docs(governance): prepare branch protection and PR review evidence

docs/BRANCH_PROTECTION_EVIDENCE_RU.md

@@ -0,0 +1,100 @@
+# AWatch-rus: branch protection evidence
+
+Дата: 2026-06-23
+
+branch_protection_status: "pending_manual_verification"
+
+GitHub issue: https://github.com/igor04091968/AWatch-rus/issues/49
+
+Этот документ является evidence template для ручной проверки GitHub branch
+protection на публичном зеркале. Он не утверждает, что branch protection уже
+настроена или подтверждена.
+
+## Target
+
+- Repository: `igor04091968/AWatch-rus`.
+- Platform role: GitHub public mirror validation only.
+- Protected branch: `main`.
+- Policy source: `docs/BRANCH_PROTECTION_POLICY_RU.md`.
+- Evidence owner: maintainer.
+
+## Settings To Verify
+
+Maintainer должен вручную проверить, что для `main` configured rule включает:
+
+- require pull request before merging;
+- require approvals: `1`;
+- dismiss stale approvals when new commits are pushed;
+- require review from CODEOWNERS, if available on the current GitHub plan;
+- require status checks to pass before merging;
+- require branches to be up to date before merging, if compatible with current
+  maintainer workflow;
+- restrict force pushes;
+- restrict deletions;
+- administrator bypass decision documented, preferably disabled for stricter
+  mode.
+
+## Required Checks
+
+Expected required checks are based on current workflow/job names:
+
+- `CI / Rust checks`
+- `CI / Docs and registry checks`
+- `CI / Smoke checks`
+- `Coverage / Coverage baseline`
+- `Security / Cargo audit`
+- `Security / Cargo deny`
+- `Security / Secret pattern check`
+- `Security / Dependency review`
+
+If GitHub displays a different context name, record the exact displayed name and
+update `docs/BRANCH_PROTECTION_POLICY_RU.md` before marking verification done.
+
+## Manual Verification Procedure
+
+1. Open repository settings for `igor04091968/AWatch-rus`.
+2. Open branch protection or repository rules for branch `main`.
+3. Compare enabled settings against this document and
+   `docs/BRANCH_PROTECTION_POLICY_RU.md`.
+4. Verify required status-check names exactly as GitHub displays them.
+5. Capture screenshot evidence without private account data or tokens.
+6. Record evidence fields below.
+7. Only after verification, update `branch_protection_status` from
+   `"pending_manual_verification"` to `"verified"` in a follow-up change.
+
+## Evidence Record
+
+- Screenshot filename placeholder:
+  `docs/evidence/github-branch-protection-main-YYYY-MM-DD.png`
+- Date: `YYYY-MM-DD`
+- Maintainer: `maintainer`
+- Repository: `igor04091968/AWatch-rus`
+- Protected branch: `main`
+- Required checks verified: `pending`
+- Admin bypass decision: `pending`
+- Force-push restriction verified: `pending`
+- Deletion restriction verified: `pending`
+- Notes: `pending`
+
+## Not Registry Release Evidence
+
+GitHub branch protection evidence is governance/process evidence for the public
+mirror. It is not registry release evidence and does not replace release
+artifacts, checksums, build logs or release evidence from the Russian
+build-runner.
+
+## Russian Contour Note
+
+Primary registry-readiness contour remains Russian Gitea plus the planned
+Russian build-runner. GitHub remains public mirror validation only.
+
+## Guardrails
+
+- Do not record secrets, tokens, private URLs or account recovery details.
+- Do not include private employee/customer data in screenshots.
+- Do not claim branch protection is verified until maintainer evidence exists.
+- Do not claim completed registry submission.
+- Do not claim certification.
+- Do not claim SIEM/DLP replacement.
+- Do not claim ML/LLM-based detection.
+- Do not claim automatic remediation.

docs/BRANCH_PROTECTION_POLICY_RU.md

@@ -1,6 +1,6 @@
 # AWatch-rus: advisory branch protection policy
 
-Дата: 2026-06-22
+Дата: 2026-06-23
 
 Статус: recommended policy. Этот документ описывает целевую настройку GitHub
 branch protection для публичного зеркала. Он не утверждает, что branch
@@ -32,6 +32,41 @@ contour остается Russian Gitea plus Russian build-runner release evidenc
 - Require linear history if compatible with the maintainer workflow.
 - Administrator bypass should be emergency-only and documented after the fact.
 
