docs(governance): record protected PR workflow evidence

.github/CODEOWNERS

@@ -6,43 +6,43 @@
 # submissions.
 
 # Repository default owner.
-* @igor04091968
+* @igor04091968 @rachkovii68-bisness
 
 # Rust workspace and crates.
-/adk-rust/ @igor04091968
-**/Cargo.toml @igor04091968
-**/Cargo.lock @igor04091968
-**/*.rs @igor04091968
+/adk-rust/ @igor04091968 @rachkovii68-bisness
+**/Cargo.toml @igor04091968 @rachkovii68-bisness
+**/Cargo.lock @igor04091968 @rachkovii68-bisness
+**/*.rs @igor04091968 @rachkovii68-bisness
 
 # Operational scripts and automation.
-/scripts/ @igor04091968
+/scripts/ @igor04091968 @rachkovii68-bisness
 
 # Product documentation, demo material and screenshots.
-/docs/ @igor04091968
-/docs/demo/ @igor04091968
-/docs/screenshots/ @igor04091968
-/docs/assets/screenshots/ @igor04091968
+/docs/ @igor04091968 @rachkovii68-bisness
+/docs/demo/ @igor04091968 @rachkovii68-bisness
+/docs/screenshots/ @igor04091968 @rachkovii68-bisness
+/docs/assets/screenshots/ @igor04091968 @rachkovii68-bisness
 
 # Registry-readiness evidence and policy documents.
-/docs/registry/ @igor04091968
+/docs/registry/ @igor04091968 @rachkovii68-bisness
 
 # GitHub public mirror validation metadata and governance controls.
-/.github/workflows/ @igor04091968
-/.github/workflows/ci.yml @igor04091968
-/.github/workflows/security.yml @igor04091968
-/.github/workflows/coverage.yml @igor04091968
-/.github/pull_request_template.md @igor04091968
-/.github/ISSUE_TEMPLATE/ @igor04091968
-/.github/CODEOWNERS @igor04091968
-/docs/BRANCH_PROTECTION_POLICY_RU.md @igor04091968
-/docs/BRANCH_PROTECTION_EVIDENCE_RU.md @igor04091968
-/docs/PR_REVIEW_WORKFLOW_RU.md @igor04091968
-/docs/PR_REVIEW_EVIDENCE_RU.md @igor04091968
+/.github/workflows/ @igor04091968 @rachkovii68-bisness
+/.github/workflows/ci.yml @igor04091968 @rachkovii68-bisness
+/.github/workflows/security.yml @igor04091968 @rachkovii68-bisness
+/.github/workflows/coverage.yml @igor04091968 @rachkovii68-bisness
+/.github/pull_request_template.md @igor04091968 @rachkovii68-bisness
+/.github/ISSUE_TEMPLATE/ @igor04091968 @rachkovii68-bisness
+/.github/CODEOWNERS @igor04091968 @rachkovii68-bisness
+/docs/BRANCH_PROTECTION_POLICY_RU.md @igor04091968 @rachkovii68-bisness
+/docs/BRANCH_PROTECTION_EVIDENCE_RU.md @igor04091968 @rachkovii68-bisness
+/docs/PR_REVIEW_WORKFLOW_RU.md @igor04091968 @rachkovii68-bisness
+/docs/PR_REVIEW_EVIDENCE_RU.md @igor04091968 @rachkovii68-bisness
 
 # Ansible deployment automation.
-/ansible/ @igor04091968
+/ansible/ @igor04091968 @rachkovii68-bisness
 
 # Security and contribution governance.
-/SECURITY.md @igor04091968
-/CONTRIBUTING.md @igor04091968
-/deny.toml @igor04091968
+/SECURITY.md @igor04091968 @rachkovii68-bisness
+/CONTRIBUTING.md @igor04091968 @rachkovii68-bisness
+/deny.toml @igor04091968 @rachkovii68-bisness

docs/BRANCH_PROTECTION_EVIDENCE_RU.md

@@ -1,87 +1,107 @@
 # AWatch-rus: branch protection evidence
 
-Дата: 2026-06-23
+Дата: 2026-06-24
 
-branch_protection_status: "pending_manual_verification"
+branch_protection_status: "verified_active_ruleset"
 
 GitHub issue: https://github.com/igor04091968/AWatch-rus/issues/49
 
-Этот документ является evidence template для ручной проверки GitHub branch
-protection на публичном зеркале. Он не утверждает, что branch protection уже
-настроена или подтверждена.
+Этот документ фиксирует maintainer-verified GitHub ruleset / branch protection
+evidence для публичного зеркала. Подтверждение относится только к GitHub public
+mirror governance.
 
 ## Target
 
 - Repository: `igor04091968/AWatch-rus`.
 - Platform role: GitHub public mirror validation only.
 - Protected branch: `main`.
+- Ruleset name: `main`.
+- Enforcement: `active`.
 - Policy source: `docs/BRANCH_PROTECTION_POLICY_RU.md`.
 - Evidence owner: maintainer.
 
-## Settings To Verify
+## Verified Settings
 
-Maintainer должен вручную проверить, что для `main` configured rule включает:
+Maintainer manually verified the following GitHub UI state:
 
-- require pull request before merging;
-- require approvals: `1`;
-- dismiss stale approvals when new commits are pushed;
-- require review from CODEOWNERS, if available on the current GitHub plan;
-- require status checks to pass before merging;
-- require branches to be up to date before merging, if compatible with current
-  maintainer workflow;
-- restrict force pushes;
-- restrict deletions;
-- administrator bypass decision documented, preferably disabled for stricter
-  mode.
+- verification date: `2026-06-24`;
+- maintainer: `maintainer`;
+- repository: `github.com/igor04091968/AWatch-rus`;
+- ruleset name: `main`;
+- enforcement: `active`;
+- target branch: `main`;
+- applies_to_targets: `1`;
+- bypass_list: `empty`;
+- required pull request: `enabled`;
+- required approvals: `1`;
+- dismiss stale pull request approvals when new commits are pushed: `enabled`;
+- require review from Code Owners: `enabled`;
+- block force pushes: `enabled`.
 
