Governance: enforce required status checks on main

[0xLeif]

main branch protection has required_status_checks: [] (no CI enforced) while requiring 1 review with enforce_admins: true. For a solo-maintainer repo with no second approver, this means every merge must use --admin (which bypasses the review), and a red audit/test can't block a merge — exactly how the wasmtime CVE sat red unnoticed. Recommend requiring test (*), lint, spec-check, audit as status checks (and/or adding a second reviewer/bot). Requires repo-admin action.

---

Filed from a skeptical staff-level review (Medium-severity tier). All Critical/High findings and the correctness/doc Medium findings were fixed in #432–442.

[0xGaspar]

Branch protection audit — ready-to-apply config

Read-only audit of main's protection against what CI actually reports. Two things in the original report have changed since filing, and there is one trap that would have wedged the repo. Details below.

---

1. Current state (gh api repos/CorvidLabs/fledge/branches/main/protection)

Setting	Value
required_status_checks.checks	["trust"] — no longer []
required_status_checks.strict	false (branches need not be up to date)
enforce_admins	true
required_approving_review_count	1
dismiss_stale_reviews	true
require_code_owner_reviews	true (CODEOWNERS: * @CorvidLabs/humans)
require_last_push_approval	false
bypass_pull_request_allowances.users	["0xLeif"]
required_linear_history	true
allow_force_pushes / allow_deletions / block_creations	false / false / false
required_conversation_resolution / lock_branch / allow_fork_syncing	false / false / false
restrictions	absent (no push restrictions)
required_signatures	false (separate endpoint — not touched by the PUT below)

No repository or org rulesets exist (/rulesets and /rules/branches/main both return []), so classic branch protection is the only thing in play.

So the premise has partly moved: trust is already enforced. The gap is that test/lint/audit/spec-check still are not.

---

2. Exact check names

Every check on this repo is a GitHub Actions check-run (app_id: 15368). There are zero legacy commit statuses (/commits/<sha>/status returns statuses: []), so all of them are configured the same way, via the checks array.

test (*) from the issue is shorthand and not a legal value — matrix jobs report one check per variant. Resolved literals:

Safe to require (report on every PR, currently green):

Literal context	Source	Notes
test (ubuntu-latest)	ci.yml → test	matrix os
test (macos-latest)	ci.yml → test	matrix os
test (windows-latest)	ci.yml → test	matrix os
lint	ci.yml → lint	fmt + clippy
audit	ci.yml → audit	the job
spec-check	ci.yml → spec-check	spec-sync strict + 100% coverage
trust	trust.yml → trust	already required
Integration (ubuntu-latest) / (macos-latest) / (windows-latest)	ci.yml → integration	name: override; needs: [test]

Do NOT require — each of these would block merges permanently or is worthless as a gate:

Name	Why not
Security audit	⚠️ The trap. Created by rustsec/audit-check via the Checks API, and it only fires on push events. It shows up in /commits/main/check-runs, so it looks like a natural thing to add — but it appears on 0 of the last 10 PRs (verified individually). Requiring it blocks every PR forever. Note the audit job does run on PRs and is the correct thing to require instead.
Record attestation	if: github.event_name == 'push' && github.ref == 'refs/heads/main' → reports skipped on every PR. Also explicitly best-effort (it warns instead of failing).
corvid-pet	needs: [...] with always(), and the script never exits non-zero — it is green even when the gates it summarizes are red. Requiring it would give false assurance.
Build Astro Site, Deploy to GitHub Pages	pages.yml is push-only and path-filtered. Never reports on a PR.
Analyze (actions), Analyze (javascript-typescript), CodeQL	CodeQL default setup, currently languages: [actions, javascript, javascript-typescript, typescript]. These do run and pass on PRs, but the per-language Analyze (*) names are derived from GitHub's auto-detected language list — if detection shifts (e.g. javascript-typescript splits, or site/ JS is removed) the required name silently stops reporting and wedges main. If you want CodeQL enforced, require the umbrella CodeQL context only, which is stable across language changes. Left out of the payload below by default.

---

3. Would this wedge the repo? — No.

Verified green across the board:

• main HEAD (/commits/main/check-runs): test (*) ×3, lint, audit, spec-check, trust, Integration (*) ×3 — all success.
• Last 4 merged PRs (fix: archive the five stranded accepted SDD records (unblocks spec-check) #506, refactor: name the two remaining --json schema literals (#444) #503, Fix: parse_source_ref rejecting refs containing a slash #501, Fix: bare fledge exits 0 with help; restore cursor on Ctrl+C #499): identical check-name set, all success.
• Both open PRs (feat: fledge spec lint — quality gate for the spec itself (#429) #505, test: mocking harness + $HOME isolation + publish coverage (#447) #504): all ten candidate contexts SUCCESS today, so neither gets stuck the moment you apply this.

spec-check was the historical blocker and is confirmed repaired by #506 ("archive the five stranded accepted SDD records"). trust — flagged for special attention — runs on pull_request (unfiltered) and push: [main], reports on both, and is green everywhere; it is already required and stays required.

