docs(governance): record protected PR workflow evidence

2026-06-24 01:11:54 +03:00
parent 7e6c067adf
commit 34e017673a
9 changed files with 339 additions and 146 deletions
@@ -6,43 +6,43 @@
 # submissions.
 # Repository default owner.
-* @igor04091968
+* @igor04091968 @rachkovii68-bisness
 # Rust workspace and crates.
-/adk-rust/ @igor04091968
+/adk-rust/ @igor04091968 @rachkovii68-bisness
-**/Cargo.toml @igor04091968
+**/Cargo.toml @igor04091968 @rachkovii68-bisness
-**/Cargo.lock @igor04091968
+**/Cargo.lock @igor04091968 @rachkovii68-bisness
-**/*.rs @igor04091968
+**/*.rs @igor04091968 @rachkovii68-bisness
 # Operational scripts and automation.
-/scripts/ @igor04091968
+/scripts/ @igor04091968 @rachkovii68-bisness
 # Product documentation, demo material and screenshots.
-/docs/ @igor04091968
+/docs/ @igor04091968 @rachkovii68-bisness
-/docs/demo/ @igor04091968
+/docs/demo/ @igor04091968 @rachkovii68-bisness
-/docs/screenshots/ @igor04091968
+/docs/screenshots/ @igor04091968 @rachkovii68-bisness
-/docs/assets/screenshots/ @igor04091968
+/docs/assets/screenshots/ @igor04091968 @rachkovii68-bisness
 # Registry-readiness evidence and policy documents.
-/docs/registry/ @igor04091968
+/docs/registry/ @igor04091968 @rachkovii68-bisness
 # GitHub public mirror validation metadata and governance controls.
-/.github/workflows/ @igor04091968
+/.github/workflows/ @igor04091968 @rachkovii68-bisness
-/.github/workflows/ci.yml @igor04091968
+/.github/workflows/ci.yml @igor04091968 @rachkovii68-bisness
-/.github/workflows/security.yml @igor04091968
+/.github/workflows/security.yml @igor04091968 @rachkovii68-bisness
-/.github/workflows/coverage.yml @igor04091968
+/.github/workflows/coverage.yml @igor04091968 @rachkovii68-bisness
-/.github/pull_request_template.md @igor04091968
+/.github/pull_request_template.md @igor04091968 @rachkovii68-bisness
-/.github/ISSUE_TEMPLATE/ @igor04091968
+/.github/ISSUE_TEMPLATE/ @igor04091968 @rachkovii68-bisness
-/.github/CODEOWNERS @igor04091968
+/.github/CODEOWNERS @igor04091968 @rachkovii68-bisness
-/docs/BRANCH_PROTECTION_POLICY_RU.md @igor04091968
+/docs/BRANCH_PROTECTION_POLICY_RU.md @igor04091968 @rachkovii68-bisness
-/docs/BRANCH_PROTECTION_EVIDENCE_RU.md @igor04091968
+/docs/BRANCH_PROTECTION_EVIDENCE_RU.md @igor04091968 @rachkovii68-bisness
-/docs/PR_REVIEW_WORKFLOW_RU.md @igor04091968
+/docs/PR_REVIEW_WORKFLOW_RU.md @igor04091968 @rachkovii68-bisness
-/docs/PR_REVIEW_EVIDENCE_RU.md @igor04091968
+/docs/PR_REVIEW_EVIDENCE_RU.md @igor04091968 @rachkovii68-bisness
 # Ansible deployment automation.
-/ansible/ @igor04091968
+/ansible/ @igor04091968 @rachkovii68-bisness
 # Security and contribution governance.
-/SECURITY.md @igor04091968
+/SECURITY.md @igor04091968 @rachkovii68-bisness
-/CONTRIBUTING.md @igor04091968
+/CONTRIBUTING.md @igor04091968 @rachkovii68-bisness
-/deny.toml @igor04091968
+/deny.toml @igor04091968 @rachkovii68-bisness
@@ -1,87 +1,107 @@
 # AWatch-rus: branch protection evidence
-Дата: 2026-06-23
+Дата: 2026-06-24
-branch_protection_status: "pending_manual_verification"
+branch_protection_status: "verified_active_ruleset"
 GitHub issue: https://github.com/igor04091968/AWatch-rus/issues/49
-Этот документ является evidence template для ручной проверки GitHub branch
+Этот документ фиксирует maintainer-verified GitHub ruleset / branch protection
-protection на публичном зеркале. Он не утверждает, что branch protection уже
+evidence для публичного зеркала. Подтверждение относится только к GitHub public
-настроена или подтверждена.
+mirror governance.
 ## Target
 - Repository: `igor04091968/AWatch-rus`.
 - Platform role: GitHub public mirror validation only.
 - Protected branch: `main`.
 - Ruleset name: `main`.
 - Enforcement: `active`.
 - Policy source: `docs/BRANCH_PROTECTION_POLICY_RU.md`.
 - Evidence owner: maintainer.
-## Settings To Verify
+## Verified Settings
-Maintainer должен вручную проверить, что для `main` configured rule включает:
+Maintainer manually verified the following GitHub UI state:
- require pull request before merging;
+- verification date: `2026-06-24`;
- require approvals: `1`;
+- maintainer: `maintainer`;
- dismiss stale approvals when new commits are pushed;
+- repository: `github.com/igor04091968/AWatch-rus`;
- require review from CODEOWNERS, if available on the current GitHub plan;
+- ruleset name: `main`;
- require status checks to pass before merging;
+- enforcement: `active`;
- require branches to be up to date before merging, if compatible with current
+- target branch: `main`;
-  maintainer workflow;
+- applies_to_targets: `1`;
- restrict force pushes;
+- bypass_list: `empty`;
- restrict deletions;
+- required pull request: `enabled`;
- administrator bypass decision documented, preferably disabled for stricter
+- required approvals: `1`;
-  mode.
+- dismiss stale pull request approvals when new commits are pushed: `enabled`;
 - require review from Code Owners: `enabled`;
 - block force pushes: `enabled`.
