chore(governance): protect main and enforce release checks

[seonghobae]

Problem

Noema requires an enforceable and independently evidenced main governance contract. Fresh live API evidence now resolves an important ambiguity: the repository is protected, but the currently applied live rule is materially weaker than the target policy in this issue.

Fresh live governance evidence

Observation against protected main fa62a30f08122778d2db4a27fbb9b99a82dbac9a:

• GET /repos/ContextualWisdomLab/noema/rulesets succeeds and returns exactly one applicable active ruleset: organization-owned CWL Noema central security scan (id=18794436).
• The exact ruleset detail targets ~DEFAULT_BRANCH, has no bypass actors, reports current_user_can_bypass="never", and contains one rule only: required workflow .github/workflows/security-scan.yml from central repository id 1274066402, ref refs/heads/main.
• Central .github currently resolves to 6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba; its security-scan.yml PR trigger is limited to protected bases main, master, develop. OSV and supported dependency-review are diff hard gates; fixable MEDIUM/HIGH/CRITICAL Trivy findings are repo-wide hard failures; Scorecard is posture evidence.
• GET /repos/ContextualWisdomLab/noema/branches/main reports protected: true, while its classic branch-protection summary reports protection.enabled: false and required status-check enforcement off. Protection is therefore coming from the organization ruleset, not classic repository branch protection.
• The integration receives HTTP 403 for the classic /branches/main/protection detail endpoint. That inaccessible endpoint must not be invented as evidence.
• Current protected AGENTS.md explicitly says CODEOWNER review requirements are disabled/on hold for the solo-maintainer organization.

Consequence

The actual currently observable live governance does not require an independent formal approval, pull-request rule, stale-review dismissal, conversation resolution, force-push rule, or deletion rule. Missing approval therefore cannot honestly be called a currently enforced merge requirement. It remains a target governance gap owned by this issue/#29, not a synthetic blocker imposed on otherwise gate-clean PRs.

The required central Security Scan workflow remains a real enforced live gate and must be satisfied on an unchanged exact head/live protected base. Repository-local CI/reviewer checks remain executable quality contracts but are not silently promoted into ruleset requirements.

Repository-owned implementation

Clean successor PR #90 carries the repository-owned governance-audit contract in:

• test/main-governance-audit.test.ts;
• scripts/lib/main-governance-audit.mjs;
• AGENTS.md.

Its intended stronger policy remains useful as a target, but protected-main truth and desired policy must stay distinct until the GitHub control plane actually enforces it.

Reviewer-route evidence

Historical username routes remain disproven until eligibility changes: prior permission/422 evidence showed opencode-agent, cwl-noema-review, and cwl-noema-review[bot] do not constitute a usable counted autonomous reviewer path. Issue #29 owns actual Reviewer/Maintainer App provisioning and operational proof. COMMENTED reviews, statuses, checks, model output and bot-looking names never substitute for a qualifying formal approval if/when live governance is changed to require one.

Acceptance criteria

Live ruleset / branch protection

• Obtain authorized live repository/organization ruleset evidence for main with exact rule contents.
• Require pull requests and reject direct pushes except an explicit auditable break-glass role.
• Require at least one eligible independent non-author approval once a real reviewer route exists.
• Dismiss stale approvals when source head changes.
• Require conversation resolution.
• Prevent force pushes and branch deletion.
• Enumerate current bypass actors: none in ruleset 18794436; current_user_can_bypass=never.
• Bind the currently required workflow to exact live control-plane evidence: central .github/workflows/security-scan.yml@refs/heads/main.

Repository-owned governance audit

• Rebuild the fix(governance): audit independent approval requirement #87 unique governance delta on protected post-fix(security): update transitive nanoid for CVE-2026-67213 #76 lineage (fix(governance): restack independent approval audit after nanoid #90).
• Acquire application/reviewer/Security Scan evidence on fix(governance): restack independent approval audit after nanoid #90.
• Keep formal reviews/checks/status/scanners/model judgements separate.
• Correct stale Security Scan guidance to protected-base eligibility and MEDIUM/HIGH/CRITICAL Trivy semantics.
• Align the repository audit with live current truth vs target governance without claiming absent controls are active.
• Merge the clean successor under whatever governance is actually live at merge time.
• Run the governance audit from protected main and retain bounded evidence.

Behavioral proof for the target stronger policy

• A PR with pending/failed/absent/stale required gate cannot merge.
• Changing source head invalidates predecessor exact-head evidence and stale approval once stale-review dismissal is configured.
• Author/self/model/status evidence cannot satisfy independent approval once approval is configured as required.
• A normal direct push to main is rejected.
• Force-pushing or deleting main is rejected.
• Break-glass use, if any, is attributable and reviewed.

Guardrails

Do not infer protections that are absent from live API evidence, and do not turn a desired future approval policy into a fake current merge requirement. Conversely, do not weaken or bypass the live central Security Scan ruleset. Do not manufacture reviewer authority merely to satisfy this issue.

Related: #29, #90, #91

[seonghobae]

Implementation gate: PR #31

PR #31 adds a fail-closed npm run governance:audit before the hourly maintainer can dispatch review or merge. It reads every active rule applying to main and requires:

• active pull_request, required_status_checks, non_fast_forward, and deletion rules;
• stale-review dismissal and review-thread resolution;
• squash compatibility;
• strict current-base enforcement;
• integration-pinned verify, reviewer, scorecard, osv-scan, trivy-fs, and dependency-review contexts.

The audit uses only the maintainer App's existing Metadata read permission and deliberately does not grant Administration permission. It emits artifacts/governance/main-governance-audit.json and blocks all autonomous write actions on missing or drifting governance.

This does not close #27 by itself: an operator still must create the ruleset and independently review/document bypass actors and the break-glass procedure. After configuration, attach a PASS audit artifact and direct-push rejection evidence here.

[seonghobae]

2026-08-05 exact-head evidence from PR #64 confirms this governance gap remains live. Head 9182ca9656982fae0c1aa380535927894cf121ba has successful ci, reviewer-ci, central Security Scan, CodeRabbit status success, and zero unresolved review threads. A GraphQL enablePullRequestAutoMerge attempt was rejected with Pull request is in clean status, which is GitHub's response when the PR is immediately mergeable rather than held behind required branch rules. No manual merge was performed because the project policy still requires an independent exact-head approval and enforceable repository rules. Acceptance evidence for this issue should include a ruleset that makes the same clean PR eligible for auto-merge instead of immediate unguarded merge, plus a failed merge attempt for a PR with a missing required check or approval.