From 34e017673afcebf539f9649e0cf50d46bc769278 Mon Sep 17 00:00:00 2001 From: igor04091968 Date: Wed, 24 Jun 2026 00:04:55 +0300 Subject: [PATCH] docs(governance): record protected PR workflow evidence --- .github/CODEOWNERS | 52 +++---- docs/BRANCH_PROTECTION_EVIDENCE_RU.md | 129 ++++++++++-------- docs/BRANCH_PROTECTION_POLICY_RU.md | 43 +++--- docs/PROJECT_STATUS_RU.md | 19 ++- docs/PR_REVIEW_EVIDENCE_RU.md | 30 ++-- docs/RESIDUAL_RISKS_RU.md | 30 ++-- .../public-issues/public-issues-manifest.json | 8 +- .../REGISTRY_READINESS_CHANGELOG_RU.md | 61 +++++++++ scripts/registry_readiness_check.sh | 113 ++++++++++++--- 9 files changed, 339 insertions(+), 146 deletions(-) diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS index c740a4d..25e5827 100644 --- a/.github/CODEOWNERS +++ b/.github/CODEOWNERS @@ -6,43 +6,43 @@ # submissions. # Repository default owner. -* @igor04091968 +* @igor04091968 @rachkovii68-bisness # Rust workspace and crates. -/adk-rust/ @igor04091968 -**/Cargo.toml @igor04091968 -**/Cargo.lock @igor04091968 -**/*.rs @igor04091968 +/adk-rust/ @igor04091968 @rachkovii68-bisness +**/Cargo.toml @igor04091968 @rachkovii68-bisness +**/Cargo.lock @igor04091968 @rachkovii68-bisness +**/*.rs @igor04091968 @rachkovii68-bisness # Operational scripts and automation. -/scripts/ @igor04091968 +/scripts/ @igor04091968 @rachkovii68-bisness # Product documentation, demo material and screenshots. -/docs/ @igor04091968 -/docs/demo/ @igor04091968 -/docs/screenshots/ @igor04091968 -/docs/assets/screenshots/ @igor04091968 +/docs/ @igor04091968 @rachkovii68-bisness +/docs/demo/ @igor04091968 @rachkovii68-bisness +/docs/screenshots/ @igor04091968 @rachkovii68-bisness +/docs/assets/screenshots/ @igor04091968 @rachkovii68-bisness # Registry-readiness evidence and policy documents. -/docs/registry/ @igor04091968 +/docs/registry/ @igor04091968 @rachkovii68-bisness # GitHub public mirror validation metadata and governance controls. -/.github/workflows/ @igor04091968 -/.github/workflows/ci.yml @igor04091968 -/.github/workflows/security.yml @igor04091968 -/.github/workflows/coverage.yml @igor04091968 -/.github/pull_request_template.md @igor04091968 -/.github/ISSUE_TEMPLATE/ @igor04091968 -/.github/CODEOWNERS @igor04091968 -/docs/BRANCH_PROTECTION_POLICY_RU.md @igor04091968 -/docs/BRANCH_PROTECTION_EVIDENCE_RU.md @igor04091968 -/docs/PR_REVIEW_WORKFLOW_RU.md @igor04091968 -/docs/PR_REVIEW_EVIDENCE_RU.md @igor04091968 +/.github/workflows/ @igor04091968 @rachkovii68-bisness +/.github/workflows/ci.yml @igor04091968 @rachkovii68-bisness +/.github/workflows/security.yml @igor04091968 @rachkovii68-bisness +/.github/workflows/coverage.yml @igor04091968 @rachkovii68-bisness +/.github/pull_request_template.md @igor04091968 @rachkovii68-bisness +/.github/ISSUE_TEMPLATE/ @igor04091968 @rachkovii68-bisness +/.github/CODEOWNERS @igor04091968 @rachkovii68-bisness +/docs/BRANCH_PROTECTION_POLICY_RU.md @igor04091968 @rachkovii68-bisness +/docs/BRANCH_PROTECTION_EVIDENCE_RU.md @igor04091968 @rachkovii68-bisness +/docs/PR_REVIEW_WORKFLOW_RU.md @igor04091968 @rachkovii68-bisness +/docs/PR_REVIEW_EVIDENCE_RU.md @igor04091968 @rachkovii68-bisness # Ansible deployment automation. -/ansible/ @igor04091968 +/ansible/ @igor04091968 @rachkovii68-bisness # Security and contribution governance. -/SECURITY.md @igor04091968 -/CONTRIBUTING.md @igor04091968 -/deny.toml @igor04091968 +/SECURITY.md @igor04091968 @rachkovii68-bisness +/CONTRIBUTING.md @igor04091968 @rachkovii68-bisness +/deny.toml @igor04091968 @rachkovii68-bisness diff --git a/docs/BRANCH_PROTECTION_EVIDENCE_RU.md b/docs/BRANCH_PROTECTION_EVIDENCE_RU.md index b8961bf..0c144f4 100644 --- a/docs/BRANCH_PROTECTION_EVIDENCE_RU.md +++ b/docs/BRANCH_PROTECTION_EVIDENCE_RU.md @@ -1,87 +1,107 @@ # AWatch-rus: branch protection evidence -Дата: 2026-06-23 +Дата: 2026-06-24 -branch_protection_status: "pending_manual_verification" +branch_protection_status: "verified_active_ruleset" GitHub issue: https://github.com/igor04091968/AWatch-rus/issues/49 -Этот документ является evidence template для ручной проверки GitHub branch -protection на публичном зеркале. Он не утверждает, что branch protection уже -настроена или подтверждена. +Этот документ фиксирует maintainer-verified GitHub ruleset / branch protection +evidence для публичного зеркала. Подтверждение относится только к GitHub public +mirror governance. ## Target - Repository: `igor04091968/AWatch-rus`. - Platform role: GitHub public mirror validation only. - Protected branch: `main`. +- Ruleset name: `main`. +- Enforcement: `active`. - Policy source: `docs/BRANCH_PROTECTION_POLICY_RU.md`. - Evidence owner: maintainer. -## Settings To Verify +## Verified Settings -Maintainer должен вручную проверить, что для `main` configured rule включает: +Maintainer manually verified the following GitHub UI state: -- require pull request before merging; -- require approvals: `1`; -- dismiss stale approvals when new commits are pushed; -- require review from CODEOWNERS, if available on the current GitHub plan; -- require status checks to pass before merging; -- require branches to be up to date before merging, if compatible with current - maintainer workflow; -- restrict force pushes; -- restrict deletions; -- administrator bypass decision documented, preferably disabled for stricter - mode. +- verification date: `2026-06-24`; +- maintainer: `maintainer`; +- repository: `github.com/igor04091968/AWatch-rus`; +- ruleset name: `main`; +- enforcement: `active`; +- target