docs: state review enforcement accurately - #2
Merged
Conversation
Branch protection on main is now live: pull request required, the three Validate jobs required, strict up-to-date checks, no force pushes, no deletions, conversation resolution required. Required approvals are zero and code-owner reviews are off, because @flowcore-io/usable-maintainers currently has one member and enforcing code-owner approval on a one-person team would make the repository unmergeable. CONTRIBUTING and the threat model claimed CODEOWNERS review was required, which was not true — corrected to say reviewer assignment is advisory today, name it as a known gap, and state the condition for closing it. Also: - T2 now credits the automated checks as the real control, with human review listed as residual rather than as a mitigation. - T3 notes that tags are not themselves protected, so checksums are the artifact-level guarantee. - Fixed the contributor instruction to add changelog entries under "## Unreleased" — that section no longer exists after 0.1.0, so it now says to create it. Co-Authored-By: Oz <oz-agent@warp.dev>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Branch protection on
mainis now live. This corrects documentation that claimed a control we do not actually have.What was wrong
CONTRIBUTING.mdanddocs/threat-model.mdboth said CODEOWNERS review is required for skills,mcp.json, release workflows, and security docs. It is not.Required approvals are 0 and code-owner reviews are off, because
@flowcore-io/usable-maintainershas a single member. Requiring code-owner approval on a one-person team would make the repo unmergeable. Reviewer assignment is advisory today.Claiming an enforcement boundary that does not exist is exactly the failure mode the threat model warns about, so it is now named as a known gap with the condition for closing it: when a second maintainer joins, raise required approvals to ≥1 and enable code-owner reviews.
Protection actually in place
mainAlso
## Unreleased, which no longer exists after 0.1.0 — now says to create it.Verification
node scripts/validate-package.mjspasses. This PR is also the first exercise of the new protected flow.