+## Recommended GitHub Branch Protection Settings
+
+Recommended settings for `main` on the GitHub public mirror:
+
+- Require pull request before merging.
+- Required approvals: `1`.
+- Dismiss stale approvals when new commits are pushed.
+- Require review from CODEOWNERS if available on the current GitHub plan.
+- Require status checks to pass before merging.
+- Require branches to be up to date before merging if this does not block the
+  current maintainer workflow.
+- Restrict force pushes.
+- Restrict deletions.
+- Allow administrators bypass: documented decision only; stricter mode should
+  keep bypass disabled unless repository recovery requires it.
+
+Recommended required checks, using current workflow/job names:
+
+- `CI / Rust checks`
+- `CI / Docs and registry checks`
+- `CI / Smoke checks`
+- `Coverage / Coverage baseline`
+- `Security / Cargo audit`
+- `Security / Cargo deny`
+- `Security / Secret pattern check`
+- `Security / Dependency review`
+
+Before verification, maintainer must compare these names with the exact check
+names displayed by GitHub. If GitHub displays different names, update this
+document and `docs/BRANCH_PROTECTION_EVIDENCE_RU.md` before recording evidence.
+
+Current evidence status is tracked in
+`docs/BRANCH_PROTECTION_EVIDENCE_RU.md` and remains
+`pending_manual_verification` until maintainer evidence is recorded.
+
 ## Review expectations
 
 - CODEOWNERS routes changes to the current maintainer.

docs/PROJECT_STATUS_RU.md

@@ -47,6 +47,15 @@ backup, registry-readiness документации, плана российск
   `docs/REVIEW_CHECKLIST_RU.md`.
 - Advisory branch protection policy:
   `docs/BRANCH_PROTECTION_POLICY_RU.md`.
+- PR-based workflow documentation: ready
+  (`docs/PR_REVIEW_WORKFLOW_RU.md`).
+- PR review evidence package: ready
+  (`docs/PR_REVIEW_EVIDENCE_RU.md`).
+- Branch protection evidence package: ready
+  (`docs/BRANCH_PROTECTION_EVIDENCE_RU.md`).
+- Branch protection actual enablement:
+  `pending_manual_verification`.
+- First reviewed PR evidence: pending.
 
 ## Что готово
 
@@ -81,6 +90,12 @@ backup, registry-readiness документации, плана российск
 - PR review process documented in PR template and review checklist.
 - Branch protection policy documented as advisory:
   `docs/BRANCH_PROTECTION_POLICY_RU.md`.
+- Branch protection evidence template prepared:
+  `docs/BRANCH_PROTECTION_EVIDENCE_RU.md`.
+- PR-based review workflow documented:
+  `docs/PR_REVIEW_WORKFLOW_RU.md`.
+- PR review evidence template prepared:
+  `docs/PR_REVIEW_EVIDENCE_RU.md`.
 - Зафиксирован residual risk register:
   `docs/RESIDUAL_RISKS_RU.md`.
 - Подготовлен план публичных issues для ручного заведения:
@@ -104,6 +119,9 @@ backup, registry-readiness документации, плана российск
 - Visible external code review is still pending.
 - Branch protection enablement is not claimed until repository settings are
   verified.
+- Branch protection actual enablement remains `pending_manual_verification`.
+- First reviewed PR evidence remains pending until a reviewed public PR is
+  merged and evidence is recorded.
 - Community adoption remains low until external contributors, public reviews
   and sustained third-party activity appear.
 
