fix(governance): audit independent approval requirement - #87
Closed
seonghobae wants to merge 21 commits into
Closed
Conversation
📝 WalkthroughWalkthroughCI가 정확한 PR head를 checkout하고 고정된 Node/npm 도구 체인을 검증하도록 변경되었습니다. 보안 스캔과 독립 승인 규칙이 갱신되었습니다. ChangesCI checkout 및 도구 체인
거버넌스 및 remediation
Estimated code review effort: 3 (Moderate) | ~25 minutes Possibly related issues
Possibly related PRs
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches 💡 1📝 Generate docstrings 💡
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
21 tasks
seonghobae
force-pushed
the
fix/governance-independent-approval-audit
branch
from
August 9, 2026 18:18
7b6701a to
e0106ce
Compare
18 tasks
Contributor
Author
|
@coderabbitai review Please review the unchanged exact head |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
head_sha='e68e0a4bb319cd52c52b6641ae5f1fdd3312811b'
base_sha='e0106ce16b7b8b493f46bf075ec5baf58762bd95'
repo='ContextualWisdomLab/noema'
echo '== Exact commits and ancestry =='
git show -s --format='HEAD %H%nParents %P%nSubject %s' "$head_sha"
git show -s --format='BASE %H%nParents %P%nSubject %s' "$base_sha"
git merge-base --is-ancestor "$base_sha" "$head_sha" && echo 'base_is_ancestor=true'
git rev-list --left-right --count "${base_sha}...${head_sha}"
git diff --name-status "$base_sha" "$head_sha"
echo '== Compact source maps =='
ast-grep outline scripts/lib/main-governance-audit.mjs --items all
ast-grep outline test/main-governance-audit.test.ts --items all
echo '== Exact delta =='
git diff --no-ext-diff --unified=80 "$base_sha" "$head_sha" -- \
AGENTS.md scripts/lib/main-governance-audit.mjs test/main-governance-audit.test.ts
echo '== Relevant evaluator references =='
rg -n -C 5 \
'required_approving_review_count|require_code_owner_review|pull_request|ruleset|Security Scan|security scan|approval|review' \
scripts/lib/main-governance-audit.mjs test/main-governance-audit.test.ts AGENTS.md
echo '== Live protected-branch governance metadata =='
gh api "repos/${repo}/branches/main/protection" 2>&1 || true
gh api "repos/${repo}/rules/branches/main" 2>&1 || true
gh api "repos/${repo}/rulesets" 2>&1 || true
echo '== PR state and current commits =='
gh pr view 87 --repo "$repo" --json number,state,isDraft,headRefOid,baseRefName,baseRefOid,reviews,reviewThreads 2>&1 || trueLength of output: 43213 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/noema'
central_repo='ContextualWisdomLab/.github'
central_sha='6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba'
echo '== Governance evaluator call sites and data acquisition =='
rg -n -C 8 \
'evaluateMainGovernanceRules\s*\(|main-governance-audit|/rules/branches/main|rules/branches|rulesets|rules_response_invalid' \
-g '*.mjs' -g '*.ts' -g '*.json' .
echo '== Central Security Scan workflow at cited exact ref =='
gh api \
-H 'Accept: application/vnd.github.raw+json' \
"repos/${central_repo}/contents/workflows/security-scan.yml?ref=${central_sha}" 2>&1 || true
echo '== Central repository ref identity =='
gh api "repos/${central_repo}/git/commits/${central_sha}" \
--jq '{sha: .sha, tree: .tree.sha, message: .message}' 2>&1 || true
echo '== PR 87 current metadata and formal review submissions =='
gh pr view 87 --repo "$repo" \
--json number,state,isDraft,headRefName,headRefOid,baseRefName,baseRefOid,reviewDecision,reviews,statusCheckRollup,url 2>&1 || true
gh api "repos/${repo}/pulls/87/reviews" 2>&1 || true
echo '== PR 87 review-thread count via GraphQL =='
gh api graphql -F owner='ContextualWisdomLab' -F name='noema' -F number=87 -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
totalCount
nodes { isResolved }
}
}
}
}' 2>&1 || trueLength of output: 36800 🏁 Script executed: #!/bin/bash
set -euo pipefail
central_repo='ContextualWisdomLab/.github'
central_sha='6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba'
echo '== Candidate Security Scan workflow paths at the cited central commit =='
gh api "repos/${central_repo}/git/trees/${central_sha}?recursive=1" \
--jq '.tree[] | select(.type == "blob" and (.path | test("security.*scan|scan.*security"; "i"))) | [.path, .sha] | `@tsv`' \
2>&1 || true
echo '== Matching workflow content =='
while IFS=$'\t' read -r path sha; do
[ -n "${path:-}" ] || continue
echo "--- ${path} (${sha}) ---"
gh api -H 'Accept: application/vnd.github.raw+json' \
"repos/${central_repo}/git/blobs/${sha}" 2>&1 || true
done < <(
gh api "repos/${central_repo}/git/trees/${central_sha}?recursive=1" \
--jq '.tree[] | select(.type == "blob" and (.path | test("security.*scan|scan.*security"; "i"))) | [.path, .sha] | `@tsv`' \
2>/dev/null || true
)Length of output: 1542 🤖 web_search executed:
Length of output: 18252
This diagnostic review is not a formal approval. It does not satisfy the required independent merge approval.
