[Governance] Remove routine administrator bypass from the central control-plane merge path

[seonghobae]

Fresh live control-plane evidence — 2026-08-25

The organization-central repository is itself exposing a routine administrator bypass path on protected main, which is not acceptable as commercial merge evidence even though this maintenance loop refuses to use it.

Exact protected branch observed immediately before filing:

• repository: ContextualWisdomLab/.github;
• protected default branch: main@d2c554dbbc04854db6215970fabb70cef1ceb690;
• branch summary reports classic required-status-check enforcement level non_admins;
• the returned classic required-status list is non-empty and includes close-empty, CodeQL compatibility checks, scan-pr-queue, dependency-review, OSV, Trivy, Scorecard, noema-review, required-workflow-bootstrap, coverage-evidence, and opencode-review;
• direct GET /branches/main/protection is not readable through the current integration (403 Resource not accessible by integration), so this issue does not invent any unobserved classic review/admin settings beyond the returned branch summary.

The only repository ruleset currently returned for .github is active ruleset 17921150 — Lock default branch, scoped to ~DEFAULT_BRANCH. Its visible rules prohibit deletion/non-fast-forward updates and require PR integration/thread resolution, but its own PR parameters currently show required_approving_review_count: 0 and require_last_push_approval: false. More importantly for this issue, it exposes:

• bypass_actors: [{ actor_type: OrganizationAdmin, bypass_mode: always }];
• current_user_can_bypass: always.

The effective policy may also include classic review restrictions that this integration cannot read. Therefore the demonstrated defect is narrower and fully evidenced: administrators have a steady-state path that is exempt from the branch-summary required-status enforcement and can always bypass the visible repository ruleset. That path must not be normalized for the repository that owns CWL's required workflow/review control plane.

Why this is commercially material

.github owns organization-wide security, SAST, Strix, OpenCode/Noema review, merge-scheduler, coverage/evidence and other admission controls consumed by product repositories. A routine administrator path around the central repository's own protected checks/rules can mutate the control plane without the exact-head evidence expected of downstream products, weakening separation of duties and auditability even when individual automation loops voluntarily refuse to bypass.

This issue is distinct from:

• [Governance] Establish a counted independent-review path for protected CWL pull requests #772 / [Fleet incident] Resolve independent-review bootstrap deadlock for sole-collaborator repositories #948 — establishing genuinely independent counted reviewer capacity;
• fix(governance): audit must fail on non-default branch scope drift #1200 — auditing default-branch ruleset scope;
• individual product-repository governance issues that consume organization rulesets.

Those remain valid. Do not use this issue to lower approval counts, remove required workflows, or substitute administrator authority for unavailable reviewers.

Required administrator action

1. Make .github/main required-status enforcement apply to administrators as well as non-admins, unless GitHub's current policy model provides an equivalently fail-closed mechanism whose effective result can be demonstrated.
2. Remove the always-on OrganizationAdmin bypass actor from ruleset 17921150, or replace it with a separately governed emergency-only mechanism that is not available as the normal merge path.
3. Preserve all then-current required exact-head security, supply-chain, coverage, review and scheduler gates; do not weaken them to make administration easier.
4. Preserve the intended qualifying independent-review policy documented by current central governance. Because direct classic protection detail is presently unreadable, first read the complete effective policy with repository/organization administration access rather than assuming the ruleset's visible 0 approvals is the whole review policy.
5. Keep deletion and non-fast-forward protections, stale-evidence invalidation, review-thread resolution, and normal PR-only integration.
6. Document emergency access activation, approving identity, reason, time window, exact SHA, and post-incident review if an emergency bypass capability must exist at all.

Acceptance criteria

• a fresh supported settings/API read proves normal administrators cannot bypass the central protected merge evidence merely because of their role;
• the effective required-status policy applies to the normal administrator merge path, with all then-live mandatory contexts fail-closed on the exact candidate head;
• the normal protected path requires the intended qualifying independent review semantics and does not treat self/model/status evidence as a substitute;
• a negative canary cannot merge while one required current-head check is failed/queued/absent, while a required independent review is missing, or while a valid review thread remains unresolved;
• an unchanged exact-head canary with all required evidence can merge normally without administrator bypass;
• if emergency bypass is retained, it is separately controlled, explicitly activated, time-bounded and auditable rather than always available.

Do not direct-push, self-approve, use current_user_can_bypass=always, reduce required checks/reviews, manufacture statuses, or mutate unrelated product repositories as part of this repair.

[seonghobae]

Fresh downstream control-plane evidence from ContextualWisdomLab/Orgmetra confirms the same routine-admin bypass class is not limited to the central repository's local ruleset.

• Orgmetra default branch: develop@9e3e4847510e1e612b48474ba42b177b8ed824df.
• Effective inherited organization ruleset: 18156473 — CWL Central required workflows, enforcement=active, condition ref_name.include=["~DEFAULT_BRANCH"].
• Its PR rule requires 2 approving reviews, dismiss_stale_reviews_on_push=true, require_last_push_approval=true, required_review_thread_resolution=true, and extra approval for unattributed changes; it also requires the central workflow set and blocks deletion/non-fast-forward updates.
• The same live ruleset payload nevertheless exposes bypass_actors=[{actor_type:"OrganizationAdmin", bypass_mode:"always"}] and current_user_can_bypass="always".
• Oldest Orgmetra root PR ⚡ Bolt: JSON 파싱 성능 최적화 #40 is exact head 8d8896b14db10a5a4981f0b9e209ea00ee3be64c, all applicable exact-head product/Foundation/Recovery/SAST/Security workflows GREEN, all fetched threads resolved, but zero qualifying independent APPROVE. The Orgmetra loop deliberately refuses to use the administrator bypass as a substitute.

This is downstream evidence for the existing governance owner boundary, not a request for an Orgmetra-local workaround. Acceptance should prove that the normal OrganizationAdmin path cannot bypass the inherited organization ruleset's review/workflow evidence on product repositories, or that any emergency capability is separately activated, time-bounded and auditable rather than always available. No central source/ref/workflow/settings mutation was attempted from the Orgmetra writer.