feat: 治理变更流程（GM-2/flows.governance_change）+ archetype 验证链（AR-8/9）+ .github 纳入保护 by randypanding · Pull Request #8 · Cloudbird-Software/.github

randypanding · 2026-08-18T10:17:32Z

内容（C1，附 ADR-0006/0007，见 agent-registry/decisions/）

GM-2 advisory→enforced；flows.governance_change：C1(ADR)/C2(validate)/C3(PR) + 破玻璃 24h 回填制
drift-check §8：policy_effective 后非 PR commit=漂移（周检自动开 issue）
main-protection 解除 .github 豁免；本仓新增 gate 工作流（YAML/JSON/脚本检查）与 CODEOWNERS
agent.schema: archetype 七分类 + guardrails（no-self-test 等）；team.schema: verification（in_team_check + external_audit）
agent_runtime 增 AR-8（原型分离）/AR-9（验证链）

C1 预检

本地 drift-check 已跑：除既存 AGENT_APP_SECRET 缺失（另处理）外无漂移；合并后执行 apply.sh 下发 ruleset 更新

…-8/9 + 解除 .github 保护豁免（ADR-0006/0007）

coderabbitai · 2026-08-18T10:17:43Z

Warning

Review limit reached

@randypanding, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 31 minutes

Limit details: You’ve used all 3 included reviews currently available under your plan.

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 5da7217c-2550-4bc7-9e69-dead08d4b4e9

📥 Commits

Reviewing files that changed from the base of the PR and between 4d34ae2 and 94a44a8.

📒 Files selected for processing (8)

.github/CODEOWNERS
.github/workflows/gate.yml
governance/GOVERNANCE.yaml
governance/apply.sh
governance/drift-check.sh
governance/rulesets/main-protection.json
standards/agent/agent.schema.yaml
standards/agent/team.schema.yaml

_{Comment @coderabbitai help to get the list of available commands.}

drift-check.sh： - §8 直推检测去掉消息后缀预筛（qodo #1：后缀可伪造——直推挂 "(#N)" 假后缀即绕过预筛被报 clean）。唯一权威判据 = 关联 PR API，窗口内每个 commit 都复核 - §8 fail-closed（qodo #2）：关联 PR 查询改用全 SHA；响应须为数组（error 对象此前被 length>0 读作 has-pr、传输失败读作非 none—— 均静默放行）。查询失败 = 无法验证 = 判漂移，绝不静默放行 - §8 分页（qodo #7）：commit 列表全分页；超 MAX_COMMITS=300 显式报漂移而非静默截断 - §4 fail-closed：org 仓库清单拉取失败时此前 REPOS 为空 → 全部循环静默跳过 → 检测整体假绿；现显式 exit 2 - §10 新增 ADR 引用存在性后验（qodo #5）：窗口内合并 PR 的 ADR-NNNN 引用须真实存在于 agent-registry/decisions/——gate 的存在性校验受私有仓跨读权 + PR 上下文 secret 暴露面约束（见 gate.yml 注释），后验防线与其互补 apply.sh：前置 GET 参与失败计数（qodo #3）——ruleset 清单/CS 清单/ org 仓库清单拉取失败时此前静默跳过或走错误分支，违反 loud-failure 契约；现显式计 FAIL 并在汇总中 exit 1 gate.yml：adr-required 的 PR 文件清单 --paginate（qodo #4：>100 文件的 C1 变更不再漏检）；正则词边界（防 NOTADR-0013junk 子串绕过）；存在性校验后移至 drift-check §10 的原因记录在案（org secret 不可进 PR 触发的 workflow——PR 控制的代码 + secret = zizmor secret-exposure） governance-drift.yml：issue 归属判定改用专属 label auto-drift-report （qodo #8：标题搜索会把人工开的同名 issue 误评论/误关闭；label 幂等创建，创建/评论/关闭全部 label-scoped） GOVERNANCE.yaml：C1 scope 补 scripts/、.github/、CODEOWNERS、profile/ （qodo #6：机器可读声明与 gate adr-required 实际执法路径一致—— 声明与执行不得互斥） Refs: ADR-0013, #17, #18