-## Required Checks
+## Verified Required Status Checks
-Expected required checks are based on current workflow/job names:
+GitHub ruleset required status checks verified in the UI:
- `CI / Rust checks`
+- `Coverage baseline`
- `CI / Docs and registry checks`
+- `security`
- `CI / Smoke checks`
+- `rust-checks`
- `Coverage / Coverage baseline`
+- `docs-registry-checks`
- `Security / Cargo audit`
+- `smoke-checks`
 - `Security / Cargo deny`
 - `Security / Secret pattern check`
 - `Security / Dependency review`
-If GitHub displays a different context name, record the exact displayed name and
+These names are the ruleset-visible required check names from GitHub UI. They
-update `docs/BRANCH_PROTECTION_POLICY_RU.md` before marking verification done.
+may differ from the human-readable workflow job names shown inside workflow
-
+files.
 ## Manual Verification Procedure
 1. Open repository settings for `igor04091968/AWatch-rus`.
 2. Open branch protection or repository rules for branch `main`.
 3. Compare enabled settings against this document and
   `docs/BRANCH_PROTECTION_POLICY_RU.md`.
 4. Verify required status-check names exactly as GitHub displays them.
 5. Capture screenshot evidence without private account data or tokens.
 6. Record evidence fields below.
 7. Only after verification, update `branch_protection_status` from
   `"pending_manual_verification"` to `"verified"` in a follow-up change.
 ## Evidence Record
 - Screenshot filename placeholder:
-  `docs/evidence/github-branch-protection-main-YYYY-MM-DD.png`
+  `docs/evidence/github-ruleset-main-2026-06-24.png`
- Date: `YYYY-MM-DD`
+- Date: `2026-06-24`
 - Maintainer: `maintainer`
- Repository: `igor04091968/AWatch-rus`
+- Repository: `github.com/igor04091968/AWatch-rus`
 - Ruleset: `main`
 - Protected branch: `main`
- Required checks verified: `pending`
+- Enforcement: `active`
- Admin bypass decision: `pending`
+- Applies to targets: `1`
- Force-push restriction verified: `pending`
+- Bypass list: `empty`
- Deletion restriction verified: `pending`
+- Required checks verified: `Coverage baseline`, `security`, `rust-checks`,
- Notes: `pending`
+  `docs-registry-checks`, `smoke-checks`
 - Force-push restriction verified: `enabled`
 - Notes: GitHub UI confirms active ruleset for target branch `main`.
 ## First Protected PR Validation
 - PR URL: `https://github.com/igor04091968/AWatch-rus/pull/50`
 - Linked governance issue: `https://github.com/igor04091968/AWatch-rus/issues/49`
 - PR source branch: `docs/verified-github-ruleset-evidence`
 - PR target branch: `main`
 - Runtime/API/UI/product code changes: `none`
 - Required checks status: `passed`
 - Required checks: `Coverage baseline`, `security`, `rust-checks`,
  `docs-registry-checks`, `smoke-checks`
 - Review requirement status: `pending_review_required`
 - Merge status: `open`
 - Admin bypass used: `false`
 - Outcome note: PR #50 confirms required checks execute under the active ruleset;
  review/merge evidence is not yet complete.
 ## Future Reverification Procedure
 1. Open repository settings for `igor04091968/AWatch-rus`.
 2. Open repository rules/rulesets for `main`.
 3. Confirm enforcement remains `active`.
 4. Confirm target branch remains `main`.
 5. Confirm bypass list remains empty.
 6. Confirm required PR, approvals, stale dismissal, Code Owners review, status
   checks and force-push block.
 7. Capture screenshot evidence without private account data or tokens.
 ## Not Registry Release Evidence
-GitHub branch protection evidence is governance/process evidence for the public
+GitHub ruleset / branch protection evidence is public governance evidence only.
-mirror. It is not registry release evidence and does not replace release
+It is not Russian registry release evidence and does not replace Russian
-artifacts, checksums, build logs or release evidence from the Russian
+Gitea/build-runner release contour, release artifacts, checksums, build logs or
-build-runner.
+release evidence from the Russian build-runner.
 ## Russian Contour Note
@@ -92,7 +112,6 @@ Russian build-runner. GitHub remains public mirror validation only.
 - Do not record secrets, tokens, private URLs or account recovery details.
 - Do not include private employee/customer data in screenshots.
 - Do not claim branch protection is verified until maintainer evidence exists.
 - Do not claim completed registry submission.
 - Do not claim certification.
 - Do not claim SIEM/DLP replacement.
@@ -2,9 +2,8 @@
 Дата: 2026-06-23
-Статус: recommended policy. Этот документ описывает целевую настройку GitHub
+Статус: recommended policy plus verified GitHub ruleset evidence. GitHub UI
-branch protection для публичного зеркала. Он не утверждает, что branch
+verification is recorded in `docs/BRANCH_PROTECTION_EVIDENCE_RU.md`.
 protection уже включен.
 GitHub остается public mirror validation surface. Primary registry-readiness
 contour остается Russian Gitea plus Russian build-runner release evidence.
@@ -12,6 +11,7 @@ contour остается Russian Gitea plus Russian build-runner release evidenc
 ## Scope
 - Branch: `main`.
 - Ruleset: `main`.
 - Platform: GitHub public mirror.
 - Purpose: visible review discipline, status-check discipline and public
  engineering maturity signal.
@@ -36,10 +36,15 @@ contour остается Russian Gitea plus Russian build-runner release evidenc
 Recommended settings for `main` on the GitHub public mirror:
 - Ruleset name: `main`.
 - Enforcement: `active`.
 - Target branches: `main`.
 - Applies to: `1` target, `main`.
 - Bypass list: empty.
 - Require pull request before merging.
 - Required approvals: `1`.
 - Dismiss stale approvals when new commits are pushed.
- Require review from CODEOWNERS if available on the current GitHub plan.
+- Require review from Code Owners.
 - Require status checks to pass before merging.
 - Require branches to be up to date before merging if this does not block the
  current maintainer workflow.
@@ -48,24 +53,24 @@ Recommended settings for `main` on the GitHub public mirror:
 - Allow administrators bypass: documented decision only; stricter mode should
  keep bypass disabled unless repository recovery requires it.
-Recommended required checks, using current workflow/job names:
+Verified ruleset required status checks from GitHub UI:
- `CI / Rust checks`
+- `Coverage baseline`
- `CI / Docs and registry checks`
+- `security`
- `CI / Smoke checks`
+- `rust-checks`
- `Coverage / Coverage baseline`
+- `docs-registry-checks`
- `Security / Cargo audit`
+- `smoke-checks`
 - `Security / Cargo deny`
 - `Security / Secret pattern check`
 - `Security / Dependency review`
-Before verification, maintainer must compare these names with the exact check
+Workflow/job-name mapping for operator review:
 names displayed by GitHub. If GitHub displays different names, update this
 document and `docs/BRANCH_PROTECTION_EVIDENCE_RU.md` before recording evidence.
-Current evidence status is tracked in
+- `Coverage baseline`: Coverage workflow baseline job.
-`docs/BRANCH_PROTECTION_EVIDENCE_RU.md` and remains
+- `rust-checks`: CI Rust checks job.
-`pending_manual_verification` until maintainer evidence is recorded.
+- `docs-registry-checks`: CI docs and registry checks job.
 - `smoke-checks`: CI smoke checks job.
 - `security`: security validation context shown by GitHub rulesets UI.
 Current evidence status is `verified_active_ruleset` in
 `docs/BRANCH_PROTECTION_EVIDENCE_RU.md`.
 ## Review expectations
@@ -53,8 +53,12 @@ backup, registry-readiness документации, плана российск
  (`docs/PR_REVIEW_EVIDENCE_RU.md`).
 - Branch protection evidence package: ready
  (`docs/BRANCH_PROTECTION_EVIDENCE_RU.md`).
- Branch protection actual enablement:
+- Branch protection ruleset: `verified_active_ruleset`.
-  `pending_manual_verification`.
+- Branch protection target branch: `main`.
 - Branch protection required checks: `Coverage baseline`, `security`,
  `rust-checks`, `docs-registry-checks`, `smoke-checks`.
 - First protected PR workflow: PR #50 opened; required checks passed;
  review/merge still `pending_review_required`.
 - First reviewed PR evidence: pending.
 ## Что готово
@@ -92,10 +96,17 @@ backup, registry-readiness документации, плана российск
  `docs/BRANCH_PROTECTION_POLICY_RU.md`.
 - Branch protection evidence template prepared:
  `docs/BRANCH_PROTECTION_EVIDENCE_RU.md`.
 - GitHub ruleset / branch protection for `main` verified active by maintainer:
  ruleset `main`, target branch `main`, empty bypass list, required PR with
  one approval, stale approval dismissal, Code Owners review, required status
  checks and force-push blocking.
 - PR-based review workflow documented:
  `docs/PR_REVIEW_WORKFLOW_RU.md`.
 - PR review evidence template prepared:
  `docs/PR_REVIEW_EVIDENCE_RU.md`.
 - First protected PR workflow evidence recorded for PR #50:
  required checks passed; review requirement is still pending; merge status is
  open; no admin bypass recorded.
 - Зафиксирован residual risk register:
  `docs/RESIDUAL_RISKS_RU.md`.
 - Подготовлен план публичных issues для ручного заведения:
@@ -117,11 +128,9 @@ backup, registry-readiness документации, плана российск
 - Финальная юридическая проверка пакета документов перед подачей.
 - Проверка совместимости с российскими ОС.
 - Visible external code review is still pending.
 - Branch protection enablement is not claimed until repository settings are
  verified.
 - Branch protection actual enablement remains `pending_manual_verification`.
 - First reviewed PR evidence remains pending until a reviewed public PR is
  merged and evidence is recorded.
 - External peer review remains pending.
 - Community adoption remains low until external contributors, public reviews
  and sustained third-party activity appear.
@@ -1,13 +1,14 @@
 # AWatch-rus: PR review evidence
-Дата: 2026-06-23
+Дата: 2026-06-24
-pr_review_evidence_status: "pending_until_first_reviewed_pr_is_merged"
+pr_review_status: "pending_review_required"
 GitHub issue: https://github.com/igor04091968/AWatch-rus/issues/48
-Этот документ фиксирует, что будет считаться evidence для PR-based review
+Этот документ фиксирует evidence первого protected PR-based workflow после
-workflow. Он не утверждает, что external peer review уже выполнен.
+включения GitHub ruleset на `main`. Он не утверждает, что review requirement
 уже выполнен или что external peer review завершен.
 ## Evidence Criteria
@@ -23,16 +24,23 @@ workflow. Он не утверждает, что external peer review уже в
 ## Evidence Record
- PR URL: `pending`
+- PR URL: `https://github.com/igor04091968/AWatch-rus/pull/50`
- Linked issue URL: `pending`
+- Linked issue URL: `https://github.com/igor04091968/AWatch-rus/issues/48`
 - Evidence issue URL: `https://github.com/igor04091968/AWatch-rus/issues/49`
 - Required checks status: `passed`
 - Required checks: `Coverage baseline`, `security`, `rust-checks`,
  `docs-registry-checks`, `smoke-checks`
 - Review requirement status: `pending_review_required`
 - Merge status: `open`
 - Admin bypass used: `false`
 - Reviewer: `pending`
 - Reviewer type: `pending`
 - Approval URL or screenshot filename: `pending`
 - Passed checks: `pending`
 - Merge commit: `pending`
- Bypass used: `pending`
+- Date: `2026-06-24`
- Date: `YYYY-MM-DD`
+- Maintainer note: PR #50 demonstrates protected branch workflow and required
- Maintainer note: `pending`
+  checks execution, but first reviewed PR evidence remains pending until review
  requirement is satisfied and the PR is merged without bypass.
 ## Reviewer Interpretation
@@ -46,6 +54,8 @@ the review is visible.
 - PR workflow documentation: ready.
 - PR template: ready.
 - CODEOWNERS routing: ready.
 - First protected PR validation reference: PR #50.
 - Required checks for PR #50: passed.
 - First reviewed PR evidence: pending.
 - External peer review completed: not claimed.
@@ -50,26 +50,31 @@ visibility, release evidence contour and legal package. Они требуют д
 ## 2. Нет внешнего visible peer review / публично видимого peer review
- Текущий статус: риск открыт; PR template, CODEOWNERS, public governance
+- Текущий статус: риск открыт частично; PR template, CODEOWNERS, public
-  issues and PR workflow docs exist, but first reviewed PR evidence and branch
+  governance issues, PR workflow docs and verified active GitHub ruleset for
-  protection verification are still pending.
+  `main` exist. PR #50 has run through protected checks, but first reviewed PR
  evidence is still pending because review/merge is not complete.
 - Влияние: внешним аудиторам сложнее оценить review discipline and change
  control maturity.
 - Почему не блокирует pilot/readiness stage: current changes are protected by
  reproducible checks, public workflows and documented conservative positioning.
 - Как риск будет снижаться: review checklist, CODEOWNERS routing, public issue
-  #48, `docs/PR_REVIEW_WORKFLOW_RU.md`, first public reviewed PR evidence,
+  #48, `docs/PR_REVIEW_WORKFLOW_RU.md`, first public reviewed PR evidence and
-  explicit release branch review policy and verified branch protection evidence.
+  explicit release branch review policy.
 - Уже снижающие evidence/documents/CI: `.github/pull_request_template.md`,
  `.github/CODEOWNERS`, `.github/ISSUE_TEMPLATE/`,
  `docs/REVIEW_CHECKLIST_RU.md`, `docs/BRANCH_PROTECTION_POLICY_RU.md`,
  `docs/BRANCH_PROTECTION_EVIDENCE_RU.md`,
  `docs/PR_REVIEW_WORKFLOW_RU.md`, `docs/PR_REVIEW_EVIDENCE_RU.md`,
  `CONTRIBUTING.md`, `SECURITY.md`, public CI, public security workflow.
- Residual risk: remains open until branch protection is verified and first
+- Branch protection pending risk: mitigated by verified active GitHub ruleset
-  reviewed PR evidence exists.
+  for `main` with empty bypass list, required PR review, Code Owners review,
- Следующий action: выполнить maintainer verification for branch protection and
+  required status checks and force-push blocking.
-  record first reviewed PR evidence without overstating external peer review.
+- PR workflow risk: remains open until PR #50 or a later PR is reviewed and
  merged without bypass.
 - Residual risk: remains open until first reviewed PR evidence exists.
 - Следующий action: record first reviewed PR evidence without overstating
  external peer review.
 ## 3. Низкая публичная активность issue tracker
@@ -185,12 +190,11 @@ visibility, release evidence contour and legal package. Они требуют д
 - PR review checklist exists in `docs/REVIEW_CHECKLIST_RU.md`.
 - Advisory branch protection policy exists in
  `docs/BRANCH_PROTECTION_POLICY_RU.md`.
- Branch protection evidence template exists in
+- Branch protection evidence exists in `docs/BRANCH_PROTECTION_EVIDENCE_RU.md`
-  `docs/BRANCH_PROTECTION_EVIDENCE_RU.md` with
+  with `verified_active_ruleset` status.
  `pending_manual_verification` status.
 - PR-based workflow documentation exists in `docs/PR_REVIEW_WORKFLOW_RU.md`.
 - PR review evidence template exists in `docs/PR_REVIEW_EVIDENCE_RU.md`;
-  first reviewed PR evidence remains pending.
+  PR #50 required checks passed, but first reviewed PR evidence remains pending.
 - Public PR template includes security, registry-claim, runtime/API/UI,
  smoke-test, rollback and evidence checklist items.
 - Visible external code review remains pending until public reviewed PRs exist.
@@ -113,7 +113,9 @@
      "github_issue_url": "https://github.com/igor04091968/AWatch-rus/issues/48",
      "created_at": "2026-06-23T19:43:08Z",
      "created_by": "maintainer",
-      "next_evidence_doc": "docs/PR_REVIEW_EVIDENCE_RU.md"
+      "next_evidence_doc": "docs/PR_REVIEW_EVIDENCE_RU.md",
      "evidence_status": "pending_review_required",
      "evidence_doc": "docs/PR_REVIEW_EVIDENCE_RU.md"
    },
    {
      "id": "012",
@@ -124,7 +126,9 @@
      "github_issue_url": "https://github.com/igor04091968/AWatch-rus/issues/49",
      "created_at": "2026-06-23T19:43:10Z",
      "created_by": "maintainer",
-      "next_evidence_doc": "docs/BRANCH_PROTECTION_EVIDENCE_RU.md"
+      "next_evidence_doc": "docs/BRANCH_PROTECTION_EVIDENCE_RU.md",
      "evidence_status": "verified_active_ruleset",
      "evidence_doc": "docs/BRANCH_PROTECTION_EVIDENCE_RU.md"
    }
  ]
 }
@@ -1,5 +1,66 @@
 # Registry readiness changelog
 ## 2026-06-24 protected PR workflow evidence recorded
 Changed:
 - Recorded PR #50 as the first protected PR workflow reference in
  `docs/PR_REVIEW_EVIDENCE_RU.md`.
 - Recorded that required ruleset checks passed for PR #50: `Coverage baseline`,
  `security`, `rust-checks`, `docs-registry-checks`, `smoke-checks`.
 - Recorded that PR #50 remains `pending_review_required`; first reviewed PR
  evidence is not claimed complete.
 - Linked issue #48 in `docs/public-issues/public-issues-manifest.json` to
  `docs/PR_REVIEW_EVIDENCE_RU.md` with `pending_review_required`.
 Runtime impact:
 - No runtime/product code changes.
 - No API changes.
 - No UI changes.
 - No business logic changes.
 Guardrails:
 - GitHub remains public mirror validation only.
 - Protected PR workflow evidence is governance evidence only.
 - This is not registry release evidence.
 - External peer review is not claimed completed.
 - Russian Gitea plus planned Russian build-runner remains the primary registry
  contour.
 ## 2026-06-23 verified GitHub ruleset evidence
 Changed:
 - Recorded maintainer-verified active GitHub ruleset `main` for target branch
  `main` in `docs/BRANCH_PROTECTION_EVIDENCE_RU.md`.
 - Recorded empty bypass list, required pull request review, one required
  approval, stale approval dismissal and Code Owners review.
 - Recorded required status checks: `Coverage baseline`, `security`,
  `rust-checks`, `docs-registry-checks`, `smoke-checks`.
 - Linked issue #49 in `docs/public-issues/public-issues-manifest.json` to
  verified ruleset evidence.
 - Updated project status, branch protection policy and residual risks to show
  branch protection risk mitigated while first reviewed PR evidence remains
  pending.
 Runtime impact:
 - No runtime/product code changes.
 - No API changes.
 - No UI changes.
 - No business logic changes.
 Guardrails:
 - GitHub remains public mirror validation only.
 - Verified GitHub ruleset is public governance evidence only.
 - This is not registry release evidence.
 - Russian Gitea plus planned Russian build-runner remains the primary registry
  contour.
 - External peer review is not claimed completed.
 ## 2026-06-23 branch protection and PR review evidence package
 Added:
@@ -239,8 +239,22 @@ if [[ -s "$PUBLIC_ISSUES_MANIFEST" ]]; then
          )
        )
      )
-      and ([.issues[] | select(.id == "011" and .github_issue_url == "https://github.com/igor04091968/AWatch-rus/issues/48" and .status == "created" and .next_evidence_doc == "docs/PR_REVIEW_EVIDENCE_RU.md")] | length == 1)
+      and ([.issues[] | select(
-      and ([.issues[] | select(.id == "012" and .github_issue_url == "https://github.com/igor04091968/AWatch-rus/issues/49" and .status == "created" and .next_evidence_doc == "docs/BRANCH_PROTECTION_EVIDENCE_RU.md")] | length == 1)
+        .id == "011"
        and .github_issue_url == "https://github.com/igor04091968/AWatch-rus/issues/48"
        and .status == "created"
        and .next_evidence_doc == "docs/PR_REVIEW_EVIDENCE_RU.md"
        and .evidence_status == "pending_review_required"
        and .evidence_doc == "docs/PR_REVIEW_EVIDENCE_RU.md"
      )] | length == 1)
      and ([.issues[] | select(
        .id == "012"
        and .github_issue_url == "https://github.com/igor04091968/AWatch-rus/issues/49"
        and .status == "created"
        and .next_evidence_doc == "docs/BRANCH_PROTECTION_EVIDENCE_RU.md"
        and .evidence_status == "verified_active_ruleset"
        and .evidence_doc == "docs/BRANCH_PROTECTION_EVIDENCE_RU.md"
      )] | length == 1)
    ' "$PUBLIC_ISSUES_MANIFEST" >/dev/null || fail "public_issues_manifest_required_fields"
  elif command -v python3 >/dev/null 2>&1; then
    python3 - "$PUBLIC_ISSUES_MANIFEST" <<'PY' || fail "public_issues_manifest_required_fields"
@@ -296,6 +310,10 @@ if issue_011.get("github_issue_url") != "https://github.com/igor04091968/AWatch-
    raise SystemExit("issue 011 URL mismatch")
 if issue_011.get("next_evidence_doc") != "docs/PR_REVIEW_EVIDENCE_RU.md":
    raise SystemExit("issue 011 next_evidence_doc mismatch")
 if issue_011.get("evidence_status") != "pending_review_required":
    raise SystemExit("issue 011 evidence_status mismatch")
 if issue_011.get("evidence_doc") != "docs/PR_REVIEW_EVIDENCE_RU.md":
    raise SystemExit("issue 011 evidence_doc mismatch")
 issue_012 = issue_by_id.get("012") or {}
 if issue_012.get("status") != "created":
@@ -304,6 +322,10 @@ if issue_012.get("github_issue_url") != "https://github.com/igor04091968/AWatch-
    raise SystemExit("issue 012 URL mismatch")
 if issue_012.get("next_evidence_doc") != "docs/BRANCH_PROTECTION_EVIDENCE_RU.md":
    raise SystemExit("issue 012 next_evidence_doc mismatch")
 if issue_012.get("evidence_status") != "verified_active_ruleset":
    raise SystemExit("issue 012 evidence_status mismatch")
 if issue_012.get("evidence_doc") != "docs/BRANCH_PROTECTION_EVIDENCE_RU.md":
    raise SystemExit("issue 012 evidence_doc mismatch")
 PY
  else
    fail "json_validator_missing:jq_or_python3_required"
@@ -340,8 +362,17 @@ require_grep "PUBLIC_ISSUES_CREATION_RUNBOOK_RU\\.md" "docs/PROJECT_STATUS_RU.md
 require_grep "Public issues:[[:space:]]*created and linked in manifest|Созданы 12 публичных" "docs/PROJECT_STATUS_RU.md" "project_status_issue_creation_created_urls"
 require_grep "PR-based workflow documentation:[[:space:]]*ready" "docs/PROJECT_STATUS_RU.md" "project_status_pr_workflow_ready"
 require_grep "Branch protection evidence package:[[:space:]]*ready" "docs/PROJECT_STATUS_RU.md" "project_status_branch_evidence_ready"
-require_grep "pending_manual_verification" "docs/PROJECT_STATUS_RU.md" "project_status_branch_pending_manual"
+require_grep 'Branch protection ruleset:[[:space:]]*`verified_active_ruleset`' "docs/PROJECT_STATUS_RU.md" "project_status_branch_verified_ruleset"
