Governance framework v2#2
Merged
Merged
Conversation
…flow, evaluation governance
…w, eval governance, case file
… lifecycle stages
|
Caution Review failedThe pull request is closed. ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughAdds documentation artifacts for AI governance: a Control Register mapping controls across 10 lifecycle stages, a Governance Workflow with stage gates and evidence packs, an Evaluation Governance standard with tiered thresholds, plus an operationalization plan, design spec, a T1 worked example, and README links to these resources. Changes
Estimated code review effort🎯 4 (Complex) | ⏱️ ~45 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 inconclusive)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
📝 Coding Plan
Comment |
Owner
Author
|
@copilot can review this |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 5
🧹 Nitpick comments (1)
docs/superpowers/plans/2026-03-19-operationalization.md (1)
236-239: Control count discrepancy in plan comments.The plan's commit message states "50+ controls" but the actual implementation contains 48 controls. While this is still technically "50+" in terms of order of magnitude, for precision the summary in control-register.md should state 48 (as already flagged in that file's review).
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@docs/superpowers/plans/2026-03-19-operationalization.md` around lines 236 - 239, The Summary section currently uses a placeholder "{N}" and the plan text/commit claims "50+ controls" while the actual register has 48 controls; update the Summary sentence in the control register's "Summary" section to replace "{N}" with the precise number 48 and ensure the sentence reads: "This register contains 48 controls across 10 lifecycle stages..." also verify the same precise count is used anywhere else in that "Summary" text (e.g., the sentence referencing governance-workflow.md and the customer service chatbot link) so the document consistently reports 48 controls.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@docs/superpowers/specs/2026-03-19-operationalization-design.md`:
- Around line 45-58: The fenced code block showing the controls table lacks a
language identifier; update that fenced block (the table beginning with "|
Control ID | Control | Applies To | Owner | Evidence | Frequency | Escalation if
Failed |") to include an explicit language tag (e.g., ```markdown) immediately
after the opening backticks so the table renders correctly and is
syntax-highlighted consistently in previews and docs.
In `@examples/customer-service-chatbot/governance-case-file.md`:
- Around line 367-373: The markdown block under the "### Review Decision"
section contains a table (or table-like block) that lacks surrounding blank
lines; update the content so any Markdown table is preceded and followed by a
single blank line to satisfy MD058 (e.g., insert an empty line before the table
starts and after the table ends in the "Review Decision" section) ensuring the
heading and the following paragraph are separated correctly.
- Around line 444-448: The Markdown contains tables that are not surrounded by
blank lines (violating MD058); locate the table blocks in the document near the
"1. **No monitoring on document refresh pipeline health.**" / "### What Went
Well" area and add a single blank line immediately before the table start and a
single blank line immediately after the table end so each table is separated
from adjacent paragraphs/headings; ensure all table instances in the file follow
this pattern.
- Around line 389-393: The Markdown table starting with the lines "| Mitigation
Time | 2026-03-15 16:45 UTC |" and "| Resolution Time | 2026-03-16 10:00 UTC |"
must be surrounded by blank lines for MD058 compliance; insert a single blank
line immediately before the first table line and a single blank line immediately
after the last table line (so there is an empty line between the preceding
content and the table and another empty line between the table and the "### What
Happened" heading).
In `@framework/governance-operations/control-register.md`:
- Around line 107-109: Update the opening summary sentence "This register
contains 53 controls across 10 lifecycle stages" to the correct count by
verifying the control IDs under each stage heading (e.g., "Stage 1 (RA)" through
"Stage 10 (DR)") and change the number to 48 (or adjust if you find
additional/missing controls during verification); ensure the referenced total in
that paragraph matches the summed counts for Stage 1 (RA), Stage 2 (AR), Stage 3
(DE), Stage 4 (EV), Stage 5 (SR), Stage 6 (DA), Stage 7 (PM), Stage 8 (IR),
Stage 9 (RV), and Stage 10 (DR).