branch: `main`; +- applies_to_targets: `1`; +- bypass_list: `empty`; +- required pull request: `enabled`; +- required approvals: `1`; +- dismiss stale pull request approvals when new commits are pushed: `enabled`; +- require review from Code Owners: `enabled`; +- block force pushes: `enabled`. -## Required Checks +## Verified Required Status Checks -Expected required checks are based on current workflow/job names: +GitHub ruleset required status checks verified in the UI: -- `CI / Rust checks` -- `CI / Docs and registry checks` -- `CI / Smoke checks` -- `Coverage / Coverage baseline` -- `Security / Cargo audit` -- `Security / Cargo deny` -- `Security / Secret pattern check` -- `Security / Dependency review` +- `Coverage baseline` +- `security` +- `rust-checks` +- `docs-registry-checks` +- `smoke-checks` -If GitHub displays a different context name, record the exact displayed name and -update `docs/BRANCH_PROTECTION_POLICY_RU.md` before marking verification done. - -## Manual Verification Procedure - -1. Open repository settings for `igor04091968/AWatch-rus`. -2. Open branch protection or repository rules for branch `main`. -3. Compare enabled settings against this document and - `docs/BRANCH_PROTECTION_POLICY_RU.md`. -4. Verify required status-check names exactly as GitHub displays them. -5. Capture screenshot evidence without private account data or tokens. -6. Record evidence fields below. -7. Only after verification, update `branch_protection_status` from - `"pending_manual_verification"` to `"verified"` in a follow-up change. +These names are the ruleset-visible required check names from GitHub UI. They +may differ from the human-readable workflow job names shown inside workflow +files. ## Evidence Record - Screenshot filename placeholder: - `docs/evidence/github-branch-protection-main-YYYY-MM-DD.png` -- Date: `YYYY-MM-DD` + `docs/evidence/github-ruleset-main-2026-06-24.png` +- Date: `2026-06-24` - Maintainer: `maintainer` -- Repository: `igor04091968/AWatch-rus` +- Repository: `github.com/igor04091968/AWatch-rus` +- Ruleset: `main` - Protected branch: `main` -- Required checks verified: `pending` -- Admin bypass decision: `pending` -- Force-push restriction verified: `pending` -- Deletion restriction verified: `pending` -- Notes: `pending` +- Enforcement: `active` +- Applies to targets: `1` +- Bypass list: `empty` +- Required checks verified: `Coverage baseline`, `security`, `rust-checks`, + `docs-registry-checks`, `smoke-checks` +- Force-push restriction verified: `enabled` +- Notes: GitHub UI confirms active ruleset for target branch `main`. + +## First Protected PR Validation + +- PR URL: `https://github.com/igor04091968/AWatch-rus/pull/50` +- Linked governance issue: `https://github.com/igor04091968/AWatch-rus/issues/49` +- PR source branch: `docs/verified-github-ruleset-evidence` +- PR target branch: `main` +- Runtime/API/UI/product code changes: `none` +- Required checks status: `passed` +- Required checks: `Coverage baseline`, `security`, `rust-checks`, + `docs-registry-checks`, `smoke-checks` +- Review requirement status: `pending_review_required` +- Merge status: `open` +- Admin bypass used: `false` +- Outcome note: PR #50 confirms required checks execute under the active ruleset; + review/merge evidence is not yet complete. + +## Future Reverification Procedure + +1. Open repository settings for `igor04091968/AWatch-rus`. +2. Open repository rules/rulesets for `main`. +3. Confirm enforcement remains `active`. +4. Confirm target branch remains `main`. +5. Confirm bypass list remains empty. +6. Confirm required PR, approvals, stale dismissal, Code Owners review, status + checks and force-push block. +7. Capture screenshot evidence without private account data or tokens. ## Not Registry Release Evidence -GitHub branch protection evidence is governance/process evidence for the public -mirror. It is not registry release evidence and does not replace release -artifacts, checksums, build logs or release evidence from the Russian -build-runner. +GitHub ruleset / branch protection evidence is public governance evidence only. +It is not Russian registry release evidence and does not replace Russian +Gitea/build-runner release contour, release artifacts, checksums, build logs or +release evidence from the Russian build-runner. ## Russian Contour Note @@ -92,7 +112,6 @@ Russian build-runner. GitHub remains public mirror validation only. - Do not record secrets, tokens, private URLs or account recovery details. - Do not include private employee/customer data in screenshots. -- Do not claim branch protection is verified until maintainer evidence exists. - Do not claim completed registry submission. - Do not claim certification. - Do not claim SIEM/DLP replacement. diff --git a/docs/BRANCH_PROTECTION_POLICY_RU.md b/docs/BRANCH_PROTECTION_POLICY_RU.md index 7bf049f..13611f3 100644 --- a/docs/BRANCH_PROTECTION_POLICY_RU.md +++ b/docs/BRANCH_PROTECTION_POLICY_RU.md @@ -2,9 +2,8 @@ Дата: 2026-06-23 -Статус: recommended policy. Этот документ описывает целевую настройку GitHub -branch protection для публичного зеркала. Он не утверждает, что branch -protection уже включен. +Статус: recommended policy plus verified GitHub ruleset evidence. GitHub UI +verification is recorded in `docs/BRANCH_PROTECTION_EVIDENCE_RU.md`. GitHub остается public mirror validation surface. Primary registry-readiness contour остается Russian Gitea plus Russian build-runner release evidence. @@ -12,6 +11,7 @@ contour остается Russian Gitea plus Russian build-runner release evidenc ## Scope - Branch: `main`. +- Ruleset: `main`. - Platform: GitHub public mirror. - Purpose: visible review discipline, status-check discipline and public engineering maturity signal. @@ -36,10 +36,15 @@ contour остается Russian Gitea plus Russian build-runner release evidenc Recommended settings for `main` on the GitHub public mirror: +- Ruleset name: `main`. +- Enforcement: `active`. +- Target branches: `main`. +- Applies to: `1` target, `main`. +- Bypass list: empty. - Require pull request before merging. - Required approvals: `1`. - Dismiss stale approvals when new commits are pushed. -- Require review from CODEOWNERS if available on the current GitHub plan. +- Require review from Code Owners. - Require status checks to pass before merging. - Require branches to be up to date before merging if this does not block the current maintainer workflow. @@ -48,24 +53,24 @@ Recommended settings for `main` on the GitHub public mirror: - Allow administrators bypass: documented decision only; stricter mode should keep bypass disabled unless repository recovery requires it. -Recommended required checks, using current workflow/job names: +Verified ruleset required status checks from GitHub UI: -- `CI / Rust checks` -- `CI / Docs and registry checks` -- `CI / Smoke checks` -- `Coverage / Coverage baseline` -- `Security / Cargo audit` -- `Security / Cargo deny` -- `Security / Secret pattern check` -- `Security / Dependency review` +- `Coverage baseline` +- `security` +- `rust-checks` +- `docs-registry-checks` +- `smoke-checks` -Before verification, maintainer must compare these names with the exact check -names displayed by GitHub. If GitHub displays different names, update this -document and `docs/BRANCH_PROTECTION_EVIDENCE_RU.md` before recording evidence. +Workflow/job-name mapping for operator review: -Current evidence status is tracked in -`docs/BRANCH_PROTECTION_EVIDENCE_RU.md` and remains -`pending_manual_verification` until maintainer evidence is recorded. +- `Coverage baseline`: Coverage workflow baseline job. +- `rust-checks`: CI Rust checks job. +- `docs-registry-checks`: CI docs and registry checks job. +- `smoke-checks`: CI smoke checks job. +- `security`: security validation context shown by GitHub rulesets UI. + +Current evidence status is `verified_active_ruleset` in +`docs/BRANCH_PROTECTION_EVIDENCE_RU.md`. ## Review expectations diff --git a/docs/PROJECT_STATUS_RU.md b/docs/PROJECT_STATUS_RU.md index 970094c..9daa328 100644 --- a/docs/PROJECT_STATUS_RU.md +++ b/docs/PROJECT_STATUS_RU.md @@ -53,8 +53,12 @@ backup, registry-readiness документации, плана российск (`docs/PR_REVIEW_EVIDENCE_RU.md`). - Branch protection evidence package: ready (`docs/BRANCH_PROTECTION_EVIDENCE_RU.md`). -- Branch protection actual enablement: - `pending_manual_verification`. +- Branch protection ruleset: `verified_active_ruleset`. +- Branch protection target branch: `main`. +- Branch protection required checks: `Coverage baseline`, `security`, + `rust-checks`, `docs-registry-checks`, `smoke-checks`. +- First protected PR workflow: PR #50 opened; required checks passed; + review/merge still `pending_review_required`. - First reviewed PR evidence: pending. ## Что готово @@ -92,10 +96,17 @@ backup, registry-readiness документации, плана российск `docs/BRANCH_PROTECTION_POLICY_RU.md`. - Branch protection evidence template prepared: `docs/BRANCH_PROTECTION_EVIDENCE_RU.md`. +- GitHub ruleset / branch protection for `main` verified active by maintainer: + ruleset `main`, target branch `main`, empty bypass list, required PR with + one approval, stale approval dismissal, Code Owners review, required status + checks and force-push blocking. - PR-based review workflow documented: `docs/PR_REVIEW_WORKFLOW_RU.md`. - PR review evidence template prepared: `docs/PR_REVIEW_EVIDENCE_RU.md`. +- First protected PR workflow evidence recorded for PR #50: + required checks passed; review requirement is still pending; merge status is + open; no admin bypass recorded. - Зафиксирован residual risk register: `docs/RESIDUAL_RISKS_RU.md`. - Подготовлен план публичных issues для ручного заведения: @@ -117,11 +128,9 @@ backup, registry-readiness документации, плана российск - Финальная юридическая проверка пакета документов перед подачей. - Проверка совместимости с российскими ОС. - Visible external code review is still pending. -- Branch protection enablement is not claimed until repository settings are - verified. -- Branch protection actual enablement remains `pending_manual_verification`. - First reviewed PR evidence remains pending until a reviewed public PR is merged and evidence is recorded. +- External peer review remains pending. - Community adoption remains low until external contributors, public reviews and sustained third-party activity appear. diff --git a/docs/PR_REVIEW_EVIDENCE_RU.md b/docs/PR_REVIEW_EVIDENCE_RU.md index ccb5f74..e1105c3 100644 --- a/docs/PR_REVIEW_EVIDENCE_RU.md +++ b/docs/PR_REVIEW_EVIDENCE_RU.md @@ -1,13 +1,14 @@ # AWatch-rus: PR review evidence -Дата: 2026-06-23 +Дата: 2026-06-24 -pr_review_evidence_status: "pending_until_first_reviewed_pr_is_merged" +pr_review_status: "pending_review_required" GitHub issue: https://github.com/igor04091968/AWatch-rus/issues/48 -Этот документ фиксирует, что будет считаться evidence для PR-based review -workflow. Он не утверждает, что external peer review уже выполнен. +Этот документ фиксирует evidence первого protected PR-based workflow после +включения GitHub ruleset на `main`. Он не утверждает, что review requirement +уже выполнен или что external peer review завершен. ## Evidence Criteria @@ -23,16 +24,23 @@ workflow. Он не утверждает, что external peer review уже в ## Evidence Record -- PR URL: `pending` -- Linked issue URL: `pending` +- PR URL: `https://github.com/igor04091968/AWatch-rus/pull/50` +- Linked issue URL: `https://github.com/igor04091968/AWatch-rus/issues/48` +- Evidence issue URL: `https://github.com/igor04091968/AWatch-rus/issues/49` +- Required checks status: `passed` +- Required checks: `Coverage baseline`, `security`, `rust-checks`, + `docs-registry-checks`, `smoke-checks` +- Review requirement status: `pending_review_required` +- Merge status: `open` +- Admin bypass used: `false` - Reviewer: `pending` - Reviewer type: `pending` - Approval URL or screenshot filename: `pending` -- Passed checks: `pending` - Merge commit: `pending` -- Bypass used: `pending` -- Date: `YYYY-MM-DD` -- Maintainer note: `pending` +- Date: `2026-06-24` +- Maintainer note: PR #50 demonstrates protected branch workflow and required + checks execution, but first reviewed PR evidence remains pending until review + requirement is satisfied and the PR is merged without bypass. ## Reviewer Interpretation @@ -46,6 +54,8 @@ the review is visible. - PR workflow documentation: ready. - PR template: ready. - CODEOWNERS routing: ready. +- First protected PR validation reference: PR #50. +- Required checks for PR #50: passed. - First reviewed PR evidence: pending. - External peer review completed: not claimed. diff --git a/docs/RESIDUAL_RISKS_RU.md b/docs/RESIDUAL_RISKS_RU.md index 77ad50f..4b5f39a 100644 --- a/docs/RESIDUAL_RISKS_RU.md +++ b/docs/RESIDUAL_RISKS_RU.md @@ -50,26 +50,31 @@ visibility, release evidence contour and legal package. Они требуют д ## 2. Нет внешнего visible peer review / публично видимого peer review -- Текущий статус: риск открыт; PR template, CODEOWNERS, public governance - issues and PR workflow docs exist, but first reviewed PR evidence and branch - protection verification are still pending. +- Текущий статус: риск открыт частично; PR template, CODEOWNERS, public + governance issues, PR workflow docs and verified active GitHub ruleset for + `main` exist. PR #50 has run through protected checks, but first reviewed PR + evidence is still pending because review/merge is not complete. - Влияние: внешним аудиторам сложнее оценить review discipline and change control maturity. - Почему не блокирует pilot/readiness stage: current changes are protected by reproducible checks, public workflows and documented conservative positioning. - Как риск будет снижаться: review checklist, CODEOWNERS routing, public issue - #48, `docs/PR_REVIEW_WORKFLOW_RU.md`, first public reviewed PR evidence, - explicit release branch review policy and verified branch protection evidence. + #48, `docs/PR_REVIEW_WORKFLOW_RU.md`, first public reviewed PR evidence and + explicit release branch review policy. - Уже снижающие evidence/documents/CI: `.github/pull_request_template.md`, `.github/CODEOWNERS`, `.github/ISSUE_TEMPLATE/`, `docs/REVIEW_CHECKLIST_RU.md`, `docs/BRANCH_PROTECTION_POLICY_RU.md`, `docs/BRANCH_PROTECTION_EVIDENCE_RU.md`, `docs/PR_REVIEW_WORKFLOW_RU.md`, `docs/PR_REVIEW_EVIDENCE_RU.md`, `CONTRIBUTING.md`, `SECURITY.md`, public CI, public security workflow. -- Residual risk: remains open until branch protection is verified and first - reviewed PR evidence exists. -- Следующий action: выполнить maintainer verification for branch protection and - record first reviewed PR evidence without overstating external peer review. +- Branch protection pending risk: mitigated by verified active GitHub ruleset + for `main` with empty bypass list, required PR review, Code Owners review, + required status checks and force-push blocking. +- PR workflow risk: remains open until PR #50 or a later PR is reviewed and + merged without bypass. +- Residual risk: remains open until first reviewed PR evidence exists. +- Следующий action: record first reviewed PR evidence without overstating + external peer review. ## 3. Низкая публичная активность issue tracker @@ -185,12 +190,11 @@ visibility, release evidence contour and legal package. Они требуют д - PR review checklist exists in `docs/REVIEW_CHECKLIST_RU.md`. - Advisory branch protection policy exists in `docs/BRANCH_PROTECTION_POLICY_RU.md`. -- Branch protection evidence template exists in - `docs/BRANCH_PROTECTION_EVIDENCE_RU.md` with - `pending_manual_verification` status. +- Branch protection evidence exists in `docs/BRANCH_PROTECTION_EVIDENCE_RU.md` + with `verified_active_ruleset` status. - PR-based workflow documentation exists in `docs/PR_REVIEW_WORKFLOW_RU.md`. - PR review evidence template exists in `docs/PR_REVIEW_EVIDENCE_RU.md`; - first reviewed PR evidence remains pending. + PR #50 required checks passed, but first reviewed PR evidence remains pending. - Public PR template includes security, registry-claim, runtime/API/UI, smoke-test, rollback and evidence checklist items. - Visible external code review remains pending until public reviewed PRs exist. diff --git a/docs/public-issues/public-issues-manifest.json b/docs/public-issues/public-issues-manifest.json index 78f0d1d..09ec2f1 100644 --- a/docs/public-issues/public-issues-manifest.json +++ b/docs/public-issues/public-issues-manifest.json @@ -113,7 +113,9 @@ "github_issue_url": "https://github.com/igor04091968/AWatch-rus/issues/48", "created_at": "2026-06-23T19:43:08Z", "created_by": "maintainer", - "next_evidence_doc": "docs/PR_REVIEW_EVIDENCE_RU.md" + "next_evidence_doc": "docs/PR_REVIEW_EVIDENCE_RU.md", + "evidence_status": "pending_review_required", + "evidence_doc": "docs/PR_REVIEW_EVIDENCE_RU.md" }, { "id": "012", @@ -124,7 +126,9 @@ "github_issue_url": "https://github.com/igor04091968/AWatch-rus/issues/49", "created_at": "2026-06-23T19:43:10Z", "created_by": "maintainer", - "next_evidence_doc": "docs/BRANCH_PROTECTION_EVIDENCE_RU.md" + "next_evidence_doc": "docs/BRANCH_PROTECTION_EVIDENCE_RU.md", + "evidence_status": "verified_active_ruleset", + "evidence_doc": "docs/BRANCH_PROTECTION_EVIDENCE_RU.md" } ] } diff --git a/docs/registry/REGISTRY_READINESS_CHANGELOG_RU.md b/docs/registry/REGISTRY_READINESS_CHANGELOG_RU.md index 301201c..e90d9d0 100644 --- a/docs/registry/REGISTRY_READINESS_CHANGELOG_RU.md +++ b/docs/registry/REGISTRY_READINESS_CHANGELOG_RU.md @@ -1,5 +1,66 @@ # Registry readiness changelog +## 2026-06-24 protected PR workflow evidence recorded + +Changed: + +- Recorded PR #50 as the first protected PR workflow reference in + `docs/PR_REVIEW_EVIDENCE_RU.md`. +- Recorded that required ruleset checks passed for PR #50: `Coverage baseline`, + `security`, `rust-checks`, `docs-registry-checks`, `smoke-checks`. +- Recorded that PR #50 remains `pending_review_required`; first reviewed PR + evidence is not claimed complete. +- Linked issue #48 in `docs/public-issues/public-issues-manifest.json` to + `docs/PR_REVIEW_EVIDENCE_RU.md` with `pending_review_required`. + +Runtime impact: + +- No runtime/product code changes. +- No API changes. +- No UI changes. +- No business logic changes. + +Guardrails: + +- GitHub remains public mirror validation only. +- Protected PR workflow evidence is governance evidence only. +- This is not registry release evidence. +- External peer review is not claimed completed. +- Russian Gitea plus planned Russian build-runner remains the primary registry + contour. + +## 2026-06-23 verified GitHub ruleset evidence + +Changed: + +- Recorded maintainer-verified active GitHub ruleset `main` for target branch + `main` in `docs/BRANCH_PROTECTION_EVIDENCE_RU.md`. +- Recorded empty bypass list, required pull request review, one required + approval, stale approval dismissal and Code Owners review. +- Recorded required status checks: `Coverage baseline`, `security`, + `rust-checks`, `docs-registry-checks`, `smoke-checks`. +- Linked issue #49 in `docs/public-issues/public-issues-manifest.json` to + verified ruleset evidence. +- Updated project status, branch protection policy and residual risks to show + branch protection risk mitigated while first reviewed PR evidence remains + pending. + +Runtime impact: + +- No runtime/product code changes. +- No API changes. +- No UI changes. +- No business logic changes. + +Guardrails: + +- GitHub remains public mirror validation only. +- Verified GitHub ruleset is public governance evidence only. +- This is not registry release evidence. +- Russian Gitea plus planned Russian build-runner remains the primary registry + contour. +- External peer review is not claimed completed. + ## 2026-06-23 branch protection and PR review evidence package Added: diff --git a/scripts/registry_readiness_check.sh b/scripts/registry_readiness_check.sh index 95083ca..2c29e07 100644 --- a/scripts/registry_readiness_check.sh +++ b/scripts/registry_readiness_check.sh @@ -239,8 +239,22 @@ if [[ -s "$PUBLIC_ISSUES_MANIFEST" ]]; then ) ) ) - and ([.issues[] | select(.id == "011" and .github_issue_url == "https://github.com/igor04091968/AWatch-rus/issues/48" and .status == "created" and .next_evidence_doc == "docs/PR_REVIEW_EVIDENCE_RU.md")] | length == 1) - and ([.issues[] | select(.id == "012" and .github_issue_url == "https://github.com/igor04091968/AWatch-rus/issues/49" and .status == "created" and .next_evidence_doc == "docs/BRANCH_PROTECTION_EVIDENCE_RU.md")] | length == 1) + and ([.issues[] | select( + .id == "011" + and .github_issue_url == "https://github.com/igor04091968/AWatch-rus/issues/48" + and .status == "created" + and .next_evidence_doc == "docs/PR_REVIEW_EVIDENCE_RU.md" + and .evidence_status == "pending_review_required" + and .evidence_doc == "docs/PR_REVIEW_EVIDENCE_RU.md" + )] | length == 1) + and ([.issues[] | select( + .id == "012" + and .github_issue_url == "https://github.com/igor04091968/AWatch-rus/issues/49" + and .status == "created" + and .next_evidence_doc == "docs/BRANCH_PROTECTION_EVIDENCE_RU.md" + and .evidence_status == "verified_active_ruleset" + and .evidence_doc == "docs/BRANCH_PROTECTION_EVIDENCE_RU.md" + )] | length == 1) ' "$PUBLIC_ISSUES_MANIFEST" >/dev/null || fail "public_issues_manifest_required_fields" elif command -v python3 >/dev/null 2>&1; then python3 - "$PUBLIC_ISSUES_MANIFEST" <<'PY' || fail "public_issues_manifest_required_fields" @@ -296,6 +310,10 @@ if issue_011.get("github_issue_url") != "https://github.com/igor04091968/AWatch- raise SystemExit("issue 011 URL mismatch") if issue_011.get("next_evidence_doc") != "docs/PR_REVIEW_EVIDENCE_RU.md": raise SystemExit("issue 011 next_evidence_doc mismatch") +if issue_011.get("evidence_status") != "pending_review_required": + raise SystemExit("issue 011 evidence_status mismatch") +if issue_011.get("evidence_doc") != "docs/PR_REVIEW_EVIDENCE_RU.md": + raise SystemExit("issue 011 evidence_doc mismatch") issue_012 = issue_by_id.get("012") or {} if issue_012.get("status") != "created": @@ -304,6 +322,10 @@ if issue_012.get("github_issue_url") != "https://github.com/igor04091968/AWatch- raise