@@ -135,8 +153,11 @@ backup, registry-readiness документации, плана российск
 - `docs/registry/RELEASE_ARTIFACTS_STORAGE_RU.md`
 - `docs/QUALITY_STATUS_RU.md`
 - `docs/REVIEW_CHECKLIST_RU.md`
+- `docs/PR_REVIEW_WORKFLOW_RU.md`
+- `docs/PR_REVIEW_EVIDENCE_RU.md`
 - `docs/RESIDUAL_RISKS_RU.md`
 - `docs/PUBLIC_ISSUES_PLAN_RU.md`
 - `docs/PUBLIC_ISSUES_CREATION_RUNBOOK_RU.md`
 - `docs/public-issues/public-issues-manifest.json`
 - `docs/BRANCH_PROTECTION_POLICY_RU.md`
+- `docs/BRANCH_PROTECTION_EVIDENCE_RU.md`

docs/PR_REVIEW_EVIDENCE_RU.md

@@ -0,0 +1,74 @@
+# AWatch-rus: PR review evidence
+
+Дата: 2026-06-23
+
+pr_review_evidence_status: "pending_until_first_reviewed_pr_is_merged"
+
+GitHub issue: https://github.com/igor04091968/AWatch-rus/issues/48
+
+Этот документ фиксирует, что будет считаться evidence для PR-based review
+workflow. Он не утверждает, что external peer review уже выполнен.
+
+## Evidence Criteria
+
+Первый evidence-backed reviewed PR должен содержать:
+
+- PR URL;
+- linked issue URL;
+- completed pull request template;
+- passed checks;
+- reviewer approval;
+- merge commit;
+- no bypass, or documented bypass with reason and follow-up checks.
+
+## Evidence Record
+
+- PR URL: `pending`
+- Linked issue URL: `pending`
+- Reviewer: `pending`
+- Reviewer type: `pending`
+- Approval URL or screenshot filename: `pending`
+- Passed checks: `pending`
+- Merge commit: `pending`
+- Bypass used: `pending`
+- Date: `YYYY-MM-DD`
+- Maintainer note: `pending`
+
+## Reviewer Interpretation
+
+Review by the same maintainer improves change discipline but does not prove
+external peer review. External peer review must not be marked completed unless a
+reviewed public PR includes a reviewer who is not the submitting maintainer and
+the review is visible.
+
+## Current Status
+
+- PR workflow documentation: ready.
+- PR template: ready.
+- CODEOWNERS routing: ready.
+- First reviewed PR evidence: pending.
+- External peer review completed: not claimed.
+
+## Not Registry Release Evidence
+
+PR review evidence is governance/process evidence for public development
+visibility. It is not registry release evidence and does not replace artifacts,
+checksums, logs or release evidence from the Russian build-runner.
+
+## Russian Contour Note
+
+Primary registry-readiness contour remains Russian Gitea plus the planned
+Russian build-runner. GitHub remains public mirror validation only.
+
+## Guardrails
+
+- Do not publish secrets, private URLs, private account data or customer
+  identifiers.
+- Do not claim completed external peer review until the evidence record is
+  filled from a real reviewed PR.
+- Do not claim branch protection verification from PR evidence alone.
+- Do not claim completed registry submission.
+- Do not claim certification.
+- Do not claim SIEM/DLP replacement.
+- Do not claim ML/LLM-based detection.
+- Do not claim automatic remediation.

