governance: mutual 申报入图 + bootstrap 直推豁免登记（ADR-0027）

[randypanding]

变更（ADR-0027 决策 1/2 落地）

• governance/REPOS.yaml：新增 mutual 条目（L2 / public / active——LLM 双向互惠推荐引擎，Go+BAML 重写路线）
• governance/expected-state.json：direct_push_exemptions 登记 mutual 建仓 bootstrap commit f5d9b5b58d4dc30a2b0e259449862fc4a3c91f6b（ADR-0021 (b) 类）

预检

• drift-check 本地预检通过：无漂移（含 §7b/§8 mutual 项消除、vcs-admin-unique mutual）
• REPOS.yaml 解析 + 无重名校验通过；expected-state.json JSON 校验通过

关联

• 决策记录：ADR-0027（agent-registry PR [总结] 2026-08-19 红队演练：治理体系全栈问题报告 #39，已合并）

Summary by CodeRabbit

• 治理
  • 新增 mutual 产品仓库登记，标注其公开、活跃及 L2 层级属性，并补充产品定位与关键质量门禁信息。
  • 更新治理状态配置，为该仓库登记直推豁免规则及对应提交记录，确保相关变更流程状态保持一致。

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: fee80acf-593a-4a11-bffa-773c61c1998f

📥 Commits

Reviewing files that changed from the base of the PR and between d444eab and a530f54.

📒 Files selected for processing (2)

• governance/REPOS.yaml
• governance/expected-state.json

Included review availability: Your plan provides up to 3 included reviews per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

Changes

mutual 仓库治理注册

Layer / File(s)	Summary
仓库注册与直推豁免 governance/REPOS.yaml, governance/expected-state.json	新增 mutual 的公开、active、L2 仓库注册信息，并登记其直推豁免提交 SHA。

Possibly related PRs

• Cloudbird-Software/.github#77：同样更新仓库注册表和直推豁免配置，但针对不同仓库。
• Cloudbird-Software/.github#7：建立仓库注册表，当前变更在其中新增 mutual 条目。

Suggested labels: security, feature

Merge Risk: ⚪ Minimal · up to a530f

This is a localized governance metadata change with no actionable merge-blocking risk remaining after normal checks and review.

🚥 Pre-merge checks | ✅ 1 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Title check	⚠️ Warning	标题未使用要求的 Conventional Commits 前缀，且长度为 52 个字符，超过 50 个字符限制。	将标题改为以 feat、fix、chore、refactor、docs 或 test 开头，并压缩至不超过 50 个字符。

✅ Passed checks (1 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch adr-0027-mutual-declare

---

_{Comment @coderabbitai help to get the list of available commands.}

[qodo-code-review]

PR Summary by Qodo

Register mutual and bootstrap exemption under ADR-0027

⚙️ Configuration changes 🕐 Less than 10 minutes

AI Description

• Registers mutual as an active public L2 repository and documents its Go+BAML rewrite.
• Records the ADR-approved bootstrap commit as an exact direct-push exemption.

Diagram

graph TD
  Registry["Repo Registry"] -->|declared topology| Drift["Drift Check"] -->|checks repository| Mutual["mutual Repo"]
  Expected["Expected State"] -->|exempt SHA| Drift -->|checks commits| History["GitHub History"]

Loading

High-Level Assessment

The current approach matches the established governance model: declare the repository centrally and exempt only the exact ADR-approved bootstrap SHA. Changing drift-check logic or using broader exemptions would add unnecessary complexity and weaken auditability.

Files changed (2) +13 / -0

Other (2) +13 / -0

REPOS.yamlRegister mutual in the organization repository map +10/-0

Register mutual in the organization repository map

• Adds mutual as an active, public L2 product repository. Documents the Go+BAML rewrite scope, imported Python baseline constraints, evaluation gates, and key governed paths.

governance/REPOS.yaml

expected-state.jsonAllow-list mutual's bootstrap commit +3/-0

Allow-list mutual's bootstrap commit

• Adds mutual's exact initial commit SHA to direct_push_exemptions, preventing its ADR-approved repository bootstrap from being reported as direct-push drift.

governance/expected-state.json

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (1) 📜 Skill insights (0)

1. mutual registry entry added 📘 Rule violation § Compliance

Description

The PR adds mutual to this repository’s organization repository registry. Registry entries must
instead reside in the designated agent-registry repository.

Code

governance/REPOS.yaml[R98-101]

+  - name: mutual
+    layer: L2
+    visibility: public
+    status: active

Relevance

● Weak

Recent registry additions to REPOS.yaml were repeatedly accepted, contradicting this compliance
finding.

PR-#7
PR-#77
PR-#78

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

Compliance rule 2778541 prohibits registry entries in this repository. governance/REPOS.yaml
describes itself as the organization repository registry, and the cited changed region introduces
the new mutual entry there.

Rule 2778541: Disallow ADR documents and registry entries in this repository
governance/REPOS.yaml[4-12]
governance/REPOS.yaml[98-106]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The new `mutual` registry entry is being added to this repository, although registry entries must be maintained in the designated `agent-registry` repository.

## Issue Context
`governance/REPOS.yaml` identifies itself as the organization repository registry. Remove the local registry addition and submit the corresponding declaration to `agent-registry`, retaining only non-registry governance state that is appropriate here.

## Fix Focus Areas
- governance/REPOS.yaml[98-106]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

Context sources

✅ Compliance rules (platform): 7 rules

✅ Web pages:

  🌐 netbirdio/netbird

  🌐 Merge NetBird cloud edition into the dashboard · Pull Request #674 · netbirdio/dashboard

  🌐 [self-hosted] add netbird server · Pull Request #5232 · netbirdio/netbird

  +7 more

Review mode: ⚖️ Balanced: This changes governance configuration and expected-state registration, affecting repository discovery and exemption/drift enforcement; it is localized but behaviorally consequential, so a complete single-pass review is warranted.

Tip of the day

💡 Did you know, you can show, collapse, or hide each part of a finding: code, evidence, and all

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