…19) * feat: 红队修复批次——gate 硬化、每日漂移+自动关闭、apply loud-failure、App 名统一（ADR-0013） - gate.yml：timeout-minutes=10；JSON 校验覆盖 expected-state.json（此前只验 rulesets）； adr-required 实装——C1 路径变更 PR 必须引用 ADR-NNNN（flows "无 ADR 不合并"的机器执行） - governance-drift.yml：周检→每日（盲区 7 天→1 天）；漂移消除自动关闭 issue（防陈旧报告噪音） - drift-check.sh §8 重写：消息后缀快速筛 + associated-PR API 复核（防伪造/漏报）；超 24h 未回填直推标记 P0 - apply.sh：loud failure（HTTP 非 2xx 计数汇总 exit 1，防检测→修复死循环）；头部显式声明不可自动修复类别（§5-§9）及人工路径 - new-repo-init.sh：environment/app 挂载失败 exit 1（此前静默"完成"）；引导改 pin commit - App 名统一 cloudbrid-agent（线上真实 slug id=4632704；cloudbird-agent 404） - GOVERNANCE.yaml：governance-core→team:stewardship（ADR-0004 规划名的落地形态）； C1 scope 纳入 template-service（供应链入口）；GM-1 每日+自动关闭；frequency 对齐 - expected-state.json：org_secrets_required 登记 GOVERNANCE_TOKEN（drift workflow 实际依赖） - languages.yaml：依赖审批 approver+SLA（防永久挂起）；SECURITY.md：响应 SLA/接收人/披露 - AGENTS.md 创建（CG-1 声明的契约文件，此前缺失）；agent.schema.yaml profiles 指向 agent-registry * fix: 评审修复——直推检测去后缀预筛、fail-closed、分页；幽灵 ADR 后验；C1 scope 对齐（ADR-0013） drift-check.sh： - §8 直推检测去掉消息后缀预筛（qodo #1：后缀可伪造——直推挂 "(#N)" 假后缀即绕过预筛被报 clean）。唯一权威判据 = 关联 PR API，窗口内每个 commit 都复核 - §8 fail-closed（qodo #2）：关联 PR 查询改用全 SHA；响应须为数组（error 对象此前被 length>0 读作 has-pr、传输失败读作非 none—— 均静默放行）。查询失败 = 无法验证 = 判漂移，绝不静默放行 - §8 分页（qodo #7）：commit 列表全分页；超 MAX_COMMITS=300 显式报漂移而非静默截断 - §4 fail-closed：org 仓库清单拉取失败时此前 REPOS 为空 → 全部循环静默跳过 → 检测整体假绿；现显式 exit 2 - §10 新增 ADR 引用存在性后验（qodo #5）：窗口内合并 PR 的 ADR-NNNN 引用须真实存在于 agent-registry/decisions/——gate 的存在性校验受私有仓跨读权 + PR 上下文 secret 暴露面约束（见 gate.yml 注释），后验防线与其互补 apply.sh：前置 GET 参与失败计数（qodo #3）——ruleset 清单/CS 清单/ org 仓库清单拉取失败时此前静默跳过或走错误分支，违反 loud-failure 契约；现显式计 FAIL 并在汇总中 exit 1 gate.yml：adr-required 的 PR 文件清单 --paginate（qodo #4：>100 文件的 C1 变更不再漏检）；正则词边界（防 NOTADR-0013junk 子串绕过）；存在性校验后移至 drift-check §10 的原因记录在案（org secret 不可进 PR 触发的 workflow——PR 控制的代码 + secret = zizmor secret-exposure） governance-drift.yml：issue 归属判定改用专属 label auto-drift-report （qodo #8：标题搜索会把人工开的同名 issue 误评论/误关闭；label 幂等创建，创建/评论/关闭全部 label-scoped） GOVERNANCE.yaml：C1 scope 补 scripts/、.github/、CODEOWNERS、profile/ （qodo #6：机器可读声明与 gate adr-required 实际执法路径一致—— 声明与执行不得互斥） Refs: ADR-0013, #17, #18 * fix: CodeRabbit 评审修复——权限下沉 job 级、仓库枚举分页、C1 路径三处统一、App 令牌最小作用域（ADR-0013） - gate.yml：permissions 下沉 gate job（顶层 permissions: {}——防后续新增 job 继承 workflow 级权限，对齐 agent-registry validate.yml 同款防御） - apply.sh/drift-check.sh §4：org 仓库枚举改全分页（>100 仓的 org 不再漏应用/漏检基线）；apply 侧空清单同样计 FAIL（loud-failure） - GOVERNANCE.yaml/AGENTS.md/gate.yml：C1 路径定义三处统一——GOVERNANCE C1 scope 改 governance/ 整目录并补 tests/（agent-registry 元验证）； AGENTS.md 硬规则补 profile/；与两个仓的机器执法路径集完全一致 - gh-app-token.sh：REPO 改必填（此前不设=令牌作用域为全部已安装仓库，违反最小权限）；用法注释禁止交互 shell 内联 PEM（history+子进程环境双暴露面），本地走 AGENT_APP_SECRET_FILE、CI 走 Actions secret - new-repo-init.sh：远端脚本 pin 指引改为"审阅过的合并提交 SHA" （gh pr view mergeCommit），不再建议运行时取 main HEAD Refs: ADR-0013, #17, #18 --------- Co-authored-by: randypanding <randypanding@users.noreply.github.com>

