Problem
After #2 makes release mutation push-only, the authority to push semper/compile-observer becomes the authority to move and republish semper-exp-current.
The repository rulesets API currently reports no repository rulesets. The connected GitHub integration cannot read the classic branch-protection endpoint, so classic protection is unknown, not assumed absent.
That state should be made explicit before the rolling channel is treated as a hardened promotion surface.
Required outcome
Verify the effective controls on semper/compile-observer (repository ruleset, classic branch protection, organization rules, or equivalent). If they do not already provide the intended promotion boundary, add the smallest appropriate protection.
The goal is not process ceremony; it is to ensure an accidental or unrelated direct push cannot silently become a public release merely because the workflow is correctly push-only.
Minimum acceptance
- effective protection for
semper/compile-observer is documented with evidence;
- promotion requires the intended reviewed path rather than an accidental direct push;
- required public build/test status checks cannot be bypassed by the ordinary promotion path;
- force-push/deletion behavior is explicitly decided and restricted appropriately for a release-trigger branch;
- automation identities that legitimately need to update the branch are explicitly scoped;
- the chosen control does not expose private validator data or require private CI on the public repository.
Relationship
These are separate controls and should remain independently testable/reversible.
Problem
After #2 makes release mutation push-only, the authority to push
semper/compile-observerbecomes the authority to move and republishsemper-exp-current.The repository rulesets API currently reports no repository rulesets. The connected GitHub integration cannot read the classic branch-protection endpoint, so classic protection is unknown, not assumed absent.
That state should be made explicit before the rolling channel is treated as a hardened promotion surface.
Required outcome
Verify the effective controls on
semper/compile-observer(repository ruleset, classic branch protection, organization rules, or equivalent). If they do not already provide the intended promotion boundary, add the smallest appropriate protection.The goal is not process ceremony; it is to ensure an accidental or unrelated direct push cannot silently become a public release merely because the workflow is correctly push-only.
Minimum acceptance
semper/compile-observeris documented with evidence;Relationship
These are separate controls and should remain independently testable/reversible.