fix(governance): restack independent approval audit after nanoid

[seonghobae]

Purpose

Clean protected-main successor to superseded #87 after #76 integrated. This PR starts from current protected main and replays only #87's unique governance/Security-Scan guidance delta; predecessor and sibling checks/reviews do not transfer.

Test-first proof

Exact RED head f0ee29936cc3f46f38c04b5f32992396e4b543fa ran application CI and failed exactly two intended contracts in test/main-governance-audit.test.ts:

1. the protected-main evaluator did not fail when required_approving_review_count was zero;
2. protected-main AGENTS.md still claimed central Security Scan ran on every stacked PR and documented a stale CRITICAL/HIGH threshold.

The narrow GREEN implementation then changed only:

• test/main-governance-audit.test.ts;
• scripts/lib/main-governance-audit.mjs;
• AGENTS.md.

Current exact head: 4ee417372c7a7e084767b50692c376bf03ff4b0a.

Implemented boundary

• the repository-owned main-governance evaluator now requires at least one active pull-request rule with a positive generic approving-review count while retaining the existing separate CODEOWNERS hold;
• review/check/status/scanner/model evidence remains distinct and no model/status/comment becomes approval;
• AGENTS.md now matches the live central Security Scan event contract: protected bases (main, master, develop) are eligible, feature-base absence is non-passing evidence that must be refreshed after dependency integration, and the fixable Trivy boundary is MEDIUM/HIGH/CRITICAL;
• no fix(security): update transitive nanoid for CVE-2026-67213 #76 lockfile/CI/doctoring/changelog changes are replayed because they are already protected-main truth.

Current exact-head verification

For unchanged exact head 4ee417372c7a7e084767b50692c376bf03ff4b0a:

• application ci run 31366570251: terminal success;
• reviewer-ci run 31366570220: terminal success;
• central Security Scan run 31366570232: terminal success under its own scanner/revision semantics;
• formal GitHub reviews: none at the latest fresh read;
• inline review threads: none at the latest fresh read;
• GitHub reports the PR mergeable and it is now Ready for review.

The successful technical gates do not create live ruleset evidence or a qualifying independent formal approval. Issue #27 remains the enforceable-governance owner and #29 remains the Reviewer/Maintainer App provisioning owner.

Supersession

#87 was closed only after proving this clean protected-main successor preserves its three unique final blobs exactly. Old #87 checks/reviews do not transfer.

No repair workflow, self-modifying Action, force-push, synthetic approval, protection weakening, version bump, release or deployment authority is introduced.

Summary by CodeRabbit

• 문서

  • 보호된 기본 브랜치에 대한 보안 스캔 절차를 최신 워크플로에 맞게 명확히 했습니다.
  • 스택형 PR에서는 선행 변경사항을 통합한 뒤 보안 스캔의 최종 성공을 확인하도록 안내를 보완했습니다.

• 버그 수정

  • 거버넌스 규칙에서 독립적인 승인 리뷰가 필요한지 더욱 정확하게 검증합니다.
  • 최소 승인 리뷰 수가 설정되지 않은 경우 적절한 오류를 표시합니다.

• 테스트

  • 보안 스캔 트리거, 스택형 PR 처리 및 심각도 기준에 대한 검증을 강화했습니다.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: b2780d94-a4de-4f4a-b655-cb5d3b742b90

📥 Commits

Reviewing files that changed from the base of the PR and between f07f3ce and c36a3bf.

📒 Files selected for processing (3)

• AGENTS.md
• scripts/lib/main-governance-audit.mjs
• test/main-governance-audit.test.ts

---

📝 Walkthrough

Walkthrough

활성 PR 규칙의 승인 리뷰 요구 검증을 추가했습니다. 보안 스캔 게이트 안내를 보호된 기본 브랜치와 스택형 PR 동작에 맞게 수정했습니다. 관련 감사 테스트와 문서 검증 테스트를 추가했습니다.

Changes

거버넌스 및 보안 스캔 규칙

Layer / File(s)	Summary
승인 리뷰 요구 검증 scripts/lib/main-governance-audit.mjs, test/main-governance-audit.test.ts	활성 PR 규칙 중 하나라도 양의 required_approving_review_count를 요구하는지 검사합니다. 요구사항이 없으면 independent_approval_not_required 실패 코드를 반환합니다.
보안 스캔 게이트 안내 및 검증 AGENTS.md, test/main-governance-audit.test.ts	보안 스캔 대상을 보호된 기본 브랜치로 명시합니다. 적격하지 않은 스택형 PR의 스캔 부재를 성공으로 처리하지 않도록 안내합니다. 기본 브랜치 갱신 또는 재지정과 최종 커밋 검증 절차를 문서 테스트로 확인합니다.

Estimated code review effort: 2 (Simple) | ~15 minutes

Possibly related PRs

• ContextualWisdomLab/noema#87: evaluateMainGovernanceRules의 승인 리뷰 검증과 관련 테스트를 함께 변경합니다.
• ContextualWisdomLab/noema#95: 보안 스캔, 취약점 처리, 독립 승인 요구에 대한 거버넌스 로직과 문서 테스트를 변경합니다.
• ContextualWisdomLab/noema#117: 운영 거버넌스 검증에서 evaluateMainGovernanceRules를 호출합니다.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	제목은 거버넌스 감사와 독립 승인 요구사항 변경을 나타내며 변경 사항과 관련됩니다.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/governance-independent-approval-after-nanoid

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}