fix(governance): restack independent approval audit after nanoid

[seonghobae]

Purpose

Make independent non-author approval a machine-checked protected-main governance prerequisite, while keeping review, check-run, commit-status, scanner, and model evidence as distinct authorities.

Exact current source

• protected base: main at f1b5a5626b4779b7a554aee76ba600e19ad53cc7;
• branch: fix/governance-independent-approval-after-nanoid;
• current exact head: a9922040c1b345189003296ed8970515068c6fee;
• exact compare: zero commits behind protected main and exactly three changed paths;
• no stacked dependency.

Test-first proof

RED head f0ee29936cc3f46f38c04b5f32992396e4b543fa failed the intended contracts because the evaluator accepted required_approving_review_count=0 and protected AGENTS.md described stale central Security Scan trigger/severity semantics.

The narrow GREEN changes only:

• scripts/lib/main-governance-audit.mjs;
• test/main-governance-audit.test.ts;
• AGENTS.md.

Current non-forced two-parent refresh a9922040c1b345189003296ed8970515068c6fee preserves protected main plus the exact three reviewed blobs. Predecessor checks and reviews do not transfer.

Implemented boundary

• at least one active pull-request rule must require a positive generic approving-review count;
• the existing separate CODEOWNERS hold remains required;
• model comments, commit statuses, check runs, security scans, or self-authored evidence never become formal approval;
• AGENTS.md reflects protected-base Security Scan eligibility, feature-base defer_until_trigger, and MEDIUM/HIGH/CRITICAL fixable Trivy policy;
• no workflow permission, reviewer key contract, branch setting, release, deployment, or version is changed by this PR.

Exact-head verification state

For exact head a9922040c1b345189003296ed8970515068c6fee:

• application ci run 31593972033: queued;
• reviewer-ci run 31593972063: queued;
• central Security Scan run 31593972025: queued;
• current formal reviews: none at the latest exact read;
• current inline review threads: none at the latest exact read;
• queued/pending/predecessor/status/model evidence is not success or approval.

Merge boundary

Do not merge until this unchanged exact head has terminal-success required checks and security gates, current findings and threads are clean, an eligible independent non-author reviewer submits formal APPROVE, and the live ruleset itself is evidenced. Issue #27 remains the external enforceable-governance owner and #29 remains the eligible Reviewer/Maintainer App provisioning owner.

No repair workflow, self-modifying Action, force push, synthetic approval, protection weakening, version bump, release, or deployment authority is introduced.

Related: #27, #29

[coderabbitai]

📝 Walkthrough

Walkthrough

활성 PR 규칙의 승인 리뷰 요구 검증을 추가했습니다. 보안 스캔 게이트 안내를 보호된 기본 브랜치와 스택형 PR 동작에 맞게 수정했습니다. 관련 감사 테스트와 문서 검증 테스트를 추가했습니다.

Changes

거버넌스 및 보안 스캔 규칙

Layer / File(s)	Summary
승인 리뷰 요구 검증 scripts/lib/main-governance-audit.mjs, test/main-governance-audit.test.ts	활성 PR 규칙 중 하나라도 양의 required_approving_review_count를 요구하는지 검사합니다. 요구사항이 없으면 independent_approval_not_required 실패 코드를 반환합니다.
보안 스캔 게이트 안내 및 검증 AGENTS.md, test/main-governance-audit.test.ts	보안 스캔 대상을 보호된 기본 브랜치로 명시합니다. 적격하지 않은 스택형 PR의 스캔 부재를 성공으로 처리하지 않도록 안내합니다. 기본 브랜치 갱신 또는 재지정과 최종 커밋 검증 절차를 문서 테스트로 확인합니다.

Estimated code review effort: 2 (Simple) | ~15 minutes

Possibly related PRs

• ContextualWisdomLab/noema#87: evaluateMainGovernanceRules의 승인 리뷰 검증과 관련 테스트를 함께 변경합니다.
• ContextualWisdomLab/noema#95: 보안 스캔, 취약점 처리, 독립 승인 요구에 대한 거버넌스 로직과 문서 테스트를 변경합니다.
• ContextualWisdomLab/noema#117: 운영 거버넌스 검증에서 evaluateMainGovernanceRules를 호출합니다.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	제목은 거버넌스 감사의 독립 승인 요구사항 변경을 명확히 설명하며 변경사항의 주요 목적과 관련됩니다.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/governance-independent-approval-after-nanoid

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}