…#53) CI-Workflows #8 qodo review 发现的同款缺陷在本仓 gate.yml 同样存在： 1. on.pull_request.types 增 edited：PR title/body 是可变输入，check 通过后编辑掉 ADR 引用必须触发重验（反向：补引用救活 check 同理） 2. previous_filename 纳入 C1 判定：governance/standards/CODEOWNERS 等 C1 资产改名移出受管路径同样是 C1 变更 3. files API 3000 文件硬上限：返回数 < changed_files 即 fail-closed Co-authored-by: randypanding <randypanding@users.noreply.github.com>

* governance(AG-1): 修订为开发身份唯一+验证者身份独立 * chore: retrigger checks after archive #8 merged --------- Co-authored-by: randypanding <randy_panding@qq.com>

* fix(governance): ADR-0056 DECISION-02 修订 + drift-check §18 同步 (#269) * chore: retrigger checks after archive #8 merged --------- Co-authored-by: randypanding <randy_panding@qq.com>

feat: 治理变更分级流程 GM-2 enforced + drift-check §8 直推检测 + archetype/验证链 AR…

94a44a8

…-8/9 + 解除 .github 保护豁免（ADR-0006/0007）

randypanding merged commit 6b20979 into main Aug 18, 2026
3 of 4 checks passed

randypanding deleted the change-control branch August 18, 2026 10:22

randypanding mentioned this pull request Aug 18, 2026

fix: gate REPOS 自检 heredoc 化 #9

Merged

randypanding mentioned this pull request Aug 19, 2026

fix: gate 文件清单三防线——edited/rename 溯源/3000 fail-closed（ADR-0016） #53

Merged

This was referenced Aug 19, 2026

fix: adr-required 换行文件名绕过截断检测——jq 结构化计数（ADR-0016） #54

Merged

[自动合并 P2-2] 抑制标记预算门 #87

Closed

cloudbrid-agent Bot pushed a commit that referenced this pull request Aug 23, 2026

chore: retrigger checks after archive #8 merged

7707aa7

cloudbrid-agent Bot pushed a commit that referenced this pull request Aug 23, 2026

chore: retrigger checks after archive #8 merged

78543d7

randypanding mentioned this pull request Aug 24, 2026

spec(IR-0004): IR-0004 Cloudbird-Software/.github#315 条款级规格 rev4（ADR-0050，红队四轮 survived） #338

Merged

Navigation Menu

Uh oh!

feat: 治理变更流程（GM-2/flows.governance_change）+ archetype 验证链（AR-8/9）+ .github 纳入保护 - #8

feat: 治理变更流程（GM-2/flows.governance_change）+ archetype 验证链（AR-8/9）+ .github 纳入保护#8
randypanding merged 1 commit into
mainfrom
change-control

randypanding commented Aug 18, 2026

Uh oh!

coderabbitai Bot commented Aug 18, 2026

Review limit reached

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

randypanding commented Aug 18, 2026

内容（C1，附 ADR-0006/0007，见 agent-registry/decisions/）

C1 预检

Uh oh!

coderabbitai Bot commented Aug 18, 2026

Review limit reached

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant