ADR-0023: AI_Web_School 纳入治理基线——解除全部豁免（ADR-0023）

[randypanding]

改了什么（C1：governance/ 变更，ADR-0023 背书）

• expected-state.json：repo_baseline.exclude_repos 置空
• GOVERNANCE.yaml：BP-1 移除 exception: [AI_Web_School]
• rulesets/main-protection.json：repository_name.exclude 置空
• rulesets/codeql-gate.json：exclude 仅保留 .github（本仓自指豁免不变）
• REPOS.yaml：AI_Web_School status: exempt → active，角色更新

为什么

ADR-0023（agent-registry PR #34 已合）：历史豁免代价已实证——AI_Web_School PR #31 于 2026-08-19 在 pr-check 失败（7 单测红灯）状态下无防线合入 main。仓库侧治理面已落地（其任务卡 T-W0-009：ci.yml 聚合 gate=CI-Workflows@v1 复用 + automerge/scorecard/CODEOWNERS/dependabot/zizmor/gitleaks 白名单）；平台侧已就绪（App 挂载 AG-4、production env RL-1、CodeQL default setup 2026-08-18 启用、仓库基线设置合规、admin 唯一）。

怎么验证

• 本地 drift-check 预检（变更前 main 状态）：除 4 项 Use-up-Plan 预存漂移（新仓未申报/基线异常/2 直推，与本 PR 无关，须人工处置）外全绿
• 合并后跑 apply.sh 落地 ruleset，再跑 drift-check.sh 复核不新增漂移

风险 / 回滚

纳管后 AI_Web_School PR 受 main-protection（gate required）约束——其 ci.yml 已提供 gate；回滚=新 ADR。

Summary by CodeRabbit

• 治理规则
  • 将 AI_Web_School 纳入标准治理范围，不再享受特定规则豁免。
  • 启用代码安全检查与主分支保护要求。
  • 补充该项目的治理接入和生产环境配置说明。

[coderabbitai]

Warning

Review limit reached

@randypanding, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 26 minutes

Limit details: You’ve used all 3 included reviews currently available.

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits within each organization.

For paid Pro and Pro+ reviews, CodeRabbit uses a developer's included PR review attempts over the past 7 days to set the current hourly allowance. At typical activity levels, the full plan allowance applies. Higher sustained activity can lower the allowance until earlier attempts leave the 7-day window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 14bfae38-c515-45fe-a180-0ec7371a1f30

📥 Commits

Reviewing files that changed from the base of the PR and between b245b87 and 5c5ab64.

📒 Files selected for processing (1)

• governance/rulesets/release-tags.json

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 16ab00b2-fc3a-4403-9acb-a7e8f855a2de

📥 Commits

Reviewing files that changed from the base of the PR and between ec6da4f and b245b87.

📒 Files selected for processing (5)

• governance/GOVERNANCE.yaml
• governance/REPOS.yaml
• governance/expected-state.json
• governance/rulesets/codeql-gate.json
• governance/rulesets/main-protection.json

💤 Files with no reviewable changes (1)

• governance/GOVERNANCE.yaml

Included review availability: Your plan provides up to 3 included reviews per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

本次变更将 AI_Web_School 纳入治理基线，并移除代码扫描门禁和主分支保护规则中的仓库排除配置。

Changes

AI_Web_School 治理接入

Layer / File(s)	Summary
仓库治理状态更新 governance/REPOS.yaml, governance/expected-state.json	将 AI_Web_School 状态改为 active，补充治理接入项和生产环境配置，并清空基线排除列表。
治理规则覆盖范围更新 governance/rulesets/codeql-gate.json, governance/rulesets/main-protection.json	代码扫描门禁和主分支保护规则不再排除 AI_Web_School。

Suggested labels: security, tech-debt

🚥 Pre-merge checks | ✅ 1 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Title check	⚠️ Warning	标题描述了将 AI_Web_School 纳入治理基线的主要变更，但未使用要求的 Conventional Commits 前缀。	将标题改为以 feat、fix、chore、refactor、docs 或 test 开头，例如：chore: AI_Web_School 纳入治理基线。

✅ Passed checks (1 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch adr-0023-onboard-ai-web-school

---

_{Comment @coderabbitai help to get the list of available commands.}

[qodo-code-review]

PR Summary by Qodo

ADR-0023：解除 AI_Web_School 治理豁免

⚙️ Configuration changes ✨ Enhancement 🕐 10-20 Minutes

AI Description

• 将 AI_Web_School 从豁免仓库调整为正式治理对象。
• 启用仓库基线、主分支保护与 CodeQL 安全门禁。
• 同步治理声明、仓库目录和平台期望状态。

Diagram

graph TD
  ADR["ADR-0023"] --> GOV["Governance Policy"] --> ENGINE["Apply and Drift"] --> REPO["AI Web School"]
  ADR --> CATALOG["Repository Catalog"] --> ENGINE
  ADR --> BASELINE["Baseline State"] --> ENGINE
  ADR --> MAIN["Main Protection"] --> ENGINE
  ADR --> CODEQL["CodeQL Gate"] --> ENGINE

Loading

High-Level Assessment

当前方案最合适：在 ADR 已批准且仓库侧 CI、CodeQL、App 与环境配置均已就绪后，一次性同步清除所有治理层面的豁免，可避免声明状态与平台规则不一致。分阶段解除或单独创建仓库级 ruleset 会延长无保护窗口并增加长期配置分叉，因此不推荐。

Files changed (5) +7 / -10

Other (5) +7 / -10

GOVERNANCE.yaml移除 BP-1 的 AI_Web_School 例外 +0/-1

移除 BP-1 的 AI_Web_School 例外

• 删除主分支保护措施中的仓库级例外，使 BP-1 的组织 ruleset 强制要求适用于 AI_Web_School。

governance/GOVERNANCE.yaml

REPOS.yaml将 AI_Web_School 登记为活动仓库 +4/-2

将 AI_Web_School 登记为活动仓库

• 将仓库状态从 exempt 改为 active，并补充产品定位、存量技术栈豁免范围及已接入的治理能力。

governance/REPOS.yaml

expected-state.json解除仓库基线豁免 +1/-3

解除仓库基线豁免

• 清空 repo_baseline.exclude_repos，使 AI_Web_School 接受 squash-only、合并后删分支等标准仓库设置。

governance/expected-state.json

codeql-gate.json将 AI_Web_School 纳入 CodeQL 门禁 +1/-1

将 AI_Web_School 纳入 CodeQL 门禁

• 从 CodeQL ruleset 的排除列表中移除 AI_Web_School，仅保留治理仓库自身的 .github 豁免。

governance/rulesets/codeql-gate.json

main-protection.json将主分支保护扩展至全部仓库 +1/-3

将主分支保护扩展至全部仓库

• 清空 repository_name 排除列表，使 AI_Web_School 的默认分支必须通过 PR、squash 和 gate 检查。

governance/rulesets/main-protection.json

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📜 Skill insights (0)

1. Release tags remain exempt ✓ Resolved 🐞 Bug ≡ Correctness

Description

Changing AI_Web_School to active while leaving it excluded from release-tags means its v* tags
can still be deleted or overwritten. Applying and drift-checking the governance configuration will
preserve this partial exemption rather than detect it.

Code

governance/REPOS.yaml[76]

+    status: active

Relevance

●●● Strong

PR explicitly removes all exemptions; leaving release-tags exclusion contradicts that intent.
Governance gaps are routinely fixed.

PR-#19
PR-#2

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The changed registry entry declares AI_Web_School active, and BP-3 defines release-tag protection as
enforced. However, the active release-tags ruleset still explicitly excludes this repository, and
apply.sh deploys every ruleset file, so the exemption remains effective.

governance/REPOS.yaml[73-79]
governance/GOVERNANCE.yaml[31-35]
governance/rulesets/release-tags.json[2-12]
governance/apply.sh[44-69]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
AI_Web_School is now declared active and removed from the baseline, main-protection, and CodeQL exclusions, but it remains excluded from the release-tags ruleset. Remove that exclusion so `v*` tags receive the enforced deletion, update, and non-fast-forward protections.

## Issue Context
`apply.sh` applies every ruleset definition, while drift-check treats each checked-in definition as desired state. The current release-tags exclusion will therefore be actively retained after onboarding.

## Fix Focus Areas
- governance/rulesets/release-tags.json[5-8]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

Context sources

✅ Compliance rules (platform): 7 rules

Review mode: ⚖️ Balanced: This changes active governance enforcement across several policy artifacts, so a full review is warranted despite the small diff.

Tip of the day

💡 Did you know, you can show, collapse, or hide each part of a finding: code, evidence, and all

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