feat(governance): enforce adaptive orchestration defaults

[seonghobae]

Summary

• add a reusable organization workflow that rejects production contextual-orchestrator request constructors with an implicit mode or forced route;
• allow narrow, explicit path-glob exceptions only for controlled ablation or separately tested wrappers;
• emit bounded JSON evidence and document the quality-first/cost-aware ownership rule in ADR-0012;
• add unit coverage for forced-route, implicit-mode, compliant-auto, excluded fixture, and governed-exception cases.

The branch workflow stages the tests before the scanner exists, proves the red/green transition, runs all organization Python tests, compiles scripts, self-scans the repository, verifies the patch, removes itself, and publishes only the verified source commit.

[coderabbitai]

Important

Review available on request

• 🔍 Trigger review

Reviews should be triggered manually for repositories with fewer than 10 stars. Select Trigger review above or comment @coderabbitai review to review the latest changes. For a full review, comment @coderabbitai full review.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: dd9ec95a-963c-4921-8764-5d186f80f267

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Current-head triage: the original branch 111de3f is behind an older base and its workflow self-mutates the repository with contents: write, persistent checkout credentials, and a runtime commit/push. It is not safe to repair in place.

A current-main replacement is available as PR #1145 at d7375b1. It keeps the requested adaptive policy but makes the workflow read-only and exact-ref, places the scanner in the repository before execution, and adds 100% statement/branch coverage. No merge or bypass is claimed for this predecessor.

[seonghobae]

Exact-head audit at 111de3f: this stale adaptive-policy branch contains broad old-base workflow deletions and is superseded by the cleaned current-main implementation in #1145. Closing rather than merging unrelated removals.

[seonghobae]

Superseded by #1145.