Description
This issue was produced by the automated enterprise quality & NFR audit (2026-07-02), which audited the repository against the quality attributes from Wikipedia's "List of system quality attributes" plus AI-native development readiness. Attribute: process capabilities (cluster: Governance, Process & Compliance), current score 4/5. Audit justification: Process maturity is high and largely institutionalized: 16 focused workflows with least-privilege permissions, a documented 1:1 mapping from every CI check to a local make target (docs/sre-operations.md, docs/ci-architecture.md), a labeled override process for destructive infra changes ('allow-destructive-infra-change'), PR/issue templates, CodeRabbit with request_changes_workflow (.coderabbit.yaml), and agent-specific process rules in AGENTS.md. The gaps are enforcement, not definition: required checks exist only as prose ('should be required in branch protection' in docs/ci-quality-gates.md) rather than as codified rulesets, and the conventional-commit convention that autorelease.yml depends on is not machine-enforced — git history already contains non-conforming commits ('Update README.md', 'Fix autorelease version source'). Identified gaps: Branch protection / required checks are documented but not codified — docs/ci-quality-gates.md says its PR-blocking table 'should be required in branch protection', but nothing in the repo enforces or verifies that (no GitHub ruleset export, no settings-as-code, no structural test asserting required-check names). Downstream repos created from the template inherit the workflows but not the protection, so the entire gate system can be silently bypassed by merging with failing or skipped checks. Conventional commits are relied on by autorelease but never enforced — autorelease.yml derives versions and changelogs from conventional-commit messages (TriPSs/conventional-changelog-action), yet no commitlint or PR-title check exists, and CONTRIBUTING.md never mentions the convention. Non-conforming commits already in history ('Update README.md', 'Fix autorelease version source') show the process leaks, which corrupts semver inference for release automation.
Tasks
Acceptance Criteria
Description
This issue was produced by the automated enterprise quality & NFR audit (2026-07-02), which audited the repository against the quality attributes from Wikipedia's "List of system quality attributes" plus AI-native development readiness. Attribute: process capabilities (cluster: Governance, Process & Compliance), current score 4/5. Audit justification: Process maturity is high and largely institutionalized: 16 focused workflows with least-privilege permissions, a documented 1:1 mapping from every CI check to a local make target (docs/sre-operations.md, docs/ci-architecture.md), a labeled override process for destructive infra changes ('allow-destructive-infra-change'), PR/issue templates, CodeRabbit with request_changes_workflow (.coderabbit.yaml), and agent-specific process rules in AGENTS.md. The gaps are enforcement, not definition: required checks exist only as prose ('should be required in branch protection' in docs/ci-quality-gates.md) rather than as codified rulesets, and the conventional-commit convention that autorelease.yml depends on is not machine-enforced — git history already contains non-conforming commits ('Update README.md', 'Fix autorelease version source'). Identified gaps: Branch protection / required checks are documented but not codified — docs/ci-quality-gates.md says its PR-blocking table 'should be required in branch protection', but nothing in the repo enforces or verifies that (no GitHub ruleset export, no settings-as-code, no structural test asserting required-check names). Downstream repos created from the template inherit the workflows but not the protection, so the entire gate system can be silently bypassed by merging with failing or skipped checks. Conventional commits are relied on by autorelease but never enforced — autorelease.yml derives versions and changelogs from conventional-commit messages (TriPSs/conventional-changelog-action), yet no commitlint or PR-title check exists, and CONTRIBUTING.md never mentions the convention. Non-conforming commits already in history ('Update README.md', 'Fix autorelease version source') show the process leaks, which corrupts semver inference for release automation.
Tasks
Acceptance Criteria