fix(governance): restack production protection ambiguity on current main

[seonghobae]

Purpose

Create a clean current-protected-main successor for #278 after its application CI correctly failed the live-base drift check. This successor preserves only the reviewed production-environment rule-ambiguity hardening and its focused regressions; predecessor checks and review evidence do not transfer.

Exact construction identity

• protected main immediately before construction: e60eff4c71dc4997b9990a79daa5069d6f5e2037;
• predecessor fix(governance): reject ambiguous production protection rules #278 exact unchanged head: af152e4fa1b698d563369712e3e8bb0e1e065797;
• successor exact head: 4ef3af68879eae4f32259480843761b3a19fad7b;
• successor tree: 3b4bbb33b49a6aa15eb2f40b623ddd67093ee7ef;
• ancestry: one commit directly on current protected main, 1 ahead / 0 behind, merge base exactly e60eff4c71dc4997b9990a79daa5069d6f5e2037;
• scope: exactly two paths: scripts/lib/production-environment-governance.mjs and test/production-environment-governance.test.ts.

RCA and preserved behavior

#278's latest application run did not fail product logic. Exact-head checkout and package-manager verification succeeded, then verify live pull-request base before lockfile control failed because protected main had advanced. Its reviewer CI and central Security Scan were terminal success, but that predecessor evidence is historical only.

The successor keeps the reviewed fail-closed behavior:

• collect all required_reviewers rules and require exactly one;
• collect all branch_policy rules and require exactly one;
• emit required_reviewers_rule_ambiguous or branch_policy_rule_ambiguous for duplicate semantic authority;
• preserve concrete reviewer validation, self-review prevention, protected-branch requirement, and disabled custom branch policies;
• focused tests cover duplicate reviewer and branch-policy rule families.

The earlier unused-variable finding on #278 is already addressed in the transplanted source; the predecessor inline thread is resolved/outdated.

Evidence boundary

This PR starts with no transferable CI, coverage, scanner, model, review, deployment, release, or production-environment evidence. Keep Draft until this unchanged exact head has fresh terminal-success application ci, reviewer-ci, protected-base-eligible central Security Scan, exact 100% owned production statement/branch/function/line coverage with realistic tests, and zero valid unresolved findings.

Immediately before Ready or merge, re-resolve protected main, exact head/ref/ancestry, workflow checkout SHAs, live rulesets, central .github Security Scan authority, reviews, threads, and active-writer state. Current live Noema policy requires the central Security Scan workflow; it does not currently require an independent formal approval, so no synthetic approval requirement is imposed.

This change does not assert that the live GitHub production environment passes, does not alter external reviewer/admin configuration, and does not publish, deploy, weaken gates, invent evidence, or choose an outbound license.

Supersedes #278 after fresh exact-head verification.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 1d2f5f72-3c6e-434d-9495-aea9f6b77524

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}