fix(governance): accept self-approval for downstream feature exceptions - #34
Merged
Conversation
A single-maintainer fork has no second human to approve a PR, so the non-author requirement was unsatisfiable by construction. Approval now just requires an APPROVED review of the current head, author or not.
joeshull
added a commit
that referenced
this pull request
Aug 22, 2026
GitHub refuses to let a PR author approve their own pull request, so the self-approval fix in #34 was necessary but not sufficient: a solo-maintainer PR could still never produce an APPROVED review, which permanently deadlocked the required reconcile status check. Provenance metadata is the audit trail now; no mode asserts a review.
joeshull
added a commit
that referenced
this pull request
Aug 22, 2026
* feat(governance): add downstream sync provenance mode Conflicted main -> internal/main sync pull requests had no resolution route that could satisfy the required reconcile check. * fix(governance): gate downstream sync on merge shape and render its summary Review found the mode could not pass CI at all: writeEvidence fell through to the upstream-import renderer and dereferenced mergeParents. It also found the ahead/identical containment check was satisfied by any branch that merges main, leaving one approval to authorise unrestricted paths. * fix(governance): drop the human-review requirement entirely GitHub refuses to let a PR author approve their own pull request, so the self-approval fix in #34 was necessary but not sufficient: a solo-maintainer PR could still never produce an APPROVED review, which permanently deadlocked the required reconcile status check. Provenance metadata is the audit trail now; no mode asserts a review. * docs(governance): state what the sync merge shape does not prove * docs(governance): warn against unrelated edits in a sync merge
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Downstream governance: true
Summary
resolveApprovalinscripts/check-upstream-provenance.mjsrequired a downstream-feature exception's APPROVED review to come from someone other than the PR author. This fork has exactly one human maintainer, so that requirement was permanently unsatisfiable — PR #30 is blocked on it right now.Change
resolveApproval; any humanAPPROVEDreview of the current head (self or otherwise) now satisfies the downstream-feature exception. All other checks are unchanged: state must beAPPROVED, reviewer must be aUser(not a bot), commit SHA must match the current head exactly, and a newer commit still invalidates prior approval.scripts/check-upstream-provenance.test.mjsto match: renamed the coverage test, added a case proving self-approval is now accepted, dropped the now-removed thirdresolveApprovalargument across all call sites.docs/fork-governance.mdwording accordingly.Verification
node --test scripts/check-upstream-provenance.test.mjs— 11/11 passednpm run lint/npm run formaton changed filesnpm run typecheck