governance: 登记 agent-registry 破玻璃直推豁免（ADR-0030）

[randypanding]

摘要

把 agent-registry 两条破玻璃直推登记入 direct_push_exemptions（ADR-0030 背书，agent-registry#44 已合并）：

• 60bd155（owner 直推，误入 agent-platform gitlink → 全仓 PR CI 死锁）
• e9424d2（admin 破玻璃移除该 gitlink 解死锁）

同型先例：.github 仓 ae905a6 + ADR-0017 附录。

验证

• expected-state.json 合法 JSON（gate JSON 校验段等价本地预检）
• 豁免登记在 drift-check §8 生效路径上（逐完整 SHA 匹配）

Summary by CodeRabbit

• 配置更新
  • 为 agent-registry 仓库新增直接推送豁免配置。
  • 登记两个获豁免的提交记录。

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 17c38bc7-dbcd-4a55-8cc4-fb0e8d59f07f

📥 Commits

Reviewing files that changed from the base of the PR and between 6c7cf96 and 310ca10.

📒 Files selected for processing (1)

• governance/expected-state.json

Included review availability: Your plan provides up to 10 included reviews per hour; 9 remain after this review.

---

📝 Walkthrough

Walkthrough

变更概述

新增 agent-registry 仓库的直推豁免配置，并登记两个获豁免的提交 SHA。

Changes

直推豁免配置

Layer / File(s)	Summary
登记直推豁免 governance/expected-state.json	在 direct_push_exemptions 中新增 agent-registry 条目，并记录两个完整提交 SHA。

Suggested labels: security

Merge Risk: ⚪ Minimal · up to 310ca

This change registers two approved direct-push exemptions in the governance state; no actionable merge-blocking risk remains after normal checks and review.

🚥 Pre-merge checks | ✅ 1 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Title check	⚠️ Warning	标题准确描述了登记 agent-registry 直推豁免的变更，但未使用要求的 Conventional Commits 前缀。	将标题前缀改为 feat、fix、chore、refactor、docs 或 test，例如：chore: 登记 agent-registry 破玻璃直推豁免（ADR-0030）。

✅ Passed checks (1 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch adr-0030-exemption-registration

---

_{Comment @coderabbitai help to get the list of available commands.}

[qodo-code-review]

PR Summary by Qodo

Register agent-registry direct-push exemptions (ADR-0030)

⚙️ Configuration changes 🕐 Less than 5 minutes

AI Description

• Registers two ADR-0030-approved agent-registry break-glass commits as direct-push exemptions.
• Prevents §8 drift checks from flagging the deadlock-recovery pushes.

Diagram

graph TD
  A["expected-state.json"] --> B["Drift Check"] --> C{"SHA Exempt?"}
  C -- Yes --> D["Skip PR Check"]
  C -- No --> E["PR Association"] --> F{"PR Found?"}
  F -- Yes --> G["Pass Check"]
  F -- No --> H["Report Drift"]

Loading

High-Level Assessment

Using the existing full-SHA exemption registry is the appropriate approach because it preserves §8 enforcement while making ADR-approved exceptions explicit and auditable. Manual bypasses or repository-specific script conditions would be less transparent and harder to maintain.

Files changed (1) +4 / -0

Other (1) +4 / -0

expected-state.jsonRegister agent-registry break-glass commit exemptions +4/-0

Register agent-registry break-glass commit exemptions

• Adds the two ADR-0030-approved agent-registry commit SHAs to 'direct_push_exemptions'. The §8 drift check will recognize these exact commits without weakening checks for future pushes.

governance/expected-state.json

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (1) 📘 Rule violations (0) 📜 Skill insights (0)

1. 豁免审计归因错误 🐞 Bug ◔ Observability

Description

新增的两条 agent-registry 豁免由 ADR-0030 背书，但 drift-check.sh
对匹配项固定输出“ADR-0017”，导致每次检查都生成错误的治理审计依据。该错误会误导事件追溯和后续豁免复核。

Code

governance/expected-state.json[R73-75]

+    "agent-registry": [
+      "60bd1557481fa89d0358302e150a8f7d9381309c",
+      "e9424d220ded331c221b37135faa9d6e9cd1ecac"

Relevance

●●● Strong

Team consistently accepts drift-check.sh correctness/audit-accuracy fixes; recent precedents
(PR#50,#19,#13) show acceptance.

PR-#50
PR-#19
PR-#13

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

新增记录明确位于 agent-registry 豁免列表中，而其唯一消费者取得该列表后，在任何 SHA 匹配时都固定打印 ADR-0017；因此这两条 ADR-0030 记录必然被错误归因。

governance/expected-state.json[50-80]
governance/drift-check.sh[217-228]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
`direct_push_exemptions` 新增了由 ADR-0030 背书的提交，但检查结果仍将所有豁免固定归因于 ADR-0017。

## Issue Context
豁免数据目前只保存 SHA，消费者无法确定每条记录的实际 ADR。请为豁免保留可审计的 ADR 归属，并让成功日志输出对应依据；至少不要继续输出错误的固定 ADR 编号。

## Fix Focus Areas
- governance/expected-state.json[50-80]
- governance/drift-check.sh[217-228]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

Context sources

✅ Compliance rules (platform): 7 rules

Review mode: ⚖️ Balanced: This is a small, localized governance configuration change, but it affects drift-check exemption behavior and therefore has semantic correctness and governance implications; it is not documentation-only or purely formatting.

Tip of the day

💡 Did you know, you can copy the agent prompt from any finding and feed it to your IDE agent

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

[qodo-code-review]

1. 豁免审计归因错误 🐞 Bug ◔ Observability

新增的两条 agent-registry 豁免由 ADR-0030 背书，但 drift-check.sh
对匹配项固定输出“ADR-0017”，导致每次检查都生成错误的治理审计依据。该错误会误导事件追溯和后续豁免复核。

Agent Prompt

## Issue description
`direct_push_exemptions` 新增了由 ADR-0030 背书的提交，但检查结果仍将所有豁免固定归因于 ADR-0017。

## Issue Context
豁免数据目前只保存 SHA，消费者无法确定每条记录的实际 ADR。请为豁免保留可审计的 ADR 归属，并让成功日志输出对应依据；至少不要继续输出错误的固定 ADR 编号。

## Fix Focus Areas
- governance/expected-state.json[50-80]
- governance/drift-check.sh[217-228]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools