docs(governance): prepare branch protection and PR review evidence

.github/CODEOWNERS

@@ -17,13 +17,27 @@
 # Operational scripts and automation.
 /scripts/ @igor04091968
 
+# Product documentation, demo material and screenshots.
+/docs/ @igor04091968
+/docs/demo/ @igor04091968
+/docs/screenshots/ @igor04091968
+/docs/assets/screenshots/ @igor04091968
+
 # Registry-readiness evidence and policy documents.
 /docs/registry/ @igor04091968
 
-# GitHub public mirror validation metadata.
+# GitHub public mirror validation metadata and governance controls.
 /.github/workflows/ @igor04091968
+/.github/workflows/ci.yml @igor04091968
+/.github/workflows/security.yml @igor04091968
+/.github/workflows/coverage.yml @igor04091968
 /.github/pull_request_template.md @igor04091968
 /.github/ISSUE_TEMPLATE/ @igor04091968
+/.github/CODEOWNERS @igor04091968
+/docs/BRANCH_PROTECTION_POLICY_RU.md @igor04091968
+/docs/BRANCH_PROTECTION_EVIDENCE_RU.md @igor04091968
+/docs/PR_REVIEW_WORKFLOW_RU.md @igor04091968
+/docs/PR_REVIEW_EVIDENCE_RU.md @igor04091968
 
 # Ansible deployment automation.
 /ansible/ @igor04091968

.github/pull_request_template.md

@@ -18,6 +18,14 @@ stand or unavailable tool.
 
 ## Review Checklist
 
+- [ ] Linked issue is provided, or the PR explains why no issue is applicable.
+- [ ] Runtime/API/UI impact is stated.
+- [ ] Registry claims are checked and remain conservative.
+- [ ] Secrets, PII, employee logs and customer identifiers are absent.
+- [ ] Tests/checks executed are listed, or skipped checks have reasons.
+- [ ] Evidence docs are updated when the change affects governance, registry
+      readiness or release evidence.
+- [ ] GitHub Actions are public validation only, not registry release evidence.
 - [ ] I checked that this PR does not publish secrets, tokens, passwords,
       private keys, recovery codes or live credentials.
 - [ ] I checked that this PR does not publish personal data, real employee data,

README.md

@@ -283,6 +283,12 @@ collectors.
   [docs/public-issues/public-issues-manifest.json](docs/public-issues/public-issues-manifest.json).
 - Advisory branch protection policy:
   [docs/BRANCH_PROTECTION_POLICY_RU.md](docs/BRANCH_PROTECTION_POLICY_RU.md).
+- Branch protection evidence template:
+  [docs/BRANCH_PROTECTION_EVIDENCE_RU.md](docs/BRANCH_PROTECTION_EVIDENCE_RU.md).
+- PR-based review workflow:
+  [docs/PR_REVIEW_WORKFLOW_RU.md](docs/PR_REVIEW_WORKFLOW_RU.md).
+- PR review evidence template:
+  [docs/PR_REVIEW_EVIDENCE_RU.md](docs/PR_REVIEW_EVIDENCE_RU.md).
 - CODEOWNERS and PR template are maintained for review routing and public
   change-control visibility.
 - Visible external code review is still pending until public reviewed PRs exist.

docs/BRANCH_PROTECTION_EVIDENCE_RU.md

@@ -0,0 +1,100 @@
+# AWatch-rus: branch protection evidence
+
+Дата: 2026-06-23
+
+branch_protection_status: "pending_manual_verification"
+
+GitHub issue: https://github.com/igor04091968/AWatch-rus/issues/49
+
+Этот документ является evidence template для ручной проверки GitHub branch
+protection на публичном зеркале. Он не утверждает, что branch protection уже
+настроена или подтверждена.
+
+## Target
+
+- Repository: `igor04091968/AWatch-rus`.
+- Platform role: GitHub public mirror validation only.
+- Protected branch: `main`.
+- Policy source: `docs/BRANCH_PROTECTION_POLICY_RU.md`.
+- Evidence owner: maintainer.
+
+## Settings To Verify
+
+Maintainer должен вручную проверить, что для `main` configured rule включает:
+
+- require pull request before merging;
+- require approvals: `1`;
+- dismiss stale approvals when new commits are pushed;
+- require review from CODEOWNERS, if available on the current GitHub plan;
+- require status checks to pass before merging;
+- require branches to be up to date before merging, if compatible with current
+  maintainer workflow;
+- restrict force pushes;
+- restrict deletions;
+- administrator bypass decision documented, preferably disabled for stricter
+  mode.
+
+## Required Checks
+
+Expected required checks are based on current workflow/job names:
+
+- `CI / Rust checks`
+- `CI / Docs and registry checks`
+- `CI / Smoke checks`
+- `Coverage / Coverage baseline`
+- `Security / Cargo audit`
+- `Security / Cargo deny`
+- `Security / Secret pattern check`
+- `Security / Dependency review`
+
+If GitHub displays a different context name, record the exact displayed name and
+update `docs/BRANCH_PROTECTION_POLICY_RU.md` before marking verification done.
+
+## Manual Verification Procedure
+
+1. Open repository settings for `igor04091968/AWatch-rus`.
+2. Open branch protection or repository rules for branch `main`.
+3. Compare enabled settings against this document and
+   `docs/BRANCH_PROTECTION_POLICY_RU.md`.
+4. Verify required status-check names exactly as GitHub displays them.
+5. Capture screenshot evidence without private account data or tokens.
+6. Record evidence fields below.
+7. Only after verification, update `branch_protection_status` from
+   `"pending_manual_verification"` to `"verified"` in a follow-up change.
+
+## Evidence Record
+
+- Screenshot filename placeholder:
+  `docs/evidence/github-branch-protection-main-YYYY-MM-DD.png`
+- Date: `YYYY-MM-DD`
+- Maintainer: `maintainer`
+- Repository: `igor04091968/AWatch-rus`
+- Protected branch: `main`
+- Required checks verified: `pending`
+- Admin bypass decision: `pending`
+- Force-push restriction verified: `pending`
+- Deletion restriction verified: `pending`
+- Notes: `pending`
+
+## Not Registry Release Evidence
+
+GitHub branch protection evidence is governance/process evidence for the public
+mirror. It is not registry release evidence and does not replace release
+artifacts, checksums, build logs or release evidence from the Russian
+build-runner.
+
+## Russian Contour Note
+
+Primary registry-readiness contour remains Russian Gitea plus the planned
+Russian build-runner. GitHub remains public mirror validation only.
+
+## Guardrails
+
+- Do not record secrets, tokens, private URLs or account recovery details.
+- Do not include private employee/customer data in screenshots.
+- Do not claim branch protection is verified until maintainer evidence exists.
+- Do not claim completed registry submission.
+- Do not claim certification.
+- Do not claim SIEM/DLP replacement.
+- Do not claim ML/LLM-based detection.
+- Do not claim automatic remediation.