 require_grep 'Branch protection target branch:[[:space:]]*`main`' "docs/PROJECT_STATUS_RU.md" "project_status_branch_target_main"
 require_grep "Coverage baseline" "docs/PROJECT_STATUS_RU.md" "project_status_branch_check_coverage_baseline"
 require_grep "security" "docs/PROJECT_STATUS_RU.md" "project_status_branch_check_security"
 require_grep "rust-checks" "docs/PROJECT_STATUS_RU.md" "project_status_branch_check_rust_checks"
 require_grep "docs-registry-checks" "docs/PROJECT_STATUS_RU.md" "project_status_branch_check_docs_registry_checks"
 require_grep "smoke-checks" "docs/PROJECT_STATUS_RU.md" "project_status_branch_check_smoke_checks"
 require_grep "First reviewed PR evidence:[[:space:]]*pending|First reviewed PR evidence remains pending" "docs/PROJECT_STATUS_RU.md" "project_status_first_reviewed_pr_pending"
 require_grep "First protected PR workflow: PR #50 opened" "docs/PROJECT_STATUS_RU.md" "project_status_first_protected_pr"
 require_grep "pending_review_required" "docs/PROJECT_STATUS_RU.md" "project_status_pr_pending_review_required"
 require_grep "External peer review remains pending" "docs/PROJECT_STATUS_RU.md" "project_status_external_peer_review_pending"
 require_grep "GITEA_BACKUP_AND_RESTORE_RUNBOOK_RU\\.md|Restore outline|Post-restore checks" "docs/registry/GITEA_BACKUP_AND_RESTORE_RUNBOOK_RU.md" "backup_restore_runbook"
 require_grep "awatch-gitea-backup\\.timer" "docs/registry/GITEA_BACKUP_AND_RESTORE_RUNBOOK_RU.md" "backup_timer"
 require_grep "sha256|SHA256" "docs/registry/GITEA_BACKUP_AND_RESTORE_RUNBOOK_RU.md" "backup_sha256"
@@ -374,6 +405,11 @@ require_grep "docs/public-issues" "docs/registry/REGISTRY_READINESS_CHANGELOG_RU
 require_grep "runtime/product code changes" "docs/registry/REGISTRY_READINESS_CHANGELOG_RU.md" "changelog_public_issues_no_runtime"
 require_grep "GitHub remains public mirror validation only" "docs/registry/REGISTRY_READINESS_CHANGELOG_RU.md" "changelog_public_issues_github_role"
 require_grep "branch protection and PR review evidence package" "docs/registry/REGISTRY_READINESS_CHANGELOG_RU.md" "changelog_branch_pr_evidence_package"
 require_grep "verified GitHub ruleset evidence" "docs/registry/REGISTRY_READINESS_CHANGELOG_RU.md" "changelog_verified_ruleset_evidence"
 require_grep "protected PR workflow evidence recorded" "docs/registry/REGISTRY_READINESS_CHANGELOG_RU.md" "changelog_protected_pr_workflow"
 require_grep "PR #50" "docs/registry/REGISTRY_READINESS_CHANGELOG_RU.md" "changelog_pr_50"
 require_grep "pending_review_required" "docs/registry/REGISTRY_READINESS_CHANGELOG_RU.md" "changelog_pr_pending_review_required"
 require_grep "This is not registry release evidence" "docs/registry/REGISTRY_READINESS_CHANGELOG_RU.md" "changelog_ruleset_not_registry_evidence"
 require_grep "No runtime/product code changes" "docs/registry/REGISTRY_READINESS_CHANGELOG_RU.md" "changelog_branch_pr_no_runtime"
 require_grep "External peer review is not claimed completed" "docs/registry/REGISTRY_READINESS_CHANGELOG_RU.md" "changelog_external_review_not_completed"
 require_grep "Restore test is not claimed as completed" "docs/registry/REGISTRY_READINESS_CHANGELOG_RU.md" "changelog_restore_not_completed"
@@ -422,14 +458,14 @@ require_grep 'Required approvals:[[:space:]]*`1`' "docs/BRANCH_PROTECTION_POLICY
 require_grep "Dismiss stale approvals" "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_dismiss_stale"
 require_grep "CODEOWNERS" "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_codeowners_review"
 require_grep "Require status checks" "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_status_checks"
-require_grep "CI / Rust checks" "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_ci_rust_checks"
+require_grep 'Ruleset name:[[:space:]]*`main`' "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_ruleset_main"
-require_grep "CI / Docs and registry checks" "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_ci_docs_registry_checks"
+require_grep 'Enforcement:[[:space:]]*`active`' "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_enforcement_active"
-require_grep "CI / Smoke checks" "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_ci_smoke_checks"
+require_grep "Bypass list:[[:space:]]*empty" "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_bypass_empty"
-require_grep "Coverage / Coverage baseline" "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_coverage_baseline_check"
+require_grep "Coverage baseline" "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_coverage_baseline_check"
-require_grep "Security / Cargo audit" "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_security_cargo_audit"
+require_grep "security" "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_security_check"
-require_grep "Security / Cargo deny" "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_security_cargo_deny"
+require_grep "rust-checks" "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_rust_checks"
-require_grep "Security / Secret pattern check" "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_secret_pattern_check"