|
This was referenced Aug 10, 2026
seonghobae
marked this pull request as ready for review
August 10, 2026 07:19
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/doctoring/nanoid-cve-2026-67213.md`:
- Line 21: Update the paragraph beginning with “#77/#78 remain” to begin with
“PR `#77/`#78 remain,” preserving the rest of the sentence unchanged.
In `@test/ci-exact-head-contract.test.ts`:
- Around line 19-22: Update the contract test around the existing
NOEMA_EXPECTED_HEAD_SHA and HEAD assertions to also require the SHA-format
validation condition `^[0-9a-f]{40}$` in the workflow content. Ensure the test
covers both workflows so removing either validation causes the contract test to
fail.
In `@test/main-governance-audit.test.ts`:
- Around line 103-108: Update the governance audit test around
evaluateMainGovernanceRules to also assert that result.status equals "FAIL",
while preserving the existing failures entry assertion.
- Around line 208-221: Extend the test in “repository governance guidance”
beyond AGENTS.md text checks to inspect the canonical workflow configuration for
the pull_request base-branch trigger and the osv-scan, dependency-review, and
trivy-fs jobs. Assert that the workflow contract explicitly covers the main
branch, while preserving the existing documentation assertions.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: c9c19b7a-ea06-42f5-80f6-2ad1ad4cdaf5
⛔ Files ignored due to path filters (1)
package-lock.jsonis excluded by!**/package-lock.json
📒 Files selected for processing (9)
.github/workflows/ci.yml.github/workflows/reviewer-ci.ymlAGENTS.mdCHANGELOG.mddocs/doctoring/nanoid-cve-2026-67213.mdscripts/lib/main-governance-audit.mjstest/ci-exact-head-contract.test.tstest/main-governance-audit.test.tstest/workflow-readiness.test.ts
|
|
||
| The baseline `main` CI did not provide a deterministic package-manager identity: earlier terminal-success PR-associated CI used Node `24.18.0`, npm `11.16.0`, and plain `npm ci`. PR #76 now narrows that gap for this security remediation by selecting Node.js `24.19.0` through immutable `actions/setup-node` commit `48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e` (v6.4.0), verifying `node --version` equals `v24.19.0`, verifying `npm --version` equals `11.17.0`, and installing with exactly `npm ci --legacy-peer-deps=false --install-links=false`. Checkout is supplied by immutable `actions/checkout` commit `de0fac2e4500dabe0009e67214ff5f5447ce83dd` (v6.0.2). Any mismatch fails before dependency installation. These are execution-time reproduction constraints for PR #76; they do not claim that repository-wide package-manager metadata and install-script policy are complete. | ||
|
|
||
| #77/#78 remain the broader test-first acquisition-readiness workstream for repository-level `packageManager`/`devEngines` identity, strict dependency install-script policy, immutable Node-24-native Actions, exact PR-head checkout, and lockfile change control. PR #76 deliberately does not duplicate #78's full lockfile-policy machinery merely to remediate one transitive vulnerability. |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Markdown 문법 오류를 수정하세요.
Line 21의 #77/#78 remain...은 해시 뒤 공백이 없어 MD018 경고를 발생시킵니다. PR 참조임을 명확히 하도록 PR #77/#78 remain...으로 시작하세요.
