docs(governance): add review process residual risks and issue plan

2026-06-22 21:42:43 +03:00
parent f310aeff49
commit 77c705a649
10 changed files with 397 additions and 23 deletions
@@ -1 +1,34 @@
+# AWatch-rus CODEOWNERS
+#
+# Ownership is used for review routing and engineering accountability.
+# It does not certify security, legal readiness, performance or fitness for
+# production use. Contributors remain responsible for the safety of their
+# submissions.
+
+# Repository default owner.
 * @igor04091968
+
+# Rust workspace and crates.
+/adk-rust/ @igor04091968
+**/Cargo.toml @igor04091968
+**/Cargo.lock @igor04091968
+**/*.rs @igor04091968
+
+# Operational scripts and automation.
+/scripts/ @igor04091968
+
+# Registry-readiness evidence and policy documents.
+/docs/registry/ @igor04091968
+
+# GitHub public mirror validation metadata.
+/.github/workflows/ @igor04091968
+/.github/pull_request_template.md @igor04091968
+/.github/ISSUE_TEMPLATE/ @igor04091968
+
+# Ansible deployment automation.
+/ansible/ @igor04091968
+
+# Security and contribution governance.
+/SECURITY.md @igor04091968
+/CONTRIBUTING.md @igor04091968
+/deny.toml @igor04091968
@@ -2,11 +2,37 @@

 Describe what changed and why.

+## Impact
+
+- Runtime impact: `none / changed / not applicable`
+- API impact: `none / changed / not applicable`
+- UI impact: `none / changed / not applicable`
+- Documentation impact: `none / changed / not applicable`
+- Rollback impact: `none / documented / not applicable`
+- Evidence impact: `none / registry docs updated / release evidence required`
+
 ## Validation

 List commands executed. Use `skipped: <reason>` when a check requires a live
 stand or unavailable tool.

+## Review Checklist
+
+- [ ] I checked that this PR does not publish secrets, tokens, passwords,
+      private keys, recovery codes or live credentials.
+- [ ] I checked that this PR does not publish personal data, real employee data,
+      customer logs or customer infrastructure identifiers.
+- [ ] I checked registry claims: no completed registry submission, no
+      FSTEC/FSB certification claim, no SIEM/DLP replacement claim.
+- [ ] I ran relevant checks or documented why a check was skipped.
+- [ ] I stated runtime/API/UI impact.
+- [ ] I stated documentation impact.
+- [ ] I stated smoke-test result or why smoke testing is not applicable.
+- [ ] I stated rollback and evidence impact.
+- [ ] I checked that GitHub Actions remains public mirror validation only.
+- [ ] I checked that registry release evidence still requires the Russian
+      build-runner.
+
 ## Registry / Public Mirror Scope

 - GitHub is public mirror validation only.
@@ -261,6 +261,22 @@ collectors.
 - Public issues plan:
  [docs/PUBLIC_ISSUES_PLAN_RU.md](docs/PUBLIC_ISSUES_PLAN_RU.md).

+### Engineering governance and residual risks
+
+- Review checklist:
+  [docs/REVIEW_CHECKLIST_RU.md](docs/REVIEW_CHECKLIST_RU.md).
+- Residual risks register:
+  [docs/RESIDUAL_RISKS_RU.md](docs/RESIDUAL_RISKS_RU.md).
+- Public issues plan:
+  [docs/PUBLIC_ISSUES_PLAN_RU.md](docs/PUBLIC_ISSUES_PLAN_RU.md).
+- Advisory branch protection policy:
+  [docs/BRANCH_PROTECTION_POLICY_RU.md](docs/BRANCH_PROTECTION_POLICY_RU.md).
+- CODEOWNERS and PR template are maintained for review routing and public
+  change-control visibility.
+- Visible external code review is still pending until public reviewed PRs exist.
+- Branch protection policy is documented as advisory; it is not claimed as
+  enabled here.
+
 - [Позиционирование для реестра российского ПО](docs/RUSSIAN_SOFTWARE_REGISTRY_POSITIONING_RU.md)
 - [Сведения для подачи в реестр](REGISTER_RU_SOFTWARE.md)
 - [Registry product passport](docs/REGISTRY_PRODUCT_PASSPORT_RU.md)
@@ -550,6 +566,9 @@ detmir-dlp --json
 ✅ ROADMAP.md
 ✅ Issue templates
 ✅ PR template
+✅ CODEOWNERS
+✅ Review checklist
+✅ Branch protection policy documented
 ✅ Registry docs
 ✅ Russian Gitea contour
 ✅ GitHub public mirror validation
@@ -760,6 +779,7 @@ PILOT V1 SCOPE (ГОТОВО):
   - Низкая community adoption
   - Gitea restore test еще не выполнен
   - Российский build-runner пока planned
+   - Branch protection policy documented, but enablement not yet verified

 5. 🚀 TIMELINE К PRODUCTION:
   - Pilot v1 freeze: готовится (freeze readiness doc)
@@ -0,0 +1,64 @@
+# AWatch-rus: advisory branch protection policy
+
+Дата: 2026-06-22
+
+Статус: recommended policy. Этот документ описывает целевую настройку GitHub
+branch protection для публичного зеркала. Он не утверждает, что branch
+protection уже включен.
+
+GitHub остается public mirror validation surface. Primary registry-readiness
+contour остается Russian Gitea plus Russian build-runner release evidence.
+
+## Scope
+
+- Branch: `main`.
+- Platform: GitHub public mirror.
+- Purpose: visible review discipline, status-check discipline and public
+  engineering maturity signal.
+- Registry release evidence: out of scope for GitHub Actions.
+
+## Recommended rules
+
+- Require pull request before merge.
+- Require at least one approving review for non-emergency changes.
+- Require status checks before merge.
+- Require `CI` workflow.
+- Require `Security` workflow.
+- Require `Coverage` workflow as baseline visibility; no coverage threshold is
+  enforced yet.
+- Require conversation resolution before merge.
+- Restrict force push.
+- Restrict branch deletion.
+- Require linear history if compatible with the maintainer workflow.
+- Administrator bypass should be emergency-only and documented after the fact.
+
+## Review expectations
+
+- CODEOWNERS routes changes to the current maintainer.
+- External visible peer review is still pending and should be introduced through
+  public pull requests.
+- Review approval is not a warranty of security, fitness for production or
+  legal readiness.
+- Contributors remain responsible for the safety and accuracy of their changes.
+
+## Registry and security guardrails
+
+- Do not claim FSTEC/FSB certification.
+- Do not claim completed Russian software registry submission.
+- Do not claim SIEM/DLP replacement.
+- Do not publish secrets, personal data, employee data or customer
+  infrastructure identifiers.
+- Do not claim Gitea restore test completed until evidence exists.
+- Do not claim Russian build-runner ready until provisioning evidence exists.
+
+## Emergency bypass
+
+Emergency administrator bypass may be used only for urgent repository recovery,
+blocked release hygiene or security containment. The follow-up record should
+state:
+
+- reason for bypass;
+- commits affected;
+- checks run after bypass;
+- rollback or follow-up action;
+- whether registry-readiness claims changed.
@@ -32,6 +32,10 @@ backup, registry-readiness документации, плана российск
  `docs/RESIDUAL_RISKS_RU.md`.
 - План публичных GitHub issues:
  `docs/PUBLIC_ISSUES_PLAN_RU.md`.
+- Review checklist:
+  `docs/REVIEW_CHECKLIST_RU.md`.
+- Advisory branch protection policy:
+  `docs/BRANCH_PROTECTION_POLICY_RU.md`.

 ## Что готово

@@ -60,6 +64,12 @@ backup, registry-readiness документации, плана российск
  по контурам `CI`, `Coverage` и `Security`.
 - Добавлены `SECURITY.md`, `CONTRIBUTING.md`, `ROADMAP.md`, issue templates и
  pull request template.
+- Добавлен `.github/CODEOWNERS` for review routing.
+- Добавлен review checklist:
+  `docs/REVIEW_CHECKLIST_RU.md`.
+- PR review process documented in PR template and review checklist.
+- Branch protection policy documented as advisory:
+  `docs/BRANCH_PROTECTION_POLICY_RU.md`.
 - Зафиксирован residual risk register:
  `docs/RESIDUAL_RISKS_RU.md`.
 - Подготовлен план публичных issues для ручного заведения:
@@ -75,6 +85,9 @@ backup, registry-readiness документации, плана российск
 - Финальная юридическая проверка пакета документов перед подачей.
 - Проверка совместимости с российскими ОС.
 - Публичные roadmap/issues из `docs/PUBLIC_ISSUES_PLAN_RU.md`.
+- Visible external code review is still pending.
+- Branch protection enablement is not claimed until repository settings are
+  verified.

 ## Честные ограничения

@@ -103,5 +116,7 @@ backup, registry-readiness документации, плана российск
 - `docs/registry/RELEASE_EVIDENCE_RUNBOOK_RU.md`
 - `docs/registry/RELEASE_ARTIFACTS_STORAGE_RU.md`
 - `docs/QUALITY_STATUS_RU.md`
+- `docs/REVIEW_CHECKLIST_RU.md`
 - `docs/RESIDUAL_RISKS_RU.md`
 - `docs/PUBLIC_ISSUES_PLAN_RU.md`
+- `docs/BRANCH_PROTECTION_POLICY_RU.md`
@@ -12,18 +12,20 @@ Gitea-контура, backup, public CI, coverage, security scanning и status f

 ## Issues to create manually

-| Title | Purpose | Current status |
-| --- | --- | --- |
-| `[registry] Perform Gitea backup restore test` | Prove restore procedure on a separate host and keep `restore_tested=false` until evidence exists. | To create |
-| `[registry] Prepare temporary Russian build-runner awatch-build-01` | Provision temporary or permanent Russian build-runner for registry release evidence. | To create |
-| `[release] Produce first release evidence package` | Run release evidence scripts on `awatch-build-01` and collect artifacts/logs/checksums. | To create |
-| `[legal] Prepare rightsholder evidence package` | Prepare rightsholder and legal evidence for future registry submission. | To create |
-| `[qa] Define coverage threshold policy` | Define threshold only after stable coverage baseline review. | To create |
-| `[security] Prepare external security/code review checklist` | Establish visible peer review and external security review checklist. | To create |
-| `[compat] Test Russian OS compatibility matrix` | Validate supported Russian OS matrix and document evidence. | To create |
-| `[ops] Validate release artifacts storage in RF` | Confirm release artifact storage location and retention in the Russian contour. | To create |
-| `[docs] Refresh public demo pack and screenshots` | Update public demo pack, screenshots and non-sensitive demo evidence. | To create |
-| `[pilot] Prepare Pilot Acceptance Checklist v2` | Update pilot acceptance checklist after residual risk register and public issue plan. | To create |
+| Title | Labels | Short goal | Acceptance criteria | Status |
+| --- | --- | --- | --- | --- |
+| `[registry] Perform Gitea backup restore test` | `registry`, `ops`, `evidence` | Prove restore procedure on a separate host and keep `restore_tested=false` until evidence exists. | Restore log, checksum verification, post-restore checks and rollback notes are attached or linked. | planned |
+| `[registry] Prepare temporary Russian build-runner awatch-build-01` | `registry`, `build-runner`, `ops` | Provision temporary or permanent Russian build-runner for registry release evidence. | Host provisioning notes, toolchain list, Gitea access method and required checks plan are documented. | planned |
+| `[release] Produce first release evidence package` | `release`, `registry`, `evidence` | Run release evidence scripts on `awatch-build-01` and collect artifacts/logs/checksums. | Release evidence manifest, logs, checksums and artifact storage path are documented. | planned |
+| `[legal] Prepare rightsholder evidence package` | `legal`, `registry`, `docs` | Prepare rightsholder and legal evidence for future registry submission. | Rightsholder evidence checklist, ownership notes and legal review TODOs are documented. | planned |
+| `[qa] Define coverage threshold policy` | `qa`, `coverage`, `policy` | Define threshold only after stable coverage baseline review. | Coverage baseline reviewed and initial threshold policy proposed without blocking current baseline workflow. | planned |
+| `[security] Prepare external security/code review checklist` | `security`, `review`, `governance` | Establish visible peer review and external security review checklist. | Checklist references `docs/REVIEW_CHECKLIST_RU.md` and defines public review evidence expectations. | planned |
+| `[compat] Test Russian OS compatibility matrix` | `compat`, `qa`, `registry` | Validate supported Russian OS matrix and document evidence. | Matrix lists target OS versions, test status and gaps without unsupported compatibility claims. | planned |
+| `[ops] Validate release artifacts storage in RF` | `ops`, `release`, `registry` | Confirm release artifact storage location and retention in the Russian contour. | Storage path, retention, access model and checksum verification procedure are documented. | planned |
+| `[docs] Refresh public demo pack and screenshots` | `docs`, `demo`, `public` | Update public demo pack, screenshots and non-sensitive demo evidence. | Demo materials contain no secrets, PII, real employee data or customer infrastructure identifiers. | planned |
+| `[pilot] Prepare Pilot Acceptance Checklist v2` | `pilot`, `qa`, `docs` | Update pilot acceptance checklist after residual risk register and public issue plan. | Checklist references residual risks, smoke checks and acceptance evidence needed for pilot stage. | planned |
+| `[governance] Enable PR-based review workflow` | `governance`, `review`, `process` | Move visible changes through pull requests where practical. | First public PR review record exists or a documented dry-run PR demonstrates the process. | planned |
+| `[governance] Add branch protection policy` | `governance`, `github`, `policy` | Configure GitHub branch protection after maintainer review of the advisory policy. | Branch protection settings are documented with screenshots or notes, or blockers are recorded. | planned |

 ## Guardrails

@@ -33,4 +35,6 @@ Gitea-контура, backup, public CI, coverage, security scanning и status f
 - Do not claim completed registry submission.
 - Do not claim fake community adoption.
 - Do not position GitHub Actions as the primary registry build contour.
-
+- Do not claim external peer review is active until public reviewed PRs exist.
+- Do not claim branch protection is enabled until repository settings are
+  verified.
@@ -48,21 +48,23 @@ visibility, release evidence contour and legal package. Они требуют д
 - Следующий action: завести публичную задачу
  `[security] Prepare external security/code review checklist`.

-## 2. Нет публично видимого peer review
+## 2. Нет внешнего visible peer review / публично видимого peer review

 - Текущий статус: риск открыт; PR template and issue templates exist, but
-  public peer review history is still limited.
+  public peer review history is still limited and external review is pending.
 - Влияние: внешним аудиторам сложнее оценить review discipline and change
  control maturity.
 - Почему не блокирует pilot/readiness stage: current changes are protected by
  reproducible checks, public workflows and documented conservative positioning.
- Как риск будет снижаться: external review checklist, first public PR reviews,
-  explicit release branch review policy.
+- Как риск будет снижаться: review checklist, CODEOWNERS routing, first public
+  PR reviews, explicit release branch review policy and advisory branch
+  protection.
 - Уже снижающие evidence/documents/CI: `.github/pull_request_template.md`,
-  `.github/ISSUE_TEMPLATE/`, `CONTRIBUTING.md`, `SECURITY.md`, public CI,
-  public security workflow.
+  `.github/CODEOWNERS`, `.github/ISSUE_TEMPLATE/`,
+  `docs/REVIEW_CHECKLIST_RU.md`, `docs/BRANCH_PROTECTION_POLICY_RU.md`,
+  `CONTRIBUTING.md`, `SECURITY.md`, public CI, public security workflow.
 - Следующий action: завести публичную задачу
-  `[security] Prepare external security/code review checklist`.
+  `[governance] Enable PR-based review workflow`.

 ## 3. Низкая публичная активность issue tracker

@@ -166,9 +168,18 @@ visibility, release evidence contour and legal package. Они требуют д
 - Следующий action: завести публичную задачу
  `[legal] Prepare rightsholder evidence package`.

+## Review/governance evidence added
+
+- CODEOWNERS exists for review routing and engineering ownership.
+- PR review checklist exists in `docs/REVIEW_CHECKLIST_RU.md`.
+- Advisory branch protection policy exists in
+  `docs/BRANCH_PROTECTION_POLICY_RU.md`.
+- Public PR template includes security, registry-claim, runtime/API/UI,
+  smoke-test, rollback and evidence checklist items.
+- Visible external code review remains pending until public reviewed PRs exist.
+
 ## Следующие публичные задачи

 Полный список задач для ручного заведения в GitHub issue tracker:

 - `docs/PUBLIC_ISSUES_PLAN_RU.md`.
-
@@ -0,0 +1,108 @@
+# AWatch-rus: PR / code review checklist
+
+Дата: 2026-06-22
+
+Статус: advisory checklist for public review process.
+
+Этот документ описывает проверочный чеклист для pull requests и внешнего
+инженерного review. Он не утверждает, что внешний peer review уже выполняется
+регулярно, и не является гарантией отсутствия дефектов или уязвимостей.
+
+GitHub Actions используется только как public mirror validation. Registry
+release evidence должен производиться на российском build-runner.
+
+## Общая безопасность изменений
+
+- Изменение имеет понятную цель, ограниченный scope and documented impact.
+- Нет секретов, токенов, паролей, приватных ключей, recovery codes or live
+  credentials.
+- Нет персональных данных сотрудников, реальных employee logs or customer
+  evidence.
+- Нет реальных IP, hostname or infrastructure identifiers заказчика.
+- Нет новых публичных портов, external callbacks or telemetry without explicit
+  documentation.
+- Нет ослабления fail-closed checks, security gates or auditability.
+
+## Rust code quality
+
+- Rust-код форматируется `cargo fmt --all --check`.
+- Для затронутого Rust workspace ожидаются relevant `cargo test` checks.
+- Ошибки обрабатываются явно; нет silent fallback для security-sensitive paths.
+- Timeouts, retries and bounds are explicit for network or long-running work.
+- Новые dependencies justified and license-compatible.
+
+## API / contract compatibility
+
+- Public API, CLI flags, file formats and JSON contracts remain compatible, or
+  breaking impact is explicitly blocked for this stage.
+- Backward compatibility checked for existing collectors, exporters,
+  dashboards and automation consumers.
+- Error responses and status codes are not changed accidentally.
+
+## UI / runtime impact
+
+- PR states whether UI impact is none, documentation-only or user-visible.
+- PR states whether runtime deployment impact is none or requires operator
+  action.
+- No runtime behavior is changed by documentation/governance-only PRs.
+- No service restart, migration or production config change is implied unless
+  explicitly documented.
+
+## Registry-readiness impact
+
+- GitHub Actions is public mirror validation only.
+- Public CI, Coverage and Security workflows are not registry release evidence.
+- Release evidence must be produced on the Russian build-runner.
+- Russian Gitea remains the primary registry-readiness source contour.
+- Do not claim completed Russian software registry submission.
+- Do not claim FSTEC/FSB certification.
+- Do not claim SIEM/DLP replacement.
+- Do not mark restore test as completed while `restore_tested=false`.
+- Do not mark `awatch-build-01` as ready until provisioning evidence exists.
+
+## Secret / PII safety
+
+- No secrets, tokens, passwords or private keys in code, docs, logs,
+  screenshots or workflow output.
+- No employee personal data, real user activity traces or unredacted customer
+  identifiers.
+- No customer IP addresses, internal hostnames, VPN details or private network
+  topology.
+- Demo data is synthetic or anonymized.
+- Public secret scan is expected to pass before merge.
+
+## Documentation impact
+
+- README, `docs/PROJECT_STATUS_RU.md`, registry docs and operational runbooks
+  are updated when claims, checks, workflows or procedures change.
+- New claims are conservative and evidence-backed.
+- Pending work remains marked as planned/pending until evidence exists.
+- Public mirror wording remains separate from registry release evidence.
+
+## Deployment / rollback impact
+
+- PR states whether deployment action is required.
+- Rollback path is documented for runtime or automation changes.
+- Documentation-only PRs state that runtime/API/UI impact is unchanged.
+- Changes to scripts include syntax checks and a clear operator failure mode.
+
+## Smoke checks
+
+- Run checks relevant to changed files.
+- For documentation/governance updates, expected minimum checks are:
+  `python3 scripts/public_secret_pattern_check.py`,
+  `bash -n scripts/registry_readiness_check.sh`,
+  `bash scripts/registry_readiness_check.sh`,
+  `git diff --check`.
+- For shell changes, `bash -n` is mandatory for changed shell scripts.
+- For Rust/product changes, Rust checks are required by risk and scope.
+
+## Evidence requirements
+
+- PR records commands run and results.
+- Skipped checks include a concrete reason.
+- Registry release evidence is not accepted from GitHub Actions alone.
+- Russian build-runner release evidence must include logs, checksums and
+  artifact manifest when that contour is ready.
+- Restore test evidence must include separate-host restore notes and checksum
+  verification before `restore_tested` changes from false.
@@ -1,5 +1,42 @@
 # Registry readiness changelog

+## 2026-06-22 review governance and branch protection policy
+
+Added:
+
+- `.github/CODEOWNERS` for public review routing and engineering ownership.
+- `docs/REVIEW_CHECKLIST_RU.md` for PR/code review checks.
+- `docs/BRANCH_PROTECTION_POLICY_RU.md` as advisory GitHub branch protection
+  policy.
+- Expanded `docs/PUBLIC_ISSUES_PLAN_RU.md` with governance issues for PR-based
+  review workflow and branch protection.
+- Registry readiness checks for review/governance documents and false-claim
+  guardrails.
+
+Changed:
+
+- PR template now includes compact security, registry-claim, runtime/API/UI,
+  smoke-test, rollback and evidence checklist items.
+- README and project status now link to review/governance documents.
+- Residual risk register now records that visible external code review remains
+  pending.
+
+Runtime impact:
+
+- No runtime/product code changes.
+- No API changes.
+- No UI changes.
+- No business logic changes.
+
+Guardrails:
+
+- Branch protection is documented as advisory and is not claimed as enabled.
+- External visible peer review is not claimed as active.
+- Restore test remains pending.
+- Russian build-runner remains planned.
+- Registry submission, FSTEC/FSB certification and SIEM/DLP replacement are not
+  claimed.
+
 ## 2026-06-22 residual risk register and public issue plan

 Added:
@@ -49,11 +49,14 @@ required_files=(
  "docs/PROJECT_STATUS_RU.md"
  "docs/QUALITY_STATUS_RU.md"
  "docs/SECURITY_SCANNING_POLICY_RU.md"
+  "docs/REVIEW_CHECKLIST_RU.md"
  "docs/RESIDUAL_RISKS_RU.md"
  "docs/PUBLIC_ISSUES_PLAN_RU.md"
+  "docs/BRANCH_PROTECTION_POLICY_RU.md"
  "scripts/build_release_evidence.sh"
  "scripts/check_release_evidence.sh"
  "scripts/public_secret_pattern_check.py"
+  ".github/CODEOWNERS"
  ".github/workflows/ci.yml"
  ".github/workflows/security.yml"
  ".github/workflows/coverage.yml"
@@ -245,8 +248,38 @@ require_grep "First release evidence build is not claimed as completed" "docs/re
 require_grep "Legal rightsholder package remains pending" "docs/registry/REGISTRY_READINESS_CHANGELOG_RU.md" "changelog_legal_package_pending"
 require_grep "RESIDUAL_RISKS_RU\\.md" "README.md" "readme_residual_risks_link"
 require_grep "PUBLIC_ISSUES_PLAN_RU\\.md" "README.md" "readme_public_issues_plan_link"
+require_grep "Engineering governance and residual risks" "README.md" "readme_engineering_governance_section"
+require_grep "REVIEW_CHECKLIST_RU\\.md" "README.md" "readme_review_checklist_link"
+require_grep "BRANCH_PROTECTION_POLICY_RU\\.md" "README.md" "readme_branch_protection_policy_link"
+require_grep "CODEOWNERS" "README.md" "readme_codeowners"
+require_grep "\\* @igor04091968" ".github/CODEOWNERS" "codeowners_default_owner"
+require_grep "/adk-rust/" ".github/CODEOWNERS" "codeowners_rust_workspace"
+require_grep "/scripts/" ".github/CODEOWNERS" "codeowners_scripts"
+require_grep "/docs/registry/" ".github/CODEOWNERS" "codeowners_registry_docs"
+require_grep "/\\.github/workflows/" ".github/CODEOWNERS" "codeowners_workflows"
+require_grep "/ansible/" ".github/CODEOWNERS" "codeowners_ansible"
+require_grep "SECURITY\\.md" ".github/CODEOWNERS" "codeowners_security_docs"
+require_grep "не публиковать секреты|No secrets" "docs/REVIEW_CHECKLIST_RU.md" "review_checklist_no_secrets"
+require_grep "персональных данных|personal data" "docs/REVIEW_CHECKLIST_RU.md" "review_checklist_no_pii"
+require_grep "реальных IP|hostname|customer infrastructure identifiers" "docs/REVIEW_CHECKLIST_RU.md" "review_checklist_no_customer_infra"
+require_grep "GitHub Actions.*public mirror validation" "docs/REVIEW_CHECKLIST_RU.md" "review_checklist_github_public_only"
+require_grep "Release evidence must be produced on the Russian build-runner" "docs/REVIEW_CHECKLIST_RU.md" "review_checklist_russian_runner"
+require_grep "Do not claim FSTEC/FSB certification" "docs/REVIEW_CHECKLIST_RU.md" "review_checklist_no_fstec_fsb"
+require_grep "Do not claim SIEM/DLP replacement" "docs/REVIEW_CHECKLIST_RU.md" "review_checklist_no_siem_dlp"
+require_grep "restore_tested=false|restore_tested.*false" "docs/REVIEW_CHECKLIST_RU.md" "review_checklist_restore_false"
+require_grep "Require pull request before merge" "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_require_pr"
+require_grep "Require status checks" "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_status_checks"
+require_grep 'Require `CI` workflow' "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_ci"
+require_grep 'Require `Security` workflow' "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_security"
+require_grep 'Require `Coverage` workflow' "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_coverage"
+require_grep "no coverage threshold" "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_no_coverage_threshold"
+require_grep "Restrict force push" "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_force_push"
+require_grep "Require conversation resolution" "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_conversation_resolution"
+require_grep "Require linear history" "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_linear_history"
+require_grep "emergency-only" "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_admin_bypass"
+require_grep "recommended policy|advisory branch protection policy" "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_advisory_not_enabled"
 require_grep "Один основной разработчик" "docs/RESIDUAL_RISKS_RU.md" "risk_single_developer"
-require_grep "Нет публично видимого peer review" "docs/RESIDUAL_RISKS_RU.md" "risk_peer_review"
+require_grep "Нет внешнего visible peer review" "docs/RESIDUAL_RISKS_RU.md" "risk_peer_review"
 require_grep "Низкая публичная активность issue tracker" "docs/RESIDUAL_RISKS_RU.md" "risk_issue_tracker_activity"
 require_grep "Низкая community adoption" "docs/RESIDUAL_RISKS_RU.md" "risk_community_adoption"
 require_grep "Gitea restore test еще не выполнен" "docs/RESIDUAL_RISKS_RU.md" "risk_restore_test_pending"
@@ -267,6 +300,10 @@ require_grep "\\[compat\\] Test Russian OS compatibility matrix" "docs/PUBLIC_IS
 require_grep "\\[ops\\] Validate release artifacts storage in RF" "docs/PUBLIC_ISSUES_PLAN_RU.md" "issue_artifact_storage"
 require_grep "\\[docs\\] Refresh public demo pack and screenshots" "docs/PUBLIC_ISSUES_PLAN_RU.md" "issue_demo_pack"
 require_grep "\\[pilot\\] Prepare Pilot Acceptance Checklist v2" "docs/PUBLIC_ISSUES_PLAN_RU.md" "issue_pilot_acceptance_v2"
+require_grep "\\[governance\\] Enable PR-based review workflow" "docs/PUBLIC_ISSUES_PLAN_RU.md" "issue_pr_review_workflow"
+require_grep "\\[governance\\] Add branch protection policy" "docs/PUBLIC_ISSUES_PLAN_RU.md" "issue_branch_protection_policy"
+require_grep "Acceptance criteria" "docs/PUBLIC_ISSUES_PLAN_RU.md" "issues_acceptance_criteria"
+require_grep "planned" "docs/PUBLIC_ISSUES_PLAN_RU.md" "issues_status_planned"
 require_grep "Do not mark restore test as completed until restore evidence exists" "docs/PUBLIC_ISSUES_PLAN_RU.md" "issues_restore_guardrail"
 require_grep "Do not mark .*awatch-build-01.* as ready until provisioning evidence exists" "docs/PUBLIC_ISSUES_PLAN_RU.md" "issues_build_runner_guardrail"
 require_grep "public mirror validation only" "SECURITY.md" "security_public_mirror_validation"
@@ -286,14 +323,17 @@ scan_files=(
  "$REGISTRY_DIR"/*.json
  "$ROOT/docs/QUALITY_STATUS_RU.md"
  "$ROOT/docs/SECURITY_SCANNING_POLICY_RU.md"
+  "$ROOT/docs/REVIEW_CHECKLIST_RU.md"
  "$ROOT/docs/RESIDUAL_RISKS_RU.md"
  "$ROOT/docs/PUBLIC_ISSUES_PLAN_RU.md"
+  "$ROOT/docs/BRANCH_PROTECTION_POLICY_RU.md"
  "$ROOT/SECURITY.md"
  "$ROOT/CONTRIBUTING.md"
  "$ROOT/ROADMAP.md"
  "$ROOT/deny.toml"
  "$ROOT/.github/workflows"/*.yml
  "$ROOT/.github/ISSUE_TEMPLATE"/*.yml
+  "$ROOT/.github/CODEOWNERS"
  "$ROOT/.github/pull_request_template.md"
  "$ROOT/scripts/build_release_evidence.sh"
  "$ROOT/scripts/check_release_evidence.sh"
@@ -306,8 +346,10 @@ claim_scan_files=(
  "$REGISTRY_DIR"/*.json
  "$ROOT/docs/QUALITY_STATUS_RU.md"
  "$ROOT/docs/SECURITY_SCANNING_POLICY_RU.md"
+  "$ROOT/docs/REVIEW_CHECKLIST_RU.md"
  "$ROOT/docs/RESIDUAL_RISKS_RU.md"
  "$ROOT/docs/PUBLIC_ISSUES_PLAN_RU.md"
+  "$ROOT/docs/BRANCH_PROTECTION_POLICY_RU.md"
  "$ROOT/SECURITY.md"
  "$ROOT/CONTRIBUTING.md"
  "$ROOT/ROADMAP.md"
@@ -335,7 +377,7 @@ fi
 rm -f /tmp/registry_forbidden_fstec_fsb.$$

 if grep -RInEi "(заменяет|replacement for|replaces).{0,80}(SIEM|DLP)|((SIEM|DLP).{0,80}(replacement|заменяет))" "${claim_scan_files[@]}" \
-  | grep -Eiv "(не |not |does not|not_claimed|не является|не подменяет|не заявляет|forbidden|not_made)" \
+  | grep -Eiv "(не |not |are not|does not|not_claimed|не является|не подменяет|не заявляет|forbidden|not_made)" \
  >/tmp/registry_forbidden_replacement.$$ 2>/dev/null; then
  fail "forbidden_claim_siem_dlp_replacement:$(cat /tmp/registry_forbidden_replacement.$$)"
 fi
@@ -355,6 +397,20 @@ if grep -RInEi "(юридически заверш(е|ё)нн?ая регист
 fi
 rm -f /tmp/registry_forbidden_legal_done.$$

+if grep -RInEi "(branch protection).{0,120}(enabled|включ(е|ё)н|настроен|active)" "$ROOT/README.md" "$ROOT/docs/PROJECT_STATUS_RU.md" "$ROOT/docs/BRANCH_PROTECTION_POLICY_RU.md" "$REGISTRY_DIR"/*.md \
+  | grep -Eiv "(not |не |не утверждает|not claimed|advisory|until repository settings|если применимо|recommended)" \
+  >/tmp/registry_forbidden_branch_protection_enabled.$$ 2>/dev/null; then
+  fail "forbidden_claim_branch_protection_enabled:$(cat /tmp/registry_forbidden_branch_protection_enabled.$$)"
+fi
+rm -f /tmp/registry_forbidden_branch_protection_enabled.$$
+
+if grep -RInEi "(external|visible|peer).{0,80}(review).{0,120}(active|performed|completed|done|выполняется|проведен|провед(е|ё)н|активен)" "$ROOT/README.md" "$ROOT/docs/PROJECT_STATUS_RU.md" "$ROOT/docs/RESIDUAL_RISKS_RU.md" "$REGISTRY_DIR"/*.md \
+  | grep -Eiv "(not |не |pending|still pending|не утверждает|not claimed|until public reviewed PRs)" \
+  >/tmp/registry_forbidden_external_review_active.$$ 2>/dev/null; then
+  fail "forbidden_claim_external_review_active:$(cat /tmp/registry_forbidden_external_review_active.$$)"
+fi
+rm -f /tmp/registry_forbidden_external_review_active.$$
+
 if grep -RInEi "(restore(_| )?test|restore_tested|тестов(ое|ого)[[:space:]]+восстановлен).{0,120}(completed|done|passed|true|выполнен|готов|подтвержден)" "$ROOT/docs/RESIDUAL_RISKS_RU.md" "$ROOT/docs/PUBLIC_ISSUES_PLAN_RU.md" "$ROOT/docs/PROJECT_STATUS_RU.md" "$REGISTRY_DIR"/*.md "$REGISTRY_DIR"/*.json \
  | grep -Eiv "(not |не |false|pending|not completed|not claimed|не выполнен|еще не выполнен|ещё не выполнен|не заяв|не готов|until evidence|restore_tested.*false|если.*выполнен)" \
  >/tmp/registry_forbidden_restore_done.$$ 2>/dev/null; then