docs/BRANCH_PROTECTION_POLICY_RU.md

@@ -1,6 +1,6 @@
 # AWatch-rus: advisory branch protection policy
 
-Дата: 2026-06-22
+Дата: 2026-06-23
 
 Статус: recommended policy. Этот документ описывает целевую настройку GitHub
 branch protection для публичного зеркала. Он не утверждает, что branch
@@ -32,6 +32,41 @@ contour остается Russian Gitea plus Russian build-runner release evidenc
 - Require linear history if compatible with the maintainer workflow.
 - Administrator bypass should be emergency-only and documented after the fact.
 
+## Recommended GitHub Branch Protection Settings
+
+Recommended settings for `main` on the GitHub public mirror:
+
+- Require pull request before merging.
+- Required approvals: `1`.
+- Dismiss stale approvals when new commits are pushed.
+- Require review from CODEOWNERS if available on the current GitHub plan.
+- Require status checks to pass before merging.
+- Require branches to be up to date before merging if this does not block the
+  current maintainer workflow.
+- Restrict force pushes.
+- Restrict deletions.
+- Allow administrators bypass: documented decision only; stricter mode should
+  keep bypass disabled unless repository recovery requires it.
+
+Recommended required checks, using current workflow/job names:
+
+- `CI / Rust checks`
+- `CI / Docs and registry checks`
+- `CI / Smoke checks`
+- `Coverage / Coverage baseline`
+- `Security / Cargo audit`
+- `Security / Cargo deny`
+- `Security / Secret pattern check`
+- `Security / Dependency review`
+
+Before verification, maintainer must compare these names with the exact check
+names displayed by GitHub. If GitHub displays different names, update this
+document and `docs/BRANCH_PROTECTION_EVIDENCE_RU.md` before recording evidence.
+
+Current evidence status is tracked in
+`docs/BRANCH_PROTECTION_EVIDENCE_RU.md` and remains
+`pending_manual_verification` until maintainer evidence is recorded.
+
 ## Review expectations
 
 - CODEOWNERS routes changes to the current maintainer.

docs/PROJECT_STATUS_RU.md

@@ -47,6 +47,15 @@ backup, registry-readiness документации, плана российск
   `docs/REVIEW_CHECKLIST_RU.md`.
 - Advisory branch protection policy:
   `docs/BRANCH_PROTECTION_POLICY_RU.md`.
+- PR-based workflow documentation: ready
+  (`docs/PR_REVIEW_WORKFLOW_RU.md`).
+- PR review evidence package: ready
+  (`docs/PR_REVIEW_EVIDENCE_RU.md`).
+- Branch protection evidence package: ready
+  (`docs/BRANCH_PROTECTION_EVIDENCE_RU.md`).
+- Branch protection actual enablement:
+  `pending_manual_verification`.
+- First reviewed PR evidence: pending.
 
 ## Что готово
 
@@ -81,6 +90,12 @@ backup, registry-readiness документации, плана российск
 - PR review process documented in PR template and review checklist.
 - Branch protection policy documented as advisory:
   `docs/BRANCH_PROTECTION_POLICY_RU.md`.
+- Branch protection evidence template prepared:
+  `docs/BRANCH_PROTECTION_EVIDENCE_RU.md`.
+- PR-based review workflow documented:
+  `docs/PR_REVIEW_WORKFLOW_RU.md`.
+- PR review evidence template prepared:
+  `docs/PR_REVIEW_EVIDENCE_RU.md`.
 - Зафиксирован residual risk register:
   `docs/RESIDUAL_RISKS_RU.md`.
 - Подготовлен план публичных issues для ручного заведения:
@@ -104,6 +119,9 @@ backup, registry-readiness документации, плана российск
 - Visible external code review is still pending.
 - Branch protection enablement is not claimed until repository settings are
   verified.
+- Branch protection actual enablement remains `pending_manual_verification`.
+- First reviewed PR evidence remains pending until a reviewed public PR is
+  merged and evidence is recorded.
 - Community adoption remains low until external contributors, public reviews
   and sustained third-party activity appear.
 
@@ -135,8 +153,11 @@ backup, registry-readiness документации, плана российск
 - `docs/registry/RELEASE_ARTIFACTS_STORAGE_RU.md`
 - `docs/QUALITY_STATUS_RU.md`
 - `docs/REVIEW_CHECKLIST_RU.md`
+- `docs/PR_REVIEW_WORKFLOW_RU.md`
+- `docs/PR_REVIEW_EVIDENCE_RU.md`
 - `docs/RESIDUAL_RISKS_RU.md`
 - `docs/PUBLIC_ISSUES_PLAN_RU.md`
 - `docs/PUBLIC_ISSUES_CREATION_RUNBOOK_RU.md`
 - `docs/public-issues/public-issues-manifest.json`
 - `docs/BRANCH_PROTECTION_POLICY_RU.md`
+- `docs/BRANCH_PROTECTION_EVIDENCE_RU.md`

docs/PR_REVIEW_EVIDENCE_RU.md

@@ -0,0 +1,74 @@
+# AWatch-rus: PR review evidence
+
+Дата: 2026-06-23
+
+pr_review_evidence_status: "pending_until_first_reviewed_pr_is_merged"
+
+GitHub issue: https://github.com/igor04091968/AWatch-rus/issues/48
+
+Этот документ фиксирует, что будет считаться evidence для PR-based review
+workflow. Он не утверждает, что external peer review уже выполнен.
+
+## Evidence Criteria
+
+Первый evidence-backed reviewed PR должен содержать:
+
+- PR URL;
+- linked issue URL;
+- completed pull request template;
+- passed checks;
+- reviewer approval;
+- merge commit;
+- no bypass, or documented bypass with reason and follow-up checks.
+
+## Evidence Record
+
+- PR URL: `pending`
+- Linked issue URL: `pending`
+- Reviewer: `pending`
+- Reviewer type: `pending`
+- Approval URL or screenshot filename: `pending`
+- Passed checks: `pending`
+- Merge commit: `pending`
+- Bypass used: `pending`
+- Date: `YYYY-MM-DD`
+- Maintainer note: `pending`
+
+## Reviewer Interpretation
+
+Review by the same maintainer improves change discipline but does not prove
+external peer review. External peer review must not be marked completed unless a
+reviewed public PR includes a reviewer who is not the submitting maintainer and
+the review is visible.
+
+## Current Status
+
+- PR workflow documentation: ready.
+- PR template: ready.
+- CODEOWNERS routing: ready.
+- First reviewed PR evidence: pending.
+- External peer review completed: not claimed.
+
+## Not Registry Release Evidence
+
+PR review evidence is governance/process evidence for public development
+visibility. It is not registry release evidence and does not replace artifacts,
+checksums, logs or release evidence from the Russian build-runner.
+
+## Russian Contour Note
+
+Primary registry-readiness contour remains Russian Gitea plus the planned
+Russian build-runner. GitHub remains public mirror validation only.
+
+## Guardrails
+
+- Do not publish secrets, private URLs, private account data or customer
+  identifiers.
+- Do not claim completed external peer review until the evidence record is
+  filled from a real reviewed PR.
+- Do not claim branch protection verification from PR evidence alone.
+- Do not claim completed registry submission.
+- Do not claim certification.
+- Do not claim SIEM/DLP replacement.
+- Do not claim ML/LLM-based detection.
+- Do not claim automatic remediation.

docs/PR_REVIEW_WORKFLOW_RU.md

@@ -0,0 +1,106 @@
+# AWatch-rus: PR-based review workflow
+
+Дата: 2026-06-23
+
+Статус: workflow documentation ready; first reviewed PR evidence remains
+pending.
+
+GitHub issue: https://github.com/igor04091968/AWatch-rus/issues/48
+
+Этот документ описывает целевой PR-based workflow для публичного GitHub mirror.
+Он не утверждает, что external peer review уже выполнен.
+
+## Scope
+
+- Repository: `igor04091968/AWatch-rus`.
+- Branch: `main`.
+- GitHub role: public mirror validation only.
+- Primary registry contour: Russian Gitea plus planned Russian build-runner.
+
+## Workflow
+
+1. Significant changes should be made on a branch and submitted through a pull
+   request.
+2. Each PR should link the relevant GitHub issue or state why no issue is
+   applicable.
+3. The PR template must be completed before merge.
+4. CODEOWNERS should route review to the responsible maintainer or reviewer.
+5. CI, Coverage and Security checks should pass before merge.
+6. Any bypass must be documented in the PR or follow-up evidence note.
+
+## Docs-Only Changes
+
+Docs-only governance changes may use a reduced local check set when no product
+code changes:
+
+- `python3 scripts/public_secret_pattern_check.py`
+- `bash scripts/prepare_public_issues.sh`
+- `bash -n scripts/registry_readiness_check.sh`
+- `bash scripts/registry_readiness_check.sh`
+- `git diff --check`
+
+If shell scripts change, run `bash -n` for each changed shell script.
+
+## Runtime/Product Changes
+
+Runtime, API, UI or product-code changes require a broader validation plan.
+Expected checks include:
+
+- `cargo fmt --all --check`
+- `cargo test --workspace`
+- `cargo clippy --workspace --all-targets -- -D warnings`
+- `cargo build --workspace`
+- relevant smoke tests for deployment, pilot validation or browser behavior;
+- rollback notes when operational behavior changes.
+
+## Security-Sensitive Changes
+
+Security-sensitive changes require:
+
+- public secret-pattern scan;
+- review against `SECURITY.md`;
+- no secrets, tokens, private keys, recovery codes or customer identifiers;
+- no exploit detail in public text before security triage.
+
+## Registry Documentation Changes
+
+Registry docs must preserve conservative claims:
+
+- GitHub Actions is public mirror validation only.
+- Registry release evidence requires Russian Gitea and the planned Russian
+  build-runner.
+- Do not claim completed registry submission.
+- Do not claim FSTEC/FSB certification.
+- Do not claim SIEM/DLP replacement.
+- Do not claim ML/LLM-based detection.
+- Do not claim automatic remediation.
+- Do not claim branch protection verification until maintainer evidence exists.
+- Do not claim external peer review completion until reviewed PR evidence
+  exists.
+
+## Required Check Names
+
+Current workflow/job names used for branch protection planning:
+
+- `CI / Rust checks`
+- `CI / Docs and registry checks`
+- `CI / Smoke checks`
+- `Coverage / Coverage baseline`
+- `Security / Cargo audit`
+- `Security / Cargo deny`
+- `Security / Secret pattern check`
+- `Security / Dependency review`
+
+These names should be rechecked against GitHub UI before branch protection is
+marked verified.
+
+## Evidence
+
+Evidence for the first reviewed PR is tracked in
+`docs/PR_REVIEW_EVIDENCE_RU.md`.
+
+## Not Registry Release Evidence
+
+PR review workflow evidence improves public process visibility. It is not
+registry release evidence and does not replace release evidence generated on the
+Russian build-runner.

