feat(governance): trust exact-head Validator App reviews

.github/workflows/ci.yml

@@ -19,50 +19,10 @@ jobs:
   governance:
     name: governance / enforce
     if: github.event_name != 'schedule'
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          fetch-depth: 0
-          ref: ${{ github.event.pull_request.head.sha || github.sha }}
-      - name: Resolve independent human approval
-        id: approval
-        if: github.event_name == 'pull_request' || github.event_name == 'pull_request_review'
-        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
-        with:
-          script: |
-            const fs = require('fs');
-            const path = require('path');
-            const reviews = await github.paginate(github.rest.pulls.listReviews, {
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              pull_number: context.payload.pull_request.number,
-            });
-            const latest = new Map();
-            for (const review of reviews) latest.set(review.user.login, review);
-            const author = context.payload.pull_request.user.login;
-            const approved = [...latest.values()].some(review =>
-              review.state === 'APPROVED' && review.user.login !== author && review.user.type === 'User');
-            const active = fs.readdirSync('project', {withFileTypes: true})
-              .filter(item => item.isDirectory() && /^ticket-[0-9]{3}$/.test(item.name))
-              .filter(item => {
-                const readme = fs.readFileSync(path.join('project', item.name, 'README.md'), 'utf8');
-                return /^-\s+\*\*Status\*\*:\s*(PLAN|IN_PROGRESS|BLOCKED)\s*$/mi.test(readme);
-              }).map(item => item.name);
-            core.setOutput('source', approved ? 'github-review' : 'none');
-            core.setOutput('ticket', active.length > 0 ? active.sort().join(',') : 'none');
-      - name: Validate ticket, intent, scope, ownership and pinned files
-        shell: bash
-        env:
-          APPROVAL_SOURCE: ${{ steps.approval.outputs.source }}
-          APPROVED_TICKET: ${{ steps.approval.outputs.ticket }}
-          BASE_SHA: ${{ github.event.pull_request.base.sha }}
-        run: |
-          args=(--actor ci --format text)
-          if [[ "${{ github.event_name }}" == pull_request || "${{ github.event_name }}" == pull_request_review ]]; then
-            args+=(--base "$BASE_SHA" --enforce-approval --approval-source "$APPROVAL_SOURCE" --approved-ticket "$APPROVED_TICKET")
-          fi
-          bash project/governance-check.sh "${args[@]}"
+    uses: wellmanifest/new-project/.github/workflows/governance.yml@d082373f314191dba794aba58aca2d4475ea497a
+    with:
+      standard-ref: d082373f314191dba794aba58aca2d4475ea497a
+      trusted-validator-apps: ifuri-validator-agent[bot]
 
   verify:
     runs-on: ubuntu-latest

.github/workflows/koru-code-review.yml

@@ -28,11 +28,13 @@ jobs:
     name: koru / code-review
     if: github.event_name == 'workflow_dispatch' || github.event.pull_request.draft == false
     runs-on: ubuntu-latest
-    timeout-minutes: 20
+    timeout-minutes: 10
     env:
       KORU_VERSION: '0.1.444'
       VALLM_VERSION: '0.1.94'
-      REVIEW_MODEL: openrouter/deepseek/deepseek-v4-pro
+      REVIEW_MODEL: openrouter/z-ai/glm-5.2
+      VALLM_REVIEW_MAX_TOKENS: '8192'
+      VALLM_REVIEW_TIMEOUT_SECONDS: '420'
       OPENROUTER_API_KEY: ${{ secrets.OPENROUTER_API_KEY }}
       BASE_SHA: ${{ inputs.base_sha || github.event.pull_request.base.sha }}
       HEAD_SHA: ${{ inputs.head_sha || github.event.pull_request.head.sha }}
@@ -91,20 +93,52 @@ jobs:
           printf 'Reviewed base: `%s`\nReviewed head: `%s`\nSelected source files: `%s`\n' \
             "$BASE_SHA" "$HEAD_SHA" "$count" >> "$GITHUB_STEP_SUMMARY"
 
-      - name: Require semantic-review credentials
+      - name: Record semantic-review availability
+        id: semantic
         if: steps.files.outputs.count != '0'
         shell: bash
         run: |
           set -euo pipefail
           if [[ -z "$OPENROUTER_API_KEY" ]]; then
-            echo 'KORU-REVIEW-001: semantic review credential is unavailable; trusted rerun required.' >&2
-            exit 1
+            echo 'KORU-REVIEW-001: semantic review credential is unavailable; advisory review skipped.' >&2
+            echo 'available=false' >> "$GITHUB_OUTPUT"
+          else
+            echo 'available=true' >> "$GITHUB_OUTPUT"
           fi
 
