[Governance] Restore enforceable Argos developmental branch protection #1239

Verified repository-policy defect

Fresh live GitHub state on 2026-08-23 shows ContextualWisdomLab/argos/developmental@b5745ec09501bc348a2f65e8b8060e9999b35637 with protected: true, but the effective branch protection payload reports:

• protection.enabled: false;
• required_status_checks.enforcement_level: off;
• required_status_checks.contexts: []; and
• required_status_checks.checks: [].

The display-level protected flag is therefore not currently backed by an enforceable status-check gate for the integration branch. A representative buyer-facing PR (argos#459) is mechanically mergeable even while its current Security Scan/Trivy and OSV workflows fail on a protected-base dependency vulnerability, so missing enforcement must not be treated as merge authorization.

Argos has Issues disabled, so the repository-local governance issue could not be created (410 Issues has been disabled in this repository). This central issue records the repository/organization administration boundary instead.

Required administrative remedy

Restore an enforceable repository or organization ruleset for Argos developmental without weakening any existing CI, security, review, or separation-of-duties expectation. At minimum require:

• pull-request integration rather than routine direct pushes;
• qualifying independent non-author human approval on the current/latest-push head;
• stale-approval dismissal after head movement;
• review-thread resolution;
• current-head CI plus applicable SAST/security/dependency gates, including Security Scan/Trivy, OSV, Dependency Review, and SAST Semgrep where present;
• fail-closed treatment of pending, queued, skipped-required, cancelled, absent, stale, predecessor-head, synthetic-only, author-only, model-only, or status-only evidence;
• deletion and non-fast-forward/force-push protection; and
• no routine administrator bypass.

Do not solve this by synthesizing status checks, self-approval, reducing approval requirements, or merging around failed scanners.

Acceptance evidence

• Fresh live branch/ruleset state for argos/developmental reports enforcement actually enabled.
• Required current-head contexts/checks are non-empty and match the live repository governance contract.
• Current-head independent approval/latest-push approval and resolved-thread requirements are enforceable.
• Force-push/deletion and routine administrator bypass are disabled.
• A representative Argos PR cannot merge while a required security/check context fails or qualifying independent approval is absent.
• The resulting configuration and rollback path are documented in the central governance/ruleset authority.

This issue owns settings/governance only. Application, dependency, and design-system source repairs remain in their actual product/dependency owner lanes.