수정 예시
-#77/#78 remain the broader test-first acquisition-readiness workstream for repository-level `packageManager`/`devEngines` identity, strict dependency install-script policy, immutable Node-24-native Actions, exact PR-head checkout, and lockfile change control. PR `#76` deliberately does not duplicate `#78`'s full lockfile-policy machinery merely to remediate one transitive vulnerability.
+PR `#77/`#78 remain the broader test-first acquisition-readiness workstream for repository-level `packageManager`/`devEngines` identity, strict dependency install-script policy, immutable Node-24-native Actions, exact PR-head checkout, and lockfile change control. PR `#76` deliberately does not duplicate `#78`'s full lockfile-policy machinery merely to remediate one transitive vulnerability.📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| #77/#78 remain the broader test-first acquisition-readiness workstream for repository-level `packageManager`/`devEngines` identity, strict dependency install-script policy, immutable Node-24-native Actions, exact PR-head checkout, and lockfile change control. PR #76 deliberately does not duplicate #78's full lockfile-policy machinery merely to remediate one transitive vulnerability. | |
| PR `#77/`#78 remain the broader test-first acquisition-readiness workstream for repository-level `packageManager`/`devEngines` identity, strict dependency install-script policy, immutable Node-24-native Actions, exact PR-head checkout, and lockfile change control. PR `#76` deliberately does not duplicate `#78`'s full lockfile-policy machinery merely to remediate one transitive vulnerability. |
🧰 Tools
🪛 markdownlint-cli2 (0.23.2)
[warning] 21-21: No space after hash on atx style heading
(MD018, no-missing-space-atx)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@docs/doctoring/nanoid-cve-2026-67213.md` at line 21, Update the paragraph
beginning with “#77/#78 remain” to begin with “PR `#77/`#78 remain,” preserving
the rest of the sentence unchanged.
Source: Linters/SAST tools
Comment on lines
+19
to
+22
| expect(workflow).toContain( | ||
| "NOEMA_EXPECTED_HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }}", | ||
| ); | ||
| expect(workflow).toContain('test "$(git rev-parse HEAD)" = "$NOEMA_EXPECTED_HEAD_SHA"'); |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win
SHA 형식 검증도 계약 테스트에 고정하세요.
현재 테스트는 NOEMA_EXPECTED_HEAD_SHA 설정과 HEAD 비교만 확인합니다. 두 워크플로에서 ^[0-9a-f]{40}$ 검증을 제거해도 테스트가 통과합니다. 해당 조건문을 assertion으로 추가하세요.
수정 예시
expect(workflow).toContain(
"NOEMA_EXPECTED_HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }}",
);
+ expect(workflow).toContain(
+ 'if [[ ! "$NOEMA_EXPECTED_HEAD_SHA" =~ ^[0-9a-f]{40}$ ]]; then',
+ );
expect(workflow).toContain('test "$(git rev-parse HEAD)" = "$NOEMA_EXPECTED_HEAD_SHA"');코딩 가이드라인의 “Add or update regression tests for security and API behavior changes” 요구사항에 따른 것입니다.
📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| expect(workflow).toContain( | |
| "NOEMA_EXPECTED_HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }}", | |
| ); | |
| expect(workflow).toContain('test "$(git rev-parse HEAD)" = "$NOEMA_EXPECTED_HEAD_SHA"'); | |
| expect(workflow).toContain( | |
| "NOEMA_EXPECTED_HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }}", | |
| ); | |
| expect(workflow).toContain( | |
| 'if [[ ! "$NOEMA_EXPECTED_HEAD_SHA" =~ ^[0-9a-f]{40}$ ]]; then', | |
| ); | |
| expect(workflow).toContain('test "$(git rev-parse HEAD)" = "$NOEMA_EXPECTED_HEAD_SHA"'); |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@test/ci-exact-head-contract.test.ts` around lines 19 - 22, Update the
contract test around the existing NOEMA_EXPECTED_HEAD_SHA and HEAD assertions to
also require the SHA-format validation condition `^[0-9a-f]{40}$` in the
workflow content. Ensure the test covers both workflows so removing either
validation causes the contract test to fail.
Source: Coding guidelines
Comment on lines
+103
to
+108
| const result = evaluateMainGovernanceRules(rules); | ||
|
|
||
| expect(result.failures).toContainEqual({ | ||
| code: "independent_approval_not_required", | ||
| detail: "Active pull-request rules do not require at least one approving review.", | ||
| }); |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
최종 status도 검증하세요.
현재 테스트는 result.failures 배열에 특정 실패 항목이 포함되는지만 검사합니다. 구현이 실패 항목을 기록하고도 status: "PASS"를 반환하면 이 테스트는 통과합니다.
result.status가 "FAIL"인지도 단언하세요.
수정 예시
const result = evaluateMainGovernanceRules(rules);
+ expect(result.status).toBe("FAIL");
expect(result.failures).toContainEqual({PR 목표가 거버넌스 감사를 기계적으로 판정하도록 요구하므로 최종 상태를 검증해야 합니다.
📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| const result = evaluateMainGovernanceRules(rules); | |
| expect(result.failures).toContainEqual({ | |
| code: "independent_approval_not_required", | |
| detail: "Active pull-request rules do not require at least one approving review.", | |
| }); | |
| const result = evaluateMainGovernanceRules(rules); | |
| expect(result.status).toBe("FAIL"); | |
| expect(result.failures).toContainEqual({ | |
| code: "independent_approval_not_required", | |
| detail: "Active pull-request rules do not require at least one approving review.", | |
| }); |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@test/main-governance-audit.test.ts` around lines 103 - 108, Update the
governance audit test around evaluateMainGovernanceRules to also assert that
result.status equals "FAIL", while preserving the existing failures entry
assertion.
Comment on lines
+208
to
+221
| describe("repository governance guidance", () => { | ||
| it("documents the live central Security Scan trigger and severity boundary", () => { | ||
| const agents = readFileSync(new URL("../AGENTS.md", import.meta.url), "utf8"); | ||
|
|
||
| expect(agents).not.toContain("It runs on every PR base, **including stacked PRs**."); | ||
| expect(agents).toContain( | ||
| "The central workflow currently selects pull requests whose base branch is `main`, `master`, or `develop`.", | ||
| ); | ||
| expect(agents).toContain( | ||
| "A feature-base stacked PR can therefore have no Security Scan run; absence is non-passing evidence", | ||
| ); | ||
| expect(agents).toContain("MEDIUM/HIGH/CRITICAL"); | ||
| expect(agents).not.toContain("CRITICAL/HIGH, fixable only"); | ||
| }); |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
workflow_files="$(fd --hidden --type f --extension yml --extension yaml .github 2>/dev/null || true)"
if [ -z "$workflow_files" ]; then
echo "No workflow files found under .github" >&2
exit 1
fi
while IFS= read -r file; do
rg -n -C 12 \
'Security Scan|pull_request|branches|trivy-fs|severity|ignore-unfixed' \
"$file" || true
done <<< "$workflow_files"Repository: ContextualWisdomLab/noema
Length of output: 201
🏁 Script executed:
#!/bin/bash
set -u
echo "Root files:"
git ls-files | sed -n '1,120p'
echo
echo "AGENTS.md references:"
if [ -f AGENTS.md ]; then
rg -n -C 8 'Security Scan|trivy|ignore-unfixed|Main governance|approval|stacked|pull requests|severity|MEDIUM|HIGH|CRITICAL' AGENTS.md || true
else
echo "AGENTS.md not found"
fi
echo
echo "Workflow-like files:"
git ls-files | rg '(^|/) workflow |\.ya?ml$|github/action|\.gitlab|sonar|trivy|gosec|codeql|security' | sed -n '1,200p'
echo
echo "Test file section:"
if [ -f test/main-governance-audit.test.ts ]; then
sed -n '1,260p' test/main-governance-audit.test.ts | cat -n
fiRepository: ContextualWisdomLab/noema
Length of output: 17365
🏁 Script executed:
#!/bin/bash
set -u
echo "Search Security Scan-related terms:"
rg -n -C 4 'Security Scan|trivy-fs|trivy|dependency-review|osv-scan|pull_request|branches|trivyignore' .github/test scripts/main-governance-audit.mjs scripts/lib/main-governance-audit.mjs docs AGENTS.md test/main-governance-audit.test.ts || true
echo
echo "Workflows:"
for f in .github/workflows/*.yml; do
echo "---- $f ----"
sed -n '1,220p' "$f" | sed -n '/security\|trivy\|dependency\|osv\|Security Scan/p; 1,220p'
done
echo
echo "Audit source:"
wc -l scripts/lib/main-governance-audit.mjs
sed -n '1,260p' scripts/lib/main-governance-audit.mjs | cat -nRepository: ContextualWisdomLab/noema
Length of output: 50384
🏁 Script executed:
#!/bin/bash
set -u
echo "Workflow files with exact Security Scan/Scanner references:"
for f in .github/workflows/*.yml; do
hits="$(rg -n 'Security Scan|trivy-fs|trivy|dependency-review|osv-scan|pull_request' "$f" 2>/dev/null || true)"
if [ -n "$hits" ]; then
echo "---- $f ----"
sed -n '1,220p' "$f" | rg -n -C 8 'Security Scan|trivy-fs|trivy|dependency-review|osv-scan|pull_request|branches:'
fi
done
echo
echo "Workflow occurrences:"
rg -n -C 3 'Security Scan|trivy-fs|trivy|dependency-review|osv-scan|pull_request:' .github/workflows .github/reusable 2>/dev/null || true
echo
echo "Tests referencing scanner triggers/workflows:"
rg -n -C 4 'Security Scan|pull_request|trivy-fs|dependency-review|osv-scan|getSecurityScan|scanner|readme|AGENTS' test scripts docs docs/superpowers specs scripts/lib/main-governance-audit.mjs 2>/dev/null || trueRepository: ContextualWisdomLab/noema
Length of output: 50383
Security Scan 문서 회귀 검사를 실제 워크플로 기준과 맞춰보세요.
현재 생성된 테스트는 AGENTS.md 문구만 검증합니다. 저장소에 pull_request branches: main 트리거의 osv-scan / dependency-review / trivy-fs 실행 계약이 있는지 분리하지 못합니다. 이 지침을 유지하려면 테스트도 같은 pull_request job 기준을 읽도록 확장하거나, 문서가 워크플로 설정을 정확히 반영한다고 명시된 다른 소스를 계약으로 두세요.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@test/main-governance-audit.test.ts` around lines 208 - 221, Extend the test
in “repository governance guidance” beyond AGENTS.md text checks to inspect the
canonical workflow configuration for the pull_request base-branch trigger and
the osv-scan, dependency-review, and trivy-fs jobs. Assert that the workflow
contract explicitly covers the main branch, while preserving the existing
documentation assertions.
Contributor
Author
|
#76 has now integrated into protected |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Purpose
Make issue #27's generic independent-approval requirement machine-checkable in the repository-owned
maingovernance audit without re-enabling CODEOWNERS, and correct Noema's repository-consumed Security Scan guidance where it had drifted from the live central workflow.Current dependency identity
Freshly revalidated immediately before this metadata write:
e68e0a4bb319cd52c52b6641ae5f1fdd3312811b.fix/nanoid-cve-2026-67213/ PR fix(security): update transitive nanoid for CVE-2026-67213 #76.e0106ce16b7b8b493f46bf075ec5baf58762bd95.AGENTS.md,scripts/lib/main-governance-audit.mjs, andtest/main-governance-audit.test.ts.mainremains9adb784902cae19a150146a8fadd6a0491f67814.The branch was rebuilt onto the exact #76 predecessor after the earlier direct-main experiment showed that retaining divergent common-main history did not provide dependency-ordered current-base evidence. No repair workflow, self-modifying Action, encoded patch workflow, or new credential authority is used.
Governance audit implementation
The evaluator requires at least one active pull-request rule whose
required_approving_review_countis positive while preservingrequire_code_owner_review: false. This keeps the current solo-maintainer CODEOWNERS hold separate from Noema's generic independent-review governance contract. Stale-review dismissal, review-thread resolution, status-source pinning, current-base policy, squash policy, force-push prevention, and deletion prevention remain independently checked.Formal GitHub review submissions, authenticated Noema App review decisions, check runs, commit statuses, scanner evidence and model judgments remain distinct evidence classes. No model/status/comment is promoted to independent approval.
Security Scan guidance RCA and test-first repair
A read-only comparison against the live central
.githubworkflow reproduced two Noema-owned documentation defects:AGENTS.mdstated that central Security Scan runs on every PR base, including stacked feature-base PRs. The live central workflow selects protected bases (main,master,develop), so a feature-base stack can be event-ineligible.AGENTS.mdsummarized the Trivy hard gate asCRITICAL/HIGH; the live workflow fails on fixableMEDIUM/HIGH/CRITICALfindings.This mismatch could make an agent treat feature-base Security Scan absence as an unexpected central outage or understate the vulnerability threshold.