docs/RESIDUAL_RISKS_RU.md

@@ -50,21 +50,26 @@ visibility, release evidence contour and legal package. Они требуют д
 
 ## 2. Нет внешнего visible peer review / публично видимого peer review
 
-- Текущий статус: риск открыт; PR template and issue templates exist, but
+- Текущий статус: риск открыт; PR template, CODEOWNERS, public governance
-  public peer review history is still limited and external review is pending.
+  issues and PR workflow docs exist, but first reviewed PR evidence and branch
+  protection verification are still pending.
 - Влияние: внешним аудиторам сложнее оценить review discipline and change
   control maturity.
 - Почему не блокирует pilot/readiness stage: current changes are protected by
   reproducible checks, public workflows and documented conservative positioning.
-- Как риск будет снижаться: review checklist, CODEOWNERS routing, first public
+- Как риск будет снижаться: review checklist, CODEOWNERS routing, public issue
-  PR reviews, explicit release branch review policy and advisory branch
+  #48, `docs/PR_REVIEW_WORKFLOW_RU.md`, first public reviewed PR evidence,
-  protection.
+  explicit release branch review policy and verified branch protection evidence.
 - Уже снижающие evidence/documents/CI: `.github/pull_request_template.md`,
   `.github/CODEOWNERS`, `.github/ISSUE_TEMPLATE/`,
   `docs/REVIEW_CHECKLIST_RU.md`, `docs/BRANCH_PROTECTION_POLICY_RU.md`,
+  `docs/BRANCH_PROTECTION_EVIDENCE_RU.md`,
+  `docs/PR_REVIEW_WORKFLOW_RU.md`, `docs/PR_REVIEW_EVIDENCE_RU.md`,
   `CONTRIBUTING.md`, `SECURITY.md`, public CI, public security workflow.
-- Следующий action: завести публичную задачу
+- Residual risk: remains open until branch protection is verified and first
-  `[governance] Enable PR-based review workflow`.
+  reviewed PR evidence exists.
+- Следующий action: выполнить maintainer verification for branch protection and
+  record first reviewed PR evidence without overstating external peer review.
 
 ## 3. Низкая публичная активность issue tracker
 
@@ -180,6 +185,12 @@ visibility, release evidence contour and legal package. Они требуют д
 - PR review checklist exists in `docs/REVIEW_CHECKLIST_RU.md`.
 - Advisory branch protection policy exists in
   `docs/BRANCH_PROTECTION_POLICY_RU.md`.
+- Branch protection evidence template exists in
+  `docs/BRANCH_PROTECTION_EVIDENCE_RU.md` with
+  `pending_manual_verification` status.
+- PR-based workflow documentation exists in `docs/PR_REVIEW_WORKFLOW_RU.md`.
+- PR review evidence template exists in `docs/PR_REVIEW_EVIDENCE_RU.md`;
+  first reviewed PR evidence remains pending.
 - Public PR template includes security, registry-claim, runtime/API/UI,
   smoke-test, rollback and evidence checklist items.
 - Visible external code review remains pending until public reviewed PRs exist.

docs/public-issues/public-issues-manifest.json

@@ -112,7 +112,8 @@
       "status": "created",
       "github_issue_url": "https://github.com/igor04091968/AWatch-rus/issues/48",
       "created_at": "2026-06-23T19:43:08Z",
-      "created_by": "maintainer"
+      "created_by": "maintainer",
+      "next_evidence_doc": "docs/PR_REVIEW_EVIDENCE_RU.md"
     },
     {
       "id": "012",
@@ -122,7 +123,8 @@
       "status": "created",
       "github_issue_url": "https://github.com/igor04091968/AWatch-rus/issues/49",
       "created_at": "2026-06-23T19:43:10Z",
-      "created_by": "maintainer"
+      "created_by": "maintainer",
+      "next_evidence_doc": "docs/BRANCH_PROTECTION_EVIDENCE_RU.md"
     }
   ]
 }

