feat(operations): validate Maintainer and Reviewer App evidence

[seonghobae]

Summary

• add a pure, fail-closed Maintainer App readiness evaluator
• require maintenance to remain disabled before activation
• validate exact Maintainer App slug/login binding and GitHub Bot account type
• validate authenticated Reviewer App slug, positive installation identifier, exact <slug>[bot] login binding, and identity separation from the Maintainer App
• validate single-repository scope, coarse read/write/non-admin permission evidence, required API probes, and live main governance
• redact unexpected repository names from scope-failure diagnostics and retain only their count
• single-line and cap every evaluator diagnostic at 800 characters
• harden the existing main governance adapter with shell-free execution, a 20-second request timeout, a 4 MiB output bound, minimal environment, pinned github.com, and explicit GitHub REST media type/API version headers
• add deterministic unit and contract tests for every boundary

Why this is the first stack slice

The original PR combined evaluator, collector, privileged workflow, runbook, and evidence retention into a diff larger than Noema's 60,000-character strict review budget. This PR isolates the policy engine and governance input boundary so an independent reviewer can inspect complete evidence without weakening the fail-closed gate.

TDD

• RED: a configured public bot login with a mismatched authenticated Reviewer App slug was accepted
• GREEN: the evaluator now requires valid Reviewer App slug and installation identity plus exact <slug>[bot] binding
• RED: scope failure evidence exposed names of unexpected repositories
• GREEN: scope failures retain only the effective repository count
• RED: hostile multiline or oversized evidence could flow into retained policy diagnostics
• GREEN: every check/failure detail is single-line and capped at 800 characters
• RED: the governance adapter did not pin GitHub's REST media type and API version
• GREEN: every governance API call now carries the reviewed version headers

Security boundaries

• evaluator is pure and has no network, filesystem, environment, or clock dependency
• public user responses are limited to exact login and account type
• unknown administrator state fails closed
• unexpected repository names are not retained in evaluator results
• governance collection is shell-free, output-bounded, timeout-bounded, credential-required, version-pinned, and fixed to github.com
• this slice adds no privileged workflow, token minting, merge, dispatch, or activation path

Stacked follow-ups

1. bounded effective-token collector and package command
2. default-branch-only privileged workflow, retained artifacts, runbook, and changelog

Verification required before merge

The exact current head must satisfy ci, reviewer-ci, Security Scan, CodeRabbit, Noema/OpenCode or independent human approval, and repository policy. Queued or stale-head results are not accepted.

Related: #29, #27

[coderabbitai]

Warning

Review limit reached

@seonghobae, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 18 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 4e2c721a-7302-426a-89dc-508689543c0a

📥 Commits

Reviewing files that changed from the base of the PR and between b88b2d1 and 5350ae6.

📒 Files selected for processing (7)

• docs/main-governance-audit.md
• scripts/lib/maintainer-app-readiness.mjs
• scripts/main-governance-audit.mjs
• test/main-governance-audit-script.test.ts
• test/maintainer-app-readiness.test.ts
• test/maintainer-app-scope-redaction.test.ts
• test/reviewer-app-identity-binding.test.ts

---

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.