Test-first lineage:
cf96f3d115d810fa72d642ed3cd7727000fee0b5— RED guidance contract rejecting the false “every stacked PR” claim and requiring explicit feature-base absence semantics.9c59a8bb3dc36835a0bb380bb9a7dea0bfad1986— RED threshold contract requiringMEDIUM/HIGH/CRITICALand rejecting staleCRITICAL/HIGHtext.e68e0a4bb319cd52c52b6641ae5f1fdd3312811b— GREEN Noema-ownedAGENTS.mdcorrection: eligible protected-base PRs require Security Scan; feature-base absence is non-passingdefer_until_triggerand requires dependency-ordered refresh/retarget onto an eligible protected base before merge.The central
.githubrepository remains read-only; this PR changes only Noema-owned guidance and deterministic regressions.Newly proven sibling-overlap boundary with #80
Fresh comparison against Draft PR #80 proves both branches share merge base exactly at #76 head and are diverged siblings, not a valid stack. Both modify
AGENTS.md:AGENTS.mdis the narrow governance/Security-Scan correction.AGENTS.mdcontains the same corrected Security-Scan semantics plus substantial scheduler RCA, safe-write and work-conserving continuation guidance.scripts/lib/main-governance-audit.mjsortest/main-governance-audit.test.tsbecause it is a sibling, while an unrefreshed fix(governance): audit independent approval requirement #87 merged after fix(security): make product publisher branch creation atomic #80 could overwrite/remove fix(security): make product publisher branch creation atomic #80's broader agent guidance.Therefore #87 must not be treated as a safe successor to an independently integrated #80 snapshot. Current convergence plan after #76: integrate/stabilize #87 (or an equivalent protected-main governance/guidance successor), then rebuild/refresh only #80's unique scheduler/publisher/NIM delta onto that exact protected lineage and reacquire all checks/reviews. Do not manufacture ancestry by retargeting a diverged head. Old sibling evidence does not transfer.
PR #89 does not modify
AGENTS.md, so it does not create this same direct documentation-source overwrite risk.Independent-approval test-first lineage
d0dead4cd0f41743f3dac340184fda2c7043eb38— RED contract requiring a compliant pull-request rule to specifyrequired_approving_review_count: 1while retainingrequire_code_owner_review: false, plus a zero-approval regression.9fb72e4eb5917c7cd0990777301d34de8a2e3a0c— GREEN evaluator implementation requiring a positive generic approval count.Historical direct-main commits and their runs are retained only as RCA evidence, not current branch acceptance evidence.
Current exact-head verification
For unchanged exact head
e68e0a4bb319cd52c52b6641ae5f1fdd3312811b:cirun31336097264: terminal success. Exact source checkout/assertion passed; Node24.19.0and npm11.17.0matched the branch's inherited toolchain contract; frozen install succeeded; 62 test files / 648 tests passed; configured statements/branches/functions/lines are 100%;npm audit --audit-level=highfound 0 vulnerabilities; acquisition manifest generation passed.reviewer-cirun31336097263: terminal success, including exact checkout verification, reviewer coverage/docstring gates and sandbox verification.defer_until_trigger, never scanner success.The acquisition manifest continues to identify missing production KPI/provenance/security-validation/release/deployment/environment/revenue/transfer final-gate evidence; those omissions are not promoted to release/acquisition readiness.
Governance and merge boundary
This PR closes repository-owned detection/documentation gaps only. It cannot create the live
mainruleset, provision an eligible independent Reviewer App, prove direct-push/break-glass rejection, or make a feature-base central Security Scan eligible. Issue #27 owns enforceable livemaingovernance and #29 owns Reviewer/Maintainer App provisioning/activation evidence.Keep this PR Draft while #76 is unintegrated. After #76 integrates, refresh only #87's unique delta onto the then-current protected base, require fresh exact-head
ci,reviewer-ci, and central Security Scan terminal success under eligible event semantics, re-review current findings/threads, satisfy the actual live ruleset and qualifying current-head review requirements, and only then consider merge. After #87 is protected/stable, #80 must be rebuilt/refreshed onto that lineage before its own integration.No version bump, release, deployment, gate waiver, protection weakening, synthetic approval, or repair workflow is introduced.
Related: #27, #29, #30, #75, #76, #77, #79, #80, #89
Summary by CodeRabbit
개선 사항
문서
테스트