docs/registry/REGISTRY_READINESS_CHANGELOG_RU.md

@@ -1,5 +1,45 @@
 # Registry readiness changelog
 
+## 2026-06-23 branch protection and PR review evidence package
+
+Added:
+
+- `docs/BRANCH_PROTECTION_EVIDENCE_RU.md` with
+  `pending_manual_verification` status for GitHub branch protection evidence.
+- `docs/PR_REVIEW_WORKFLOW_RU.md` with PR-based review workflow rules.
+- `docs/PR_REVIEW_EVIDENCE_RU.md` with evidence criteria for the first reviewed
+  public PR.
+- Public issues manifest links issue #48 to PR review evidence and issue #49 to
+  branch protection evidence.
+
+Changed:
+
+- `docs/BRANCH_PROTECTION_POLICY_RU.md` now lists recommended settings and real
+  current GitHub Actions check names.
+- `.github/pull_request_template.md` includes compact governance/evidence
+  checklist items.
+- `.github/CODEOWNERS` has clearer zones for workflows/security/governance,
+  registry docs, scripts, Rust workspace, demo/screenshots/docs.
+- Project status and residual risks now distinguish prepared governance
+  evidence from pending verification.
+
+Runtime impact:
+
+- No runtime/product code changes.
+- No API changes.
+- No UI changes.
+- No business logic changes.
+
+Guardrails:
+
+- Branch protection verification remains pending until maintainer records
+  repository settings evidence.
+- External peer review is not claimed completed until real reviewed PR evidence
+  exists.
+- GitHub remains public mirror validation only.
+- Russian Gitea plus planned Russian build-runner remains the primary registry
+  contour.
+
 ## 2026-06-23 public roadmap issues created and linked
 
 Changed:

scripts/registry_readiness_check.sh

@@ -59,6 +59,9 @@ required_files=(
   "docs/RESIDUAL_RISKS_RU.md"
   "docs/PUBLIC_ISSUES_PLAN_RU.md"
   "docs/PUBLIC_ISSUES_CREATION_RUNBOOK_RU.md"
+  "docs/PR_REVIEW_WORKFLOW_RU.md"
+  "docs/PR_REVIEW_EVIDENCE_RU.md"
+  "docs/BRANCH_PROTECTION_EVIDENCE_RU.md"
   "docs/public-issues/public-issues-manifest.json"
   "docs/public-issues/001-registry-gitea-restore-test.md"
   "docs/public-issues/002-registry-russian-build-runner.md"
@@ -236,6 +239,8 @@ if [[ -s "$PUBLIC_ISSUES_MANIFEST" ]]; then
           )
         )
       )
+      and ([.issues[] | select(.id == "011" and .github_issue_url == "https://github.com/igor04091968/AWatch-rus/issues/48" and .status == "created" and .next_evidence_doc == "docs/PR_REVIEW_EVIDENCE_RU.md")] | length == 1)
+      and ([.issues[] | select(.id == "012" and .github_issue_url == "https://github.com/igor04091968/AWatch-rus/issues/49" and .status == "created" and .next_evidence_doc == "docs/BRANCH_PROTECTION_EVIDENCE_RU.md")] | length == 1)
     ' "$PUBLIC_ISSUES_MANIFEST" >/dev/null || fail "public_issues_manifest_required_fields"
   elif command -v python3 >/dev/null 2>&1; then
     python3 - "$PUBLIC_ISSUES_MANIFEST" <<'PY' || fail "public_issues_manifest_required_fields"
@@ -282,6 +287,23 @@ for issue in issues:
             raise SystemExit("created issue created_by mismatch")
     else:
         raise SystemExit("issue status mismatch")
+
+issue_by_id = {issue.get("id"): issue for issue in issues}
+issue_011 = issue_by_id.get("011") or {}
+if issue_011.get("status") != "created":
+    raise SystemExit("issue 011 status mismatch")
+if issue_011.get("github_issue_url") != "https://github.com/igor04091968/AWatch-rus/issues/48":
+    raise SystemExit("issue 011 URL mismatch")
+if issue_011.get("next_evidence_doc") != "docs/PR_REVIEW_EVIDENCE_RU.md":
+    raise SystemExit("issue 011 next_evidence_doc mismatch")
+
+issue_012 = issue_by_id.get("012") or {}
+if issue_012.get("status") != "created":
+    raise SystemExit("issue 012 status mismatch")
+if issue_012.get("github_issue_url") != "https://github.com/igor04091968/AWatch-rus/issues/49":
+    raise SystemExit("issue 012 URL mismatch")
+if issue_012.get("next_evidence_doc") != "docs/BRANCH_PROTECTION_EVIDENCE_RU.md":
+    raise SystemExit("issue 012 next_evidence_doc mismatch")
 PY
   else
     fail "json_validator_missing:jq_or_python3_required"
@@ -316,6 +338,10 @@ require_grep "PUBLIC_ISSUES_PLAN_RU\\.md" "docs/PROJECT_STATUS_RU.md" "project_s
 require_grep "docs/public-issues" "docs/PROJECT_STATUS_RU.md" "project_status_public_issue_templates"
 require_grep "PUBLIC_ISSUES_CREATION_RUNBOOK_RU\\.md" "docs/PROJECT_STATUS_RU.md" "project_status_public_issue_runbook"
 require_grep "Public issues:[[:space:]]*created and linked in manifest|Созданы 12 публичных" "docs/PROJECT_STATUS_RU.md" "project_status_issue_creation_created_urls"
+require_grep "PR-based workflow documentation:[[:space:]]*ready" "docs/PROJECT_STATUS_RU.md" "project_status_pr_workflow_ready"
+require_grep "Branch protection evidence package:[[:space:]]*ready" "docs/PROJECT_STATUS_RU.md" "project_status_branch_evidence_ready"
+require_grep "pending_manual_verification" "docs/PROJECT_STATUS_RU.md" "project_status_branch_pending_manual"
+require_grep "First reviewed PR evidence:[[:space:]]*pending|First reviewed PR evidence remains pending" "docs/PROJECT_STATUS_RU.md" "project_status_first_reviewed_pr_pending"
 require_grep "GITEA_BACKUP_AND_RESTORE_RUNBOOK_RU\\.md|Restore outline|Post-restore checks" "docs/registry/GITEA_BACKUP_AND_RESTORE_RUNBOOK_RU.md" "backup_restore_runbook"
 require_grep "awatch-gitea-backup\\.timer" "docs/registry/GITEA_BACKUP_AND_RESTORE_RUNBOOK_RU.md" "backup_timer"
 require_grep "sha256|SHA256" "docs/registry/GITEA_BACKUP_AND_RESTORE_RUNBOOK_RU.md" "backup_sha256"
@@ -347,6 +373,9 @@ require_grep "public roadmap issues created and linked" "docs/registry/REGISTRY_
 require_grep "docs/public-issues" "docs/registry/REGISTRY_READINESS_CHANGELOG_RU.md" "changelog_public_issues_dir"
 require_grep "runtime/product code changes" "docs/registry/REGISTRY_READINESS_CHANGELOG_RU.md" "changelog_public_issues_no_runtime"
 require_grep "GitHub remains public mirror validation only" "docs/registry/REGISTRY_READINESS_CHANGELOG_RU.md" "changelog_public_issues_github_role"
+require_grep "branch protection and PR review evidence package" "docs/registry/REGISTRY_READINESS_CHANGELOG_RU.md" "changelog_branch_pr_evidence_package"
+require_grep "No runtime/product code changes" "docs/registry/REGISTRY_READINESS_CHANGELOG_RU.md" "changelog_branch_pr_no_runtime"
+require_grep "External peer review is not claimed completed" "docs/registry/REGISTRY_READINESS_CHANGELOG_RU.md" "changelog_external_review_not_completed"
 require_grep "Restore test is not claimed as completed" "docs/registry/REGISTRY_READINESS_CHANGELOG_RU.md" "changelog_restore_not_completed"
 require_grep "Russian build-runner is not claimed as ready" "docs/registry/REGISTRY_READINESS_CHANGELOG_RU.md" "changelog_build_runner_not_ready"
 require_grep "First release evidence build is not claimed as completed" "docs/registry/REGISTRY_READINESS_CHANGELOG_RU.md" "changelog_release_evidence_not_completed"
@@ -358,14 +387,27 @@ require_grep "public-issues/public-issues-manifest\\.json" "README.md" "readme_p
 require_grep "Engineering governance and residual risks" "README.md" "readme_engineering_governance_section"
 require_grep "REVIEW_CHECKLIST_RU\\.md" "README.md" "readme_review_checklist_link"
 require_grep "BRANCH_PROTECTION_POLICY_RU\\.md" "README.md" "readme_branch_protection_policy_link"
+require_grep "BRANCH_PROTECTION_EVIDENCE_RU\\.md" "README.md" "readme_branch_protection_evidence_link"
+require_grep "PR_REVIEW_WORKFLOW_RU\\.md" "README.md" "readme_pr_review_workflow_link"
+require_grep "PR_REVIEW_EVIDENCE_RU\\.md" "README.md" "readme_pr_review_evidence_link"
 require_grep "CODEOWNERS" "README.md" "readme_codeowners"
 require_grep "\\* @igor04091968" ".github/CODEOWNERS" "codeowners_default_owner"
 require_grep "/adk-rust/" ".github/CODEOWNERS" "codeowners_rust_workspace"
 require_grep "/scripts/" ".github/CODEOWNERS" "codeowners_scripts"
+require_grep "/docs/demo/" ".github/CODEOWNERS" "codeowners_demo_docs"
+require_grep "/docs/screenshots/" ".github/CODEOWNERS" "codeowners_screenshots"
 require_grep "/docs/registry/" ".github/CODEOWNERS" "codeowners_registry_docs"
 require_grep "/\\.github/workflows/" ".github/CODEOWNERS" "codeowners_workflows"
+require_grep "/\\.github/workflows/security\\.yml" ".github/CODEOWNERS" "codeowners_security_workflow"
+require_grep "PR_REVIEW_WORKFLOW_RU\\.md" ".github/CODEOWNERS" "codeowners_pr_review_docs"
+require_grep "BRANCH_PROTECTION_EVIDENCE_RU\\.md" ".github/CODEOWNERS" "codeowners_branch_evidence"
 require_grep "/ansible/" ".github/CODEOWNERS" "codeowners_ansible"
 require_grep "SECURITY\\.md" ".github/CODEOWNERS" "codeowners_security_docs"
+require_grep "Linked issue" ".github/pull_request_template.md" "pr_template_linked_issue"