SystemExit("issue 012 URL mismatch") if issue_012.get("next_evidence_doc") != "docs/BRANCH_PROTECTION_EVIDENCE_RU.md": raise SystemExit("issue 012 next_evidence_doc mismatch") +if issue_012.get("evidence_status") != "verified_active_ruleset": + raise SystemExit("issue 012 evidence_status mismatch") +if issue_012.get("evidence_doc") != "docs/BRANCH_PROTECTION_EVIDENCE_RU.md": + raise SystemExit("issue 012 evidence_doc mismatch") PY else fail "json_validator_missing:jq_or_python3_required" @@ -340,8 +362,17 @@ require_grep "PUBLIC_ISSUES_CREATION_RUNBOOK_RU\\.md" "docs/PROJECT_STATUS_RU.md require_grep "Public issues:[[:space:]]*created and linked in manifest|Созданы 12 публичных" "docs/PROJECT_STATUS_RU.md" "project_status_issue_creation_created_urls" require_grep "PR-based workflow documentation:[[:space:]]*ready" "docs/PROJECT_STATUS_RU.md" "project_status_pr_workflow_ready" require_grep "Branch protection evidence package:[[:space:]]*ready" "docs/PROJECT_STATUS_RU.md" "project_status_branch_evidence_ready" -require_grep "pending_manual_verification" "docs/PROJECT_STATUS_RU.md" "project_status_branch_pending_manual" +require_grep 'Branch protection ruleset:[[:space:]]*`verified_active_ruleset`' "docs/PROJECT_STATUS_RU.md" "project_status_branch_verified_ruleset" +require_grep 'Branch protection target branch:[[:space:]]*`main`' "docs/PROJECT_STATUS_RU.md" "project_status_branch_target_main" +require_grep "Coverage baseline" "docs/PROJECT_STATUS_RU.md" "project_status_branch_check_coverage_baseline" +require_grep "security" "docs/PROJECT_STATUS_RU.md" "project_status_branch_check_security" +require_grep "rust-checks" "docs/PROJECT_STATUS_RU.md" "project_status_branch_check_rust_checks" +require_grep "docs-registry-checks" "docs/PROJECT_STATUS_RU.md" "project_status_branch_check_docs_registry_checks" +require_grep "smoke-checks" "docs/PROJECT_STATUS_RU.md" "project_status_branch_check_smoke_checks" require_grep "First reviewed PR evidence:[[:space:]]*pending|First reviewed PR evidence remains pending" "docs/PROJECT_STATUS_RU.md" "project_status_first_reviewed_pr_pending" +require_grep "First protected PR workflow: PR #50 opened" "docs/PROJECT_STATUS_RU.md" "project_status_first_protected_pr" +require_grep "pending_review_required" "docs/PROJECT_STATUS_RU.md" "project_status_pr_pending_review_required" +require_grep "External peer review remains pending" "docs/PROJECT_STATUS_RU.md" "project_status_external_peer_review_pending" require_grep "GITEA_BACKUP_AND_RESTORE_RUNBOOK_RU\\.md|Restore outline|Post-restore checks" "docs/registry/GITEA_BACKUP_AND_RESTORE_RUNBOOK_RU.md" "backup_restore_runbook" require_grep "awatch-gitea-backup\\.timer" "docs/registry/GITEA_BACKUP_AND_RESTORE_RUNBOOK_RU.md" "backup_timer" require_grep "sha256|SHA256" "docs/registry/GITEA_BACKUP_AND_RESTORE_RUNBOOK_RU.md" "backup_sha256" @@ -374,6 +405,11 @@ require_grep "docs/public-issues" "docs/registry/REGISTRY_READINESS_CHANGELOG_RU require_grep "runtime/product code changes" "docs/registry/REGISTRY_READINESS_CHANGELOG_RU.md" "changelog_public_issues_no_runtime" require_grep "GitHub remains public mirror validation only" "docs/registry/REGISTRY_READINESS_CHANGELOG_RU.md" "changelog_public_issues_github_role" require_grep "branch protection and PR review evidence package" "docs/registry/REGISTRY_READINESS_CHANGELOG_RU.md" "changelog_branch_pr_evidence_package" +require_grep "verified GitHub ruleset evidence" "docs/registry/REGISTRY_READINESS_CHANGELOG_RU.md" "changelog_verified_ruleset_evidence" +require_grep "protected PR workflow evidence recorded" "docs/registry/REGISTRY_READINESS_CHANGELOG_RU.md" "changelog_protected_pr_workflow" +require_grep "PR #50" "docs/registry/REGISTRY_READINESS_CHANGELOG_RU.md" "changelog_pr_50" +require_grep "pending_review_required" "docs/registry/REGISTRY_READINESS_CHANGELOG_RU.md" "changelog_pr_pending_review_required" +require_grep "This is not registry release evidence" "docs/registry/REGISTRY_READINESS_CHANGELOG_RU.md" "changelog_ruleset_not_registry_evidence" require_grep "No runtime/product code changes" "docs/registry/REGISTRY_READINESS_CHANGELOG_RU.md" "changelog_branch_pr_no_runtime" require_grep "External peer review is not claimed completed" "docs/registry/REGISTRY_READINESS_CHANGELOG_RU.md" "changelog_external_review_not_completed" require_grep "Restore test is not claimed as completed" "docs/registry/REGISTRY_READINESS_CHANGELOG_RU.md" "changelog_restore_not_completed" @@ -422,14 +458,14 @@ require_grep 'Required approvals:[[:space:]]*`1`' "docs/BRANCH_PROTECTION_POLICY require_grep "Dismiss stale approvals" "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_dismiss_stale" require_grep "CODEOWNERS" "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_codeowners_review" require_grep "Require status checks" "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_status_checks" -require_grep "CI / Rust checks" "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_ci_rust_checks" -require_grep "CI / Docs and registry checks" "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_ci_docs_registry_checks" -require_grep "CI / Smoke checks" "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_ci_smoke_checks" -require_grep "Coverage / Coverage baseline" "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_coverage_baseline_check" -require_grep "Security / Cargo audit" "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_security_cargo_audit" -require_grep "Security / Cargo deny" "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_security_cargo_deny" -require_grep "Security / Secret pattern check" "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_secret_pattern_check" -require_grep "Security / Dependency review" "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_dependency_review" +require_grep 'Ruleset name:[[:space:]]*`main`' "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_ruleset_main" +require_grep 'Enforcement:[[:space:]]*`active`' "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_enforcement_active" +require_grep "Bypass list:[[:space:]]*empty" "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_bypass_empty" +require_grep "Coverage baseline" "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_coverage_baseline_check" +require_grep "security" "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_security_check" +require_grep "rust-checks" "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_rust_checks" +require_grep "docs-registry-checks" "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_docs_registry_checks" +require_grep "smoke-checks" "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_smoke_checks" require_grep 'Require `CI` workflow' "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_ci" require_grep 'Require `Security` workflow' "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_security" require_grep 'Require `Coverage` workflow' "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_coverage" @@ -438,12 +474,21 @@ require_grep "Restrict force push" "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch require_grep "Require conversation resolution" "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_conversation_resolution" require_grep "Require linear history" "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_linear_history" require_grep "emergency-only" "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_admin_bypass" -require_grep "recommended policy|advisory branch protection policy" "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_advisory_not_enabled" -require_grep "branch_protection_status:[[:space:]]*\"pending_manual_verification\"" "docs/BRANCH_PROTECTION_EVIDENCE_RU.md" "branch_evidence_pending_manual" +require_grep "verified_active_ruleset" "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_verified_active_ruleset" +require_grep "branch_protection_status:[[:space:]]*\"verified_active_ruleset\"" "docs/BRANCH_PROTECTION_EVIDENCE_RU.md" "branch_evidence_verified_active" require_grep "https://github\\.com/igor04091968/AWatch-rus/issues/49" "docs/BRANCH_PROTECTION_EVIDENCE_RU.md" "branch_evidence_issue_49" require_grep "Not Registry Release Evidence|Not registry release evidence" "docs/BRANCH_PROTECTION_EVIDENCE_RU.md" "branch_evidence_not_registry" require_grep "Russian Contour Note" "docs/BRANCH_PROTECTION_EVIDENCE_RU.md" "branch_evidence_russian_contour" -require_grep "CI / Rust checks" "docs/BRANCH_PROTECTION_EVIDENCE_RU.md" "branch_evidence_required_checks" +require_grep 'enforcement:[[:space:]]*`active`' "docs/BRANCH_PROTECTION_EVIDENCE_RU.md" "branch_evidence_enforcement_active" +require_grep 'bypass_list:[[:space:]]*`empty`' "docs/BRANCH_PROTECTION_EVIDENCE_RU.md" "branch_evidence_bypass_empty" +require_grep 'required approvals:[[:space:]]*`1`' "docs/BRANCH_PROTECTION_EVIDENCE_RU.md" "branch_evidence_required_approvals" +require_grep 'require review from Code Owners:[[:space:]]*`enabled`' "docs/BRANCH_PROTECTION_EVIDENCE_RU.md" "branch_evidence_codeowners_enabled" +require_grep "Coverage baseline" "docs/BRANCH_PROTECTION_EVIDENCE_RU.md" "branch_evidence_coverage_baseline" +require_grep "security" "docs/BRANCH_PROTECTION_EVIDENCE_RU.md" "branch_evidence_security_check" +require_grep "rust-checks" "docs/BRANCH_PROTECTION_EVIDENCE_RU.md" "branch_evidence_rust_checks" +require_grep "docs-registry-checks" "docs/BRANCH_PROTECTION_EVIDENCE_RU.md" "branch_evidence_docs_registry_checks" +require_grep "smoke-checks" "docs/BRANCH_PROTECTION_EVIDENCE_RU.md" "branch_evidence_smoke_checks" +require_grep "GitHub ruleset / branch protection evidence is public governance evidence only" "docs/BRANCH_PROTECTION_EVIDENCE_RU.md" "branch_evidence_governance_only" require_grep "workflow documentation ready" "docs/PR_REVIEW_WORKFLOW_RU.md" "pr_workflow_ready" require_grep "https://github\\.com/igor04091968/AWatch-rus/issues/48" "docs/PR_REVIEW_WORKFLOW_RU.md" "pr_workflow_issue_48" require_grep "PR template must be completed" "docs/PR_REVIEW_WORKFLOW_RU.md" "pr_workflow_template_required" @@ -451,12 +496,26 @@ require_grep "CODEOWNERS" "docs/PR_REVIEW_WORKFLOW_RU.md" "pr_workflow_codeowner require_grep "CI, Coverage and Security checks" "docs/PR_REVIEW_WORKFLOW_RU.md" "pr_workflow_checks" require_grep "public secret-pattern scan" "docs/PR_REVIEW_WORKFLOW_RU.md" "pr_workflow_secret_scan" require_grep "GitHub Actions is public mirror validation only" "docs/PR_REVIEW_WORKFLOW_RU.md" "pr_workflow_github_public_only" -require_grep "pr_review_evidence_status:[[:space:]]*\"pending_until_first_reviewed_pr_is_merged\"" "docs/PR_REVIEW_EVIDENCE_RU.md" "pr_evidence_pending_first_reviewed_pr" +require_grep "pr_review_status:[[:space:]]*\"pending_review_required\"" "docs/PR_REVIEW_EVIDENCE_RU.md" "pr_evidence_pending_review_required" +require_grep "https://github\\.com/igor04091968/AWatch-rus/pull/50" "docs/PR_REVIEW_EVIDENCE_RU.md" "pr_evidence_pr_50" +require_grep 'Required checks