governance: verify effective main gate under active organization ruleset

[seonghobae]

Current governance truth

Protected main is exact b05d5acca82b9d916ada2c8e82f59f92a89817e1 at the latest fresh read.

The legacy branches/main payload still reports protected: true while its embedded legacy branch-protection object is non-enforcing (protection.enabled: false, required-status-check enforcement off, no legacy required contexts). That payload is not the complete effective governance state.

A fresh read of organization-owned ruleset 18156473, CWL Central required workflows, shows enforcement: active on ~DEFAULT_BRANCH. Its current pull-request rule requires:

• 1 approving review;
• stale-review dismissal after pushes;
• no separate latest-push approval requirement (require_last_push_approval: false);
• review-thread resolution;
• extra approval for unattributed changes; and
• only merge/squash integration methods.

The same active ruleset requires the organization-owned close-empty-pr, opencode-review, pr-review-merge-scheduler, security-scan, strix, sast-semgrep, and noema-review workflows, with required-workflow enforcement disabled during branch creation (do_not_enforce_on_create: true). It also prohibits branch deletion and non-fast-forward updates. The ruleset exposes an OrganizationAdmin always bypass and reports the connected current user as able to bypass; protected-main AGENTS.md and this scheduled OriginWeave writer nevertheless forbid using any bypass to merge or weaken governance.

The earlier issue text claiming 2 approvals and latest-push approval was stale after the organization ruleset changed and is superseded by this live read. This issue must continue to refetch the ruleset rather than freezing those historical parameters.

Remaining governance verification

The active organization ruleset still does not directly enumerate OriginWeave's repository-native CI or Manifest V3 Compatibility workflows in the returned workflow rule. Those workflows remain product evidence under protected-main AGENTS.md and repository quality contracts, but this issue must not assume that the central merge scheduler transitively substitutes for or correctly enforces them without proof.

The causal configuration owner for any missing effective merge gate is the organization governance / .github boundary, not OriginWeave product code. OriginWeave should preserve exact affected heads/runs and regenerate local evidence after any central governance repair rather than adding a leaf workaround.

Acceptance

1. A fresh ruleset evaluation proves the active default-branch ruleset is the effective merge authority even though the legacy branch-protection subobject is disabled.
2. A protected test PR cannot integrate with fewer than the then-current live ruleset approval count, with unresolved review threads, or while any other then-current pull-request rule is unsatisfied. Do not hard-code historical 2 approvals or latest-push approval assumptions after the ruleset changes.
3. A protected test PR cannot integrate while any intended current-head central or OriginWeave-native required gate is absent/failing. In particular, verify whether repository-native CI/exact owned-production coverage and applicable Manifest V3 Compatibility evidence are transitively enforced by the central scheduler or need an organization-owned governance configuration repair.
4. Exact-head checks/reviews are regenerated after head movement; queued, skipped-required, stale, predecessor-head, author-only, model-only, synthetic, status-only, or absent evidence is never promoted to passing.
5. Open PRs are evaluated against independently resolved live bases and the then-current effective ruleset immediately before any integration decision.
6. If the organization ruleset changes again, update this issue's governance snapshot from the live payload before using it as acceptance evidence.

No scheduled-agent merge, workflow/ruleset mutation, admin bypass, credential change, approval manufacture, tag, release, or publish action is authorized by this issue.

[seonghobae]

Fresh exact-head evidence for the governance owner: PR #40 is currently open/Ready/mergeable at contributor head 93ce1e7efad0a1e8c107f1f465a5260ba568d466 against protected main b05d5acca82b9d916ada2c8e82f59f92a89817e1. Repository-native runs on that unchanged head are CI 32724060308 success, Manifest V3 Compatibility 32724060309 success, SAST Semgrep 32724060294 success, and Security Scan 32724060307 success; the PR's exact coverage evidence records all four owned-production dimensions at 100%. All current inline review threads are resolved. Nevertheless the latest OpenCode formal review is CHANGES_REQUESTED on this same exact head, citing central workflow run 32785566524 because its coverage-evidence job reported failure/not-proven. That run is not a repository-local Actions run (GET /repos/ContextualWisdomLab/OriginWeave/actions/runs/32785566524 returns 404), consistent with the organization-owned required-workflow boundary. Please use this as a concrete protected-test case when verifying the effective ruleset/scheduler contract: determine why central coverage evidence failed while repository-native same-head CI/coverage succeeded, and correct the organization-owned evidence path if it is a false negative. Do not work around it in OriginWeave product code or weaken the gate; exact current-head native evidence and central evidence must both remain independently truthful.