docs(merge-policy): explain why PR Governance / Canonical issue and evidence are absent from gate 2

[Copilot]

Canonical issue

Outcome

Anyone auditing the escape-path topology described in the issue (job-level Canonical issue and evidence reporting success while only the custom PR Governance check carried the honest neutral) now finds, directly in MERGE_POLICY.md gate 2, why neither name appears in the required-checks list and what to do if a similar gate is ever reintroduced.

Scope

• Included: a documentation note in MERGE_POLICY.md gate 2.
• Explicitly excluded: any workflow, script, or test changes — pr-governance.yml (the sole source of both check names) was already retired outright by Remove retired PR Governance gate #1665, so the reported defect can no longer occur in this repo.

Investigation:

• Traced pr-governance.yml / Canonical issue and evidence history and confirmed the gate was removed entirely (not narrowed) by Remove retired PR Governance gate #1665, which also stripped both names from MERGE_POLICY.md gate 2 and deleted its test file.
• Confirmed no remaining code, workflow, or active doc still emits either check name.
• Confirmed gate 3 (Review) already documents that a reviewer skipping for configuration reasons satisfies the gate — covering the analogous CodeRabbit "Review skipped → success" concern raised in the issue thread.

Change:

• Added a note next to the existing trivy/Trivy case-sensitivity trap in gate 2, explaining the original defect, why the omission is deliberate, and requiring that any future canonical-issue gate name its authoritative check here before it's added to branch protection.

Risk

• Risk level: low
• Failure mode: documentation-only change; no functional risk. Worst case is imprecise wording, correctable without any code implications.
• Rollback: git revert, no migration or config impact.

Verification

• Focused tests: test_required_checks_match_merge_policy (regex-parses gate 2's required list — confirmed unaffected by the new paragraph) plus full test_dependabot_automation_workflow.py and test_gh_aw_workflow_governance.py suites.
• Required CI
• Review threads resolved

Production evidence

Not applicable — documentation-only change to MERGE_POLICY.md, no runtime or code surface touched.

Agent handoff

• One canonical issue is linked
• No competing PR implements the same issue
• Acceptance criteria are satisfied
• Required checks pass on the current head
• Human decision is requested only for product, security, irreversible infrastructure, or production approval

• Fixes ci: governance escape paths report success on the job-level check, not "not applicable" #1436

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
v0-uvai	Ready	Preview, v0	Sep 8, 2026 11:42pm UTC