docs(governance): record protected PR workflow evidence

docs/BRANCH_PROTECTION_EVIDENCE_RU.md

@@ -1,87 +1,107 @@
 # AWatch-rus: branch protection evidence
 
-Дата: 2026-06-23
+Дата: 2026-06-24
 
-branch_protection_status: "pending_manual_verification"
+branch_protection_status: "verified_active_ruleset"
 
 GitHub issue: https://github.com/igor04091968/AWatch-rus/issues/49
 
-Этот документ является evidence template для ручной проверки GitHub branch
-protection на публичном зеркале. Он не утверждает, что branch protection уже
-настроена или подтверждена.
+Этот документ фиксирует maintainer-verified GitHub ruleset / branch protection
+evidence для публичного зеркала. Подтверждение относится только к GitHub public
+mirror governance.
 
 ## Target
 
 - Repository: `igor04091968/AWatch-rus`.
 - Platform role: GitHub public mirror validation only.
 - Protected branch: `main`.
+- Ruleset name: `main`.
+- Enforcement: `active`.
 - Policy source: `docs/BRANCH_PROTECTION_POLICY_RU.md`.
 - Evidence owner: maintainer.
 
-## Settings To Verify
+## Verified Settings
 
-Maintainer должен вручную проверить, что для `main` configured rule включает:
+Maintainer manually verified the following GitHub UI state:
 
-- require pull request before merging;
-- require approvals: `1`;
-- dismiss stale approvals when new commits are pushed;
-- require review from CODEOWNERS, if available on the current GitHub plan;
-- require status checks to pass before merging;
-- require branches to be up to date before merging, if compatible with current
-  maintainer workflow;
-- restrict force pushes;
-- restrict deletions;
-- administrator bypass decision documented, preferably disabled for stricter
-  mode.
+- verification date: `2026-06-24`;
+- maintainer: `maintainer`;
+- repository: `github.com/igor04091968/AWatch-rus`;
+- ruleset name: `main`;
+- enforcement: `active`;
+- target branch: `main`;
+- applies_to_targets: `1`;
+- bypass_list: `empty`;
+- required pull request: `enabled`;
+- required approvals: `1`;
+- dismiss stale pull request approvals when new commits are pushed: `enabled`;
+- require review from Code Owners: `enabled`;
+- block force pushes: `enabled`.
 
-## Required Checks
+## Verified Required Status Checks
 
-Expected required checks are based on current workflow/job names:
+GitHub ruleset required status checks verified in the UI:
 
-- `CI / Rust checks`
-- `CI / Docs and registry checks`
-- `CI / Smoke checks`
-- `Coverage / Coverage baseline`
-- `Security / Cargo audit`
-- `Security / Cargo deny`
-- `Security / Secret pattern check`
-- `Security / Dependency review`
+- `Coverage baseline`
+- `security`
+- `rust-checks`
+- `docs-registry-checks`
+- `smoke-checks`
 
-If GitHub displays a different context name, record the exact displayed name and
-update `docs/BRANCH_PROTECTION_POLICY_RU.md` before marking verification done.
-
-## Manual Verification Procedure
-
-1. Open repository settings for `igor04091968/AWatch-rus`.
-2. Open branch protection or repository rules for branch `main`.
-3. Compare enabled settings against this document and
-   `docs/BRANCH_PROTECTION_POLICY_RU.md`.
-4. Verify required status-check names exactly as GitHub displays them.
-5. Capture screenshot evidence without private account data or tokens.
-6. Record evidence fields below.
-7. Only after verification, update `branch_protection_status` from
-   `"pending_manual_verification"` to `"verified"` in a follow-up change.
+These names are the ruleset-visible required check names from GitHub UI. They
+may differ from the human-readable workflow job names shown inside workflow
+files.
 
