fix(governance): reject ambiguous production protection rules

[seonghobae]

Purpose

Harden Noema's production-environment governance evidence so malformed or future-drifted GitHub responses containing duplicate semantic protection rules cannot normalize into a passing result by selecting only the first matching rule.

Exact identities

• protected/live base: 4573a6f7eaf904e19a6e3198c8cabcfd4be40c40
• original RED commit: 0c59219f0e213162576d6465ae9d8b731d745035
• current restacked GREEN head: af152e4fa1b698d563369712e3e8bb0e1e065797
• branch: fix/production-environment-rule-ambiguity

GREEN implementation

evaluateProductionEnvironment() now collects the required_reviewers and branch_policy semantic rule families, requires exactly one record for each authority type, preserves concrete first-rule details for diagnostics, and emits required_reviewers_rule_ambiguous or branch_policy_rule_ambiguous when duplicates are observed. Existing requirements for concrete reviewers, self-review prevention, protected branches, and disabled custom branch policies remain intact.

Focused tests prove duplicate reviewer and branch-policy rule families fail closed rather than inheriting the first record.

Restack and verification boundary

The branch was merged with protected main after #272, #266, and #275. The current merge tree overlays only scripts/lib/production-environment-governance.mjs and test/production-environment-governance.test.ts on current protected-main bytes.

Historical predecessor evidence does not transfer. Application ci, reviewer-ci, protected-base-eligible Security Scan, and fresh review must complete successfully on unchanged current head af152e4fa1b698d563369712e3e8bb0e1e065797 before merge. Pending, queued, skipped, absent, neutral, failed, cancelled, stale, predecessor, status-only, model-only, or rate-limited evidence is non-passing.

This evaluator hardening does not assert that the live GitHub production environment passes, that administrator bypass is disabled, that reviewer ownership is valid, or that a deployment or release occurred.

No repair/self-modifying workflow, protection weakening, reviewer invention, secret mutation, audit waiver, release, or deployment claim.

[coderabbitai]

Warning

Review limit reached

@seonghobae, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 60 minutes

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: bfc04fa7-93b7-4a6b-bb72-2ee0b9b7c642

📥 Commits

Reviewing files that changed from the base of the PR and between 4573a6f and af152e4.

📒 Files selected for processing (2)

• scripts/lib/production-environment-governance.mjs
• test/production-environment-governance.test.ts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@coderabbitai review

Review exact current head af152e4fa1b698d563369712e3e8bb0e1e065797 against protected base 4573a6f7eaf904e19a6e3198c8cabcfd4be40c40. Verify duplicate semantic production-environment rule families fail closed, diagnostic details do not make ambiguous evidence authoritative, and no live-governance or deployment success is overstated. Do not transfer conclusions from predecessor heads.

[coderabbitai]

Rate Limit Exceeded

@seonghobae have exceeded the limit for the number of chat messages per hour. Please wait 19 minutes and 41 seconds before sending another message.