Remove retired PR Governance gate

.github/workflows/AUDIT.md

@@ -62,15 +62,14 @@ valid. Referenced paths were checked against the working tree:
   `gh issue edit` used a GraphQL mutation unsupported by GitHub App
   installation tokens; the workflow now calls the REST assignees endpoint.
 
-
+## Agent completion enforcement
 ## Agent completion enforcement
 
 
-The agent-lock trust policy and both agent-completion Checks were removed as unsatisfiable; `pr-governance.yml` is now the sole binding gate. See `MERGE_POLICY.md`.
-
+The agent-lock trust policy and both agent-completion Checks were removed as unsatisfiable; the governance workflow was later removed, and binding is no longer enforced by an automated check. See `MERGE_POLICY.md`.
+## Repository governance workflows
 ## Repository governance workflows
 
-| `pr-governance.yml` | **ADD** | Validates that every non-draft ready PR links exactly one real open issue (not a PR number) with non-empty delivery evidence sections (Outcome, Risk, Verification, Production evidence). Fails closed on competing implementation PRs. Triggers on `pull_request_target`. |
 | `repository-reconciliation.yml` | **ADD** | Scheduled (13:17 UTC daily) non-destructive reconciliation report: identifies ready PRs missing a canonical issue, issues with competing implementation PRs (references validated via Issues API), and stale unattached branches. Excludes draft PRs and fork-branch name collisions. Upserts a single issue titled "[automation] Repository drift report". |
 ## Multi-agent pipeline alignment (Phase 1)
 

.github/workflows/README.md

@@ -171,18 +171,16 @@ A full audit of this directory was performed (see
 - [pytest-cov Documentation](https://pytest-cov.readthedocs.io/)
 
 
-| PR Governance | `pr-governance.yml` | `pull_request_target` (opened/edited/reopened/synchronize/ready_for_review) | Validates that every ready PR links exactly one real open canonical issue and contains non-empty delivery evidence sections; fails on competing PRs. |
 | Repository Reconciliation | `repository-reconciliation.yml` | daily (13:17 UTC); manual | Non-destructive daily report of ready PRs missing a canonical issue, issues with competing implementation PRs, and stale unattached branches. |
 
 ## Agent-completion enforcement
 
 Removed. The `agent-completion/truth-gate` status and the `Agent completion
 enforcement` Check were retired because they were unsatisfiable: the gate scored a
-pull request against an intent snapshot written only on `issues` events, so any
-pull request that satisfied `PR Governance` (which requires `Closes #<issue>`)
-necessarily armed the gate and then failed it. It was red on ~100% of pull
-requests, including merged ones such as #1368.
-
-Binding a pull request to one focused issue is now owned solely by
-`pr-governance.yml`, which produces the `PR Governance` and `Canonical issue and
-evidence` Checks. See `MERGE_POLICY.md` at the repository root.
+pull request against an intent snapshot written only on `issues` events, so a pull
+request with a `Closes #<issue>` binding necessarily armed the gate and then
+failed it. It was red on ~100% of pull requests, including merged ones such as
+#1368.
+
+Binding a pull request to one focused issue is now a policy-level requirement
+with no automated gate. See `MERGE_POLICY.md` at the repository root.

.github/workflows/dependabot-auto-merge.yml

@@ -255,8 +255,6 @@ jobs:
                 'CodeQL',
                 'gitleaks (working tree)',
                 'dependency-review',
-                'PR Governance',
-                'Canonical issue and evidence',
                 'Security Scan - python',
                 'Security Scan - javascript',
                 'bandit',

.jules/agent_orchestration_sop.md

@@ -62,9 +62,6 @@ Before a PR advances:
 - all current review findings are fixed and resolved with evidence;
 - a current-head independent review exists;
 - deployment evidence is bound to the same head, or deployment is explicitly non-applicable;
-- `PR Governance` / `Canonical issue and evidence` report the real remaining blockers
-  (this bullet named `agent-completion/truth-gate` until #1434 retired it — the gate
-  was red on ~100% of pull requests, so it never reported real blockers);
 - the focused issue and #898 are updated with exact evidence.
 
 Vercel proves the Next.js application build and runtime only. It does not prove Python, Cloud Run, Cloud SQL, worker, webhook, or credential behavior unless those paths are explicitly exercised.

MERGE_POLICY.md

@@ -58,8 +58,8 @@ A pull request may merge when all of the following hold.
 Exactly one `Closes #<issue>` reference, and the pull request description
 follows `.github/pull_request_template.md`.
 
-*Already enforced by the `PR Governance` and `Canonical issue and evidence`
-checks. These work — keep them.*
+Binding is a policy-level, author-declared requirement. There is no automated
+gate for it.
 
 ### 2. Required checks green on the head commit
 
@@ -78,14 +78,11 @@ The real contexts, as observed on live pull requests:
 | Security | `Security Scan - python`, `Security Scan - javascript`, `bandit`, `python-safety`, `npm-audit`, `trivy` |
 | Secrets | `gitleaks (working tree)` |
 | Dependencies | `dependency-review` |
-| Binding | `PR Governance`, `Canonical issue and evidence` |
 
 Required for every pull request: `validate`, `guards`, `lint-python`,
 `lint-frontend`, `build`, `test`, `test-frontend`, `CodeQL`,
-`gitleaks (working tree)`, `dependency-review`, `PR Governance`,
-`Canonical issue and evidence`, `Security Scan - python`,
-`Security Scan - javascript`, `bandit`, `python-safety`, `npm-audit`,
-`trivy`.
+`gitleaks (working tree)`, `dependency-review`, `Security Scan - python`,
+`Security Scan - javascript`, `bandit`, `python-safety`, `npm-audit`, `trivy`.
 
 > **`test` vs `test-frontend`.** The CI job id/name `test` runs **Python**
 > pytest only. Frontend unit tests (apps/web vitest, including CWE-209 /

tests/unit/test_dependabot_automation_workflow.py

@@ -195,8 +195,6 @@ def test_dependabot_ignores_eslint_v10() -> None:
     "CodeQL",
     "gitleaks (working tree)",
     "dependency-review",
-    "PR Governance",
-    "Canonical issue and evidence",
     "Security Scan - python",
     "Security Scan - javascript",
     "bandit",
@@ -298,17 +296,14 @@ def test_merge_gate_blocks_on_a_failing_check_run(tmp_path: Path) -> None:
 
 def test_merge_gate_treats_skipped_and_neutral_as_satisfied(tmp_path: Path) -> None:
     """`MERGE_POLICY.md` gate 2 lists conditional checks; `E2E Pipeline Tests`
-    is routinely `skipped` and `PR Governance` `neutral`. Neither should
-    deadlock a merge."""
+    is routinely `skipped` and should not deadlock a merge."""
     outcome = _run_merge_gate(
         tmp_path,
         {
             "commitMessage": DIRECT_PATCH_COMMIT,
             "combinedState": "success",
             "checkRuns": [
-                *_all_required_green(
-                    **{"PR Governance": {"conclusion": "neutral"}}
-                ),
+                *_all_required_green(),
                 {
                     "name": "E2E Pipeline Tests",
                     "status": "completed",