status:[[:space:]]*`passed`' "docs/PR_REVIEW_EVIDENCE_RU.md" "pr_evidence_required_checks_passed" +require_grep 'Review requirement status:[[:space:]]*`pending_review_required`' "docs/PR_REVIEW_EVIDENCE_RU.md" "pr_evidence_review_pending" +require_grep 'Merge status:[[:space:]]*`open`' "docs/PR_REVIEW_EVIDENCE_RU.md" "pr_evidence_merge_open" +require_grep 'Admin bypass used:[[:space:]]*`false`' "docs/PR_REVIEW_EVIDENCE_RU.md" "pr_evidence_no_bypass" +require_grep "Coverage baseline" "docs/PR_REVIEW_EVIDENCE_RU.md" "pr_evidence_coverage_baseline" +require_grep "security" "docs/PR_REVIEW_EVIDENCE_RU.md" "pr_evidence_security" +require_grep "rust-checks" "docs/PR_REVIEW_EVIDENCE_RU.md" "pr_evidence_rust_checks" +require_grep "docs-registry-checks" "docs/PR_REVIEW_EVIDENCE_RU.md" "pr_evidence_docs_registry_checks" +require_grep "smoke-checks" "docs/PR_REVIEW_EVIDENCE_RU.md" "pr_evidence_smoke_checks" require_grep "reviewer approval" "docs/PR_REVIEW_EVIDENCE_RU.md" "pr_evidence_reviewer_approval" require_grep "External peer review completed:[[:space:]]*not claimed" "docs/PR_REVIEW_EVIDENCE_RU.md" "pr_evidence_external_not_claimed" require_grep "Not Registry Release Evidence|Not registry release evidence" "docs/PR_REVIEW_EVIDENCE_RU.md" "pr_evidence_not_registry" require_grep "\"next_evidence_doc\"[[:space:]]*:[[:space:]]*\"docs/PR_REVIEW_EVIDENCE_RU\\.md\"" "docs/public-issues/public-issues-manifest.json" "manifest_issue_48_next_evidence_doc" +require_grep "\"evidence_status\"[[:space:]]*:[[:space:]]*\"pending_review_required\"" "docs/public-issues/public-issues-manifest.json" "manifest_issue_48_evidence_status" +require_grep "\"evidence_doc\"[[:space:]]*:[[:space:]]*\"docs/PR_REVIEW_EVIDENCE_RU\\.md\"" "docs/public-issues/public-issues-manifest.json" "manifest_issue_48_evidence_doc" require_grep "\"next_evidence_doc\"[[:space:]]*:[[:space:]]*\"docs/BRANCH_PROTECTION_EVIDENCE_RU\\.md\"" "docs/public-issues/public-issues-manifest.json" "manifest_issue_49_next_evidence_doc" +require_grep "\"evidence_status\"[[:space:]]*:[[:space:]]*\"verified_active_ruleset\"" "docs/public-issues/public-issues-manifest.json" "manifest_issue_49_evidence_status" +require_grep "\"evidence_doc\"[[:space:]]*:[[:space:]]*\"docs/BRANCH_PROTECTION_EVIDENCE_RU\\.md\"" "docs/public-issues/public-issues-manifest.json" "manifest_issue_49_evidence_doc" require_grep "Один основной разработчик" "docs/RESIDUAL_RISKS_RU.md" "risk_single_developer" require_grep "Нет внешнего visible peer review" "docs/RESIDUAL_RISKS_RU.md" "risk_peer_review" require_grep "Низкая публичная активность issue tracker" "docs/RESIDUAL_RISKS_RU.md" "risk_issue_tracker_activity" @@ -599,12 +658,34 @@ fi rm -f /tmp/registry_forbidden_registry_submission_done.$$ if grep -RInEi "(branch protection).{0,120}(enabled|включ(е|ё)н|настроен|active)" "$ROOT/README.md" "$ROOT/docs/PROJECT_STATUS_RU.md" "$ROOT/docs/BRANCH_PROTECTION_POLICY_RU.md" "$ROOT/docs/BRANCH_PROTECTION_EVIDENCE_RU.md" "$ROOT/docs/PR_REVIEW_WORKFLOW_RU.md" "$ROOT/docs/PR_REVIEW_EVIDENCE_RU.md" "$REGISTRY_DIR"/*.md \ - | grep -Eiv "(not |не |не утверждает|not claimed|advisory|until repository settings|если применимо|recommended|pending_manual_verification|until maintainer evidence|until.*evidence|to verify)" \ + | grep -Eiv "(not |не |не утверждает|not claimed|no claim|no assertion|advisory|until repository settings|если применимо|recommended|pending|pending_manual_verification|verified_active_ruleset|maintainer-verified|verified active by maintainer|verified GitHub ruleset|until maintainer evidence|until.*evidence|to verify)" \ >/tmp/registry_forbidden_branch_protection_enabled.$$ 2>/dev/null; then fail "forbidden_claim_branch_protection_enabled:$(cat /tmp/registry_forbidden_branch_protection_enabled.$$)" fi rm -f /tmp/registry_forbidden_branch_protection_enabled.$$ +if grep -Eq 'pr_review_status:[[:space:]]*"verified"' "$ROOT/docs/PR_REVIEW_EVIDENCE_RU.md" \ + && ! grep -Eq 'Admin bypass used:[[:space:]]*`false`' "$ROOT/docs/PR_REVIEW_EVIDENCE_RU.md"; then + fail "pr_review_verified_requires_admin_bypass_false" +fi + +if grep -Eq 'Admin bypass used:[[:space:]]*`true`' "$ROOT/docs/PR_REVIEW_EVIDENCE_RU.md" \ + && grep -Eiq "first PR review workflow:[[:space:]]*verified|PR review workflow:[[:space:]]*verified|first reviewed PR evidence:[[:space:]]*verified" "$ROOT/docs/PROJECT_STATUS_RU.md"; then + fail "bypass_pr_must_not_mark_review_workflow_verified" +fi + +if grep -RInEi "(CodeQL|code scanning).{0,80}(enabled|required|requirement|tool)" \ + "$ROOT/docs/BRANCH_PROTECTION_EVIDENCE_RU.md" \ + "$ROOT/docs/BRANCH_PROTECTION_POLICY_RU.md" \ + "$ROOT/docs/PROJECT_STATUS_RU.md" \ + "$ROOT/docs/RESIDUAL_RISKS_RU.md" \ + "$ROOT/docs/PR_REVIEW_EVIDENCE_RU.md" \ + "$REGISTRY_DIR/REGISTRY_READINESS_CHANGELOG_RU.md" \ + >/tmp/registry_forbidden_codeql_claim.$$ 2>/dev/null; then + fail "forbidden_claim_codeql_enabled_or_required:$(cat /tmp/registry_forbidden_codeql_claim.$$)" +fi +rm -f /tmp/registry_forbidden_codeql_claim.$$ + if grep -RInEi "(external|visible|peer).{0,80}(review).{0,120}(active|performed|completed|done|выполняется|проведен|провед(е|ё)н|активен)" "$ROOT/README.md" "$ROOT/docs/PROJECT_STATUS_RU.md" "$ROOT/docs/RESIDUAL_RISKS_RU.md" "$ROOT/docs/PR_REVIEW_WORKFLOW_RU.md" "$ROOT/docs/PR_REVIEW_EVIDENCE_RU.md" "$REGISTRY_DIR"/*.md \ | grep -Eiv "(not |не |pending|still pending|не утверждает|not claimed|until public reviewed PRs|until reviewed PR evidence|unless a reviewed public PR|is not claimed)" \ >/tmp/registry_forbidden_external_review_active.$$ 2>/dev/null; then