---
Nitpick comments:
In `@docs/superpowers/plans/2026-03-19-operationalization.md`:
- Around line 236-239: The Summary section currently uses a placeholder "{N}"
and the plan text/commit claims "50+ controls" while the actual register has 48
controls; update the Summary sentence in the control register's "Summary"
section to replace "{N}" with the precise number 48 and ensure the sentence
reads: "This register contains 48 controls across 10 lifecycle stages..." also
verify the same precise count is used anywhere else in that "Summary" text
(e.g., the sentence referencing governance-workflow.md and the customer service
chatbot link) so the document consistently reports 48 controls.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 9a427132-9d01-489c-a442-c148d621a022
📒 Files selected for processing (7)
README.mddocs/superpowers/plans/2026-03-19-operationalization.mddocs/superpowers/specs/2026-03-19-operationalization-design.mdexamples/customer-service-chatbot/governance-case-file.mdframework/governance-operations/control-register.mdframework/governance-operations/governance-workflow.mdframework/llm-lifecycle/evaluation-governance.md
Comment on lines
+45
to
+58
|
|
||
| | Control ID | Control | Applies To | Owner | Evidence | Frequency | Escalation if Failed | | ||
| |---|---|---|---|---|---|---| | ||
| | RA-001 | Risk assessment completed | All AI systems | Product owner | Signed risk assessment + tier determination | Before development | Cannot proceed to development | | ||
|
|
||
| ### Column Definitions | ||
|
|
||
| - **Control ID**: stable identifier (stage prefix + number) for cross-referencing from policy-as-code, audit reports, and case files | ||
| - **Control**: what must be done (imperative, specific) | ||
| - **Applies To**: tier + system type (e.g., "T1/T2 GenAI", "All agentic", "All production AI") | ||
| - **Owner**: role responsible for producing evidence (not a named person) | ||
| - **Evidence**: specific artifact(s) that prove the control is operating — never vague ("documentation"), always concrete ("signed risk assessment + tier determination") | ||
| - **Frequency**: when evidence must be produced (before development, before release, quarterly, annual, on change) | ||
| - **Escalation if Failed**: what happens if the control is not satisfied — always an action ("block deployment", "escalate to AI Risk Committee", "human review required") |
There was a problem hiding this comment.
Add language identifier to fenced code block.
The table format example should specify a language identifier (e.g., markdown or text) for the fenced code block.
📝 Proposed fix
### Table Format
-```
+```markdown
| Control ID | Control | Applies To | Owner | Evidence | Frequency | Escalation if Failed |
|---|---|---|---|---|---|---|
| RA-001 | Risk assessment completed | All AI systems | Product owner | Signed risk assessment + tier determination | Before development | Cannot proceed to development |</details>
<details>
<summary>🧰 Tools</summary>
<details>
<summary>🪛 markdownlint-cli2 (0.21.0)</summary>
[warning] 45-45: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
</details>
</details>
<details>
<summary>🤖 Prompt for AI Agents</summary>
Verify each finding against the current code and only fix it if needed.
In @docs/superpowers/specs/2026-03-19-operationalization-design.md around lines
45 - 58, The fenced code block showing the controls table lacks a language
identifier; update that fenced block (the table beginning with "| Control ID |
Control | Applies To | Owner | Evidence | Frequency | Escalation if Failed |")
to include an explicit language tag (e.g., ```markdown) immediately after the
opening backticks so the table renders correctly and is syntax-highlighted
consistently in previews and docs.
</details>
<!-- fingerprinting:phantom:triton:puma -->
<!-- This is an auto-generated comment by CodeRabbit -->
Comment on lines
+367
to
+373
|
|
||
| ### Review Decision | ||
|
|
||
| The system continues to operate within acceptable risk parameters. Finding 1 was resolved during the review period. The hallucination rate breach validated that the monitoring and escalation controls work as designed — the incident was detected automatically, AI Risk was notified within SLA, and the root cause was resolved within 20 hours. | ||
|
|
||
| **Next scheduled review:** 2026-07-01 | ||
|
|
There was a problem hiding this comment.
Add blank lines around tables for Markdown compliance.
Tables should be surrounded by blank lines per Markdown best practices (MD058).
📝 Proposed fix
| 3 | Cost per request trending 8% above baseline (€0.032 vs. €0.03) | Low | Investigate prompt optimization | Due 2026-05-01 |
+
### Review Decision📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| ### Review Decision | |
| The system continues to operate within acceptable risk parameters. Finding 1 was resolved during the review period. The hallucination rate breach validated that the monitoring and escalation controls work as designed — the incident was detected automatically, AI Risk was notified within SLA, and the root cause was resolved within 20 hours. | |
| **Next scheduled review:** 2026-07-01 | |
| | 3 | Cost per request trending 8% above baseline (€0.032 vs. €0.03) | Low | Investigate prompt optimization | Due 2026-05-01 | | |
| ### Review Decision | |
| The system continues to operate within acceptable risk parameters. Finding 1 was resolved during the review period. The hallucination rate breach validated that the monitoring and escalation controls work as designed — the incident was detected automatically, AI Risk was notified within SLA, and the root cause was resolved within 20 hours. | |
| **Next scheduled review:** 2026-07-01 |
🧰 Tools
🪛 markdownlint-cli2 (0.21.0)
[warning] 369-369: Tables should be surrounded by blank lines
(MD058, blanks-around-tables)
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@examples/customer-service-chatbot/governance-case-file.md` around lines 367 -
373, The markdown block under the "### Review Decision" section contains a table
(or table-like block) that lacks surrounding blank lines; update the content so
any Markdown table is preceded and followed by a single blank line to satisfy
MD058 (e.g., insert an empty line before the table starts and after the table
ends in the "Review Decision" section) ensuring the heading and the following
paragraph are separated correctly.
