[Codename-11]

Summary

#706 updated ONNX Runtime without updating sherpa-onnx's native dependency. Both APK flavors then failed the packaged JNI compatibility check. Restore the compatible 1.27.0 runtime and prevent dependency updates from merging before the aggregate CI gate passes.

Changes

• Preserve the original author of the ONNX compatibility fix from fix(android): request include_compacted on session message loads #709, with a source-commit trailer.
• Require enforced target-branch protection for Required checks from GitHub Actions, including current-base validation, before enabling Dependabot auto-merge.
• Load the policy from the trusted target branch, limit eligibility to explicit patch/minor updates, pin the requested head SHA, and use merge commits.
• Run five gate-policy regressions in required CI and document the dependency/native compatibility contract.

Verification

• node --test .github/scripts/check-dependabot-merge.test.cjs: 5 passed, including absent protection, wrong check, stale-base allowance, and wrong check producer.
• node .github/scripts/classify-ci-paths.test.cjs: passed.
• git diff --check: passed.
• The active dev ruleset was read back and accepted by the same policy validator. It requires the GitHub Actions aggregate check with strict current-base validation and no bypass actors.
• Hosted required CI passed on 4ee237c56999873404ed6c0cdf47ac8fe64800a0: https://github.com/Codename-11/hermes-relay/actions/runs/38747586356. Both APK flavors passed native compatibility; Android lint/tests and the selected desktop, plugin, dashboard, docs, and contract checks passed. No phone installation or release.

Screenshots

No UI change.

Compatibility / risk

Restores the existing Sherpa ABI baseline. The merge workflow fails closed if protection is removed or changed to an insufficient gate. Major upgrades remain manual. No production deployment or migration.

Lineage / contributor credit

• ONNX fix from fix(android): request include_compacted on session message loads #709: commit 86b5a27eaa50822ff63aa8e8beb205905fcd4364, authored by ophirhan, cherry-picked with original authorship and source reference preserved.
• Only its ONNX compatibility change is included; fix(android): request include_compacted on session message loads #709's transcript-history change remains in that PR. The changelog conflict was resolved to retain only the applicable native compatibility entry.
• Prerequisite for fix(android): preserve quiet Gateway turns and recover completion #694.

Checklist

• Targets dev
• Focused scope and source attribution preserved
• Local policy regression tests passed
• Changelog and contributor documentation updated
• Public writing hygiene checked
• Hosted CI passes on the final head