+require_grep "Runtime/API/UI impact" ".github/pull_request_template.md" "pr_template_runtime_api_ui"
+require_grep "Registry claims" ".github/pull_request_template.md" "pr_template_registry_claims"
+require_grep "Secrets, PII" ".github/pull_request_template.md" "pr_template_secrets_pii"
+require_grep "GitHub Actions.*not registry release evidence" ".github/pull_request_template.md" "pr_template_github_not_registry_evidence"
 require_grep "не публиковать секреты|No secrets" "docs/REVIEW_CHECKLIST_RU.md" "review_checklist_no_secrets"
 require_grep "персональных данных|personal data" "docs/REVIEW_CHECKLIST_RU.md" "review_checklist_no_pii"
 require_grep "реальных IP|hostname|customer infrastructure identifiers" "docs/REVIEW_CHECKLIST_RU.md" "review_checklist_no_customer_infra"
@@ -375,7 +417,19 @@ require_grep "Do not claim FSTEC/FSB certification" "docs/REVIEW_CHECKLIST_RU.md
 require_grep "Do not claim SIEM/DLP replacement" "docs/REVIEW_CHECKLIST_RU.md" "review_checklist_no_siem_dlp"
 require_grep "restore_tested=false|restore_tested.*false" "docs/REVIEW_CHECKLIST_RU.md" "review_checklist_restore_false"
 require_grep "Require pull request before merge" "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_require_pr"
+require_grep "Recommended GitHub Branch Protection Settings" "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_recommended_settings"
+require_grep 'Required approvals:[[:space:]]*`1`' "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_one_approval"
+require_grep "Dismiss stale approvals" "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_dismiss_stale"
+require_grep "CODEOWNERS" "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_codeowners_review"
 require_grep "Require status checks" "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_status_checks"
+require_grep "CI / Rust checks" "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_ci_rust_checks"
+require_grep "CI / Docs and registry checks" "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_ci_docs_registry_checks"
+require_grep "CI / Smoke checks" "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_ci_smoke_checks"
+require_grep "Coverage / Coverage baseline" "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_coverage_baseline_check"
+require_grep "Security / Cargo audit" "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_security_cargo_audit"
+require_grep "Security / Cargo deny" "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_security_cargo_deny"
+require_grep "Security / Secret pattern check" "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_secret_pattern_check"
+require_grep "Security / Dependency review" "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_dependency_review"
 require_grep 'Require `CI` workflow' "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_ci"
 require_grep 'Require `Security` workflow' "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_security"
 require_grep 'Require `Coverage` workflow' "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_coverage"
@@ -385,6 +439,24 @@ require_grep "Require conversation resolution" "docs/BRANCH_PROTECTION_POLICY_RU
 require_grep "Require linear history" "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_linear_history"
 require_grep "emergency-only" "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_admin_bypass"
 require_grep "recommended policy|advisory branch protection policy" "docs/BRANCH_PROTECTION_POLICY_RU.md" "branch_policy_advisory_not_enabled"
+require_grep "branch_protection_status:[[:space:]]*\"pending_manual_verification\"" "docs/BRANCH_PROTECTION_EVIDENCE_RU.md" "branch_evidence_pending_manual"
+require_grep "https://github\\.com/igor04091968/AWatch-rus/issues/49" "docs/BRANCH_PROTECTION_EVIDENCE_RU.md" "branch_evidence_issue_49"
+require_grep "Not Registry Release Evidence|Not registry release evidence" "docs/BRANCH_PROTECTION_EVIDENCE_RU.md" "branch_evidence_not_registry"
+require_grep "Russian Contour Note" "docs/BRANCH_PROTECTION_EVIDENCE_RU.md" "branch_evidence_russian_contour"
+require_grep "CI / Rust checks" "docs/BRANCH_PROTECTION_EVIDENCE_RU.md" "branch_evidence_required_checks"
+require_grep "workflow documentation ready" "docs/PR_REVIEW_WORKFLOW_RU.md" "pr_workflow_ready"
+require_grep "https://github\\.com/igor04091968/AWatch-rus/issues/48" "docs/PR_REVIEW_WORKFLOW_RU.md" "pr_workflow_issue_48"
+require_grep "PR template must be completed" "docs/PR_REVIEW_WORKFLOW_RU.md" "pr_workflow_template_required"
+require_grep "CODEOWNERS" "docs/PR_REVIEW_WORKFLOW_RU.md" "pr_workflow_codeowners"
+require_grep "CI, Coverage and Security checks" "docs/PR_REVIEW_WORKFLOW_RU.md" "pr_workflow_checks"
+require_grep "public secret-pattern scan" "docs/PR_REVIEW_WORKFLOW_RU.md" "pr_workflow_secret_scan"
+require_grep "GitHub Actions is public mirror validation only" "docs/PR_REVIEW_WORKFLOW_RU.md" "pr_workflow_github_public_only"
+require_grep "pr_review_evidence_status:[[:space:]]*\"pending_until_first_reviewed_pr_is_merged\"" "docs/PR_REVIEW_EVIDENCE_RU.md" "pr_evidence_pending_first_reviewed_pr"
+require_grep "reviewer approval" "docs/PR_REVIEW_EVIDENCE_RU.md" "pr_evidence_reviewer_approval"
+require_grep "External peer review completed:[[:space:]]*not claimed" "docs/PR_REVIEW_EVIDENCE_RU.md" "pr_evidence_external_not_claimed"
+require_grep "Not Registry Release Evidence|Not registry release evidence" "docs/PR_REVIEW_EVIDENCE_RU.md" "pr_evidence_not_registry"
+require_grep "\"next_evidence_doc\"[[:space:]]*:[[:space:]]*\"docs/PR_REVIEW_EVIDENCE_RU\\.md\"" "docs/public-issues/public-issues-manifest.json" "manifest_issue_48_next_evidence_doc"
+require_grep "\"next_evidence_doc\"[[:space:]]*:[[:space:]]*\"docs/BRANCH_PROTECTION_EVIDENCE_RU\\.md\"" "docs/public-issues/public-issues-manifest.json" "manifest_issue_49_next_evidence_doc"
 require_grep "Один основной разработчик" "docs/RESIDUAL_RISKS_RU.md" "risk_single_developer"
 require_grep "Нет внешнего visible peer review" "docs/RESIDUAL_RISKS_RU.md" "risk_peer_review"
 require_grep "Низкая публичная активность issue tracker" "docs/RESIDUAL_RISKS_RU.md" "risk_issue_tracker_activity"
@@ -437,6 +509,9 @@ scan_files=(
   "$ROOT/docs/RESIDUAL_RISKS_RU.md"
   "$ROOT/docs/PUBLIC_ISSUES_PLAN_RU.md"
   "$ROOT/docs/PUBLIC_ISSUES_CREATION_RUNBOOK_RU.md"
+  "$ROOT/docs/PR_REVIEW_WORKFLOW_RU.md"
+  "$ROOT/docs/PR_REVIEW_EVIDENCE_RU.md"
+  "$ROOT/docs/BRANCH_PROTECTION_EVIDENCE_RU.md"
   "$ROOT/docs/public-issues"/*.md
   "$ROOT/docs/public-issues"/*.json
   "$ROOT/docs/BRANCH_PROTECTION_POLICY_RU.md"
@@ -463,6 +538,9 @@ claim_scan_files=(
   "$ROOT/docs/RESIDUAL_RISKS_RU.md"
   "$ROOT/docs/PUBLIC_ISSUES_PLAN_RU.md"
   "$ROOT/docs/PUBLIC_ISSUES_CREATION_RUNBOOK_RU.md"
+  "$ROOT/docs/PR_REVIEW_WORKFLOW_RU.md"
+  "$ROOT/docs/PR_REVIEW_EVIDENCE_RU.md"
+  "$ROOT/docs/BRANCH_PROTECTION_EVIDENCE_RU.md"
   "$ROOT/docs/public-issues"/*.md
   "$ROOT/docs/public-issues"/*.json
   "$ROOT/docs/BRANCH_PROTECTION_POLICY_RU.md"
@@ -500,7 +578,7 @@ fi
 rm -f /tmp/registry_forbidden_replacement.$$
 