 ## Evidence Record
 
 - Screenshot filename placeholder:
-  `docs/evidence/github-branch-protection-main-YYYY-MM-DD.png`
-- Date: `YYYY-MM-DD`
+  `docs/evidence/github-ruleset-main-2026-06-24.png`
+- Date: `2026-06-24`
 - Maintainer: `maintainer`
-- Repository: `igor04091968/AWatch-rus`
+- Repository: `github.com/igor04091968/AWatch-rus`
+- Ruleset: `main`
 - Protected branch: `main`
-- Required checks verified: `pending`
-- Admin bypass decision: `pending`
-- Force-push restriction verified: `pending`
-- Deletion restriction verified: `pending`
-- Notes: `pending`
+- Enforcement: `active`
+- Applies to targets: `1`
+- Bypass list: `empty`
+- Required checks verified: `Coverage baseline`, `security`, `rust-checks`,
+  `docs-registry-checks`, `smoke-checks`
+- Force-push restriction verified: `enabled`
+- Notes: GitHub UI confirms active ruleset for target branch `main`.
+
+## First Protected PR Validation
+
+- PR URL: `https://github.com/igor04091968/AWatch-rus/pull/50`
+- Linked governance issue: `https://github.com/igor04091968/AWatch-rus/issues/49`
+- PR source branch: `docs/verified-github-ruleset-evidence`
+- PR target branch: `main`
+- Runtime/API/UI/product code changes: `none`
+- Required checks status: `passed`
+- Required checks: `Coverage baseline`, `security`, `rust-checks`,
+  `docs-registry-checks`, `smoke-checks`
+- Review requirement status: `pending_review_required`
+- Merge status: `open`
+- Admin bypass used: `false`
+- Outcome note: PR #50 confirms required checks execute under the active ruleset;
+  review/merge evidence is not yet complete.
+
+## Future Reverification Procedure
+
+1. Open repository settings for `igor04091968/AWatch-rus`.
+2. Open repository rules/rulesets for `main`.
+3. Confirm enforcement remains `active`.
+4. Confirm target branch remains `main`.
+5. Confirm bypass list remains empty.
+6. Confirm required PR, approvals, stale dismissal, Code Owners review, status
+   checks and force-push block.
+7. Capture screenshot evidence without private account data or tokens.
 
 ## Not Registry Release Evidence
 
-GitHub branch protection evidence is governance/process evidence for the public
-mirror. It is not registry release evidence and does not replace release
-artifacts, checksums, build logs or release evidence from the Russian
-build-runner.
+GitHub ruleset / branch protection evidence is public governance evidence only.
+It is not Russian registry release evidence and does not replace Russian
+Gitea/build-runner release contour, release artifacts, checksums, build logs or
+release evidence from the Russian build-runner.
 
 ## Russian Contour Note
 
@@ -92,7 +112,6 @@ Russian build-runner. GitHub remains public mirror validation only.
 
 - Do not record secrets, tokens, private URLs or account recovery details.
 - Do not include private employee/customer data in screenshots.
-- Do not claim branch protection is verified until maintainer evidence exists.
 - Do not claim completed registry submission.
 - Do not claim certification.
 - Do not claim SIEM/DLP replacement.

docs/BRANCH_PROTECTION_POLICY_RU.md

@@ -2,9 +2,8 @@
 
 Дата: 2026-06-23
 
-Статус: recommended policy. Этот документ описывает целевую настройку GitHub
-branch protection для публичного зеркала. Он не утверждает, что branch
-protection уже включен.
+Статус: recommended policy plus verified GitHub ruleset evidence. GitHub UI
+verification is recorded in `docs/BRANCH_PROTECTION_EVIDENCE_RU.md`.
 
 GitHub остается public mirror validation surface. Primary registry-readiness
 contour остается Russian Gitea plus Russian build-runner release evidence.
@@ -12,6 +11,7 @@ contour остается Russian Gitea plus Russian build-runner release evidenc
 ## Scope
 
 - Branch: `main`.
+- Ruleset: `main`.
 - Platform: GitHub public mirror.
 - Purpose: visible review discipline, status-check discipline and public
   engineering maturity signal.
@@ -36,10 +36,15 @@ contour остается Russian Gitea plus Russian build-runner release evidenc
 
 Recommended settings for `main` on the GitHub public mirror:
 
+- Ruleset name: `main`.
+- Enforcement: `active`.
+- Target branches: `main`.
+- Applies to: `1` target, `main`.
+- Bypass list: empty.
 - Require pull request before merging.
 - Required approvals: `1`.
 - Dismiss stale approvals when new commits are pushed.
-- Require review from CODEOWNERS if available on the current GitHub plan.
+- Require review from Code Owners.
 - Require status checks to pass before merging.
 - Require branches to be up to date before merging if this does not block the
   current maintainer workflow.
@@ -48,24 +53,24 @@ Recommended settings for `main` on the GitHub public mirror:
 - Allow administrators bypass: documented decision only; stricter mode should
   keep bypass disabled unless repository recovery requires it.
 