Comment on lines
+389
to
+393
| | Mitigation Time | 2026-03-15 16:45 UTC | | ||
| | Resolution Time | 2026-03-16 10:00 UTC | | ||
|
|
||
| ### What Happened | ||
|
|
There was a problem hiding this comment.
Add blank lines around tables for Markdown compliance.
Tables should be surrounded by blank lines per Markdown best practices (MD058).
📝 Proposed fix
| Resolution Time | 2026-03-16 10:00 UTC |
+
### What Happened📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| | Mitigation Time | 2026-03-15 16:45 UTC | | |
| | Resolution Time | 2026-03-16 10:00 UTC | | |
| ### What Happened | |
| | Mitigation Time | 2026-03-15 16:45 UTC | | |
| | Resolution Time | 2026-03-16 10:00 UTC | | |
| ### What Happened |
🧰 Tools
🪛 markdownlint-cli2 (0.21.0)
[warning] 391-391: Tables should be surrounded by blank lines
(MD058, blanks-around-tables)
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@examples/customer-service-chatbot/governance-case-file.md` around lines 389 -
393, The Markdown table starting with the lines "| Mitigation Time | 2026-03-15
16:45 UTC |" and "| Resolution Time | 2026-03-16 10:00 UTC |" must be surrounded
by blank lines for MD058 compliance; insert a single blank line immediately
before the first table line and a single blank line immediately after the last
table line (so there is an empty line between the preceding content and the
table and another empty line between the table and the "### What Happened"
heading).
Comment on lines
+444
to
+448
| 1. **No monitoring on document refresh pipeline health.** Output quality monitoring caught the downstream effect but not the upstream cause. | ||
| 2. **Auth token manually provisioned with 90-day expiry.** Not included in automated credential rotation. | ||
| 3. **Gradual drift pattern.** The threshold breach took approximately 2 weeks to manifest, as only a subset of queries were affected by the stale documents. | ||
|
|
||
| ### What Went Well |
There was a problem hiding this comment.
Add blank lines around tables for Markdown compliance.
Tables should be surrounded by blank lines per Markdown best practices (MD058).
📝 Proposed fix
| 3. **Gradual drift pattern.** The threshold breach took approximately 2 weeks to manifest, as only a subset of queries were affected by the stale documents.
+
### What Went Well📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| 1. **No monitoring on document refresh pipeline health.** Output quality monitoring caught the downstream effect but not the upstream cause. | |
| 2. **Auth token manually provisioned with 90-day expiry.** Not included in automated credential rotation. | |
| 3. **Gradual drift pattern.** The threshold breach took approximately 2 weeks to manifest, as only a subset of queries were affected by the stale documents. | |
| ### What Went Well | |
| 1. **No monitoring on document refresh pipeline health.** Output quality monitoring caught the downstream effect but not the upstream cause. | |
| 2. **Auth token manually provisioned with 90-day expiry.** Not included in automated credential rotation. | |
| 3. **Gradual drift pattern.** The threshold breach took approximately 2 weeks to manifest, as only a subset of queries were affected by the stale documents. | |
| ### What Went Well |
🧰 Tools
🪛 markdownlint-cli2 (0.21.0)
[warning] 446-446: Tables should be surrounded by blank lines
(MD058, blanks-around-tables)
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@examples/customer-service-chatbot/governance-case-file.md` around lines 444 -
448, The Markdown contains tables that are not surrounded by blank lines
(violating MD058); locate the table blocks in the document near the "1. **No
monitoring on document refresh pipeline health.**" / "### What Went Well" area
and add a single blank line immediately before the table start and a single
blank line immediately after the table end so each table is separated from
adjacent paragraphs/headings; ensure all table instances in the file follow this
pattern.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Comprehensive update evolving the AI governance framework from a conceptual governance reference into an audit-ready, evidence-oriented governance operating system.
Two major phases:
Phase 1: Framework v2 — Regulatory, Frontier AI, Enterprise Operations (26 new/updated files, ~3,400 lines)
Phase 2: Operationalization — Control Register, Workflow, Evaluation, Case File (4 new files, ~1,100 lines)
Total: 34 files changed, +7,125 lines
Key design decisions
Test plan
Summary by CodeRabbit
Documentation