Defect
.github/workflows/pr-governance.yml (job Canonical issue and evidence) requires every non-draft PR body to contain five prose sections — ## Canonical issue, ## Outcome, ## Risk, ## Verification, ## Production evidence — plus exactly one Closes #<issue> reference.
Dependabot generates its PR body from a fixed template (release notes + changelog + commit list). It cannot be made to emit those headings or a closing reference. The gate therefore names an action the author cannot take, and fails permanently.
Live proof
PR #1171 (build(deps): bump github/gh-aw-actions/setup from 0.82.14 to 0.84.2) is the only non-draft Dependabot PR open. Its Canonical issue and evidence run fails with exactly the five-section error:
## Canonical issue is missing or still contains only template placeholders;
## Outcome is missing or still contains only template placeholders;
## Risk is missing or still contains only template placeholders;
## Verification is missing or still contains only template placeholders;
## Production evidence is missing or still contains only template placeholders;
exactly one closing reference is required: Closes #<issue>
The other three open Dependabot PRs (#1000, #1173, #1176) are drafts, so they take the existing if (pr.draft) → neutral escape at pr-governance.yml:49. Each turns permanently red the moment it is marked ready for review.
Why this is the same defect class the repo is already fixing
The sibling gate in .github/workflows/pr-checks.yml:724 already carries this exemption:
return login !== 'dependabot[bot]' &&
(issueDispatch || (pullProvenance && Boolean(selectedIssue)));
Its own rationale comment (pr-checks.yml:718–723) justifies deferring by asserting that binding a PR to a focused issue
is separately owned by Canonical issue and evidence, which states a requirement an author can actually meet.
That assertion is false for dependabot[bot]. The exemption was applied to the truth gate and not to its sibling, so the constraint simply relocated instead of being removed.
This is the same "gate naming an action the author cannot take" pattern tracked in #1130, #1398, #1401, and #1405, and named in MERGE_POLICY.md.
Acceptance criteria
Deliberately out of scope
Defect
.github/workflows/pr-governance.yml(jobCanonical issue and evidence) requires every non-draft PR body to contain five prose sections —## Canonical issue,## Outcome,## Risk,## Verification,## Production evidence— plus exactly oneCloses #<issue>reference.Dependabot generates its PR body from a fixed template (release notes + changelog + commit list). It cannot be made to emit those headings or a closing reference. The gate therefore names an action the author cannot take, and fails permanently.
Live proof
PR #1171 (
build(deps): bump github/gh-aw-actions/setup from 0.82.14 to 0.84.2) is the only non-draft Dependabot PR open. ItsCanonical issue and evidencerun fails with exactly the five-section error:The other three open Dependabot PRs (#1000, #1173, #1176) are drafts, so they take the existing
if (pr.draft)→neutralescape atpr-governance.yml:49. Each turns permanently red the moment it is marked ready for review.Why this is the same defect class the repo is already fixing
The sibling gate in
.github/workflows/pr-checks.yml:724already carries this exemption:Its own rationale comment (
pr-checks.yml:718–723) justifies deferring by asserting that binding a PR to a focused issueThat assertion is false for
dependabot[bot]. The exemption was applied to the truth gate and not to its sibling, so the constraint simply relocated instead of being removed.This is the same "gate naming an action the author cannot take" pattern tracked in #1130, #1398, #1401, and #1405, and named in
MERGE_POLICY.md.Acceptance criteria
Canonical issue and evidencedoes not fail on PRs authored bydependabot[bot].pr-checks.ymlis corrected so it no longer claims a satisfiable requirement on Dependabot's behalf.Deliberately out of scope
validate-gh-awfailure on build(deps): bump github/gh-aw-actions/setup from 0.82.14 to 0.84.2 #1171 — a genuine failure (generated lock files patched without recompiling), owned by ci: gh-aw toolchain pin is hard-coded to v0.82.14 in 4 places, making Dependabot bumps (#1171) structurally unmergeable #1398 and ci: Dependabot should not manage compiler-generated gh-aw lock files #1403.dependency-review,npm-audit,trivy,build, andtestcontinue to apply; this issue concerns only the PR-body prose contract.