One forward-looking caveat on audit: rustsec/audit-check fails when a new advisory is published against an existing dependency, with no code change on your side. Combined with enforce_admins: true, a fresh CVE can block all merges — including the PR that fixes it. That is arguably the intended behavior (it is precisely the wasmtime scenario this issue is about), but know the escape hatch: temporarily drop audit from the checks array, land the bump, then re-add. Prefer that over flipping enforce_admins off.

---

4. The solo-maintainer paradox — the premise is out of date

The repo is not single-approver anymore:

• @CorvidLabs/humans = 0xLeif, 0xGaspar, Kyntrin, tofu-ux (4 humans, all valid code owners)
• Collaborators: 0xLeif (admin), 0xGaspar (admin), corvid-agent (admin), Kyntrin (write), tofu-ux (write)

And it is working in practice — #506 and #503 both carry a genuine 0xLeif APPROVED review, not an admin bypass. There is no longer a structural need to weaken the review requirement.

Also worth correcting: with enforce_admins: true, gh pr merge --admin does not let anyone through the review gate. What actually permits merges today is bypass_pull_request_allowances.users: ["0xLeif"] — a scoped, auditable, one-person escape hatch that is already exactly the "documented escape hatch" option. Critically, that allowance exempts only the review requirement, not required status checks: once you apply the payload below, red CI blocks 0xLeif too.

Recommendation: keep required_approving_review_count: 1 and keep enforce_admins: true. Changing them is unnecessary now that the checks carry the weight. Rejected alternatives:

• Drop to 0 required reviews — unnecessary; there are 4 code owners, and it would discard the human gate for no gain.
• Allow a bot/Actions approval to count — actively dangerous here. corvid-pet runs with review-on-pr: "true" and the github-actions bot already posts APPROVED on PRs. Today that approval is harmless because require_code_owner_reviews: true + CODEOWNERS = * @CorvidLabs/humans means a non-human approval cannot satisfy the gate. Do not turn off require_code_owner_reviews — the moment you do, the bot auto-approves every PR and the review requirement becomes vacuous. This is the load-bearing reason the current config is safe.

Two optional hardening nudges, independent of this issue: require_last_push_approval: true (stops a self-approved PR from being amended post-approval) and required_conversation_resolution: true. Both are left at their current false in the payload below — flagging, not changing.

---

5. The command

PUT .../protection replaces the whole object — every omitted field is reset to its default, so this payload is reconstructed field-for-field from the current state above. Diffed against live state, the only change is the checks array (["trust"] → 7 contexts). required_signatures lives on a different endpoint and is unaffected.

cat > /tmp/fledge-protection.json <<'JSON'
{
  "required_status_checks": {
    "strict": false,
    "checks": [
      { "context": "test (ubuntu-latest)",  "app_id": 15368 },
      { "context": "test (macos-latest)",   "app_id": 15368 },
      { "context": "test (windows-latest)", "app_id": 15368 },
      { "context": "lint",                  "app_id": 15368 },
      { "context": "spec-check",            "app_id": 15368 },
      { "context": "audit",                 "app_id": 15368 },
      { "context": "trust",                 "app_id": 15368 }
    ]
  },
  "enforce_admins": true,
  "required_pull_request_reviews": {
    "dismiss_stale_reviews": true,
    "require_code_owner_reviews": true,
    "require_last_push_approval": false,
    "required_approving_review_count": 1,
    "bypass_pull_request_allowances": {
      "users": ["0xLeif"],
      "teams": [],
      "apps": []
    }
  },
  "restrictions": null,
  "required_linear_history": true,
  "allow_force_pushes": false,
  "allow_deletions": false,
  "block_creations": false,
  "required_conversation_resolution": false,
  "lock_branch": false,
  "allow_fork_syncing": false
}
JSON

# Back up current state first (so a bad apply is one command to undo)
gh api repos/CorvidLabs/fledge/branches/main/protection > /tmp/fledge-protection.backup.json

gh api --method PUT repos/CorvidLabs/fledge/branches/main/protection \
  --input /tmp/fledge-protection.json

Verify:

gh api repos/CorvidLabs/fledge/branches/main/protection \
  --jq '{checks:[.required_status_checks.checks[].context], strict:.required_status_checks.strict,
         admins:.enforce_admins.enabled, reviews:.required_pull_request_reviews.required_approving_review_count,
         codeowners:.required_pull_request_reviews.require_code_owner_reviews,
         bypass:[.required_pull_request_reviews.bypass_pull_request_allowances.users[].login],
         linear:.required_linear_history.enabled}'

Optional — also require the integration suite. Solid and green, but needs: [test] and a 3-OS release build, so it roughly doubles time-to-merge. Add to checks if you want it:

{ "context": "Integration (ubuntu-latest)",  "app_id": 15368 },
{ "context": "Integration (macos-latest)",   "app_id": 15368 },
{ "context": "Integration (windows-latest)", "app_id": 15368 }

On strict: leaving it false is deliberate. Setting strict: true (require branch up to date before merging) forces a rebase + full re-run on every PR whenever another lands first — painful with a 3-OS matrix and little value given required_linear_history: true is already on.

One repo-side follow-up: the "no paths: filter" comment at the top of ci.yml already documents exactly this hazard for test/lint/audit/spec-check. Once this is applied, that comment becomes load-bearing — worth extending it to trust.yml, which is likewise unfiltered and now permanently required.

_{Read-only audit; no settings were modified.}