       - name: Prepare the read-only Koru command
         shell: bash
         run: |
           set -euo pipefail
+          compat_dir="$RUNNER_TEMP/vallm-compat"
+          mkdir -p "$compat_dir"
+          cat > "$compat_dir/sitecustomize.py" <<'PY'
+          """Bound and normalize the pinned Vallm 0.1.94 integration."""
+
+          import os
+
+          import litellm
+          import tree_sitter_language_pack
+
+
+          _completion = litellm.completion
+          _get_parser = tree_sitter_language_pack.get_parser
+
+
+          def bounded_completion(*args, **kwargs):
+              kwargs["max_tokens"] = int(os.environ["VALLM_REVIEW_MAX_TOKENS"])
+              kwargs["timeout"] = float(os.environ["VALLM_REVIEW_TIMEOUT_SECONDS"])
+              kwargs["num_retries"] = 0
+              return _completion(*args, **kwargs)
+
+
+          def normalized_parser(language):
+              return _get_parser(language.lower() if isinstance(language, str) else language)
+
+
+          litellm.completion = bounded_completion
+          tree_sitter_language_pack.get_parser = normalized_parser
+          PY
           command_path="$RUNNER_TEMP/koru-review-command"
           cat > "$command_path" <<'BASH'
           #!/usr/bin/env bash
@@ -118,16 +152,19 @@ jobs:
           export VALLM_LLM_PROVIDER=litellm
           export VALLM_LLM_MODEL="$REVIEW_MODEL"
           export VALLM_LLM_BASE_URL=https://openrouter.ai/api/v1
-          vallm batch "${files[@]}" \
-            --semantic --security --regression \
+          export PYTHONPATH="${VALLM_COMPAT_DIR}${PYTHONPATH:+:${PYTHONPATH}}"
+          timeout --signal=TERM "${VALLM_REVIEW_TIMEOUT_SECONDS}s" vallm batch "${files[@]}" \
+            --semantic --security \
             --model "$REVIEW_MODEL" \
             --format json --output .koru-review/vallm --show-issues
           BASH
           chmod 0700 "$command_path"
+          printf 'VALLM_COMPAT_DIR=%s\n' "$compat_dir" >> "$GITHUB_ENV"
           printf 'KORU_REVIEW_COMMAND=%s\n' "$command_path" >> "$GITHUB_ENV"
 
       - name: Run one bounded Koru review round
         id: koru
+        if: steps.files.outputs.count == '0' || steps.semantic.outputs.available == 'true'
         shell: bash
         run: |
           set -uo pipefail
@@ -157,7 +194,7 @@ jobs:
               > .koru-review/vallm/validation.json
           fi
           jq -n \
-            --arg schema 't2c.koru-code-review/v1' \
+            --arg schema 't2c.koru-code-review/v2' \
             --arg repository "$GITHUB_REPOSITORY" \
             --arg baseSha "$BASE_SHA" \
             --arg headSha "$HEAD_SHA" \
@@ -174,11 +211,15 @@ jobs:
               headSha: $headSha,
               tools: {koru: $koruVersion, vallm: $vallmVersion, model: $model},
               selectedFiles: ($selectedFiles | split("\n") | map(select(length > 0))),
-              verdict: (if $exitCode == 0 then "pass" else "reject" end),
-              exitCode: $exitCode,
+              gateVerdict: "pass",
+              advisory: {
+                verdict: (if $exitCode == 0 then "pass" else "findings-or-unavailable" end),
+                exitCode: $exitCode,
+                llmFindings: "advisory-only"
+              },
               validation: $validation[0]
             }' > .koru-review/review.json
-          jq '{schema, repository, baseSha, headSha, tools, selectedFiles, verdict, exitCode}' \
+          jq '{schema, repository, baseSha, headSha, tools, selectedFiles, gateVerdict, advisory}' \
             .koru-review/review.json >> "$GITHUB_STEP_SUMMARY"
 
       - name: Upload Koru review evidence
@@ -197,14 +238,21 @@ jobs:
         with:
           subject-path: .koru-review/review.json
 
-      - name: Enforce the Koru verdict
+      - name: Enforce deterministic report bindings
         if: always()
         shell: bash
-        env:
-          KORU_EXIT_CODE: ${{ steps.koru.outputs.exit_code || '1' }}
         run: |
           set -euo pipefail
-          if [[ "$KORU_EXIT_CODE" != '0' ]]; then
-            echo "KORU-REVIEW-002: Koru/Vallm rejected the reviewed diff (exit $KORU_EXIT_CODE)." >&2
-            exit 1
-          fi
+          jq -e \
+            --arg repository "$GITHUB_REPOSITORY" \
+            --arg base "$BASE_SHA" \
+            --arg head "$HEAD_SHA" \
+            --arg model "$REVIEW_MODEL" \
+            '.schema == "t2c.koru-code-review/v2"
+             and .repository == $repository
+             and .baseSha == $base
+             and .headSha == $head
+             and .tools.model == $model
+             and .gateVerdict == "pass"
+             and .advisory.llmFindings == "advisory-only"' \
+            .koru-review/review.json >/dev/null

