governance: verify missing tagged-commit release-provenance ruleset on Naruon #2136

Fresh consumer finding — 2026-09-13

Two consecutive live reads of GET /repos/ContextualWisdomLab/naruon/rulesets now return exactly three active rulesets:

• organization 18156473 — CWL Central required workflows;
• repository 17214772 — Lock default branch;
• repository 15586698 — PR.

The previously observed CWL Central tagged-commit release provenance ruleset is absent from both reads. The same two observations bind Naruon's protected default branch to develop@042b0c70531b229af3acbd0421a2f23098d848b3 / tree 8fde14381aaa430eeaaf61151dab6f6800127cd3, with 17 required status contexts. No Naruon source or PR mutation can establish whether the missing tag-target ruleset was intentionally retired, renamed/replaced, or accidentally removed.

Fresh latest-release evidence is still v0.14.4, published 2026-06-19, immutable=false. This is not itself proof that a current release is unsafe, but it means the release-governance owner should not assume an immutable-release setting compensates for missing tag provenance controls.

Searches in both ContextualWisdomLab/naruon and this .github owner found no open issue/PR with the exact tagged-commit release provenance phrase. .github#1552 remains the broader fleet release-pipeline owner, but it does not by itself prove the live ruleset disappearance is intentional.

Owner-path verification / repair

1. Read the organization/repository audit or ruleset history available to the authorized control-plane owner and determine whether the tagged-commit provenance rule was intentionally superseded, renamed, scope-moved, or removed.
2. If a successor exists, document its exact ruleset ID/name/target/scope and prove it enforces the same or stronger release-source invariant on Naruon before treating this as benign drift.
3. If the control disappeared unintentionally, restore the canonical central release-provenance contract through the authorized ruleset owner surface. Do not copy a repo-local workflow into Naruon as a substitute.
4. Bind release authorization to the exact protected integrated source SHA and immutable tag/release/artifact provenance; reject tag movement or source/artifact identity mismatch.
5. Re-read Naruon's effective rulesets and run a bounded release-canary/dry-run showing the provenance rule is actually effective. Preserve current branch required workflows and do not weaken any CI/security/review gate.
6. Coordinate with .github#1552; if the new changelog-driven release pipeline intentionally supersedes this ruleset, record the migration and only retire the old control after the replacement is protected and proven.

Acceptance

• the disappearance has an auditable causal explanation;
• an exact current ruleset/control identity enforces tagged release provenance, or an intentionally stronger released replacement is proven effective;
• Naruon does not gain a repo-local duplicate authority;
• no ruleset/required-workflow weakening, bypass, force tag movement, synthetic status, or predecessor evidence is used;
• consumer evidence is refreshed after the control-plane mutation.

Consumer evidence: Naruon live ruleset reads immediately before filing both returned the same three-rule set; latest release remained v0.14.4 with immutable=false.