-## Required Checks
+## Verified Required Status Checks
 
-Expected required checks are based on current workflow/job names:
+GitHub ruleset required status checks verified in the UI:
 
-- `CI / Rust checks`
-- `CI / Docs and registry checks`
-- `CI / Smoke checks`
-- `Coverage / Coverage baseline`
-- `Security / Cargo audit`
-- `Security / Cargo deny`
-- `Security / Secret pattern check`
-- `Security / Dependency review`
+- `Coverage baseline`
+- `security`
+- `rust-checks`
+- `docs-registry-checks`
+- `smoke-checks`
 
-If GitHub displays a different context name, record the exact displayed name and
-update `docs/BRANCH_PROTECTION_POLICY_RU.md` before marking verification done.
-
-## Manual Verification Procedure
-
-1. Open repository settings for `igor04091968/AWatch-rus`.
-2. Open branch protection or repository rules for branch `main`.
-3. Compare enabled settings against this document and
-   `docs/BRANCH_PROTECTION_POLICY_RU.md`.
-4. Verify required status-check names exactly as GitHub displays them.
-5. Capture screenshot evidence without private account data or tokens.
-6. Record evidence fields below.
-7. Only after verification, update `branch_protection_status` from
-   `"pending_manual_verification"` to `"verified"` in a follow-up change.
+These names are the ruleset-visible required check names from GitHub UI. They
+may differ from the human-readable workflow job names shown inside workflow
+files.
 
 ## Evidence Record
 
 - Screenshot filename placeholder:
-  `docs/evidence/github-branch-protection-main-YYYY-MM-DD.png`
-- Date: `YYYY-MM-DD`
+  `docs/evidence/github-ruleset-main-2026-06-24.png`
+- Date: `2026-06-24`
 - Maintainer: `maintainer`
-- Repository: `igor04091968/AWatch-rus`
+- Repository: `github.com/igor04091968/AWatch-rus`
+- Ruleset: `main`
 - Protected branch: `main`
-- Required checks verified: `pending`
-- Admin bypass decision: `pending`
-- Force-push restriction verified: `pending`
-- Deletion restriction verified: `pending`
-- Notes: `pending`
+- Enforcement: `active`
+- Applies to targets: `1`
+- Bypass list: `empty`
+- Required checks verified: `Coverage baseline`, `security`, `rust-checks`,
+  `docs-registry-checks`, `smoke-checks`
+- Force-push restriction verified: `enabled`
+- Notes: GitHub UI confirms active ruleset for target branch `main`.
+
+## First Protected PR Validation
+
+- PR URL: `https://github.com/igor04091968/AWatch-rus/pull/50`
+- Linked governance issue: `https://github.com/igor04091968/AWatch-rus/issues/49`
+- PR source branch: `docs/verified-github-ruleset-evidence`
+- PR target branch: `main`
+- Runtime/API/UI/product code changes: `none`
+- Required checks status: `passed`
+- Required checks: `Coverage baseline`, `security`, `rust-checks`,
+  `docs-registry-checks`, `smoke-checks`
+- Review requirement status: `pending_review_required`
+- Merge status: `open`
+- Admin bypass used: `false`
+- Outcome note: PR #50 confirms required checks execute under the active ruleset;
+  review/merge evidence is not yet complete.
+
+## Future Reverification Procedure
+
+1. Open repository settings for `igor04091968/AWatch-rus`.
+2. Open repository rules/rulesets for `main`.
+3. Confirm enforcement remains `active`.
+4. Confirm target branch remains `main`.
+5. Confirm bypass list remains empty.
+6. Confirm required PR, approvals, stale dismissal, Code Owners review, status
+   checks and force-push block.
+7. Capture screenshot evidence without private account data or tokens.
 
 ## Not Registry Release Evidence
 
-GitHub branch protection evidence is governance/process evidence for the public
-mirror. It is not registry release evidence and does not replace release
-artifacts, checksums, build logs or release evidence from the Russian
-build-runner.
+GitHub ruleset / branch protection evidence is public governance evidence only.
+It is not Russian registry release evidence and does not replace Russian
+Gitea/build-runner release contour, release artifacts, checksums, build logs or
+release evidence from the Russian build-runner.
 
 ## Russian Contour Note
 
@@ -92,7 +112,6 @@ Russian build-runner. GitHub remains public mirror validation only.
 
 - Do not record secrets, tokens, private URLs or account recovery details.
 - Do not include private employee/customer data in screenshots.
-- Do not claim branch protection is verified until maintainer evidence exists.
 - Do not claim completed registry submission.
 - Do not claim certification.
 - Do not claim SIEM/DLP replacement.

docs/BRANCH_PROTECTION_POLICY_RU.md

@@ -2,9 +2,8 @@
 
 Дата: 2026-06-23
 
-Статус: recommended policy. Этот документ описывает целевую настройку GitHub
-branch protection для публичного зеркала. Он не утверждает, что branch
-protection уже включен.
+Статус: recommended policy plus verified GitHub ruleset evidence. GitHub UI
+verification is recorded in `docs/BRANCH_PROTECTION_EVIDENCE_RU.md`.
 
 GitHub остается public mirror validation surface. Primary registry-readiness
 contour остается Russian Gitea plus Russian build-runner release evidence.
@@ -12,6 +11,7 @@ contour остается Russian Gitea plus Russian build-runner release evidenc
 ## Scope
 
 - Branch: `main`.
+- Ruleset: `main`.
 - Platform: GitHub public mirror.
 - Purpose: visible review discipline, status-check discipline and public
   engineering maturity signal.
@@ -36,10 +36,15 @@ contour остается Russian Gitea plus Russian build-runner release evidenc
 
 Recommended settings for `main` on the GitHub public mirror:
 
+- Ruleset name: `main`.
+- Enforcement: `active`.
+- Target branches: `main`.
+- Applies to: `1` target, `main`.
+- Bypass list: empty.
 - Require pull request before merging.
 - Required approvals: `1`.
 - Dismiss stale approvals when new commits are pushed.
-- Require review from CODEOWNERS if available on the current GitHub plan.
+- Require review from Code Owners.
 - Require status checks to pass before merging.
 - Require branches to be up to date before merging if this does not block the
   current maintainer workflow.
@@ -48,24 +53,24 @@ Recommended settings for `main` on the GitHub public mirror:
 - Allow administrators bypass: documented decision only; stricter mode should
   keep bypass disabled unless repository recovery requires it.
 
