security(governance): bind maintainer preflight to live main rules

[seonghobae]

Problem

Protected main c85d710804139c0697d7ef8fa47d02b1389e6d84 lets scripts/maintainer-app-readiness.mjs load a local governance JSON artifact and the protected evaluator accepts that persisted status as part of the activation prerequisite. A stale or forged local PASS must never substitute for fresh effective main rules.

This is distinct from the external ruleset/reviewer provisioning gaps in #27/#29: repository code can validate live rules returned to an authorized preflight, but cannot create or prove administrator-side policy, bypass actors, App installation ownership or an eligible independent reviewer.

RCA

• First failing boundary: retained governance report -> Maintainer App activation preflight.
• Immediate cause: the protected evaluator trusted the report's stored status without binding the decision to freshly collected active rules.
• Root cause: governance evidence production and consumption were separated by a mutable local JSON artifact without live canonical re-evaluation.
• Systemic risk: a historical/local PASS can remain syntactically valid after the effective rules change.

Active test-first repair

PR #117 (fix(security): bind maintainer preflight to live governance) is the current direct-main repair.

• protected/live base: c85d710804139c0697d7ef8fa47d02b1389e6d84;
• RED head: 11407740f95c13cba0598bd990dd7a861a243498;
• current exact GREEN head: 6a43c9a8b5837c21fed0d3d853c46086244262e8;
• current compare: 7 commits ahead / 0 behind live main, merge base exactly the protected head;
• PR state: Ready, mergeable, direct main.

The current line reuses evaluateMainGovernanceRules, collects fully paginated active main rules during preflight, rejects malformed pagination, and requires the fresh live-rules evaluation to pass. Retained governance status remains diagnostic evidence and cannot override a live failure.

Exact current proof

For unchanged #117 head 6a43c9a8b5837c21fed0d3d853c46086244262e8:

• application ci 31441762566: terminal success;
• reviewer-ci 31441762550: terminal success;
• eligible central Security Scan 31441762565: terminal success;
• formal reviews: 0;
• inline review threads: 0;
• no qualifying independent APPROVED review exists, so technical GREEN is not merge authority.

Acceptance

Repository-owned implementation on #117 current exact head

• Stored {repository, branch, status: "PASS"} without live rules fails closed.
• Current live rules are evaluated by the same canonical evaluator used by the governance audit.
• Malformed/non-array pagination fails closed.
• A live ruleset failing canonical governance cannot be converted to PASS by a retained report.
• Existing identity/scope/probe/reviewer separation remains intact.
• Focused RED -> GREEN plus exact-head application CI, reviewer-ci, eligible central Security Scan and current review/thread validation are complete.
• No self-approval, protection weakening, outbound-license choice, deployment/release/KPI/acquisition claim is introduced.

Remaining protected integration / operation

• Obtain authorized live chore(governance): protect main and enforce release checks #27 governance evidence and a qualifying independent non-author formal approval where actually required; do not synthesize either from checks, model comments or mergeability.
• Merge only an unchanged exact head after every applicable gate remains satisfied.
• Re-run the live-governance binding from protected main after integration and retain protected-source operational evidence separately from PR/check/model evidence.
• Keep external Maintainer/Reviewer App provisioning, eligibility, key custody and activation evidence under chore(operations): provision and activate hourly maintainer App #29; source preflight does not create those facts.

Related: #27, #29, #90, #111, #117

[seonghobae]

Repository-owned completion is now protected truth through clean successor PR #254.

• successor exact head: c022f1519dab8218be6e854be4471d4828780a69;
• protected merge commit: 382c78f2e9eeac4f24b3a825f192b34943e30c9a;
• exact-head application ci 31661217965: terminal success;
• exact-head reviewer-ci 31661217966: terminal success;
• exact-head eligible central Security Scan 31661218033: terminal success;
• formal reviews: 0, consistent with the then/current observable live rules rather than an invented approval requirement;
• unresolved inline review threads: 0.

Current protected source still calls evaluateMainGovernanceRules(evidence.governanceRules) and records live_governance_not_pass before evaluating the retained governance report. A persisted status: PASS therefore cannot override freshly collected active-main rules. The workflow also retains the delegated token-file boundary and bounded/redacted GitHub CLI diagnostics.

This closes the source defect tracked here. Actual live ruleset strengthening, bypass/behavioral proof, Reviewer/Maintainer App installation and operational activation remain external control-plane work under #27 and #29; they are not manufactured by closing this repository-code issue.