From 64944aeda07fe640b5819809d3560b61bdc646e3 Mon Sep 17 00:00:00 2001 From: Keith Jackson Date: Tue, 29 Sep 2026 19:17:21 -0500 Subject: [PATCH] docs(decisions-log): PR #19's CI has no approval-policy check -- measured, not assumed MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The brief for the trigger-credential work said PR #19 would FAIL `approval-policy` because infra/gitea/** is security-relevant. Measured on the head commit's /statuses: `gate / gate (pull_request)` succeeded in 1m34s and the conformance context is the usual blocked placeholder. .gitea/workflows/ holds only gate.yml and the dormant merge-gate.yaml -- there is no path-scoped approval policy at all. So the "security-relevant paths need a human" rule is carried entirely by required_approvals: 1 plus a reviewer reading the diff, not by a check. Recorded because this is the same shape as every other §2b finding: a control believed to exist because prose said it did. Co-Authored-By: Claude Opus 5 (1M context) --- DECISIONS-LOG.md | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/DECISIONS-LOG.md b/DECISIONS-LOG.md index 3a8ee81..8e2a793 100644 --- a/DECISIONS-LOG.md +++ b/DECISIONS-LOG.md @@ -5190,3 +5190,20 @@ repo not checked out — the documented tolerated skip) and `gitea-settings` (`S is a credential this agent does not hold). Both are the expected local result and `gate.yml` tolerates exit 3; neither was "fixed". Run with `DEV_KUBECONFIG=/dev/null` and an `ENGINE` shim bind-mounting the main checkout's `.git` read-only, per `CLAUDE.md` §3. + +### Measured on PR #19, and it contradicts the brief: there is NO `approval-policy` check + +The brief for this work stated this PR's CI would FAIL `approval-policy` because `infra/gitea/**` +is security-relevant. Measured on the PR head commit's `/statuses`: + + gate / gate (pull_request) success Successful in 1m34s + gate / conformance (pull_request) pending Blocked by required conditions + +`.gitea/workflows/` on `main` contains only `gate.yml` and the dormant `merge-gate.yaml`. **No +path-scoped approval policy exists**, so nothing machine-enforces "security-relevant paths need a +human"; that rule rests entirely on `required_approvals: 1` plus a reviewer actually reading the +diff. Another instance of the §2b failure mode — a control believed to exist because a brief said +so. If the policy is intended, it is missing and needs its own change. + +And per this repo's own rule: the green `gate` tick is **not** evidence this script works. The +gate never executes `infra/gitea/**`, and the L2/L3 stage skipped. The script remains UNEXECUTED.