-Recommended required checks, using current workflow/job names:
+Verified ruleset required status checks from GitHub UI:
 
-- `CI / Rust checks`
-- `CI / Docs and registry checks`
-- `CI / Smoke checks`
-- `Coverage / Coverage baseline`
-- `Security / Cargo audit`
-- `Security / Cargo deny`
-- `Security / Secret pattern check`
-- `Security / Dependency review`
+- `Coverage baseline`
+- `security`
+- `rust-checks`
+- `docs-registry-checks`
+- `smoke-checks`
 
-Before verification, maintainer must compare these names with the exact check
-names displayed by GitHub. If GitHub displays different names, update this
-document and `docs/BRANCH_PROTECTION_EVIDENCE_RU.md` before recording evidence.
+Workflow/job-name mapping for operator review:
 
-Current evidence status is tracked in
-`docs/BRANCH_PROTECTION_EVIDENCE_RU.md` and remains
-`pending_manual_verification` until maintainer evidence is recorded.
+- `Coverage baseline`: Coverage workflow baseline job.
+- `rust-checks`: CI Rust checks job.
+- `docs-registry-checks`: CI docs and registry checks job.
+- `smoke-checks`: CI smoke checks job.
+- `security`: security validation context shown by GitHub rulesets UI.
+
+Current evidence status is `verified_active_ruleset` in
+`docs/BRANCH_PROTECTION_EVIDENCE_RU.md`.
 
 ## Review expectations
 

docs/PROJECT_STATUS_RU.md

@@ -53,8 +53,12 @@ backup, registry-readiness документации, плана российск
   (`docs/PR_REVIEW_EVIDENCE_RU.md`).
 - Branch protection evidence package: ready
   (`docs/BRANCH_PROTECTION_EVIDENCE_RU.md`).
-- Branch protection actual enablement:
-  `pending_manual_verification`.
+- Branch protection ruleset: `verified_active_ruleset`.
+- Branch protection target branch: `main`.
+- Branch protection required checks: `Coverage baseline`, `security`,
+  `rust-checks`, `docs-registry-checks`, `smoke-checks`.
+- First protected PR workflow: PR #50 opened; required checks passed;
+  review/merge still `pending_review_required`.
 - First reviewed PR evidence: pending.
 
 ## Что готово
@@ -92,10 +96,17 @@ backup, registry-readiness документации, плана российск
   `docs/BRANCH_PROTECTION_POLICY_RU.md`.
 - Branch protection evidence template prepared:
   `docs/BRANCH_PROTECTION_EVIDENCE_RU.md`.
+- GitHub ruleset / branch protection for `main` verified active by maintainer:
+  ruleset `main`, target branch `main`, empty bypass list, required PR with
+  one approval, stale approval dismissal, Code Owners review, required status
+  checks and force-push blocking.
 - PR-based review workflow documented:
   `docs/PR_REVIEW_WORKFLOW_RU.md`.
 - PR review evidence template prepared:
   `docs/PR_REVIEW_EVIDENCE_RU.md`.
+- First protected PR workflow evidence recorded for PR #50:
+  required checks passed; review requirement is still pending; merge status is
+  open; no admin bypass recorded.
 - Зафиксирован residual risk register:
   `docs/RESIDUAL_RISKS_RU.md`.
 - Подготовлен план публичных issues для ручного заведения:
@@ -117,11 +128,9 @@ backup, registry-readiness документации, плана российск
 - Финальная юридическая проверка пакета документов перед подачей.
 - Проверка совместимости с российскими ОС.
 - Visible external code review is still pending.
-- Branch protection enablement is not claimed until repository settings are
-  verified.
-- Branch protection actual enablement remains `pending_manual_verification`.
 - First reviewed PR evidence remains pending until a reviewed public PR is
   merged and evidence is recorded.
+- External peer review remains pending.
 - Community adoption remains low until external contributors, public reviews
   and sustained third-party activity appear.
 

docs/PR_REVIEW_EVIDENCE_RU.md

@@ -1,13 +1,14 @@
 # AWatch-rus: PR review evidence
 
-Дата: 2026-06-23
+Дата: 2026-06-24
 
-pr_review_evidence_status: "pending_until_first_reviewed_pr_is_merged"
+pr_review_status: "pending_review_required"
 
 GitHub issue: https://github.com/igor04091968/AWatch-rus/issues/48
 
-Этот документ фиксирует, что будет считаться evidence для PR-based review
-workflow. Он не утверждает, что external peer review уже выполнен.
+Этот документ фиксирует evidence первого protected PR-based workflow после
+включения GitHub ruleset на `main`. Он не утверждает, что review requirement
+уже выполнен или что external peer review завершен.
 
 ## Evidence Criteria
 
@@ -23,16 +24,23 @@ workflow. Он не утверждает, что external peer review уже в
 
 ## Evidence Record
 
-- PR URL: `pending`
-- Linked issue URL: `pending`
+- PR URL: `https://github.com/igor04091968/AWatch-rus/pull/50`
+- Linked issue URL: `https://github.com/igor04091968/AWatch-rus/issues/48`
+- Evidence issue URL: `https://github.com/igor04091968/AWatch-rus/issues/49`
+- Required checks status: `passed`
+- Required checks: `Coverage baseline`, `security`, `rust-checks`,
+  `docs-registry-checks`, `smoke-checks`
+- Review requirement status: `pending_review_required`
+- Merge status: `open`
+- Admin bypass used: `false`
 - Reviewer: `pending`
 - Reviewer type: `pending`
 - Approval URL or screenshot filename: `pending`
-- Passed checks: `pending`
 - Merge commit: `pending`
-- Bypass used: `pending`
-- Date: `YYYY-MM-DD`
-- Maintainer note: `pending`
+- Date: `2026-06-24`
+- Maintainer note: PR #50 demonstrates protected branch workflow and required
+  checks execution, but first reviewed PR evidence remains pending until review
+  requirement is satisfied and the PR is merged without bypass.
 