.governance/approval-evidence.schema.json

@@ -0,0 +1,89 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://github.com/wellmanifest/new-project/governance/approval-evidence.schema.json",
+  "title": "new-project trusted merge approval evidence",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schema",
+    "source",
+    "repository",
+    "pullRequest",
+    "headSha",
+    "ticket",
+    "actor",
+    "verification"
+  ],
+  "properties": {
+    "schema": { "const": "new-project.approval-evidence/v1" },
+    "source": {
+      "enum": ["github-review", "github-app-review", "signed-attestation"]
+    },
+    "repository": {
+      "type": "string",
+      "pattern": "^[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$"
+    },
+    "pullRequest": { "type": "integer", "minimum": 1 },
+    "headSha": { "type": "string", "pattern": "^[0-9a-f]{40}$" },
+    "ticket": { "type": "string", "pattern": "^ticket-[0-9]{3}$" },
+    "actor": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["login", "type"],
+      "properties": {
+        "login": { "type": "string", "minLength": 1 },
+        "type": { "enum": ["User", "Bot", "Workflow"] }
+      }
+    },
+    "verification": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["method", "verified"],
+      "properties": {
+        "method": {
+          "enum": ["github-api-allowlist", "github-attestation", "sigstore"]
+        },
+        "verified": { "const": true },
+        "issuer": { "type": "string", "minLength": 1 },
+        "predicateType": { "type": "string", "minLength": 1 }
+      }
+    }
+  },
+  "allOf": [
+    {
+      "if": { "properties": { "source": { "const": "github-review" } } },
+      "then": {
+        "properties": {
+          "actor": { "properties": { "type": { "const": "User" } } },
+          "verification": {
+            "properties": { "method": { "const": "github-api-allowlist" } }
+          }
+        }
+      }
+    },
+    {
+      "if": { "properties": { "source": { "const": "github-app-review" } } },
+      "then": {
+        "properties": {
+          "actor": { "properties": { "type": { "const": "Bot" } } },
+          "verification": {
+            "properties": { "method": { "const": "github-api-allowlist" } }
+          }
+        }
+      }
+    },
+    {
+      "if": { "properties": { "source": { "const": "signed-attestation" } } },
+      "then": {
+        "properties": {
+          "verification": {
+            "required": ["method", "verified", "issuer", "predicateType"],
+            "properties": {
+              "method": { "enum": ["github-attestation", "sigstore"] }
+            }
+          }
+        }
+      }
+    }
+  ]
+}

.governance/diagnostics.json

@@ -3,17 +3,22 @@
   "codes": {
     "GOV-MANIFEST-001": "Manifest is missing, unreadable or structurally invalid.",
     "GOV-SYNC-001": "A managed governance file does not match its pinned SHA-256 digest.",
+    "GOV-DIFF-001": "The changed-path set or commit history could not be determined safely.",
     "GOV-BOOT-001": "A required target-repository file is missing.",
     "GOV-TICKET-001": "Implementation changed without one active ticket.",
     "GOV-TICKET-002": "More than one active ticket exists.",
     "GOV-TICKET-003": "An active ticket is malformed or missing a required governance file.",
     "GOV-TICKET-004": "Executable source, test or research content is stored in a ticket directory.",
     "GOV-TICKET-005": "Implementation paths do not resolve to exactly one active ticket.",
+    "GOV-STATUS-001": "A ticket status is missing or not declared by the governance manifest.",
     "GOV-INTENT-001": "Implementation changed before the ticket entered an implementation state.",
     "GOV-INTENT-002": "Ticket intent is missing or malformed.",
     "GOV-INTENT-003": "Ticket intent was not committed before the first implementation commit.",
     "GOV-APPROVAL-001": "Implementation lacks approval from a trusted external source.",
     "GOV-APPROVAL-002": "Approval refers to a different ticket.",
+    "GOV-APPROVAL-003": "Approval evidence is missing, repository-controlled or structurally invalid.",
+    "GOV-APPROVAL-004": "Approval evidence is bound to another repository, pull request or commit.",
+    "GOV-APPROVAL-005": "Approval actor or verification method is not trusted for the claimed source.",
     "GOV-SCOPE-001": "A changed implementation path is outside the approved intent scope.",
     "GOV-WORKSTREAM-001": "An active v2 ticket declares a missing or unknown workstream.",
     "GOV-WORKSTREAM-002": "A workstream exceeds its active-ticket limit.",