From 4281ea9f5cf7d9e42d2ad6d8356f596d62987e3f Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 29 Jun 2026 16:21:48 +0900 Subject: [PATCH] Document html4tree governance onboarding gap --- PR_GOVERNANCE_AUDIT.md | 22 ++++++++++++++++++++-- tests/test_pr_governance_audit_contract.py | 16 ++++++++++++++++ 2 files changed, 36 insertions(+), 2 deletions(-) create mode 100644 tests/test_pr_governance_audit_contract.py diff --git a/PR_GOVERNANCE_AUDIT.md b/PR_GOVERNANCE_AUDIT.md index b03dbe13f..e8f49f779 100644 --- a/PR_GOVERNANCE_AUDIT.md +++ b/PR_GOVERNANCE_AUDIT.md @@ -281,17 +281,35 @@ PR #381: wait: OpenCode review is already in progress 4. Treat fork and non-fork repositories uniformly for onboarding. At runtime, classify only the PR head mutation capability: observable/reviewable, updateable, auto-mergeable, or mergeable. -5. Keep repo-specific product/build/autofix/security workflows repo-local only +5. Do not leave an active public fork PR queue in the inventory-only state. + When a public fork such as `html4tree` has open PRs targeting the + organization-owned fork, it must either be included in the organization required-workflow ruleset + for Strix, OpenCode Review, and PR Review Merge + Scheduler, or carry a temporary thin caller that invokes the central + `.github` workflows until the ruleset can cover it. The fork label is not a + reason to merge without same-head central review evidence. +6. Keep repo-specific product/build/autofix/security workflows repo-local only when they are not part of the governance contract. `pg-erd-cloud` autofix stays repo-local; Strix, OpenCode review, and PR review/merge governance should not. -6. Use `contextual-orchestrator` as the no-copy onboarding fixture when it next +7. Use `contextual-orchestrator` as the no-copy onboarding fixture when it next has a real PR. It now inherits central required workflows, but lacks repo-local branch-lock/stale-dismissal policy and has no open PR to prove runtime behavior. ## Remaining Proof Gaps +- 2026-06-29 KST `html4tree` onboarding gap: PR #3 is the lowest open PR and is + cleanly mergeable by GitHub, but current head + `d0c4cbc2bb267aed407e4bf6308f4f3cfd3b504c` has no check runs and no reviews. + The PR title claims an XSS/attribute-injection fix, while the diff only + changes indentation in `src/main/kotlin/html4tree/util.kt`. This proves that + `html4tree` cannot be merged by queue order until central Strix, OpenCode + Review, and scheduler evidence run on the same head and OpenCode either + requests changes or approves real code/test evidence. The required process + repair is to add `html4tree` to the organization required-workflow target set + or add a temporary thin caller that delegates to `.github`; do not bypass the review gate + with a manual or forced merge. - 2026-06-26 17:53 KST continuation snapshot: `.github` PR #68 is merged at merge commit `590b4ecb2ac9eac700019a183081309e28d8f25b`; `bandscope` PR #459 is merged at merge commit `a7173e45304d8681f02fdf43e4de5a6b6540bb44`; `.github` PR #79 and #80 are merged, and organization ruleset `18156473` now requires central Strix, OpenCode, and scheduler workflows from `.github@807254a04efafd5f806e0f70cb067ecf050cfd11`. The live organization target inventory contains 12 public non-fork repositories and confirms `appguardrail` is present while `VibeSec` is not in that set. - PR #80 proved the no-copy required-workflow path after the ruleset update: `scan-pr-queue` ran as a required check in `ContextualWisdomLab/.github`, passed in 7s, used `PULL_REQUEST_NUMBER=80`, and reported `OpenCode review is already in progress` instead of scanning or mutating the entire queue. The same PR passed central Strix in 3m20s and OpenCode in 4m36s on current head `23ee41076b8f3cec21cff3afd3cd5b4380decf12`. - `bandscope` scheduler run `28192186833` is the current live fixture. PR #450 produced conflict guidance with `gh pr checkout 450`, `git fetch origin develop`, merge-or-rebase, `git status --short`, same-branch push, and `--force-with-lease` only for rebase. PR #451 and PR #446 were updated through the workflow `GITHUB_TOKEN`; the resulting head commits were authored by `github-actions[bot]`. diff --git a/tests/test_pr_governance_audit_contract.py b/tests/test_pr_governance_audit_contract.py new file mode 100644 index 000000000..7a5cde22f --- /dev/null +++ b/tests/test_pr_governance_audit_contract.py @@ -0,0 +1,16 @@ +from pathlib import Path + + +def test_html4tree_public_fork_queue_requires_central_review_gate(): + """Guard the html4tree onboarding gap documented by the live audit.""" + audit = Path("PR_GOVERNANCE_AUDIT.md").read_text(encoding="utf-8") + + assert "html4tree" in audit + assert "Do not leave an active public fork PR queue in the inventory-only state." in audit + assert "organization required-workflow ruleset" in audit + assert "temporary thin caller" in audit + assert "same-head central review evidence" in audit + assert "2026-06-29 KST `html4tree` onboarding gap" in audit + assert "PR #3 is the lowest open PR" in audit + assert "has no check runs and no reviews" in audit + assert "do not bypass the review gate" in audit