Control-plane gap
Naruon's effective live default-branch merge contract requires a qualifying independent non-author approval on the unchanged current/last-push head. Fresh repository/control-plane evidence on 2026-08-17 shows that this path is still not verifiable from the repository writer's authority without a real governance change:
ContextualWisdomLab/naruon collaborator inventory contains only seonghobae with admin access;- protected
develop currently carries .github/CODEOWNERS with * @seonghobae only;
- the public organization member endpoint returns no visible eligible identities for this integration;
- repository team inventory remains inaccessible to the installed integration (
403 Resource not accessible by integration), so no team eligibility may be inferred or invented;
- current open PR review requests do not establish another eligible human reviewer/team;
- author approval, self-approval, CodeRabbit/OpenCode/Noema/Strix/model output, check/status evidence, comments, and dismissed/predecessor reviews must not be treated as qualifying independent approval.
This is a merge-governance availability defect, not a reason to weaken branch protection or manufacture approval.
Live protection evidence — 2026-08-17
Protected develop@bc98789521d21271e84789888413c182aa111b4d is subject to the union of all active applicable rulesets:
- repository ruleset
15586698 (PR) requires zero approvals itself, strict required statuses, stale-review dismissal, and review-thread resolution;
- repository ruleset
17214772 (Lock default branch) requires one approving review, stale-review dismissal, approval after the last push, review-thread resolution, strict required statuses, and no bypass actor;
- inherited organization ruleset
18156473 (CWL Central required workflows) requires one approving review, stale-review dismissal, approval after the last push, review-thread resolution, the central required workflow set, and no bypass actor.
No active ruleset currently requires CODEOWNER review. CODEOWNERS therefore does not itself create the blocker; the blocker is the effective one-approval requirement combined with the absence of a verifiable eligible independent human reviewer route. The exact-head status set and inherited required workflows remain additional mandatory gates.
Required governance action
Establish at least one durable independent human approval route that GitHub can actually count under the live repository/organization rules while preserving segregation of duties. Use one of the following only when backed by real organization authority:
- grant an appropriate human organization member/collaborator the minimum repository access required to submit counted PR reviews; or
- configure an existing real human review team with repository access, then expose enough repository/team metadata to the automation integration to verify—not guess—eligibility.
If future live rules add CODEOWNER approval, then update CODEOWNERS through the normal protected change path to include the eligible reviewer/team. Do not add CODEOWNER churn merely for the current contract, because no active rule presently requires it.
Do not reduce required review counts, disable stale-review dismissal/last-push approval, grant an automated model identity human-review authority merely to make it count, self-approve through another identity, invent a reviewer/team, or use admin bypass.
Acceptance evidence
Acquisition-readiness rationale
A protected branch that demands independent approval while exposing no verifiable eligible independent reviewer is operationally deadlocked and weakens evidence-ready change management despite strict technical gates. The remediation is to create a real separation-of-duties path, not to weaken controls.
Control-plane gap
Naruon's effective live default-branch merge contract requires a qualifying independent non-author approval on the unchanged current/last-push head. Fresh repository/control-plane evidence on 2026-08-17 shows that this path is still not verifiable from the repository writer's authority without a real governance change:
ContextualWisdomLab/naruoncollaborator inventory contains onlyseonghobaewith admin access;developcurrently carries.github/CODEOWNERSwith* @seonghobaeonly;403 Resource not accessible by integration), so no team eligibility may be inferred or invented;This is a merge-governance availability defect, not a reason to weaken branch protection or manufacture approval.
Live protection evidence — 2026-08-17
Protected
develop@bc98789521d21271e84789888413c182aa111b4dis subject to the union of all active applicable rulesets:15586698(PR) requires zero approvals itself, strict required statuses, stale-review dismissal, and review-thread resolution;17214772(Lock default branch) requires one approving review, stale-review dismissal, approval after the last push, review-thread resolution, strict required statuses, and no bypass actor;18156473(CWL Central required workflows) requires one approving review, stale-review dismissal, approval after the last push, review-thread resolution, the central required workflow set, and no bypass actor.No active ruleset currently requires CODEOWNER review. CODEOWNERS therefore does not itself create the blocker; the blocker is the effective one-approval requirement combined with the absence of a verifiable eligible independent human reviewer route. The exact-head status set and inherited required workflows remain additional mandatory gates.
Required governance action
Establish at least one durable independent human approval route that GitHub can actually count under the live repository/organization rules while preserving segregation of duties. Use one of the following only when backed by real organization authority:
If future live rules add CODEOWNER approval, then update CODEOWNERS through the normal protected change path to include the eligible reviewer/team. Do not add CODEOWNER churn merely for the current contract, because no active rule presently requires it.
Do not reduce required review counts, disable stale-review dismissal/last-push approval, grant an automated model identity human-review authority merely to make it count, self-approve through another identity, invent a reviewer/team, or use admin bypass.
Acceptance evidence
APPROVEDreview from that reviewer on the exact post-last-push head.Acquisition-readiness rationale
A protected branch that demands independent approval while exposing no verifiable eligible independent reviewer is operationally deadlocked and weakens evidence-ready change management despite strict technical gates. The remediation is to create a real separation-of-duties path, not to weaken controls.