ci: establish autonomous repository governance

[groupthinking]

Canonical issue

Closes #905

Parent program: #898

Outcome

Establishes a repository-owned control loop that prevents untracked or duplicate implementation PRs, publishes governance against each exact PR head, and continuously reports drift across open PRs and remote branches.

Scope

• Adds a ready-PR contract requiring one canonical issue plus meaningful outcome, risk, verification, and production evidence.
• Rejects unchanged template placeholders rather than accepting headings alone.
• Publishes an explicit PR Governance Check against pull_request.head.sha.
• Detects competing open PRs that close the same real, open issue.
• Adds a daily, non-destructive repository reconciliation report.
• Strengthens the existing PR template while preserving agent-lock provenance fields.
• Does not delete branches, modify Project Fix LiteRT-LM MCP Server based on code review #9 fields, change Vercel production, or merge existing PRs.

Risk

• Risk level: medium.
• Failure mode: older ready PRs may fail the new governance check when they next synchronize because their descriptions predate the contract.
• Rollback: revert the workflow files; no application runtime or production data is touched.

Verification

• Exact implementation head: cbae9110cfd7b6b89b2686bd9fd705ea4e649778.
• Workflow requests only checks: write, contents: read, issues: read, and pull-requests: read.
• The explicit Check uses head_sha: pr.head.sha; draft PRs receive a neutral exact-head result.
• Workflow Catalog and AUDIT entries exist for both workflows.
• Focused governance and reconciliation unit tests are committed.
• Reconciliation remains report-only and excludes main, protected branches, and branches attached to same-repository open PRs.
• CI, Security Scan, Secret Scan, CodeQL, Coverage, and Dependency Review succeeded on the exact head; E2E was repository-skipped.
• All twelve review threads are resolved.
• The current exact-head truth gate validates the repaired Execution: activate exact-head repository governance (PR #899) #905 identity projection and fails closed on the real historical error: missing_intent_snapshot. The copilot-rabbit label is present; current-head Copilot review is still pending.

Production evidence

Not applicable to application runtime. These are repository-governance workflows, tests, and documentation only. The exact-head Vercel preview was canceled, but the changed paths do not affect a deployed application surface.

Governance state

This PR is draft. Focused issue #905 was created after this PR and has no pre-dispatch intent snapshot, so the independent truth policy cannot be satisfied retroactively on this PR. Do not mark ready or merge until an authorized repository/security owner records either a policy-compliant replacement-PR transition or an explicit legacy-provenance exception.

Agent handoff

• Focused execution issue Execution: activate exact-head repository governance (PR #899) #905 is the single closing issue.
• [PROGRAM][OWNER:Codex] Autonomous EventRelay delivery control plane #898 remains the parent program and cannot be closed by this partial implementation.
• No competing PR implements issue Execution: activate exact-head repository governance (PR #899) #905.
• A new exact head exists; dispatch alone is not counted as progress.
• Application/security workflows completed on the corrected exact head.
• All twelve review threads are resolved after exact-head verification.
• PR returned to draft after the failed truth gate was discovered.
• Independent agent-completion trust policy satisfied.
• Authorized final approval obtained.

No merge, branch deletion, credential mutation, ruleset weakening, fabricated evidence, or production change was performed.

Coverage evidence correction — 2026-07-22

The previously listed Coverage success predates the authoritative workflow installed by #921. That workflow could return green after pytest collection failed because failures were suppressed. Treat the old Coverage run as non-authoritative evidence, not as proof. This PR must receive a truthful Coverage result on a current synchronized exact head before it advances; this correction does not imply a regression in this PR's code.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
v0-uvai	Canceled		Jul 21, 2026 3:31am

[coderabbitai]

Important

Review skipped

Auto reviews are limited based on label configuration.

🏷️ Required labels (at least one) (1)

• [‘architecture-gap’, ‘bug’, ‘ci-cd’, ‘ci/cd’, ‘copilot-rabbit’, ‘documentation’, ‘duplicate’, ‘enhancement’, ‘frontend’, ‘github_actions’, ‘good first issue’, ‘help wanted’, ‘high-priority’, ‘invalid’, ‘javascript’, ‘ml-model’, ‘needs-triage’, ‘pipeline-critical’, ‘placeholder-code’, ‘priority:high’, ‘python’, ‘python:uv’, ‘question’, ‘styling’, ‘tests’, ‘v0’]

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository YAML (base), Repository UI (inherited), Organization UI (inherited)

Review profile: ASSERTIVE

Plan: Pro

Run ID: ccef9b3d-d719-4412-82f1-da28c349cd7f

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch agent/autonomous-repository-governance

✨ Simplify code

• Create PR with simplified code
• Commit simplified code in branch agent/autonomous-repository-governance

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Dependency Review

The following issues were found:

• ✅ 0 vulnerable package(s)
• ✅ 0 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ⚠️ 1 package(s) with unknown licenses.

See the Details below.

Snapshot Warnings

⚠️: No snapshots were found for the head SHA cbae911.

Ensure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice.

License Issues

.github/workflows/repository-reconciliation.yml

Package	Version	License	Issue Type
actions/github-script	8.*.*	Null	Unknown License

Allowed Licenses:

MIT, Apache-2.0, BSD-2-Clause, BSD-3-Clause, ISC, Python-2.0, BlueOak-1.0.0, MPL-2.0, CC0-1.0, 0BSD

Excluded from license check:

pkg:npm/caniuse-lite, pkg:npm/@sentry/nextjs, pkg:npm/@sentry/cli, pkg:npm/@sentry/cli-darwin, pkg:npm/@sentry/cli-linux-arm, pkg:npm/@sentry/cli-linux-arm64, pkg:npm/@sentry/cli-linux-i686, pkg:npm/@sentry/cli-linux-x64, pkg:npm/@sentry/cli-win32-arm64, pkg:npm/@sentry/cli-win32-i686, pkg:npm/@sentry/cli-win32-x64, pkg:npm/@sentry/bundler-plugin-core, pkg:npm/@sentry/babel-plugin-component-annotate

OpenSSF Scorecard

Package	Version	Score	Details
actions/actions/github-script	8.*.*	🟢 6.6	Details Check Score Reason Maintained ⚠️ 0 0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0 Code-Review 🟢 10 all changesets reviewed Binary-Artifacts 🟢 10 no binaries found in the repo Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Packaging ⚠️ -1 packaging workflow not detected CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Token-Permissions 🟢 9 detected GitHub workflow tokens with excessive permissions Pinned-Dependencies ⚠️ 1 dependency not pinned by hash detected -- score normalized to 1 License 🟢 10 license file detected Fuzzing ⚠️ 0 project is not fuzzed Signed-Releases ⚠️ -1 no releases found Security-Policy 🟢 9 security policy file detected SAST 🟢 10 SAST tool is run on all commits Branch-Protection 🟢 5 branch protection is not maximal on development and all release branches

Scanned Files

• .github/workflows/repository-reconciliation.yml

[github-actions]

Agent Completion Truth Gate: BLOCKED

Reasons: evidence_collection_failed, missing_copilot_current_head_review, required_checks_failed, focused_tests_failed

Machine-readable verdict

{
  "details": {
    "collection_errors": [
      "missing_intent_snapshot"
    ],
    "focused_test_failures": [
      "tests/unit/test_pr_governance_workflow.py",
      "tests/unit/test_repository_reconciliation_workflow.py"
    ],
    "identity_projection": {
      "agent_login": "groupthinking",
      "issue_number": 905,
      "run_id": "eventrelay-governance-repair-20260721-0215z"
    }
  },
  "reasons": [
    "evidence_collection_failed",
    "missing_copilot_current_head_review",
    "required_checks_failed",
    "focused_tests_failed"
  ],
  "verdict": "blocked"
}

Workflow evidence

[Copilot]

Pull request overview

Establishes automated governance for canonical issue linkage, PR evidence, duplicate work, and repository drift reporting.

Changes:

• Adds ready-PR governance validation.
• Adds scheduled branch and PR reconciliation reporting.
• Expands the PR template with delivery evidence requirements.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 10 comments.

File	Description
.github/workflows/pr-governance.yml	Validates canonical issues and delivery evidence.
.github/workflows/repository-reconciliation.yml	Reports PR and branch governance drift.
.github/pull_request_template.md	Adds governance and evidence sections.

[groupthinking]

@copilot Fix the code for all comments in this review thread.

When a review comment includes a suggested change, apply the suggestion exactly.

Do not make changes beyond what is described in the linked review thread.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

Comments suppressed due to low confidence (6)

.github/workflows/pr-governance.yml:39

• This only verifies that heading strings occur somewhere in the body. After filling Closes #..., a PR can leave every template placeholder or evidence section empty and still pass, so the advertised outcome/risk/verification/production-evidence contract is not enforced. Parse each section and reject blank or unchanged placeholder content (including verification with no current-head evidence).

            const missing = requiredSections.filter(section => !body.includes(section));

.github/workflows/pr-governance.yml:43

• The regex treats any numeric text reference as a canonical issue without verifying that it resolves to an issue in this repository. For example, Closes #99999999 or a number belonging to a pull request satisfies this check. Resolve closingIssuesReferences and filter by repository.nameWithOwner, following .github/workflows/pr-checks.yml:1141-1156, or fetch the referenced item and reject missing items and pull requests.

            const closingPattern = /(?:close[sd]?|fix(?:e[sd])?|resolve[sd]?)\s+#(\d+)/gi;
            const issueNumbers = [...body.matchAll(closingPattern)].map(match => Number(match[1]));
            const canonicalIssues = [...new Set(issueNumbers)];

.github/workflows/repository-reconciliation.yml:45

• The report labels this metric as “Ready PRs,” but pulls.list includes drafts and this condition adds them too, contradicting the governance workflow’s explicit draft exemption. Exclude drafts from untracked so the count and list describe ready PRs accurately.

              if (unique.length !== 1) untracked.push(pr);

.github/workflows/repository-reconciliation.yml:36

• protected: false excludes protected branches from both the inventory and the value later labeled “Remote branches.” This prevents the reconciliation from reporting drift across all remote branches as promised. Fetch all branches, report the full inventory, and separately exclude or label protected branches when producing cleanup candidates.

            const branches = await github.paginate(github.rest.repos.listBranches, {
              owner, repo, protected: false, per_page: 100
            });

.github/workflows/repository-reconciliation.yml:37

• pr.head.ref also includes branch names from forks, but listBranches only returns branches in this repository. A fork PR whose branch name matches an unrelated local branch therefore hides that local branch from stale reporting. Build activeHeads only from PRs whose head.repo.full_name equals this repository.

            const activeHeads = new Set(pulls.map(pr => pr.head.ref));

.github/workflows/repository-reconciliation.yml:1

• This new workflow, and the accompanying pr-governance.yml, are absent from the repository Workflow Catalog. .github/workflows/README.md:82-89 explicitly requires a catalog row whenever a workflow is added, so both workflows need to be documented (and included in the workflow audit decision matrix).

name: Repository Reconciliation

[groupthinking]

Review summary (governance workflows)

I re-reviewed the three files and independently verified Copilot's 11 inline findings against the repo — they're all accurate. Rather than repeat them inline, here's a triage plus one piece of context that isn't in those comments.

Blocking before this becomes a required gate

1. pr-governance.yml can't serve as a head-bound required check (Copilot @ pr-governance.yml:5). It runs on pull_request_target, so the job's check attaches to the base/default-branch SHA, not pr.head.sha. Your own agent-completion-enforcement.yml (the "Publish the required head-bound Check run" step) and AUDIT.md establish the correct pattern: publish an explicit Check run against pr.head.sha with checks: write. Until it does, a ruleset can't reliably require this result for the current head. This is the one architectural fix.
2. Contract check passes on an untouched template (pr-governance.yml:39). body.includes("## Outcome") only proves the heading exists; Closes #123 + the unedited template placeholders satisfies the whole gate. Parse section bodies and reject default/empty content.
3. Issue references are unvalidated (pr-governance.yml:50, repository-reconciliation.yml:45). Any Closes #NNN is trusted — Closes #999999 passes and can also fabricate a duplicate group. pr-checks.yml already uses GitHub's authoritative closingIssuesReferences; reuse that.

Report-accuracy (non-blocking, but the reconciliation report is wrong without them)

4. Reconciliation counts drafts in "Ready PRs without a canonical issue" — filter pr.draft (reconciliation:45).
5. "Remote branches: N" is fetched with protected:false, so it silently excludes main/protected branches — relabel or fetch all (reconciliation:74).
6. pr.head.ref isn't repo-qualified, so a fork branch name collision hides a local stale branch (reconciliation:37).

Process (required by this repo's own docs)

7. Neither workflow is in the Workflow Catalog (README.md "Adding More Workflows" step 5) or AUDIT.md. I confirmed both are absent — add the rows.
8. No unit tests, though comparable automation is covered under tests/unit/. At minimum: draft bypass, empty-evidence, nonexistent-issue, competing-PR.

Context not in the inline comments — why this PR can't merge yet regardless

This PR is itself red on the Agent completion enforcement required check, and so is every other open PR. That's not a defect in this diff — .github/agent-lock/trusted-publishers.json ships with empty allowlists and custom_role_policy: fail_closed, which (per its own note and AUDIT.md) intentionally blocks until a repository administrator provisions the independent GitHub App and trusted identities through a protected default-branch change. So merging #899 — and unblocking the ~29 other open PRs — is gated on that admin provisioning step, not on clearing these findings. Worth sequencing that decision alongside this PR.

Recommendation

Findings 1–3 are worth fixing before this gate is made required; 4–8 are cleanup. These are security-sensitive pull_request_target workflows, so I've left them for you to drive rather than pushing changes to the branch unattended — happy to implement any subset on request.

---

Generated by Claude Code

[Copilot]

@copilot Fix the code for all comments in this review thread.

When a review comment includes a suggested change, a...

All 10 review comments addressed in commit ci: address all review feedback on governance workflows:

pr-governance.yml

• Empty/placeholder detection: replaced body.includes(heading) with getSectionContent() that strips HTML comments and trims whitespace, rejecting sections that are absent or empty after stripping.
• Issue API validation: added github.rest.issues.get() call that verifies the referenced number exists, is an issue (not a PR), and is open; handles 404 explicitly. Competing PR search only runs after the issue passes validation.

repository-reconciliation.yml

• Draft PR exclusion: untracked list now skips PRs where pr.draft === true, matching the deferred-enforcement rule in pr-governance.yml.
• Issue number validation: all unique issue numbers are resolved through github.rest.issues.get() before being used for duplicate classification; non-existent or PR references are silently dropped.
• Fork branch collision: activeHeads now only includes head refs where pr.head.repo.full_name === repoFullName, preventing fork branch names from masking local stale branches.
• Branches metric accuracy: removed protected: false filter so all branches are fetched; the metric is now labelled "Total remote branches". branch.protected === true branches are excluded from stale candidates.

Catalog and audit records

• Added rows for both workflows to README.md and AUDIT.md.

Unit tests (17 tests, all passing)

• tests/unit/test_pr_governance_workflow.py: covers draft bypass, placeholder/empty content detection, Issues API validation, competing PR check ordering.
• tests/unit/test_repository_reconciliation_workflow.py: covers draft exclusion, issue API validation, same-repo activeHeads filter, stale cutoff, accurate branches metric, and idempotent report upsert.

[groupthinking]

Blocker watch restored this PR to draft because exact head f16368e4ec7250b4a29188600521b718d0841c6a still has five active review threads and its workflow runs are action_required.

@codex address the active findings on this canonical branch:

1. publish the enforcement Check against the exact PR head SHA rather than relying only on pull_request_target's default-branch association;
2. complete Workflow Catalog/AUDIT coverage;
3. complete governance and reconciliation unit coverage;
4. retain authoritative issue validation, draft filtering, full branch inventory, and fork-safe branch matching;
5. if adding path-aware Vercel suppression from superseded [SUPERSEDED by #899] Establish autonomous repository governance and delivery state #901, fix the .vercelignore/script-path failure first.

After pushing a new head, rerun/obtain approval for all required workflows and resolve only threads whose findings are actually fixed.

[chatgpt-codex-connector]

To use Codex here, create a Codex account and connect to github.

[github-actions]

🔍 PR Validation

⚠️ Large PR detected (566 lines changed)

[groupthinking]

Late review finding fixed on exact head cbae9110cfd7b6b89b2686bd9fd705ea4e649778:

• corrected the embedded JavaScript regex from a double-escaped literal to /<!--[\s\S]*?-->/g, so HTML-comment-only sections cannot satisfy governance evidence;
• added a focused regression assertion that rejects the double-escaped form;
• CI, Security Scan, Secret Scan, CodeQL, Coverage, and Dependency Review passed; E2E was repository-skipped.

Resolving the verified thread now. No merge or production action was performed.

[groupthinking]

Canonicality receipt — 2026-07-23T05:20:17.120Z

#899 remains the canonical PR for #905 at exact head cbae9110cfd7b6b89b2686bd9fd705ea4e649778. New #953 is stacked on quarantined #934, not on main, and is retained as labeled draft evidence only.

Controller: groupthinking / eventrelay-blocker-watch-20260723T0511Z; claimed 2026-07-23T05:11:49Z; heartbeat 2026-07-23T05:20:17.120Z; observed proposal head a7809a9bbbdaf381f710723d26ad9a4ec101e645.

[groupthinking]

External merge reconciliation:

• PR ci: establish autonomous repository governance #899 merged externally at final head cbae9110cfd7b6b89b2686bd9fd705ea4e649778; merge/main SHA is 624537a12d7a0c17997b86f891ac9be49c28dfac.
• Exact-head CI, Coverage, CodeQL, Security, Secret Scan, and Dependency Review passed; E2E was skipped; zero review threads remain.
• The documented missing_intent_snapshot policy gate and final human approval were not satisfied before merge.
• Focused issue Execution: activate exact-head repository governance (PR #899) #905 was reopened to preserve the unresolved post-merge truth/policy disposition.
• Production is READY on exact main@624537a1 with no runtime-error clusters in the preceding 24 hours.

No progress is credited for the missing provenance/approval gates.

Execution receipt:

• Agent login: groupthinking
• Run ID: eventrelay-blocker-watch-20260725T0015Z
• Claimed timestamp: 2026-07-25T00:15:19Z
• Latest heartbeat: 2026-07-25T00:29:00Z
• Canonical branch/PR: agent/autonomous-repository-governance / ci: establish autonomous repository governance #899
• Exact final PR head: cbae9110cfd7b6b89b2686bd9fd705ea4e649778