governance: human merge is the review record — retire the per-PR ADR approval check, add the report-only governed-merges audit

[os-zhuang]

Fixes#9495

Merge posture — DRAFT, human merge only, by construction

This PR's own diff touches the governed surface it defines (AGENTS.md, .claude/skills/**, .github/** enforcement chain), so per the ruling it implements: no AI seat flips it ready, enqueues it, or arms auto-merge. Its own human merge is the first exercise of the new rule (required outcome 4).

What this implements (maintainer ruling 2026-08-18, 「同意。」 on the card; scope extension 「同意」 recorded in the card's comments)

1. The per-PR check retires..github/workflows/adr-merge-approval.yml and scripts/check-adr-merge-approval.mjs are deleted; the check:adr-merge-approval package script goes with them. No check named ADR maintainer approval runs on PRs any more.
2. A report-only audit path exists. New scripts/pm/check-governed-merges.mjs (the check-half-states report-only precedent): enumerates PRs merged into main since a date/ref whose diff touched a governed surface, with merge attribution, for the PM round report. Enumeration and diff paths are pure local git over origin/main — zero API calls on a clean window; the API is consulted only for attribution (one PR read per governed entry). Exit contract: 0 = sweep complete (entries or none); 1 = cannot sweep; 2 = swept but attribution unresolved (missing token / HTTP failure) — printed loud, never silently clean. Its --self-test is wired into lint.yml beside the half-states step (an uninvoked self-test is the check:react-declaration-parity 是唯一没接进任何 workflow 的源码审计门禁,且无 MANIFEST 时静默 skip 退出 0 —— 它现在永远不可能红 #4690 phantom shape) and check:pm-governed-merges in package.json runs it.
3. Skill text hardened; AGENTS.md synced. SKILL.md's ACCEPT fork now carries the unified governed surface — docs/adr/** + .claude/** in full + skills/** + root AGENTS.md + root CLAUDE.md — states that a human merge IS the review record, that seat discipline (never flip ready / enqueue / arm auto-merge on a governed PR) is the sole pre-merge line of defense, and that round reports carry the audit list. The Guardrails ADR + Skills bullets merge into one governed-surface bullet keeping all three ruling quotes verbatim (2026-08-08, 2026-08-11, 2026-08-18). AGENTS.md Prime Directive feat: Comprehensive CRM example demonstrating all ObjectStack protocol features #14's stale sentence — "a required check that stays red unless the maintainer's own account has approved" — is replaced by the new regime (grep-derived; CLAUDE.md has no reference, verified by the same grep).
4. Draft PR, human merge — this PR.

The #6865 two-step, honored

The required-context registry (scripts/check-required-contexts.mjs) drops its ADR maintainer approval row plus the self-test fixtures that read the retired workflow. This is the registry-follows half; the Settings half is the maintainer attestation recorded on the card (comment 5324507114): the maintainer's own 2026-08-18 reading of the required set lists exactly six contexts, this one not among them, confirmed empirically the same day by a PR that merged through the queue while carrying this check at conclusion: failure with zero approving reviews. A tombstone note in the registry header records the removal so nobody re-enrolls it from git archaeology. The types:-guard fixtures (assertion 7b, #8304) are retargeted from the deleted workflow onto ci.yml so that guard keeps red-direction coverage.

Same-day churn absorbed by the merge round (commits 2–3)

origin/main moved while this PR was open; the merge commit resolves it under the ruling:

• feat(governance): govern the published skills/ catalog under the ADR maintainer approval gate #9511 (from card finding: the published skills/ catalog is human-merge by convention but is not gated — two of the pm-dispatch fork's three prefixes are enforced #9404) widened the retiring gate's predicate to the published skills/ catalog — a pre-retirement-regime card landing after the retirement ruling. The modify/delete conflict resolves as deletion; the widening's semantic content is not lost: skills/** is already governed in the audit's GOVERNED_SURFACES under the 2026-08-18 unified definition.
• ci(lint): scan instruction surfaces for stale required-context names, budgeted for in-flight renames #9504 added the instruction-surface stale-name scan to check-required-contexts.mjs. Its append-only RETIRED_CONTEXT_NAMES ledger contract requires the PR that removes a registry row to ledger the name — so this PR adds the ADR maintainer approval retirement row (replacedBy: null, no budgets: no instruction surface named it when the row was written; the row is the standing ban on writing the dead name fresh). Merged self-test: 81 assertions green.
• Half-commit incident, stated and repaired: the ledger row was edited into the working tree while the merge's index already held the auto-merged file, so the merge commit took the index without it (the MM shape AGENTS.md warns about) — caught by the worktree-removal guard refusing an unclean tree at close-out, and landed as its own third commit (bb4d0b4ed, +13 lines, the row alone). The gates always read the working tree, which carried the row throughout; the union below is re-attributed to the head that actually contains it.