-Recommended required checks, using current workflow/job names:
+Verified ruleset required status checks from GitHub UI:
 
-- `CI / Rust checks`
-- `CI / Docs and registry checks`
-- `CI / Smoke checks`
-- `Coverage / Coverage baseline`
-- `Security / Cargo audit`
-- `Security / Cargo deny`
-- `Security / Secret pattern check`
-- `Security / Dependency review`
+- `Coverage baseline`
+- `security`
+- `rust-checks`
+- `docs-registry-checks`
+- `smoke-checks`
 
-Before verification, maintainer must compare these names with the exact check
-names displayed by GitHub. If GitHub displays different names, update this
-document and `docs/BRANCH_PROTECTION_EVIDENCE_RU.md` before recording evidence.
+Workflow/job-name mapping for operator review:
 
-Current evidence status is tracked in
-`docs/BRANCH_PROTECTION_EVIDENCE_RU.md` and remains
-`pending_manual_verification` until maintainer evidence is recorded.
+- `Coverage baseline`: Coverage workflow baseline job.
+- `rust-checks`: CI Rust checks job.
+- `docs-registry-checks`: CI docs and registry checks job.
+- `smoke-checks`: CI smoke checks job.
+- `security`: security validation context shown by GitHub rulesets UI.
+
+Current evidence status is `verified_active_ruleset` in
+`docs/BRANCH_PROTECTION_EVIDENCE_RU.md`.
 
 ## Review expectations
 

docs/PROJECT_STATUS_RU.md

@@ -53,8 +53,12 @@ backup, registry-readiness документации, плана российск
   (`docs/PR_REVIEW_EVIDENCE_RU.md`).
 - Branch protection evidence package: ready
   (`docs/BRANCH_PROTECTION_EVIDENCE_RU.md`).
-- Branch protection actual enablement:
-  `pending_manual_verification`.
+- Branch protection ruleset: `verified_active_ruleset`.
+- Branch protection target branch: `main`.
+- Branch protection required checks: `Coverage baseline`, `security`,
+  `rust-checks`, `docs-registry-checks`, `smoke-checks`.
+- First protected PR workflow: PR #50 opened; required checks passed;
+  review/merge still `pending_review_required`.
 - First reviewed PR evidence: pending.
 
 ## Что готово
@@ -92,10 +96,17 @@ backup, registry-readiness документации, плана российск
   `docs/BRANCH_PROTECTION_POLICY_RU.md`.
 - Branch protection evidence template prepared:
   `docs/BRANCH_PROTECTION_EVIDENCE_RU.md`.
+- GitHub ruleset / branch protection for `main` verified active by maintainer:
+  ruleset `main`, target branch `main`, empty bypass list, required PR with
+  one approval, stale approval dismissal, Code Owners review, required status
+  checks and force-push blocking.
 - PR-based review workflow documented:
   `docs/PR_REVIEW_WORKFLOW_RU.md`.
 - PR review evidence template prepared:
   `docs/PR_REVIEW_EVIDENCE_RU.md`.
+- First protected PR workflow evidence recorded for PR #50:
+  required checks passed; review requirement is still pending; merge status is
+  open; no admin bypass recorded.
 - Зафиксирован residual risk register:
   `docs/RESIDUAL_RISKS_RU.md`.
 - Подготовлен план публичных issues для ручного заведения:
@@ -117,11 +128,9 @@ backup, registry-readiness документации, плана российск
 - Финальная юридическая проверка пакета документов перед подачей.
 - Проверка совместимости с российскими ОС.
 - Visible external code review is still pending.
-- Branch protection enablement is not claimed until repository settings are
-  verified.
-- Branch protection actual enablement remains `pending_manual_verification`.
 - First reviewed PR evidence remains pending until a reviewed public PR is
   merged and evidence is recorded.
+- External peer review remains pending.
 - Community adoption remains low until external contributors, public reviews
   and sustained third-party activity appear.
 

docs/PR_REVIEW_EVIDENCE_RU.md

@@ -1,13 +1,14 @@
 # AWatch-rus: PR review evidence
 
-Дата: 2026-06-23
+Дата: 2026-06-24
 
-pr_review_evidence_status: "pending_until_first_reviewed_pr_is_merged"
+pr_review_status: "pending_review_required"
 
 GitHub issue: https://github.com/igor04091968/AWatch-rus/issues/48
 
-Этот документ фиксирует, что будет считаться evidence для PR-based review
-workflow. Он не утверждает, что external peer review уже выполнен.
+Этот документ фиксирует evidence первого protected PR-based workflow после
+включения GitHub ruleset на `main`. Он не утверждает, что review requirement
+уже выполнен или что external peer review завершен.
 