 ## Reviewer Interpretation
 
@@ -46,6 +54,8 @@ the review is visible.
 - PR workflow documentation: ready.
 - PR template: ready.
 - CODEOWNERS routing: ready.
+- First protected PR validation reference: PR #50.
+- Required checks for PR #50: passed.
 - First reviewed PR evidence: pending.
 - External peer review completed: not claimed.
 

docs/RESIDUAL_RISKS_RU.md

@@ -50,26 +50,31 @@ visibility, release evidence contour and legal package. Они требуют д
 
 ## 2. Нет внешнего visible peer review / публично видимого peer review
 
-- Текущий статус: риск открыт; PR template, CODEOWNERS, public governance
-  issues and PR workflow docs exist, but first reviewed PR evidence and branch
-  protection verification are still pending.
+- Текущий статус: риск открыт частично; PR template, CODEOWNERS, public
+  governance issues, PR workflow docs and verified active GitHub ruleset for
+  `main` exist. PR #50 has run through protected checks, but first reviewed PR
+  evidence is still pending because review/merge is not complete.
 - Влияние: внешним аудиторам сложнее оценить review discipline and change
   control maturity.
 - Почему не блокирует pilot/readiness stage: current changes are protected by
   reproducible checks, public workflows and documented conservative positioning.
 - Как риск будет снижаться: review checklist, CODEOWNERS routing, public issue
-  #48, `docs/PR_REVIEW_WORKFLOW_RU.md`, first public reviewed PR evidence,
-  explicit release branch review policy and verified branch protection evidence.
+  #48, `docs/PR_REVIEW_WORKFLOW_RU.md`, first public reviewed PR evidence and
+  explicit release branch review policy.
 - Уже снижающие evidence/documents/CI: `.github/pull_request_template.md`,
   `.github/CODEOWNERS`, `.github/ISSUE_TEMPLATE/`,
   `docs/REVIEW_CHECKLIST_RU.md`, `docs/BRANCH_PROTECTION_POLICY_RU.md`,
   `docs/BRANCH_PROTECTION_EVIDENCE_RU.md`,
   `docs/PR_REVIEW_WORKFLOW_RU.md`, `docs/PR_REVIEW_EVIDENCE_RU.md`,
   `CONTRIBUTING.md`, `SECURITY.md`, public CI, public security workflow.
-- Residual risk: remains open until branch protection is verified and first
-  reviewed PR evidence exists.
-- Следующий action: выполнить maintainer verification for branch protection and
-  record first reviewed PR evidence without overstating external peer review.
+- Branch protection pending risk: mitigated by verified active GitHub ruleset
+  for `main` with empty bypass list, required PR review, Code Owners review,
+  required status checks and force-push blocking.
+- PR workflow risk: remains open until PR #50 or a later PR is reviewed and
+  merged without bypass.
+- Residual risk: remains open until first reviewed PR evidence exists.
+- Следующий action: record first reviewed PR evidence without overstating
+  external peer review.
 
 ## 3. Низкая публичная активность issue tracker
 
@@ -185,12 +190,11 @@ visibility, release evidence contour and legal package. Они требуют д
 - PR review checklist exists in `docs/REVIEW_CHECKLIST_RU.md`.
 - Advisory branch protection policy exists in
   `docs/BRANCH_PROTECTION_POLICY_RU.md`.
-- Branch protection evidence template exists in
-  `docs/BRANCH_PROTECTION_EVIDENCE_RU.md` with
-  `pending_manual_verification` status.
+- Branch protection evidence exists in `docs/BRANCH_PROTECTION_EVIDENCE_RU.md`
+  with `verified_active_ruleset` status.
 - PR-based workflow documentation exists in `docs/PR_REVIEW_WORKFLOW_RU.md`.
 - PR review evidence template exists in `docs/PR_REVIEW_EVIDENCE_RU.md`;
-  first reviewed PR evidence remains pending.
+  PR #50 required checks passed, but first reviewed PR evidence remains pending.
 - Public PR template includes security, registry-claim, runtime/API/UI,
   smoke-test, rollback and evidence checklist items.
 - Visible external code review remains pending until public reviewed PRs exist.

docs/public-issues/public-issues-manifest.json

@@ -113,7 +113,9 @@
       "github_issue_url": "https://github.com/igor04091968/AWatch-rus/issues/48",
       "created_at": "2026-06-23T19:43:08Z",
       "created_by": "maintainer",
-      "next_evidence_doc": "docs/PR_REVIEW_EVIDENCE_RU.md"
+      "next_evidence_doc": "docs/PR_REVIEW_EVIDENCE_RU.md",
+      "evidence_status": "pending_review_required",
+      "evidence_doc": "docs/PR_REVIEW_EVIDENCE_RU.md"
     },
     {
       "id": "012",
@@ -124,7 +126,9 @@
       "github_issue_url": "https://github.com/igor04091968/AWatch-rus/issues/49",
       "created_at": "2026-06-23T19:43:10Z",
       "created_by": "maintainer",
-      "next_evidence_doc": "docs/BRANCH_PROTECTION_EVIDENCE_RU.md"
+      "next_evidence_doc": "docs/BRANCH_PROTECTION_EVIDENCE_RU.md",
+      "evidence_status": "verified_active_ruleset",
+      "evidence_doc": "docs/BRANCH_PROTECTION_EVIDENCE_RU.md"
     }
   ]
 }

docs/registry/REGISTRY_READINESS_CHANGELOG_RU.md

@@ -1,5 +1,66 @@
 # Registry readiness changelog
 
+## 2026-06-24 protected PR workflow evidence recorded
+
+Changed:
+
+- Recorded PR #50 as the first protected PR workflow reference in
+  `docs/PR_REVIEW_EVIDENCE_RU.md`.
+- Recorded that required ruleset checks passed for PR #50: `Coverage baseline`,
+  `security`, `rust-checks`, `docs-registry-checks`, `smoke-checks`.
+- Recorded that PR #50 remains `pending_review_required`; first reviewed PR
+  evidence is not claimed complete.
+- Linked issue #48 in `docs/public-issues/public-issues-manifest.json` to
+  `docs/PR_REVIEW_EVIDENCE_RU.md` with `pending_review_required`.
+
+Runtime impact:
+
+- No runtime/product code changes.
+- No API changes.
+- No UI changes.
+- No business logic changes.
+
+Guardrails:
+
+- GitHub remains public mirror validation only.
+- Protected PR workflow evidence is governance evidence only.
+- This is not registry release evidence.
+- External peer review is not claimed completed.
+- Russian Gitea plus planned Russian build-runner remains the primary registry
+  contour.
+
+## 2026-06-23 verified GitHub ruleset evidence
+
+Changed:
+
+- Recorded maintainer-verified active GitHub ruleset `main` for target branch
+  `main` in `docs/BRANCH_PROTECTION_EVIDENCE_RU.md`.
+- Recorded empty bypass list, required pull request review, one required
+  approval, stale approval dismissal and Code Owners review.
+- Recorded required status checks: `Coverage baseline`, `security`,
+  `rust-checks`, `docs-registry-checks`, `smoke-checks`.
+- Linked issue #49 in `docs/public-issues/public-issues-manifest.json` to
+  verified ruleset evidence.
+- Updated project status, branch protection policy and residual risks to show
+  branch protection risk mitigated while first reviewed PR evidence remains
+  pending.
+
+Runtime impact:
+
+- No runtime/product code changes.
+- No API changes.
+- No UI changes.
+- No business logic changes.
+
+Guardrails:
+
+- GitHub remains public mirror validation only.
+- Verified GitHub ruleset is public governance evidence only.
+- This is not registry release evidence.
+- Russian Gitea plus planned Russian build-runner remains the primary registry
+  contour.
+- External peer review is not claimed completed.
+
 ## 2026-06-23 branch protection and PR review evidence package
 
 Added:

scripts/registry_readiness_check.sh

@@ -239,8 +239,22 @@ if [[ -s "$PUBLIC_ISSUES_MANIFEST" ]]; then
           )
         )
       )
-      and ([.issues[] | select(.id == "011" and .github_issue_url == "https://github.com/igor04091968/AWatch-rus/issues/48" and .status == "created" and .next_evidence_doc == "docs/PR_REVIEW_EVIDENCE_RU.md")] | length == 1)
-      and ([.issues[] | select(.id == "012" and .github_issue_url == "https://github.com/igor04091968/AWatch-rus/issues/49" and .status == "created" and .next_evidence_doc == "docs/BRANCH_PROTECTION_EVIDENCE_RU.md")] | length == 1)
+      and ([.issues[] | select(
+        .id == "011"
+        and .github_issue_url == "https://github.com/igor04091968/AWatch-rus/issues/48"
+        and .status == "created"
+        and .next_evidence_doc == "docs/PR_REVIEW_EVIDENCE_RU.md"
+        and .evidence_status == "pending_review_required"
+        and .evidence_doc == "docs/PR_REVIEW_EVIDENCE_RU.md"
+      )] | length == 1)
+      and ([.issues[] | select(
+        .id == "012"
+        and .github_issue_url == "https://github.com/igor04091968/AWatch-rus/issues/49"
+        and .status == "created"
+        and .next_evidence_doc == "docs/BRANCH_PROTECTION_EVIDENCE_RU.md"
+        and .evidence_status == "verified_active_ruleset"
+        and .evidence_doc == "docs/BRANCH_PROTECTION_EVIDENCE_RU.md"
+      )] | length == 1)
     ' "$PUBLIC_ISSUES_MANIFEST" >/dev/null || fail "public_issues_manifest_required_fields"
   elif command -v python3 >/dev/null 2>&1; then
     python3 - "$PUBLIC_ISSUES_MANIFEST" <<'PY' || fail "public_issues_manifest_required_fields"
@@ -296,6 +310,10 @@ if issue_011.get("github_issue_url") != "https://github.com/igor04091968/AWatch-
     raise SystemExit("issue 011 URL mismatch")
 if issue_011.get("next_evidence_doc") != "docs/PR_REVIEW_EVIDENCE_RU.md":
     raise SystemExit("issue 011 next_evidence_doc mismatch")
+if issue_011.get("evidence_status") != "pending_review_required":
+    raise SystemExit("issue 011 evidence_status mismatch")
+if issue_011.get("evidence_doc") != "docs/PR_REVIEW_EVIDENCE_RU.md":
+    raise SystemExit("issue 011 evidence_doc mismatch")
 
 issue_012 = issue_by_id.get("012") or {}
 if issue_012.get("status") != "created":
@@ -304,6 +322,10 @@ if issue_012.get("github_issue_url") != "https://github.com/igor04091968/AWatch-
     raise SystemExit("issue 012 URL mismatch")
 if issue_012.get("next_evidence_doc") != "docs/BRANCH_PROTECTION_EVIDENCE_RU.md":
     raise SystemExit("issue 012 next_evidence_doc mismatch")
+if issue_012.get("evidence_status") != "verified_active_ruleset":
+    raise SystemExit("issue 012 evidence_status mismatch")
+if issue_012.get("evidence_doc") != "docs/BRANCH_PROTECTION_EVIDENCE_RU.md":
+    raise SystemExit("issue 012 evidence_doc mismatch")
 PY
   else
     fail "json_validator_missing:jq_or_python3_required"
@@ -340,8 +362,17 @@ require_grep "PUBLIC_ISSUES_CREATION_RUNBOOK_RU\\.md" "docs/PROJECT_STATUS_RU.md
 require_grep "Public issues:[[:space:]]*created and linked in manifest|Созданы 12 публичных" "docs/PROJECT_STATUS_RU.md" "project_status_issue_creation_created_urls"
 require_grep "PR-based workflow documentation:[[:space:]]*ready" "docs/PROJECT_STATUS_RU.md" "project_status_pr_workflow_ready"
 require_grep "Branch protection evidence package:[[:space:]]*ready" "docs/PROJECT_STATUS_RU.md" "project_status_branch_evidence_ready"
-require_grep "pending_manual_verification" "docs/PROJECT_STATUS_RU.md" "project_status_branch_pending_manual"
+require_grep 'Branch protection ruleset:[[:space:]]*`verified_active_ruleset`' "docs/PROJECT_STATUS_RU.md" "project_status_branch_verified_ruleset"
+require_grep 'Branch protection target branch:[[:space:]]*`main`' "docs/PROJECT_STATUS_RU.md" "project_status_branch_target_main"
+require_grep "Coverage baseline" "docs/PROJECT_STATUS_RU.md" "project_status_branch_check_coverage_baseline"
+require_grep "security" "docs/PROJECT_STATUS_RU.md" "project_status_branch_check_security"
+require_grep "rust-checks" "docs/PROJECT_STATUS_RU.md" "project_status_branch_check_rust_checks"
+require_grep "docs-registry-checks" "docs/PROJECT_STATUS_RU.md" "project_status_branch_check_docs_registry_checks"
+require_grep "smoke-checks" "docs/PROJECT_STATUS_RU.md" "project_status_branch_check_smoke_checks"
 require_grep "First reviewed PR evidence:[[:space:]]*pending|First reviewed PR evidence remains pending" "docs/PROJECT_STATUS_RU.md" "project_status_first_reviewed_pr_pending"
+require_grep "First protected PR workflow: PR #50 opened" "docs/PROJECT_STATUS_RU.md" "project_status_first_protected_pr"
+require_grep "pending_review_required" "docs/PROJECT_STATUS_RU.md" "project_status_pr_pending_review_required"
+require_grep "External peer review remains pending" "docs/PROJECT_STATUS_RU.md" "project_status_external_peer_review_pending"
 require_grep "GITEA_BACKUP_AND_RESTORE_RUNBOOK_RU\\.md|Restore outline|Post-restore checks" "docs/registry/GITEA_BACKUP_AND_RESTORE_RUNBOOK_RU.md" "backup_restore_runbook"
 require_grep "awatch-gitea-backup\\.timer" "docs/registry/GITEA_BACKUP_AND_RESTORE_RUNBOOK_RU.md" "backup_timer"
 require_grep "sha256|SHA256" "docs/registry/GITEA_BACKUP_AND_RESTORE_RUNBOOK_RU.md" "backup_sha256"
@@ -374,6 +405,11 @@ require_grep "docs/public-issues" "docs/registry/REGISTRY_READINESS_CHANGELOG_RU
 require_grep "runtime/product code changes" "docs/registry/REGISTRY_READINESS_CHANGELOG_RU.md" "changelog_public_issues_no_runtime"
 require_grep "GitHub remains public mirror validation only" "docs/registry/REGISTRY_READINESS_CHANGELOG_RU.md" "changelog_public_issues_github_role"
 require_grep "branch protection and PR review evidence package" "docs/registry/REGISTRY_READINESS_CHANGELOG_RU.md" "changelog_branch_pr_evidence_package"
+require_grep "verified GitHub ruleset evidence" "docs/registry/REGISTRY_READINESS_CHANGELOG_RU.md" "changelog_verified_ruleset_evidence"
+require_grep "protected PR workflow evidence recorded" "docs/registry/REGISTRY_READINESS_CHANGELOG_RU.md" "changelog_protected_pr_workflow"
+require_grep "PR #50" "docs/registry/REGISTRY_READINESS_CHANGELOG_RU.md" "changelog_pr_50"
+require_grep "pending_review_required" "docs/registry/REGISTRY_READINESS_CHANGELOG_RU.md" "changelog_pr_pending_review_required"
+require_grep "This is not registry release evidence" "docs/registry/REGISTRY_READINESS_CHANGELOG_RU.md" "changelog_ruleset_not_registry_evidence"
 require_grep "No runtime/product code changes" "docs/registry/REGISTRY_READINESS_CHANGELOG_RU.md" "changelog_branch_pr_no_runtime"
 require_grep "External peer review is not claimed completed" "docs/registry/REGISTRY_READINESS_CHANGELOG_RU.md" "changelog_external_review_not_completed"
 require_grep "Restore test is not claimed as completed" "docs/registry/REGISTRY_READINESS_CHANGELOG_RU.md" "changelog_restore_not_completed"
@@ -422,14 +458,14 @@ require_grep 'Required approvals:[[:space:]]*`1`' "docs/BRANCH_PROTECTION_POLICY
 require_grep "Dismiss stale approvals" "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_dismiss_stale"
 require_grep "CODEOWNERS" "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_codeowners_review"
 require_grep "Require status checks" "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_status_checks"
-require_grep "CI / Rust checks" "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_ci_rust_checks"
-require_grep "CI / Docs and registry checks" "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_ci_docs_registry_checks"
-require_grep "CI / Smoke checks" "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_ci_smoke_checks"
-require_grep "Coverage / Coverage baseline" "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_coverage_baseline_check"
-require_grep "Security / Cargo audit" "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_security_cargo_audit"
-require_grep "Security / Cargo deny" "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_security_cargo_deny"
-require_grep "Security / Secret pattern check" "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_secret_pattern_check"
-require_grep "Security / Dependency review" "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_dependency_review"
+require_grep 'Ruleset name:[[:space:]]*`main`' "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_ruleset_main"
+require_grep 'Enforcement:[[:space:]]*`active`' "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_enforcement_active"
+require_grep "Bypass list:[[:space:]]*empty" "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_bypass_empty"
+require_grep "Coverage baseline" "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_coverage_baseline_check"
+require_grep "security" "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_security_check"
+require_grep "rust-checks" "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_rust_checks"
+require_grep "docs-registry-checks" "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_docs_registry_checks"
+require_grep "smoke-checks" "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_smoke_checks"
 require_grep 'Require `CI` workflow' "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_ci"
 require_grep 'Require `Security` workflow' "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_security"
 require_grep 'Require `Coverage` workflow' "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_coverage"
@@ -438,12 +474,21 @@ require_grep "Restrict force push" "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch
 require_grep "Require conversation resolution" "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_conversation_resolution"
 require_grep "Require linear history" "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_linear_history"
 require_grep "emergency-only" "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_admin_bypass"
-require_grep "recommended policy|advisory branch protection policy" "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_advisory_not_enabled"
-require_grep "branch_protection_status:[[:space:]]*\"pending_manual_verification\"" "docs/BRANCH_PROTECTION_EVIDENCE_RU.md" "branch_evidence_pending_manual"
+require_grep "verified_active_ruleset" "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_verified_active_ruleset"
+require_grep "branch_protection_status:[[:space:]]*\"verified_active_ruleset\"" "docs/BRANCH_PROTECTION_EVIDENCE_RU.md" "branch_evidence_verified_active"
 require_grep "https://github\\.com/igor04091968/AWatch-rus/issues/49" "docs/BRANCH_PROTECTION_EVIDENCE_RU.md" "branch_evidence_issue_49"
 require_grep "Not Registry Release Evidence|Not registry release evidence" "docs/BRANCH_PROTECTION_EVIDENCE_RU.md" "branch_evidence_not_registry"
 require_grep "Russian Contour Note" "docs/BRANCH_PROTECTION_EVIDENCE_RU.md" "branch_evidence_russian_contour"
-require_grep "CI / Rust checks" "docs/BRANCH_PROTECTION_EVIDENCE_RU.md" "branch_evidence_required_checks"
+require_grep 'enforcement:[[:space:]]*`active`' "docs/BRANCH_PROTECTION_EVIDENCE_RU.md" "branch_evidence_enforcement_active"
+require_grep 'bypass_list:[[:space:]]*`empty`' "docs/BRANCH_PROTECTION_EVIDENCE_RU.md" "branch_evidence_bypass_empty"
+require_grep 'required approvals:[[:space:]]*`1`' "docs/BRANCH_PROTECTION_EVIDENCE_RU.md" "branch_evidence_required_approvals"
+require_grep 'require review from Code Owners:[[:space:]]*`enabled`' "docs/BRANCH_PROTECTION_EVIDENCE_RU.md" "branch_evidence_codeowners_enabled"
+require_grep "Coverage baseline" "docs/BRANCH_PROTECTION_EVIDENCE_RU.md" "branch_evidence_coverage_baseline"
+require_grep "security" "docs/BRANCH_PROTECTION_EVIDENCE_RU.md" "branch_evidence_security_check"
+require_grep "rust-checks" "docs/BRANCH_PROTECTION_EVIDENCE_RU.md" "branch_evidence_rust_checks"
+require_grep "docs-registry-checks" "docs/BRANCH_PROTECTION_EVIDENCE_RU.md" "branch_evidence_docs_registry_checks"
+require_grep "smoke-checks" "docs/BRANCH_PROTECTION_EVIDENCE_RU.md" "branch_evidence_smoke_checks"
+require_grep "GitHub ruleset / branch protection evidence is public governance evidence only" "docs/BRANCH_PROTECTION_EVIDENCE_RU.md" "branch_evidence_governance_only"
 require_grep "workflow documentation ready" "docs/PR_REVIEW_WORKFLOW_RU.md" "pr_workflow_ready"
 require_grep "https://github\\.com/igor04091968/AWatch-rus/issues/48" "docs/PR_REVIEW_WORKFLOW_RU.md" "pr_workflow_issue_48"
 require_grep "PR template must be completed" "docs/PR_REVIEW_WORKFLOW_RU.md" "pr_workflow_template_required"
@@ -451,12 +496,26 @@ require_grep "CODEOWNERS" "docs/PR_REVIEW_WORKFLOW_RU.md" "pr_workflow_codeowner
 require_grep "CI, Coverage and Security checks" "docs/PR_REVIEW_WORKFLOW_RU.md" "pr_workflow_checks"
 require_grep "public secret-pattern scan" "docs/PR_REVIEW_WORKFLOW_RU.md" "pr_workflow_secret_scan"
 require_grep "GitHub Actions is public mirror validation only" "docs/PR_REVIEW_WORKFLOW_RU.md" "pr_workflow_github_public_only"
-require_grep "pr_review_evidence_status:[[:space:]]*\"pending_until_first_reviewed_pr_is_merged\"" "docs/PR_REVIEW_EVIDENCE_RU.md" "pr_evidence_pending_first_reviewed_pr"
+require_grep "pr_review_status:[[:space:]]*\"pending_review_required\"" "docs/PR_REVIEW_EVIDENCE_RU.md" "pr_evidence_pending_review_required"
+require_grep "https://github\\.com/igor04091968/AWatch-rus/pull/50" "docs/PR_REVIEW_EVIDENCE_RU.md" "pr_evidence_pr_50"
+require_grep 'Required checks status:[[:space:]]*`passed`' "docs/PR_REVIEW_EVIDENCE_RU.md" "pr_evidence_required_checks_passed"
+require_grep 'Review requirement status:[[:space:]]*`pending_review_required`' "docs/PR_REVIEW_EVIDENCE_RU.md" "pr_evidence_review_pending"
+require_grep 'Merge status:[[:space:]]*`open`' "docs/PR_REVIEW_EVIDENCE_RU.md" "pr_evidence_merge_open"
+require_grep 'Admin bypass used:[[:space:]]*`false`' "docs/PR_REVIEW_EVIDENCE_RU.md" "pr_evidence_no_bypass"
+require_grep "Coverage baseline" "docs/PR_REVIEW_EVIDENCE_RU.md" "pr_evidence_coverage_baseline"
+require_grep "security" "docs/PR_REVIEW_EVIDENCE_RU.md" "pr_evidence_security"
+require_grep "rust-checks" "docs/PR_REVIEW_EVIDENCE_RU.md" "pr_evidence_rust_checks"
+require_grep "docs-registry-checks" "docs/PR_REVIEW_EVIDENCE_RU.md" "pr_evidence_docs_registry_checks"
+require_grep "smoke-checks" "docs/PR_REVIEW_EVIDENCE_RU.md" "pr_evidence_smoke_checks"
 require_grep "reviewer approval" "docs/PR_REVIEW_EVIDENCE_RU.md" "pr_evidence_reviewer_approval"
 require_grep "External peer review completed:[[:space:]]*not claimed" "docs/PR_REVIEW_EVIDENCE_RU.md" "pr_evidence_external_not_claimed"
 require_grep "Not Registry Release Evidence|Not registry release evidence" "docs/PR_REVIEW_EVIDENCE_RU.md" "pr_evidence_not_registry"
 require_grep "\"next_evidence_doc\"[[:space:]]*:[[:space:]]*\"docs/PR_REVIEW_EVIDENCE_RU\\.md\"" "docs/public-issues/public-issues-manifest.json" "manifest_issue_48_next_evidence_doc"
+require_grep "\"evidence_status\"[[:space:]]*:[[:space:]]*\"pending_review_required\"" "docs/public-issues/public-issues-manifest.json" "manifest_issue_48_evidence_status"
+require_grep "\"evidence_doc\"[[:space:]]*:[[:space:]]*\"docs/PR_REVIEW_EVIDENCE_RU\\.md\"" "docs/public-issues/public-issues-manifest.json" "manifest_issue_48_evidence_doc"
 require_grep "\"next_evidence_doc\"[[:space:]]*:[[:space:]]*\"docs/BRANCH_PROTECTION_EVIDENCE_RU\\.md\"" "docs/public-issues/public-issues-manifest.json" "manifest_issue_49_next_evidence_doc"
+require_grep "\"evidence_status\"[[:space:]]*:[[:space:]]*\"verified_active_ruleset\"" "docs/public-issues/public-issues-manifest.json" "manifest_issue_49_evidence_status"
+require_grep "\"evidence_doc\"[[:space:]]*:[[:space:]]*\"docs/BRANCH_PROTECTION_EVIDENCE_RU\\.md\"" "docs/public-issues/public-issues-manifest.json" "manifest_issue_49_evidence_doc"
 require_grep "Один основной разработчик" "docs/RESIDUAL_RISKS_RU.md" "risk_single_developer"
 require_grep "Нет внешнего visible peer review" "docs/RESIDUAL_RISKS_RU.md" "risk_peer_review"
 require_grep "Низкая публичная активность issue tracker" "docs/RESIDUAL_RISKS_RU.md" "risk_issue_tracker_activity"
@@ -599,12 +658,34 @@ fi
 rm -f /tmp/registry_forbidden_registry_submission_done.$$
 
 if grep -RInEi "(branch protection).{0,120}(enabled|включ(е|ё)н|настроен|active)" "$ROOT/README.md" "$ROOT/docs/PROJECT_STATUS_RU.md" "$ROOT/docs/BRANCH_PROTECTION_POLICY_RU.md" "$ROOT/docs/BRANCH_PROTECTION_EVIDENCE_RU.md" "$ROOT/docs/PR_REVIEW_WORKFLOW_RU.md" "$ROOT/docs/PR_REVIEW_EVIDENCE_RU.md" "$REGISTRY_DIR"/*.md \
-  | grep -Eiv "(not |не |не утверждает|not claimed|advisory|until repository settings|если применимо|recommended|pending_manual_verification|until maintainer evidence|until.*evidence|to verify)" \
+  | grep -Eiv "(not |не |не утверждает|not claimed|no claim|no assertion|advisory|until repository settings|если применимо|recommended|pending|pending_manual_verification|verified_active_ruleset|maintainer-verified|verified active by maintainer|verified GitHub ruleset|until maintainer evidence|until.*evidence|to verify)" \
   >/tmp/registry_forbidden_branch_protection_enabled.$$ 2>/dev/null; then
   fail "forbidden_claim_branch_protection_enabled:$(cat /tmp/registry_forbidden_branch_protection_enabled.$$)"
 fi
 rm -f /tmp/registry_forbidden_branch_protection_enabled.$$
 
+if grep -Eq 'pr_review_status:[[:space:]]*"verified"' "$ROOT/docs/PR_REVIEW_EVIDENCE_RU.md" \
+  && ! grep -Eq 'Admin bypass used:[[:space:]]*`false`' "$ROOT/docs/PR_REVIEW_EVIDENCE_RU.md"; then
+  fail "pr_review_verified_requires_admin_bypass_false"
+fi
+
+if grep -Eq 'Admin bypass used:[[:space:]]*`true`' "$ROOT/docs/PR_REVIEW_EVIDENCE_RU.md" \
+  && grep -Eiq "first PR review workflow:[[:space:]]*verified|PR review workflow:[[:space:]]*verified|first reviewed PR evidence:[[:space:]]*verified" "$ROOT/docs/PROJECT_STATUS_RU.md"; then
+  fail "bypass_pr_must_not_mark_review_workflow_verified"
+fi
+
+if grep -RInEi "(CodeQL|code scanning).{0,80}(enabled|required|requirement|tool)" \
+  "$ROOT/docs/BRANCH_PROTECTION_EVIDENCE_RU.md" \
+  "$ROOT/docs/BRANCH_PROTECTION_POLICY_RU.md" \
+  "$ROOT/docs/PROJECT_STATUS_RU.md" \
+  "$ROOT/docs/RESIDUAL_RISKS_RU.md" \
+  "$ROOT/docs/PR_REVIEW_EVIDENCE_RU.md" \
+  "$REGISTRY_DIR/REGISTRY_READINESS_CHANGELOG_RU.md" \
+  >/tmp/registry_forbidden_codeql_claim.$$ 2>/dev/null; then
+  fail "forbidden_claim_codeql_enabled_or_required:$(cat /tmp/registry_forbidden_codeql_claim.$$)"
+fi
+rm -f /tmp/registry_forbidden_codeql_claim.$$
+
 if grep -RInEi "(external|visible|peer).{0,80}(review).{0,120}(active|performed|completed|done|выполняется|проведен|провед(е|ё)н|активен)" "$ROOT/README.md" "$ROOT/docs/PROJECT_STATUS_RU.md" "$ROOT/docs/RESIDUAL_RISKS_RU.md" "$ROOT/docs/PR_REVIEW_WORKFLOW_RU.md" "$ROOT/docs/PR_REVIEW_EVIDENCE_RU.md" "$REGISTRY_DIR"/*.md \
   | grep -Eiv "(not |не |pending|still pending|не утверждает|not claimed|until public reviewed PRs|until reviewed PR evidence|unless a reviewed public PR|is not claimed)" \
   >/tmp/registry_forbidden_external_review_active.$$ 2>/dev/null; then