fix(governance): drop the human-review requirement entirely - #35
Merged
Conversation
GitHub refuses to let a PR author approve their own pull request, so the self-approval fix in #34 was necessary but not sufficient: a solo-maintainer PR could still never produce an APPROVED review, which permanently deadlocked the required reconcile status check. Provenance metadata is the audit trail now; no mode asserts a review.
4 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Downstream governance: true
Summary
PR #34 made self-approval count toward the downstream-feature exception's required review, on the assumption a solo maintainer could approve their own PR. GitHub blocks that at the platform level (
Can not approve your own pull request— not a repo setting, not bypassable). Withreconcilealso a required status check oninternal/main's ruleset, that left downstream-feature PRs permanently deadlocked: no review can ever be produced, so the required check can never pass, so the merge button never unlocks.Change
resolveApproval,mergedApproval,effectiveApproval, andapprovalSummaryfromscripts/check-upstream-provenance.mjs— no exception mode fetches or requires a GitHub review anymore.downstream-featurenow only needs the exactDownstream feature: truemarker, a non-emptyDownstream rationale:, and the existing changed-path restriction (no governance/workflow files). Same shape asdownstream-governance, just without the changed-path allowlist.upstream-import(direct/reconciled) modes are untouched — they never called the approval functions to begin with; the doc's old claim that reconciled imports "retain one human approval" was aspirational, not code-enforced.scripts/check-upstream-provenance.test.mjsandscripts/ci-workflow.test.mjs(a separate meta-test that regex-checks this script's source) to match.docs/fork-governance.mdand.claude/skills/ship/SKILL.mdto stop describing a review requirement that no longer exists.Verification
node --test scripts/ci-workflow.test.mjs scripts/daemon-launch-contract.test.mjs scripts/check-upstream-provenance.test.mjs scripts/check-upstream-port.test.mjs— 31/31 passednpm run lint/npm run format/npm run typecheck