Institutional memory preserved (required outcome 1's preservation clause)

The retired gate's incident history — the 2026-08-08 double violation within an hour of the ruling, the #8161 identity-proxy unsatisfiability, the #8012 arming incident, the #9238 queue landing with zero reviews — moves into the audit script's header as case law, and its measured violations become executable replay fixtures in the audit's --self-test. CODEOWNERS keeps routing docs/adr/, itself, and now the audit script to the maintainer; its header explains the regime change.

Boundary decisions, stated

• The audit's two exact-file entries match the repo-ROOT AGENTS.md/CLAUDE.md only — not examples/AGENTS.md, not the create-objectstack template copy (product content). Near misses are pinned in the self-test. Widening to those, or to objectui/cloud, is the separately-filed cross-repo work the card excludes.
• merged_by attribution was measured, not assumed (the dispatch's mechanism assumption): both observed flows attribute to the human account (a queue-flow landing and a direct merge both read merged_by: hotlong, 2026-08-18). The header instructs: if a bot login ever appears, report it verbatim and extend to the enqueue timeline actor — never remap silently.
• PD feat: Comprehensive CRM example demonstrating all ObjectStack protocol features #14's path-list widening beyond the synced sentence stays with its open cards (AGENTS.md Prime Directive #14 names only docs/adr/**, but the gate it describes now also holds .claude/skills/** #9403 / PR docs(agents): Prime Directive #14 governs three surfaces, and names the register that holds them #9527 — merge-order reconciliation stated on the card, comment 5324955341); the CODEOWNERS skill-surface routing gap stays with finding: CODEOWNERS routes docs/adr/ and the gate's enforcement chain, but neither governed skill surface #9513.

SKILL.md ratchet: 682/682, net zero

Additions (ACCEPT-fork surface + sole-defense clause, merged Guardrails bullet, round-report audit line, guards-index row) are paid by cuts whose content survives verbatim elsewhere, each cut site left pointing at the surviving copy:

cut (SKILL.md)	survives in
CI-convergence bullet detail (release criteria, patch-round, wait-for-CI escape)	references/review-checklist.md CI-convergence bullet (verbatim, with provenance)
os-regen four-step traps, assertion wording, anchor prohibitions	references/landing-operations.md section A (verbatim)
first-enqueue flip-point mechanics (6–9 min, webhook unreliability)	references/landing-operations.md section B (verbatim)
duplicated CONTRACT_REVIEW_TIER single-source restatement in the ACCEPT fork	the clause-② gate bullet (the single source, unchanged)

Gates — union re-run at the final head bb4d0b4ed (git rev-parse --short HEAD from that run; earlier runs at 9b75229ad and at the tree state now committed as bb4d0b4ed were identical)

All exit 0: check:pm-skill-ratchet (682/682, headroom 0) · check:pm-skill-id-lint · check:doc-authoring · check:skill-frame-sync · check:doc-formula-expressions (after building the lint closure) · check:nul-bytes · check:required-contexts (+81-assertion merged self-test; 8 names pinned) · check:pm-governed-merges (25 assertions) · check:partof-closing-keyword · check:pm-dispatch-gates (273 cases) · check:node-version · check:shard-attestation · check:workflow-status-functions · check:pm-half-states (140 cases) · check:type-check-coverage · docs-audit wrapper self-test (220 cases). Families were re-derived from the actual diff (node scripts/pm/dispatch-gates.mjs, no-args self-derived change set), not recalled.

One honest non-reading: check:type-check-debt --re-measure refuses to run in this worktree by design (52 workspace deps have no built dist; its own error text mandates the full closure build lint.yml performs before it). The diff touches no TypeScript source, so the reading cannot move; CI runs it with the closure built.

The retired gate's self-test retires with the gate — nothing invokes it any more (grep-verified: the only remaining mentions of the retired names are the audit header's history section and the registry's tombstone + ledger row).

Live sweep exercised end-to-end in this container: a 24h window enumerated 11 governed merges from local git with 11 attribution lookups, and correctly classified the container's missing token as attribution-incomplete (exit 2) rather than a clean sweep.

.claude/ + .github/ + scripts + instruction files only — publishes nothing; skip-changeset label applied on this PR (read-modify-write, read back beside the bot labels).

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

Nothing in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 0 changed package(s)), so this run has no opinion about the docs.