 ## Evidence Criteria
 
@@ -23,16 +24,23 @@ workflow. Он не утверждает, что external peer review уже в
 
 ## Evidence Record
 
-- PR URL: `pending`
-- Linked issue URL: `pending`
+- PR URL: `https://github.com/igor04091968/AWatch-rus/pull/50`
+- Linked issue URL: `https://github.com/igor04091968/AWatch-rus/issues/48`
+- Evidence issue URL: `https://github.com/igor04091968/AWatch-rus/issues/49`
+- Required checks status: `passed`
+- Required checks: `Coverage baseline`, `security`, `rust-checks`,
+  `docs-registry-checks`, `smoke-checks`
+- Review requirement status: `pending_review_required`
+- Merge status: `open`
+- Admin bypass used: `false`
 - Reviewer: `pending`
 - Reviewer type: `pending`
 - Approval URL or screenshot filename: `pending`
-- Passed checks: `pending`
 - Merge commit: `pending`
-- Bypass used: `pending`
-- Date: `YYYY-MM-DD`
-- Maintainer note: `pending`
+- Date: `2026-06-24`
+- Maintainer note: PR #50 demonstrates protected branch workflow and required
+  checks execution, but first reviewed PR evidence remains pending until review
+  requirement is satisfied and the PR is merged without bypass.
 
 ## Reviewer Interpretation
 
@@ -46,6 +54,8 @@ the review is visible.
 - PR workflow documentation: ready.
 - PR template: ready.
 - CODEOWNERS routing: ready.
+- First protected PR validation reference: PR #50.
+- Required checks for PR #50: passed.
 - First reviewed PR evidence: pending.
 - External peer review completed: not claimed.
 

docs/RESIDUAL_RISKS_RU.md

@@ -50,26 +50,31 @@ visibility, release evidence contour and legal package. Они требуют д
 
 ## 2. Нет внешнего visible peer review / публично видимого peer review
 
-- Текущий статус: риск открыт; PR template, CODEOWNERS, public governance
-  issues and PR workflow docs exist, but first reviewed PR evidence and branch
-  protection verification are still pending.
+- Текущий статус: риск открыт частично; PR template, CODEOWNERS, public
+  governance issues, PR workflow docs and verified active GitHub ruleset for
+  `main` exist. PR #50 has run through protected checks, but first reviewed PR
+  evidence is still pending because review/merge is not complete.
 - Влияние: внешним аудиторам сложнее оценить review discipline and change
   control maturity.
 - Почему не блокирует pilot/readiness stage: current changes are protected by
   reproducible checks, public workflows and documented conservative positioning.
 - Как риск будет снижаться: review checklist, CODEOWNERS routing, public issue
-  #48, `docs/PR_REVIEW_WORKFLOW_RU.md`, first public reviewed PR evidence,
-  explicit release branch review policy and verified branch protection evidence.
+  #48, `docs/PR_REVIEW_WORKFLOW_RU.md`, first public reviewed PR evidence and
+  explicit release branch review policy.
 - Уже снижающие evidence/documents/CI: `.github/pull_request_template.md`,
   `.github/CODEOWNERS`, `.github/ISSUE_TEMPLATE/`,
   `docs/REVIEW_CHECKLIST_RU.md`, `docs/BRANCH_PROTECTION_POLICY_RU.md`,
   `docs/BRANCH_PROTECTION_EVIDENCE_RU.md`,
   `docs/PR_REVIEW_WORKFLOW_RU.md`, `docs/PR_REVIEW_EVIDENCE_RU.md`,
   `CONTRIBUTING.md`, `SECURITY.md`, public CI, public security workflow.
-- Residual risk: remains open until branch protection is verified and first
-  reviewed PR evidence exists.
-- Следующий action: выполнить maintainer verification for branch protection and
-  record first reviewed PR evidence without overstating external peer review.
+- Branch protection pending risk: mitigated by verified active GitHub ruleset
+  for `main` with empty bypass list, required PR review, Code Owners review,
+  required status checks and force-push blocking.
+- PR workflow risk: remains open until PR #50 or a later PR is reviewed and
+  merged without bypass.
+- Residual risk: remains open until first reviewed PR evidence exists.
+- Следующий action: record first reviewed PR evidence without overstating
+  external peer review.
 