+require_grep "docs-registry-checks" "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_docs_registry_checks"
-require_grep "Security / Dependency review" "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_dependency_review"
+require_grep "smoke-checks" "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_smoke_checks"
 require_grep 'Require `CI` workflow' "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_ci"
 require_grep 'Require `Security` workflow' "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_security"
 require_grep 'Require `Coverage` workflow' "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_coverage"
@@ -438,12 +474,21 @@ require_grep "Restrict force push" "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch
 require_grep "Require conversation resolution" "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_conversation_resolution"
 require_grep "Require linear history" "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_linear_history"
 require_grep "emergency-only" "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_admin_bypass"
-require_grep "recommended policy|advisory branch protection policy" "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_advisory_not_enabled"
+require_grep "verified_active_ruleset" "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_verified_active_ruleset"
-require_grep "branch_protection_status:[[:space:]]*\"pending_manual_verification\"" "docs/BRANCH_PROTECTION_EVIDENCE_RU.md" "branch_evidence_pending_manual"
+require_grep "branch_protection_status:[[:space:]]*\"verified_active_ruleset\"" "docs/BRANCH_PROTECTION_EVIDENCE_RU.md" "branch_evidence_verified_active"
 require_grep "https://github\\.com/igor04091968/AWatch-rus/issues/49" "docs/BRANCH_PROTECTION_EVIDENCE_RU.md" "branch_evidence_issue_49"
 require_grep "Not Registry Release Evidence|Not registry release evidence" "docs/BRANCH_PROTECTION_EVIDENCE_RU.md" "branch_evidence_not_registry"
 require_grep "Russian Contour Note" "docs/BRANCH_PROTECTION_EVIDENCE_RU.md" "branch_evidence_russian_contour"
-require_grep "CI / Rust checks" "docs/BRANCH_PROTECTION_EVIDENCE_RU.md" "branch_evidence_required_checks"
+require_grep 'enforcement:[[:space:]]*`active`' "docs/BRANCH_PROTECTION_EVIDENCE_RU.md" "branch_evidence_enforcement_active"
 require_grep 'bypass_list:[[:space:]]*`empty`' "docs/BRANCH_PROTECTION_EVIDENCE_RU.md" "branch_evidence_bypass_empty"
 require_grep 'required approvals:[[:space:]]*`1`' "docs/BRANCH_PROTECTION_EVIDENCE_RU.md" "branch_evidence_required_approvals"
 require_grep 'require review from Code Owners:[[:space:]]*`enabled`' "docs/BRANCH_PROTECTION_EVIDENCE_RU.md" "branch_evidence_codeowners_enabled"
 require_grep "Coverage baseline" "docs/BRANCH_PROTECTION_EVIDENCE_RU.md" "branch_evidence_coverage_baseline"
 require_grep "security" "docs/BRANCH_PROTECTION_EVIDENCE_RU.md" "branch_evidence_security_check"
 require_grep "rust-checks" "docs/BRANCH_PROTECTION_EVIDENCE_RU.md" "branch_evidence_rust_checks"
 require_grep "docs-registry-checks" "docs/BRANCH_PROTECTION_EVIDENCE_RU.md" "branch_evidence_docs_registry_checks"
 require_grep "smoke-checks" "docs/BRANCH_PROTECTION_EVIDENCE_RU.md" "branch_evidence_smoke_checks"
 require_grep "GitHub ruleset / branch protection evidence is public governance evidence only" "docs/BRANCH_PROTECTION_EVIDENCE_RU.md" "branch_evidence_governance_only"
 require_grep "workflow documentation ready" "docs/PR_REVIEW_WORKFLOW_RU.md" "pr_workflow_ready"
 require_grep "https://github\\.com/igor04091968/AWatch-rus/issues/48" "docs/PR_REVIEW_WORKFLOW_RU.md" "pr_workflow_issue_48"
 require_grep "PR template must be completed" "docs/PR_REVIEW_WORKFLOW_RU.md" "pr_workflow_template_required"
@@ -451,12 +496,26 @@ require_grep "CODEOWNERS" "docs/PR_REVIEW_WORKFLOW_RU.md" "pr_workflow_codeowner
 require_grep "CI, Coverage and Security checks" "docs/PR_REVIEW_WORKFLOW_RU.md" "pr_workflow_checks"
 require_grep "public secret-pattern scan" "docs/PR_REVIEW_WORKFLOW_RU.md" "pr_workflow_secret_scan"
 require_grep "GitHub Actions is public mirror validation only" "docs/PR_REVIEW_WORKFLOW_RU.md" "pr_workflow_github_public_only"
-require_grep "pr_review_evidence_status:[[:space:]]*\"pending_until_first_reviewed_pr_is_merged\"" "docs/PR_REVIEW_EVIDENCE_RU.md" "pr_evidence_pending_first_reviewed_pr"
+require_grep "pr_review_status:[[:space:]]*\"pending_review_required\"" "docs/PR_REVIEW_EVIDENCE_RU.md" "pr_evidence_pending_review_required"
 require_grep "https://github\\.com/igor04091968/AWatch-rus/pull/50" "docs/PR_REVIEW_EVIDENCE_RU.md" "pr_evidence_pr_50"
 require_grep 'Required checks status:[[:space:]]*`passed`' "docs/PR_REVIEW_EVIDENCE_RU.md" "pr_evidence_required_checks_passed"
 require_grep 'Review requirement status:[[:space:]]*`pending_review_required`' "docs/PR_REVIEW_EVIDENCE_RU.md" "pr_evidence_review_pending"
 require_grep 'Merge status:[[:space:]]*`open`' "docs/PR_REVIEW_EVIDENCE_RU.md" "pr_evidence_merge_open"
 require_grep 'Admin bypass used:[[:space:]]*`false`' "docs/PR_REVIEW_EVIDENCE_RU.md" "pr_evidence_no_bypass"
 require_grep "Coverage baseline" "docs/PR_REVIEW_EVIDENCE_RU.md" "pr_evidence_coverage_baseline"
 require_grep "security" "docs/PR_REVIEW_EVIDENCE_RU.md" "pr_evidence_security"
 require_grep "rust-checks" "docs/PR_REVIEW_EVIDENCE_RU.md" "pr_evidence_rust_checks"
 require_grep "docs-registry-checks" "docs/PR_REVIEW_EVIDENCE_RU.md" "pr_evidence_docs_registry_checks"
 require_grep "smoke-checks" "docs/PR_REVIEW_EVIDENCE_RU.md" "pr_evidence_smoke_checks"
 require_grep "reviewer approval" "docs/PR_REVIEW_EVIDENCE_RU.md" "pr_evidence_reviewer_approval"
 require_grep "External peer review completed:[[:space:]]*not claimed" "docs/PR_REVIEW_EVIDENCE_RU.md" "pr_evidence_external_not_claimed"
 require_grep "Not Registry Release Evidence|Not registry release evidence" "docs/PR_REVIEW_EVIDENCE_RU.md" "pr_evidence_not_registry"
 require_grep "\"next_evidence_doc\"[[:space:]]*:[[:space:]]*\"docs/PR_REVIEW_EVIDENCE_RU\\.md\"" "docs/public-issues/public-issues-manifest.json" "manifest_issue_48_next_evidence_doc"
 require_grep "\"evidence_status\"[[:space:]]*:[[:space:]]*\"pending_review_required\"" "docs/public-issues/public-issues-manifest.json" "manifest_issue_48_evidence_status"
 require_grep "\"evidence_doc\"[[:space:]]*:[[:space:]]*\"docs/PR_REVIEW_EVIDENCE_RU\\.md\"" "docs/public-issues/public-issues-manifest.json" "manifest_issue_48_evidence_doc"
 require_grep "\"next_evidence_doc\"[[:space:]]*:[[:space:]]*\"docs/BRANCH_PROTECTION_EVIDENCE_RU\\.md\"" "docs/public-issues/public-issues-manifest.json" "manifest_issue_49_next_evidence_doc"
 require_grep "\"evidence_status\"[[:space:]]*:[[:space:]]*\"verified_active_ruleset\"" "docs/public-issues/public-issues-manifest.json" "manifest_issue_49_evidence_status"
 require_grep "\"evidence_doc\"[[:space:]]*:[[:space:]]*\"docs/BRANCH_PROTECTION_EVIDENCE_RU\\.md\"" "docs/public-issues/public-issues-manifest.json" "manifest_issue_49_evidence_doc"
 require_grep "Один основной разработчик" "docs/RESIDUAL_RISKS_RU.md" "risk_single_developer"
 require_grep "Нет внешнего visible peer review" "docs/RESIDUAL_RISKS_RU.md" "risk_peer_review"
 require_grep "Низкая публичная активность issue tracker" "docs/RESIDUAL_RISKS_RU.md" "risk_issue_tracker_activity"
@@ -599,12 +658,34 @@ fi
 rm -f /tmp/registry_forbidden_registry_submission_done.$$
 if grep -RInEi "(branch protection).{0,120}(enabled|включ(е|ё)н|настроен|active)" "$ROOT/README.md" "$ROOT/docs/PROJECT_STATUS_RU.md" "$ROOT/docs/BRANCH_PROTECTION_POLICY_RU.md" "$ROOT/docs/BRANCH_PROTECTION_EVIDENCE_RU.md" "$ROOT/docs/PR_REVIEW_WORKFLOW_RU.md" "$ROOT/docs/PR_REVIEW_EVIDENCE_RU.md" "$REGISTRY_DIR"/*.md \
-  | grep -Eiv "(not |не |не утверждает|not claimed|advisory|until repository settings|если применимо|recommended|pending_manual_verification|until maintainer evidence|until.*evidence|to verify)" \
+  | grep -Eiv "(not |не |не утверждает|not claimed|no claim|no assertion|advisory|until repository settings|если применимо|recommended|pending|pending_manual_verification|verified_active_ruleset|maintainer-verified|verified active by maintainer|verified GitHub ruleset|until maintainer evidence|until.*evidence|to verify)" \
  >/tmp/registry_forbidden_branch_protection_enabled.$$ 2>/dev/null; then
  fail "forbidden_claim_branch_protection_enabled:$(cat /tmp/registry_forbidden_branch_protection_enabled.$$)"
 fi
 rm -f /tmp/registry_forbidden_branch_protection_enabled.$$
 if grep -Eq 'pr_review_status:[[:space:]]*"verified"' "$ROOT/docs/PR_REVIEW_EVIDENCE_RU.md" \
  && ! grep -Eq 'Admin bypass used:[[:space:]]*`false`' "$ROOT/docs/PR_REVIEW_EVIDENCE_RU.md"; then
  fail "pr_review_verified_requires_admin_bypass_false"
 fi
 if grep -Eq 'Admin bypass used:[[:space:]]*`true`' "$ROOT/docs/PR_REVIEW_EVIDENCE_RU.md" \
  && grep -Eiq "first PR review workflow:[[:space:]]*verified|PR review workflow:[[:space:]]*verified|first reviewed PR evidence:[[:space:]]*verified" "$ROOT/docs/PROJECT_STATUS_RU.md"; then
  fail "bypass_pr_must_not_mark_review_workflow_verified"
 fi
 if grep -RInEi "(CodeQL|code scanning).{0,80}(enabled|required|requirement|tool)" \
  "$ROOT/docs/BRANCH_PROTECTION_EVIDENCE_RU.md" \
  "$ROOT/docs/BRANCH_PROTECTION_POLICY_RU.md" \
  "$ROOT/docs/PROJECT_STATUS_RU.md" \
  "$ROOT/docs/RESIDUAL_RISKS_RU.md" \
  "$ROOT/docs/PR_REVIEW_EVIDENCE_RU.md" \
  "$REGISTRY_DIR/REGISTRY_READINESS_CHANGELOG_RU.md" \
  >/tmp/registry_forbidden_codeql_claim.$$ 2>/dev/null; then
  fail "forbidden_claim_codeql_enabled_or_required:$(cat /tmp/registry_forbidden_codeql_claim.$$)"
 fi
 rm -f /tmp/registry_forbidden_codeql_claim.$$
 if grep -RInEi "(external|visible|peer).{0,80}(review).{0,120}(active|performed|completed|done|выполняется|проведен|провед(е|ё)н|активен)" "$ROOT/README.md" "$ROOT/docs/PROJECT_STATUS_RU.md" "$ROOT/docs/RESIDUAL_RISKS_RU.md" "$ROOT/docs/PR_REVIEW_WORKFLOW_RU.md" "$ROOT/docs/PR_REVIEW_EVIDENCE_RU.md" "$REGISTRY_DIR"/*.md \
  | grep -Eiv "(not |не |pending|still pending|не утверждает|not claimed|until public reviewed PRs|until reviewed PR evidence|unless a reviewed public PR|is not claimed)" \
  >/tmp/registry_forbidden_external_review_active.$$ 2>/dev/null; then