Description
SECURITY.md	Defines private reporting and workflow security policy.
README.md	Explains project scope and bootstrap status.
docs/​releases.md	Defines future publication gates.
docs/​product-charter.md	Records product intent and Phase 0 boundaries.
docs/​governance.md	Defines branching, checks and Issue linking.
CONTRIBUTING.md	Documents AI-operated contributions and validation.
AGENTS.md	Establishes engineering responsibilities and constraints.
.gitignore	Excludes generated evidence and local files.
.github/​workflows/​independent-ai-review.yml	Adds current-head AI approval verification.
.github/​workflows/​governance.yml	Runs validation and uploads evidence.
.github/​scripts/​validate_governance.py	Checks governance policies and PR routing.
.github/​PULL_REQUEST_TEMPLATE.md	Requests Issue links and engineering evidence.
.github/​ISSUE_TEMPLATE/​product-requirement.yml	Captures product requirements.
.github/​ISSUE_TEMPLATE/​config.yml	Directs security reports to policy.
.github/​ISSUE_TEMPLATE/​bug-report.yml	Captures defects and reproduction details.
.github/​dependabot.yml	Schedules Actions dependency updates.
.github/​ai-dlc.json	Declares engineering policy and reviewer identities.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Copilot review overview

🔵 Needs a closer look

Missing required inputs prevent failure-evidence artifacts, and the documented trusted approval verifier remains unprovisioned.

Review effort: Balanced
Findings: 1 · 1

Open (2)

• PR-controlled workflow can impersonate the trusted verifier
• Dependabot updates cannot satisfy governance requirements

Resolved since last review (4)

• Manual dispatch can attach approval to an unreviewed commit
• Commented review incorrectly overrides an existing approval
• Hard-coded reviewers ignore the configured authoritative allowlist
• Missing edited trigger leaves governance checks stale

Previously missed (1)

In code that hasn't changed since last review

Missing required files prevent governance evidence from being written

.github/​scripts/​validate_governance.py:19

If LICENSE or .github/ai-dlc.json is missing, this loop records the error but the unconditional reads below raise FileNotFoundError before governance-evidence.json is written. The workflow's always-run upload then fails without retaining validation evidence. Write failed evidence and exit after the required-file checks, before reading those inputs.

[Copilot]

Copilot review overview

🟡 Changes recommended

Workflow validation omits .yaml files, and the documented trusted approval verifier remains a merge prerequisite.

Review effort: Balanced
Findings: 2 · 1

Open (3)

• Scan .yaml workflows to prevent governance checks from being bypassed · New
• PR-controlled workflow can impersonate the trusted verifier
• Dependabot updates cannot satisfy governance requirements

[Copilot]

Copilot review overview

🟡 Changes recommended

The promotion exception accepts fork branches, and the documented trusted-verifier prerequisite remains unresolved.

Review effort: Balanced
Findings: 2 · 1

Open (3)

• Fork PRs can bypass develop-to-main promotion restriction · New
• PR-controlled workflow can impersonate the trusted verifier
• Dependabot updates cannot satisfy governance requirements

Resolved since last review (1)

• Scan .yaml workflows to prevent governance checks from being bypassed

[Copilot]

Copilot review overview

🔵 Needs a closer look

Validation and handoff issues remain unresolved, and trusted approval enforcement is still an explicit merge blocker.

Review effort: Balanced
Findings: 2 · 1

Open (3)

• Fork PRs can bypass develop-to-main promotion restriction
• PR-controlled workflow can impersonate the trusted verifier
• Dependabot updates cannot satisfy governance requirements

Previously missed (2)

In code that hasn't changed since last review

Preflight omits fresh candidate eligibility revalidation

.github/​scripts/​handoff_dependabot.py:64

The final preflight checks only SHAs. If Dependabot closes a withdrawn or superseded candidate during preflight without changing those SHAs, the script still creates an Issue, branch and draft PR for it. Revalidate candidate eligibility using fresh after the SHA check and before creating resources, so a closure already visible in this response stops the handoff.

Hotfix branches skip required Issue-number validation

.github/​scripts/​validate_governance.py:78

Hotfix branches encode an Issue number too (docs/governance.md:8), but this check only runs for features. A hotfix/42-fix PR targeting main with only Refs #1 therefore passes without referencing its corresponding Issue. Apply the Issue-number check to both feature and hotfix branches.

[Copilot]

Copilot review overview

🔵 Needs a closer look

Dependency handoff needs fresh-candidate validation, and trusted approval enforcement remains a documented merge blocker.

Review effort: Balanced
Findings: 2 · 1

Open (3)

• Fork PRs can bypass develop-to-main promotion restriction
• PR-controlled workflow can impersonate the trusted verifier
• Dependabot updates cannot satisfy governance requirements

Previously missed (1)

In code that hasn't changed since last review

Missing final candidate validation before resource creation

.github/​scripts/​handoff_dependabot.py:64

The final preflight check compares only SHAs. A candidate closed during preflight can retain both SHAs, so the script still creates an Issue, branch and draft PR despite requiring an open candidate. A retarget to another branch at the same commit also passes. After checking the SHAs, call validate_candidate(fresh, comparison, files) to recheck the candidate's state, identity and target before creating resources.

[Copilot]

Copilot review overview

🟡 Changes recommended

Manual dispatch can publish successful governance checks without validating PR routing or Issue references.

Review effort: Balanced
Findings: 2 · 1

Open (3)

• Manual dispatch can falsely pass governance checks for pull requests · New
• PR-controlled workflow can impersonate the trusted verifier
• Dependabot updates cannot satisfy governance requirements

Resolved since last review (1)

• Fork PRs can bypass develop-to-main promotion restriction

[Copilot]

Copilot review overview

🟡 Changes recommended

Dependency handoffs cannot pass trusted approval, and native Issue linkage is not enforced before merge.

Review effort: Balanced
Findings: 1

Open (1)

• Create a distinct commit before branching from the candidate · New

Resolved since last review (3)

• Manual dispatch can falsely pass governance checks for pull requests
• PR-controlled workflow can impersonate the trusted verifier
• Dependabot updates cannot satisfy governance requirements

Previously missed (1)

In code that hasn't changed since last review

Validate the Issue's live Development association

.github/​scripts/​validate_governance.py:64

This regex accepts a textual Issue reference without checking whether the Issue exists or has the native Development link required by docs/governance.md:26. The trusted control repository's verifier and merge guard do not check that association either, so an unlinked PR can satisfy the gates. Validate the live association to the corresponding Issue in the trusted pre-merge path and fail closed on missing links or API errors. A CI-only check is insufficient because removing a link does not change the approved head SHA.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[glyad]

Independent Codex review — APPROVE code changes.

Reviewer: separate Codex agent independent_review; no Copilot review requested. Reviewed merge authorization, current-head approval, native Issue linkage, dependency handoff, and workflow secret boundaries. No blocking code findings; 32 existing tests passed.

Exact reviewed commits:

• Component PR chore: bootstrap AI-operated engineering governance #2: 12b755b (22 tracked files match remote blobs).
• Governance PR #4: 7ba11f21dcffa8d15b7bd5329f1e9aba99a16351 (11 locally reviewed files match remote blobs; non-executable .gitignore excluded).

This is independent engineering review evidence, not a native GitHub APPROVED review. The authenticated GitHub identity is the PR author, glyad, and cannot approve its own PR. Required native approval and trusted-App gates remain enforced. Current-head CI passes; merge/deployment and Phase 0 acceptance are not yet complete.