 if grep -RInEi "(ML/LLM-based detection|LLM-based detection|ML-based detection|automatic remediation)" "${claim_scan_files[@]}" \
-  | grep -Eiv "(forbidden|not_made|not_claimed|no claim|не заявляет|не фиксируется|не используется|does not claim)" \
+  | grep -Eiv "(forbidden|not_made|not_claimed|no claim|do not claim|не заявляет|не фиксируется|не используется|does not claim)" \
   >/tmp/registry_forbidden_ai_auto.$$ 2>/dev/null; then
   fail "forbidden_claim_ai_or_automatic_remediation:$(cat /tmp/registry_forbidden_ai_auto.$$)"
 fi
@@ -520,15 +598,15 @@ if grep -RInEi "(completed Russian software registry submission|registry submiss
 fi
 rm -f /tmp/registry_forbidden_registry_submission_done.$$
 
-if grep -RInEi "(branch protection).{0,120}(enabled|включ(е|ё)н|настроен|active)" "$ROOT/README.md" "$ROOT/docs/PROJECT_STATUS_RU.md" "$ROOT/docs/BRANCH_PROTECTION_POLICY_RU.md" "$REGISTRY_DIR"/*.md \
+if grep -RInEi "(branch protection).{0,120}(enabled|включ(е|ё)н|настроен|active)" "$ROOT/README.md" "$ROOT/docs/PROJECT_STATUS_RU.md" "$ROOT/docs/BRANCH_PROTECTION_POLICY_RU.md" "$ROOT/docs/BRANCH_PROTECTION_EVIDENCE_RU.md" "$ROOT/docs/PR_REVIEW_WORKFLOW_RU.md" "$ROOT/docs/PR_REVIEW_EVIDENCE_RU.md" "$REGISTRY_DIR"/*.md \
-  | grep -Eiv "(not |не |не утверждает|not claimed|advisory|until repository settings|если применимо|recommended)" \
+  | grep -Eiv "(not |не |не утверждает|not claimed|advisory|until repository settings|если применимо|recommended|pending_manual_verification|until maintainer evidence|until.*evidence|to verify)" \
   >/tmp/registry_forbidden_branch_protection_enabled.$$ 2>/dev/null; then
   fail "forbidden_claim_branch_protection_enabled:$(cat /tmp/registry_forbidden_branch_protection_enabled.$$)"
 fi
 rm -f /tmp/registry_forbidden_branch_protection_enabled.$$
 
-if grep -RInEi "(external|visible|peer).{0,80}(review).{0,120}(active|performed|completed|done|выполняется|проведен|провед(е|ё)н|активен)" "$ROOT/README.md" "$ROOT/docs/PROJECT_STATUS_RU.md" "$ROOT/docs/RESIDUAL_RISKS_RU.md" "$REGISTRY_DIR"/*.md \
+if grep -RInEi "(external|visible|peer).{0,80}(review).{0,120}(active|performed|completed|done|выполняется|проведен|провед(е|ё)н|активен)" "$ROOT/README.md" "$ROOT/docs/PROJECT_STATUS_RU.md" "$ROOT/docs/RESIDUAL_RISKS_RU.md" "$ROOT/docs/PR_REVIEW_WORKFLOW_RU.md" "$ROOT/docs/PR_REVIEW_EVIDENCE_RU.md" "$REGISTRY_DIR"/*.md \
-  | grep -Eiv "(not |не |pending|still pending|не утверждает|not claimed|until public reviewed PRs)" \
+  | grep -Eiv "(not |не |pending|still pending|не утверждает|not claimed|until public reviewed PRs|until reviewed PR evidence|unless a reviewed public PR|is not claimed)" \
   >/tmp/registry_forbidden_external_review_active.$$ 2>/dev/null; then
   fail "forbidden_claim_external_review_active:$(cat /tmp/registry_forbidden_external_review_active.$$)"
 fi