docs/PR_REVIEW_WORKFLOW_RU.md

@@ -0,0 +1,106 @@
+# AWatch-rus: PR-based review workflow
+
+Дата: 2026-06-23
+
+Статус: workflow documentation ready; first reviewed PR evidence remains
+pending.
+
+GitHub issue: https://github.com/igor04091968/AWatch-rus/issues/48
+
+Этот документ описывает целевой PR-based workflow для публичного GitHub mirror.
+Он не утверждает, что external peer review уже выполнен.
+
+## Scope
+
+- Repository: `igor04091968/AWatch-rus`.
+- Branch: `main`.
+- GitHub role: public mirror validation only.
+- Primary registry contour: Russian Gitea plus planned Russian build-runner.
+
+## Workflow
+
+1. Significant changes should be made on a branch and submitted through a pull
+   request.
+2. Each PR should link the relevant GitHub issue or state why no issue is
+   applicable.
+3. The PR template must be completed before merge.
+4. CODEOWNERS should route review to the responsible maintainer or reviewer.
+5. CI, Coverage and Security checks should pass before merge.
+6. Any bypass must be documented in the PR or follow-up evidence note.
+
+## Docs-Only Changes
+
+Docs-only governance changes may use a reduced local check set when no product
+code changes:
+
+- `python3 scripts/public_secret_pattern_check.py`
+- `bash scripts/prepare_public_issues.sh`
+- `bash -n scripts/registry_readiness_check.sh`
+- `bash scripts/registry_readiness_check.sh`
+- `git diff --check`
+
+If shell scripts change, run `bash -n` for each changed shell script.
+
+## Runtime/Product Changes
+
+Runtime, API, UI or product-code changes require a broader validation plan.
+Expected checks include:
+
+- `cargo fmt --all --check`
+- `cargo test --workspace`
+- `cargo clippy --workspace --all-targets -- -D warnings`
+- `cargo build --workspace`
+- relevant smoke tests for deployment, pilot validation or browser behavior;
+- rollback notes when operational behavior changes.
+
+## Security-Sensitive Changes
+
+Security-sensitive changes require:
+
+- public secret-pattern scan;
+- review against `SECURITY.md`;
+- no secrets, tokens, private keys, recovery codes or customer identifiers;
+- no exploit detail in public text before security triage.
+
+## Registry Documentation Changes
+
+Registry docs must preserve conservative claims:
+
+- GitHub Actions is public mirror validation only.
+- Registry release evidence requires Russian Gitea and the planned Russian
+  build-runner.
+- Do not claim completed registry submission.
+- Do not claim FSTEC/FSB certification.
+- Do not claim SIEM/DLP replacement.
+- Do not claim ML/LLM-based detection.
+- Do not claim automatic remediation.
+- Do not claim branch protection verification until maintainer evidence exists.
+- Do not claim external peer review completion until reviewed PR evidence
+  exists.
+
+## Required Check Names
+
+Current workflow/job names used for branch protection planning:
+
+- `CI / Rust checks`
+- `CI / Docs and registry checks`
+- `CI / Smoke checks`
+- `Coverage / Coverage baseline`
+- `Security / Cargo audit`
+- `Security / Cargo deny`
+- `Security / Secret pattern check`
+- `Security / Dependency review`
+
+These names should be rechecked against GitHub UI before branch protection is
+marked verified.
+
+## Evidence
+
+Evidence for the first reviewed PR is tracked in
+`docs/PR_REVIEW_EVIDENCE_RU.md`.
+
+## Not Registry Release Evidence
+
+PR review workflow evidence improves public process visibility. It is not
+registry release evidence and does not replace release evidence generated on the
+Russian build-runner.

docs/RESIDUAL_RISKS_RU.md

@@ -50,21 +50,26 @@ visibility, release evidence contour and legal package. Они требуют д
 
 ## 2. Нет внешнего visible peer review / публично видимого peer review
 
-- Текущий статус: риск открыт; PR template and issue templates exist, but
-  public peer review history is still limited and external review is pending.
+- Текущий статус: риск открыт; PR template, CODEOWNERS, public governance
+  issues and PR workflow docs exist, but first reviewed PR evidence and branch
+  protection verification are still pending.
 - Влияние: внешним аудиторам сложнее оценить review discipline and change
   control maturity.
 - Почему не блокирует pilot/readiness stage: current changes are protected by
   reproducible checks, public workflows and documented conservative positioning.
-- Как риск будет снижаться: review checklist, CODEOWNERS routing, first public
-  PR reviews, explicit release branch review policy and advisory branch
-  protection.
+- Как риск будет снижаться: review checklist, CODEOWNERS routing, public issue
+  #48, `docs/PR_REVIEW_WORKFLOW_RU.md`, first public reviewed PR evidence,
+  explicit release branch review policy and verified branch protection evidence.
 - Уже снижающие evidence/documents/CI: `.github/pull_request_template.md`,
   `.github/CODEOWNERS`, `.github/ISSUE_TEMPLATE/`,
   `docs/REVIEW_CHECKLIST_RU.md`, `docs/BRANCH_PROTECTION_POLICY_RU.md`,
+  `docs/BRANCH_PROTECTION_EVIDENCE_RU.md`,
+  `docs/PR_REVIEW_WORKFLOW_RU.md`, `docs/PR_REVIEW_EVIDENCE_RU.md`,
   `CONTRIBUTING.md`, `SECURITY.md`, public CI, public security workflow.
-- Следующий action: завести публичную задачу
-  `[governance] Enable PR-based review workflow`.
+- Residual risk: remains open until branch protection is verified and first
+  reviewed PR evidence exists.
+- Следующий action: выполнить maintainer verification for branch protection and
+  record first reviewed PR evidence without overstating external peer review.
 
 ## 3. Низкая публичная активность issue tracker
 
@@ -180,6 +185,12 @@ visibility, release evidence contour and legal package. Они требуют д
 - PR review checklist exists in `docs/REVIEW_CHECKLIST_RU.md`.
 - Advisory branch protection policy exists in
   `docs/BRANCH_PROTECTION_POLICY_RU.md`.
+- Branch protection evidence template exists in
+  `docs/BRANCH_PROTECTION_EVIDENCE_RU.md` with
+  `pending_manual_verification` status.
+- PR-based workflow documentation exists in `docs/PR_REVIEW_WORKFLOW_RU.md`.
+- PR review evidence template exists in `docs/PR_REVIEW_EVIDENCE_RU.md`;
+  first reviewed PR evidence remains pending.
 - Public PR template includes security, registry-claim, runtime/API/UI,
   smoke-test, rollback and evidence checklist items.
 - Visible external code review remains pending until public reviewed PRs exist.

docs/public-issues/public-issues-manifest.json

@@ -112,7 +112,8 @@
       "status": "created",
       "github_issue_url": "https://github.com/igor04091968/AWatch-rus/issues/48",
       "created_at": "2026-06-23T19:43:08Z",
-      "created_by": "maintainer"
+      "created_by": "maintainer",
+      "next_evidence_doc": "docs/PR_REVIEW_EVIDENCE_RU.md"
     },
     {
       "id": "012",
@@ -122,7 +123,8 @@
       "status": "created",
       "github_issue_url": "https://github.com/igor04091968/AWatch-rus/issues/49",
       "created_at": "2026-06-23T19:43:10Z",
-      "created_by": "maintainer"
+      "created_by": "maintainer",
+      "next_evidence_doc": "docs/BRANCH_PROTECTION_EVIDENCE_RU.md"
     }
   ]
 }

docs/registry/REGISTRY_READINESS_CHANGELOG_RU.md

@@ -1,5 +1,45 @@
 # Registry readiness changelog
 
+## 2026-06-23 branch protection and PR review evidence package
+
+Added:
+
+- `docs/BRANCH_PROTECTION_EVIDENCE_RU.md` with
+  `pending_manual_verification` status for GitHub branch protection evidence.
+- `docs/PR_REVIEW_WORKFLOW_RU.md` with PR-based review workflow rules.
+- `docs/PR_REVIEW_EVIDENCE_RU.md` with evidence criteria for the first reviewed
+  public PR.
+- Public issues manifest links issue #48 to PR review evidence and issue #49 to
+  branch protection evidence.
+
+Changed:
+
+- `docs/BRANCH_PROTECTION_POLICY_RU.md` now lists recommended settings and real
+  current GitHub Actions check names.
+- `.github/pull_request_template.md` includes compact governance/evidence
+  checklist items.
+- `.github/CODEOWNERS` has clearer zones for workflows/security/governance,
+  registry docs, scripts, Rust workspace, demo/screenshots/docs.
+- Project status and residual risks now distinguish prepared governance
+  evidence from pending verification.
+
+Runtime impact:
+
+- No runtime/product code changes.
+- No API changes.
+- No UI changes.
+- No business logic changes.
+
+Guardrails:
+
+- Branch protection verification remains pending until maintainer records
+  repository settings evidence.
+- External peer review is not claimed completed until real reviewed PR evidence
+  exists.
+- GitHub remains public mirror validation only.
+- Russian Gitea plus planned Russian build-runner remains the primary registry
+  contour.
+
 ## 2026-06-23 public roadmap issues created and linked
 
 Changed: