docs(governance): add review process residual risks and issue plan

docs/BRANCH_PROTECTION_POLICY_RU.md

@@ -0,0 +1,64 @@
+# AWatch-rus: advisory branch protection policy
+
+Дата: 2026-06-22
+
+Статус: recommended policy. Этот документ описывает целевую настройку GitHub
+branch protection для публичного зеркала. Он не утверждает, что branch
+protection уже включен.
+
+GitHub остается public mirror validation surface. Primary registry-readiness
+contour остается Russian Gitea plus Russian build-runner release evidence.
+
+## Scope
+
+- Branch: `main`.
+- Platform: GitHub public mirror.
+- Purpose: visible review discipline, status-check discipline and public
+  engineering maturity signal.
+- Registry release evidence: out of scope for GitHub Actions.
+
+## Recommended rules
+
+- Require pull request before merge.
+- Require at least one approving review for non-emergency changes.
+- Require status checks before merge.
+- Require `CI` workflow.
+- Require `Security` workflow.
+- Require `Coverage` workflow as baseline visibility; no coverage threshold is
+  enforced yet.
+- Require conversation resolution before merge.
+- Restrict force push.
+- Restrict branch deletion.
+- Require linear history if compatible with the maintainer workflow.
+- Administrator bypass should be emergency-only and documented after the fact.
+
+## Review expectations
+
+- CODEOWNERS routes changes to the current maintainer.
+- External visible peer review is still pending and should be introduced through
+  public pull requests.
+- Review approval is not a warranty of security, fitness for production or
+  legal readiness.
+- Contributors remain responsible for the safety and accuracy of their changes.
+
+## Registry and security guardrails
+
+- Do not claim FSTEC/FSB certification.
+- Do not claim completed Russian software registry submission.
+- Do not claim SIEM/DLP replacement.
+- Do not publish secrets, personal data, employee data or customer
+  infrastructure identifiers.
+- Do not claim Gitea restore test completed until evidence exists.
+- Do not claim Russian build-runner ready until provisioning evidence exists.
+
+## Emergency bypass
+
+Emergency administrator bypass may be used only for urgent repository recovery,
+blocked release hygiene or security containment. The follow-up record should
+state:
+
+- reason for bypass;
+- commits affected;
+- checks run after bypass;
+- rollback or follow-up action;
+- whether registry-readiness claims changed.

docs/PROJECT_STATUS_RU.md

@@ -32,6 +32,10 @@ backup, registry-readiness документации, плана российск
   `docs/RESIDUAL_RISKS_RU.md`.
 - План публичных GitHub issues:
   `docs/PUBLIC_ISSUES_PLAN_RU.md`.
+- Review checklist:
+  `docs/REVIEW_CHECKLIST_RU.md`.
+- Advisory branch protection policy:
+  `docs/BRANCH_PROTECTION_POLICY_RU.md`.
 
 ## Что готово
 
@@ -60,6 +64,12 @@ backup, registry-readiness документации, плана российск
   по контурам `CI`, `Coverage` и `Security`.
 - Добавлены `SECURITY.md`, `CONTRIBUTING.md`, `ROADMAP.md`, issue templates и
   pull request template.
+- Добавлен `.github/CODEOWNERS` for review routing.
+- Добавлен review checklist:
+  `docs/REVIEW_CHECKLIST_RU.md`.
+- PR review process documented in PR template and review checklist.
+- Branch protection policy documented as advisory:
+  `docs/BRANCH_PROTECTION_POLICY_RU.md`.
 - Зафиксирован residual risk register:
   `docs/RESIDUAL_RISKS_RU.md`.
 - Подготовлен план публичных issues для ручного заведения:
@@ -75,6 +85,9 @@ backup, registry-readiness документации, плана российск
 - Финальная юридическая проверка пакета документов перед подачей.
 - Проверка совместимости с российскими ОС.
 - Публичные roadmap/issues из `docs/PUBLIC_ISSUES_PLAN_RU.md`.
+- Visible external code review is still pending.
+- Branch protection enablement is not claimed until repository settings are
+  verified.
 
 ## Честные ограничения
 
@@ -103,5 +116,7 @@ backup, registry-readiness документации, плана российск
 - `docs/registry/RELEASE_EVIDENCE_RUNBOOK_RU.md`
 - `docs/registry/RELEASE_ARTIFACTS_STORAGE_RU.md`
 - `docs/QUALITY_STATUS_RU.md`
+- `docs/REVIEW_CHECKLIST_RU.md`
 - `docs/RESIDUAL_RISKS_RU.md`
 - `docs/PUBLIC_ISSUES_PLAN_RU.md`
+- `docs/BRANCH_PROTECTION_POLICY_RU.md`

docs/PUBLIC_ISSUES_PLAN_RU.md

@@ -12,18 +12,20 @@ Gitea-контура, backup, public CI, coverage, security scanning и status f
 
 ## Issues to create manually
 
-| Title | Purpose | Current status |
-| --- | --- | --- |
-| `[registry] Perform Gitea backup restore test` | Prove restore procedure on a separate host and keep `restore_tested=false` until evidence exists. | To create |
-| `[registry] Prepare temporary Russian build-runner awatch-build-01` | Provision temporary or permanent Russian build-runner for registry release evidence. | To create |
-| `[release] Produce first release evidence package` | Run release evidence scripts on `awatch-build-01` and collect artifacts/logs/checksums. | To create |
-| `[legal] Prepare rightsholder evidence package` | Prepare rightsholder and legal evidence for future registry submission. | To create |
-| `[qa] Define coverage threshold policy` | Define threshold only after stable coverage baseline review. | To create |
-| `[security] Prepare external security/code review checklist` | Establish visible peer review and external security review checklist. | To create |
-| `[compat] Test Russian OS compatibility matrix` | Validate supported Russian OS matrix and document evidence. | To create |
-| `[ops] Validate release artifacts storage in RF` | Confirm release artifact storage location and retention in the Russian contour. | To create |
-| `[docs] Refresh public demo pack and screenshots` | Update public demo pack, screenshots and non-sensitive demo evidence. | To create |
-| `[pilot] Prepare Pilot Acceptance Checklist v2` | Update pilot acceptance checklist after residual risk register and public issue plan. | To create |
+| Title | Labels | Short goal | Acceptance criteria | Status |
+| --- | --- | --- | --- | --- |
+| `[registry] Perform Gitea backup restore test` | `registry`, `ops`, `evidence` | Prove restore procedure on a separate host and keep `restore_tested=false` until evidence exists. | Restore log, checksum verification, post-restore checks and rollback notes are attached or linked. | planned |
+| `[registry] Prepare temporary Russian build-runner awatch-build-01` | `registry`, `build-runner`, `ops` | Provision temporary or permanent Russian build-runner for registry release evidence. | Host provisioning notes, toolchain list, Gitea access method and required checks plan are documented. | planned |
+| `[release] Produce first release evidence package` | `release`, `registry`, `evidence` | Run release evidence scripts on `awatch-build-01` and collect artifacts/logs/checksums. | Release evidence manifest, logs, checksums and artifact storage path are documented. | planned |
+| `[legal] Prepare rightsholder evidence package` | `legal`, `registry`, `docs` | Prepare rightsholder and legal evidence for future registry submission. | Rightsholder evidence checklist, ownership notes and legal review TODOs are documented. | planned |
+| `[qa] Define coverage threshold policy` | `qa`, `coverage`, `policy` | Define threshold only after stable coverage baseline review. | Coverage baseline reviewed and initial threshold policy proposed without blocking current baseline workflow. | planned |
+| `[security] Prepare external security/code review checklist` | `security`, `review`, `governance` | Establish visible peer review and external security review checklist. | Checklist references `docs/REVIEW_CHECKLIST_RU.md` and defines public review evidence expectations. | planned |
+| `[compat] Test Russian OS compatibility matrix` | `compat`, `qa`, `registry` | Validate supported Russian OS matrix and document evidence. | Matrix lists target OS versions, test status and gaps without unsupported compatibility claims. | planned |
+| `[ops] Validate release artifacts storage in RF` | `ops`, `release`, `registry` | Confirm release artifact storage location and retention in the Russian contour. | Storage path, retention, access model and checksum verification procedure are documented. | planned |
+| `[docs] Refresh public demo pack and screenshots` | `docs`, `demo`, `public` | Update public demo pack, screenshots and non-sensitive demo evidence. | Demo materials contain no secrets, PII, real employee data or customer infrastructure identifiers. | planned |
+| `[pilot] Prepare Pilot Acceptance Checklist v2` | `pilot`, `qa`, `docs` | Update pilot acceptance checklist after residual risk register and public issue plan. | Checklist references residual risks, smoke checks and acceptance evidence needed for pilot stage. | planned |
+| `[governance] Enable PR-based review workflow` | `governance`, `review`, `process` | Move visible changes through pull requests where practical. | First public PR review record exists or a documented dry-run PR demonstrates the process. | planned |
+| `[governance] Add branch protection policy` | `governance`, `github`, `policy` | Configure GitHub branch protection after maintainer review of the advisory policy. | Branch protection settings are documented with screenshots or notes, or blockers are recorded. | planned |
 
 ## Guardrails
 
@@ -33,4 +35,6 @@ Gitea-контура, backup, public CI, coverage, security scanning и status f
 - Do not claim completed registry submission.
 - Do not claim fake community adoption.
 - Do not position GitHub Actions as the primary registry build contour.
-
+- Do not claim external peer review is active until public reviewed PRs exist.
+- Do not claim branch protection is enabled until repository settings are
+  verified.

docs/RESIDUAL_RISKS_RU.md

@@ -48,21 +48,23 @@ visibility, release evidence contour and legal package. Они требуют д
 - Следующий action: завести публичную задачу
   `[security] Prepare external security/code review checklist`.
 
-## 2. Нет публично видимого peer review
+## 2. Нет внешнего visible peer review / публично видимого peer review
 
 - Текущий статус: риск открыт; PR template and issue templates exist, but
-  public peer review history is still limited.
+  public peer review history is still limited and external review is pending.
 - Влияние: внешним аудиторам сложнее оценить review discipline and change
   control maturity.
 - Почему не блокирует pilot/readiness stage: current changes are protected by
   reproducible checks, public workflows and documented conservative positioning.
-- Как риск будет снижаться: external review checklist, first public PR reviews,
-  explicit release branch review policy.
+- Как риск будет снижаться: review checklist, CODEOWNERS routing, first public
+  PR reviews, explicit release branch review policy and advisory branch
+  protection.
 - Уже снижающие evidence/documents/CI: `.github/pull_request_template.md`,
-  `.github/ISSUE_TEMPLATE/`, `CONTRIBUTING.md`, `SECURITY.md`, public CI,
-  public security workflow.
+  `.github/CODEOWNERS`, `.github/ISSUE_TEMPLATE/`,
+  `docs/REVIEW_CHECKLIST_RU.md`, `docs/BRANCH_PROTECTION_POLICY_RU.md`,
+  `CONTRIBUTING.md`, `SECURITY.md`, public CI, public security workflow.
 - Следующий action: завести публичную задачу
-  `[security] Prepare external security/code review checklist`.
+  `[governance] Enable PR-based review workflow`.
 
 ## 3. Низкая публичная активность issue tracker
 
@@ -166,9 +168,18 @@ visibility, release evidence contour and legal package. Они требуют д
 - Следующий action: завести публичную задачу
   `[legal] Prepare rightsholder evidence package`.
 
+## Review/governance evidence added
+
+- CODEOWNERS exists for review routing and engineering ownership.
+- PR review checklist exists in `docs/REVIEW_CHECKLIST_RU.md`.
+- Advisory branch protection policy exists in
+  `docs/BRANCH_PROTECTION_POLICY_RU.md`.
+- Public PR template includes security, registry-claim, runtime/API/UI,
+  smoke-test, rollback and evidence checklist items.
+- Visible external code review remains pending until public reviewed PRs exist.
+
 ## Следующие публичные задачи
 
 Полный список задач для ручного заведения в GitHub issue tracker:
 
 - `docs/PUBLIC_ISSUES_PLAN_RU.md`.
-

docs/REVIEW_CHECKLIST_RU.md

@@ -0,0 +1,108 @@
+# AWatch-rus: PR / code review checklist
+
+Дата: 2026-06-22
+
+Статус: advisory checklist for public review process.
+
+Этот документ описывает проверочный чеклист для pull requests и внешнего
+инженерного review. Он не утверждает, что внешний peer review уже выполняется
+регулярно, и не является гарантией отсутствия дефектов или уязвимостей.
+
+GitHub Actions используется только как public mirror validation. Registry
+release evidence должен производиться на российском build-runner.
+
+## Общая безопасность изменений
+
+- Изменение имеет понятную цель, ограниченный scope and documented impact.
+- Нет секретов, токенов, паролей, приватных ключей, recovery codes or live
+  credentials.
+- Нет персональных данных сотрудников, реальных employee logs or customer
+  evidence.
+- Нет реальных IP, hostname or infrastructure identifiers заказчика.
+- Нет новых публичных портов, external callbacks or telemetry without explicit
+  documentation.
+- Нет ослабления fail-closed checks, security gates or auditability.
+
+## Rust code quality
+
+- Rust-код форматируется `cargo fmt --all --check`.
+- Для затронутого Rust workspace ожидаются relevant `cargo test` checks.
+- Ошибки обрабатываются явно; нет silent fallback для security-sensitive paths.
+- Timeouts, retries and bounds are explicit for network or long-running work.
+- Новые dependencies justified and license-compatible.
+
+## API / contract compatibility
+
+- Public API, CLI flags, file formats and JSON contracts remain compatible, or
+  breaking impact is explicitly blocked for this stage.
+- Backward compatibility checked for existing collectors, exporters,
+  dashboards and automation consumers.
+- Error responses and status codes are not changed accidentally.
+
+## UI / runtime impact
+
+- PR states whether UI impact is none, documentation-only or user-visible.
+- PR states whether runtime deployment impact is none or requires operator
+  action.
+- No runtime behavior is changed by documentation/governance-only PRs.
+- No service restart, migration or production config change is implied unless
+  explicitly documented.
+
+## Registry-readiness impact
+
+- GitHub Actions is public mirror validation only.
+- Public CI, Coverage and Security workflows are not registry release evidence.
+- Release evidence must be produced on the Russian build-runner.
+- Russian Gitea remains the primary registry-readiness source contour.
+- Do not claim completed Russian software registry submission.
+- Do not claim FSTEC/FSB certification.
+- Do not claim SIEM/DLP replacement.
+- Do not mark restore test as completed while `restore_tested=false`.
+- Do not mark `awatch-build-01` as ready until provisioning evidence exists.
+
+## Secret / PII safety
+
+- No secrets, tokens, passwords or private keys in code, docs, logs,
+  screenshots or workflow output.
+- No employee personal data, real user activity traces or unredacted customer
+  identifiers.
+- No customer IP addresses, internal hostnames, VPN details or private network
+  topology.
+- Demo data is synthetic or anonymized.
+- Public secret scan is expected to pass before merge.
+
+## Documentation impact
+
+- README, `docs/PROJECT_STATUS_RU.md`, registry docs and operational runbooks
+  are updated when claims, checks, workflows or procedures change.
+- New claims are conservative and evidence-backed.
+- Pending work remains marked as planned/pending until evidence exists.
+- Public mirror wording remains separate from registry release evidence.
+
+## Deployment / rollback impact
+
+- PR states whether deployment action is required.
+- Rollback path is documented for runtime or automation changes.
+- Documentation-only PRs state that runtime/API/UI impact is unchanged.
+- Changes to scripts include syntax checks and a clear operator failure mode.
+
+## Smoke checks
+
+- Run checks relevant to changed files.
+- For documentation/governance updates, expected minimum checks are:
+  `python3 scripts/public_secret_pattern_check.py`,
+  `bash -n scripts/registry_readiness_check.sh`,
+  `bash scripts/registry_readiness_check.sh`,
+  `git diff --check`.
+- For shell changes, `bash -n` is mandatory for changed shell scripts.
+- For Rust/product changes, Rust checks are required by risk and scope.
+
+## Evidence requirements
+
+- PR records commands run and results.
+- Skipped checks include a concrete reason.
+- Registry release evidence is not accepted from GitHub Actions alone.
+- Russian build-runner release evidence must include logs, checksums and
+  artifact manifest when that contour is ready.
+- Restore test evidence must include separate-host restore notes and checksum
+  verification before `restore_tested` changes from false.

docs/registry/REGISTRY_READINESS_CHANGELOG_RU.md

@@ -1,5 +1,42 @@
 # Registry readiness changelog
 
+## 2026-06-22 review governance and branch protection policy
+
+Added:
+
+- `.github/CODEOWNERS` for public review routing and engineering ownership.
+- `docs/REVIEW_CHECKLIST_RU.md` for PR/code review checks.
+- `docs/BRANCH_PROTECTION_POLICY_RU.md` as advisory GitHub branch protection
+  policy.
+- Expanded `docs/PUBLIC_ISSUES_PLAN_RU.md` with governance issues for PR-based
+  review workflow and branch protection.
+- Registry readiness checks for review/governance documents and false-claim
+  guardrails.
+
+Changed:
+
+- PR template now includes compact security, registry-claim, runtime/API/UI,
+  smoke-test, rollback and evidence checklist items.
+- README and project status now link to review/governance documents.
+- Residual risk register now records that visible external code review remains
+  pending.
+
+Runtime impact:
+
+- No runtime/product code changes.
+- No API changes.
+- No UI changes.
+- No business logic changes.
+
+Guardrails:
+
+- Branch protection is documented as advisory and is not claimed as enabled.
+- External visible peer review is not claimed as active.
+- Restore test remains pending.
+- Russian build-runner remains planned.
+- Registry submission, FSTEC/FSB certification and SIEM/DLP replacement are not
+  claimed.
+
 ## 2026-06-22 residual risk register and public issue plan
 
 Added: