From 3e670ec595a9ecf9f24683125e9e34037bc7e64d Mon Sep 17 00:00:00 2001
From: Nikolai Emil Damm <nikolaiemildamm@icloud.com>
Date: Mon, 14 Sep 2026 02:24:05 +0200
Subject: [PATCH 1/2] test(rulesets): negative control for the required deploy
 guards (do not merge)

Deletes a managed ruleset without a Deletion-Acknowledged line and removes
ci.yaml's own deletion guard. The organization-required deploy guards workflow
from reviewed main must still fail this pull request. Throwaway: closed unmerged.

Refs #183

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 .github/workflows/ci.yaml                     | 21 ------------
 .../organization-rulesets/kustomization.yaml  |  1 -
 ...equire-monorepo-ci-aggregate-contract.yaml | 32 -------------------
 3 files changed, 54 deletions(-)
 delete mode 100644 deploy/organization-rulesets/require-monorepo-ci-aggregate-contract.yaml

diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index a9e0fa3..24bcf08 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -46,27 +46,6 @@ jobs:
         # CRDs are applied/validated on-cluster, not here.
         run: kubectl kustomize deploy/ > /dev/null
 
-      - name: 🗑️ Validate deploy/ deletions are acknowledged
-        # Compares the RENDERED deploy/ output at the base and head by resource
-        # identity, so a resource cut out of a multi-document file is caught as
-        # surely as a deleted file. Every removed identity needs its own
-        # `Deletion-Acknowledged: <Kind>.<group>/<name>` line in the pull-request body.
-        # The body arrives through an env var and is written to a file — never
-        # interpolated into the shell — because it is contributor-authored text.
-        if: github.event_name == 'pull_request'
-        env:
-          BASE_SHA: ${{ github.event.pull_request.base.sha }}
-          PR_BODY: ${{ github.event.pull_request.body }}
-        run: |
-          git worktree add --detach "$RUNNER_TEMP/base" "$BASE_SHA"
-          kubectl kustomize "$RUNNER_TEMP/base/deploy" > "$RUNNER_TEMP/base-render.yaml" ||
-            { echo "deploy-deletions: UNKNOWN — the base deploy/ tree does not render; repair main first" >&2; exit 2; }
-          kubectl kustomize deploy/ > "$RUNNER_TEMP/head-render.yaml" ||
-            { echo "deploy-deletions: UNKNOWN — this pull request's deploy/ tree does not render" >&2; exit 2; }
-          printf '%s' "$PR_BODY" > "$RUNNER_TEMP/pr-body.txt"
-          bash scripts/validate-deploy-deletions.sh \
-            "$RUNNER_TEMP/base-render.yaml" "$RUNNER_TEMP/head-render.yaml" "$RUNNER_TEMP/pr-body.txt"
-
       - name: 🧪 Test active Admins policy
         run: bash tests/admin-team-policy.sh
 
diff --git a/deploy/organization-rulesets/kustomization.yaml b/deploy/organization-rulesets/kustomization.yaml
index b969a47..8c341bf 100644
--- a/deploy/organization-rulesets/kustomization.yaml
+++ b/deploy/organization-rulesets/kustomization.yaml
@@ -21,5 +21,4 @@ resources:
   # Net-new, managed (Create).
   - protect-release-tags.yaml
   - require-world-at-ruin-trusted-regressions.yaml
-  - require-monorepo-ci-aggregate-contract.yaml
   - require-dotgithub-deploy-guards.yaml
diff --git a/deploy/organization-rulesets/require-monorepo-ci-aggregate-contract.yaml b/deploy/organization-rulesets/require-monorepo-ci-aggregate-contract.yaml
deleted file mode 100644
index 4a95440..0000000
--- a/deploy/organization-rulesets/require-monorepo-ci-aggregate-contract.yaml
+++ /dev/null
@@ -1,32 +0,0 @@
-# Require the aggregate's execution independently of the aggregate itself.
-# The source is the monorepo's reviewed main branch; a candidate cannot disable
-# this workflow and the aggregate in the same pull request. Source deployment
-# must precede creation of this rule. No bypass or Delete policy is declared.
-apiVersion: enterprise.github.m.upbound.io/v1alpha1
-kind: OrganizationRuleset
-metadata:
-  name: require-monorepo-ci-aggregate-contract
-spec:
-  managementPolicies:
-    - Observe
-    - Create
-    - Update
-    - LateInitialize
-  forProvider:
-    name: Require workflow - Monorepo CI aggregate contract
-    target: branch
-    enforcement: active
-    conditions:
-      - refName:
-          - include: ["~DEFAULT_BRANCH"]
-            exclude: []
-        repositoryId: [786274843]
-    rules:
-      - requiredWorkflows:
-          - requiredWorkflow:
-              - repositoryId: 786274843
-                path: .github/workflows/ci-aggregate-contract.yaml
-                ref: refs/heads/main
-  providerConfigRef:
-    kind: ProviderConfig
-    name: default

From a4eecb202ecf580e68a80b7424ffa9b5428e2c2e Mon Sep 17 00:00:00 2001
From: Nikolai Emil Damm <nikolaiemildamm@icloud.com>
Date: Mon, 14 Sep 2026 02:26:13 +0200
Subject: [PATCH 2/2] chore: second commit so the release contract reads the PR
 title (negative control, do not merge)

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>