test(af02): preserve v2 evidence and pin live approval-free GitHub policy

Merged
TH
8d ago
+180-5

Correct the live GitHub authority after founder approval removal

Closes the current AF-02 v2/live ruleset-mismatch root cause tracked
by #222 without modifying AF-02 protected history or suppressing
the live ruleset evidence.

Facts and scope

On 2026-10-10 the founder removed mandatory human approvals from
ruleset 21652974; zero approvals and all five review-only flags false.
Normal PR merge commits remain required. The independently enforced
ruleset 21652953 remains unchanged (rust, assurance-proof, scorecard,
deletion/force-push protection).

The old immutable AF-02 authority-baseline v2 was genuinely captured
when review rule 21652974 required one human review. Previously its
Rust authority replay attempted to prove the historical v2 baseline
against the current live mutable ruleset, causing a reproducible
failure on PR #206 updated head 5f98eac:
"required_approving_review_count mismatch, expected 1".

Minimal migration

  • Reconstruct historical v2 against the original already frozen
    test fixture and the original pinned SHA/baseline unchanged.
  • Pin a separately versioned current zero-approval exact GitHub rule
    readback in specs/053-af02-review-free-live-policy/review-policy.json.
  • Add an independent live GitHub check for the exact new review rule,
    including all five disabled review flags, main target, bypass,
    one PR rule and merge-only methods.
  • Add negative mutation checks for reintroduced approvals, altered
    target, dropped bypass and squash permission.
  • Only one unprotected Rust test file, AGENTS.md and new specs/053
    docs/data changed. AGENTS.md now tells agents not to demand a
    human review gate under the live 2026-10-10 policy. No protected
    authority sources, workflows, frozen v2 manifest/snapshots,
    active assurance rulesets or production code modified.

Evidence on the authorized Mac

  • cargo +1.97.1 test --locked -p commandf-pkg --test
    af02_authority_reconstruction: 16/16 PASS (including the
    previously failing v2 test and new live policy check).
  • cargo +1.97.1 clippy --locked -p commandf-pkg --test
    af02_authority_reconstruction -- -D warnings: PASS.
  • cargo +1.97.1 fmt --all -- --check: PASS.
  • GitHub signed commit and DCO verified on final head.

This is a candidate, not a merge. All exact-head CI must run and pass.
Any separate real-package-graph failure from the cross-registry
content divergence #214 remains blocking and must NOT be normalized
away or explained as an AF-02 approval-policy failure. Real Alibaba
OCR/Jev review is NOT_RUN until providers qualify; no human approval
is required under current verified GitHub rule.

Do not merge if any required check fails. Use only normal merge
commit with head guard and validate fresh post-main CI.

Current final exact-head evidence

  • HEAD 6e4e8a049df45089264e9601c950883605cc9b8b,
    verified signed GitHub commit with DCO. This supersedes the
    earlier f1e1563 commit's checks; only 6e4e8a0 CI can qualify.
  • Original 16/16 tests and strict Clippy were run locally on Mac
    before the AGENTS.md documentation-only follow-on commit.
  • Exact-head GitHub CI reruns after that follow-on and must be
    fully green before any merge.