 ## 3. Низкая публичная активность issue tracker
 
@@ -185,12 +190,11 @@ visibility, release evidence contour and legal package. Они требуют д
 - PR review checklist exists in `docs/REVIEW_CHECKLIST_RU.md`.
 - Advisory branch protection policy exists in
   `docs/BRANCH_PROTECTION_POLICY_RU.md`.
-- Branch protection evidence template exists in
-  `docs/BRANCH_PROTECTION_EVIDENCE_RU.md` with
-  `pending_manual_verification` status.
+- Branch protection evidence exists in `docs/BRANCH_PROTECTION_EVIDENCE_RU.md`
+  with `verified_active_ruleset` status.
 - PR-based workflow documentation exists in `docs/PR_REVIEW_WORKFLOW_RU.md`.
 - PR review evidence template exists in `docs/PR_REVIEW_EVIDENCE_RU.md`;
-  first reviewed PR evidence remains pending.
+  PR #50 required checks passed, but first reviewed PR evidence remains pending.
 - Public PR template includes security, registry-claim, runtime/API/UI,
   smoke-test, rollback and evidence checklist items.
 - Visible external code review remains pending until public reviewed PRs exist.

docs/public-issues/public-issues-manifest.json

@@ -113,7 +113,9 @@
       "github_issue_url": "https://github.com/igor04091968/AWatch-rus/issues/48",
       "created_at": "2026-06-23T19:43:08Z",
       "created_by": "maintainer",
-      "next_evidence_doc": "docs/PR_REVIEW_EVIDENCE_RU.md"
+      "next_evidence_doc": "docs/PR_REVIEW_EVIDENCE_RU.md",
+      "evidence_status": "pending_review_required",
+      "evidence_doc": "docs/PR_REVIEW_EVIDENCE_RU.md"
     },
     {
       "id": "012",
@@ -124,7 +126,9 @@
       "github_issue_url": "https://github.com/igor04091968/AWatch-rus/issues/49",
       "created_at": "2026-06-23T19:43:10Z",
       "created_by": "maintainer",
-      "next_evidence_doc": "docs/BRANCH_PROTECTION_EVIDENCE_RU.md"
+      "next_evidence_doc": "docs/BRANCH_PROTECTION_EVIDENCE_RU.md",
+      "evidence_status": "verified_active_ruleset",
+      "evidence_doc": "docs/BRANCH_PROTECTION_EVIDENCE_RU.md"
     }
   ]
 }

docs/registry/REGISTRY_READINESS_CHANGELOG_RU.md

@@ -1,5 +1,66 @@
 # Registry readiness changelog
 
+## 2026-06-24 protected PR workflow evidence recorded
+
+Changed:
+
+- Recorded PR #50 as the first protected PR workflow reference in
+  `docs/PR_REVIEW_EVIDENCE_RU.md`.
+- Recorded that required ruleset checks passed for PR #50: `Coverage baseline`,
+  `security`, `rust-checks`, `docs-registry-checks`, `smoke-checks`.
+- Recorded that PR #50 remains `pending_review_required`; first reviewed PR
+  evidence is not claimed complete.
+- Linked issue #48 in `docs/public-issues/public-issues-manifest.json` to
+  `docs/PR_REVIEW_EVIDENCE_RU.md` with `pending_review_required`.
+
+Runtime impact:
+
+- No runtime/product code changes.
+- No API changes.
+- No UI changes.
+- No business logic changes.
+
+Guardrails:
+
+- GitHub remains public mirror validation only.
+- Protected PR workflow evidence is governance evidence only.
+- This is not registry release evidence.
+- External peer review is not claimed completed.
+- Russian Gitea plus planned Russian build-runner remains the primary registry
+  contour.
+
+## 2026-06-23 verified GitHub ruleset evidence
+
+Changed:
+
+- Recorded maintainer-verified active GitHub ruleset `main` for target branch
+  `main` in `docs/BRANCH_PROTECTION_EVIDENCE_RU.md`.
+- Recorded empty bypass list, required pull request review, one required
+  approval, stale approval dismissal and Code Owners review.
+- Recorded required status checks: `Coverage baseline`, `security`,
+  `rust-checks`, `docs-registry-checks`, `smoke-checks`.
+- Linked issue #49 in `docs/public-issues/public-issues-manifest.json` to
+  verified ruleset evidence.
+- Updated project status, branch protection policy and residual risks to show
+  branch protection risk mitigated while first reviewed PR evidence remains
+  pending.
+
+Runtime impact:
+
+- No runtime/product code changes.
+- No API changes.
+- No UI changes.
+- No business logic changes.
+
+Guardrails:
+
+- GitHub remains public mirror validation only.
+- Verified GitHub ruleset is public governance evidence only.
+- This is not registry release evidence.
+- Russian Gitea plus planned Russian build-runner remains the primary registry
+  contour.
+- External peer review is not claimed completed.
+
 ## 2026-06-23 branch protection and PR review evidence package
 
 Added: