Source title preserved
verify.yml, smoke.mjs, CODEOWNERS, PR template, and README governance notes
Source artifacts remain distinct files. This normalized title groups them as one implementation-governance method entry.
What this piece does
This piece documents the current enforcement map for publication governance in the repository. It distinguishes code-level enforcement from platform-level enforcement and makes the merge-control boundary reviewable.
Core argument
A workflow run is not the same thing as a governance gate.
Many repositories mistake visible CI activity for actual merge control. This entry argues that governance requires a layered stack:
- executable verification in-repo,
- ownership and review accountability signals in-repo,
- explicit platform policies that convert signals into blocking rules.
Without the third layer, the first two provide evidence but not enforcement. The method therefore refuses false closure: “checks exist” is not equivalent to “unsafe changes cannot ship.”
Governance method and methodological contribution
The current stack has five components.
- Verify workflow (
.github/workflows/verify.yml): runs on pull requests and pushes tomain, pins Node runtime, and executesnpm run checkplusnpm run smoke. - Smoke harness (
scripts/smoke.mjs): builds the site, starts preview on controlled host/port, validates critical routes, and checks one real dynamic project route derived from built output. - Ownership map (
.github/CODEOWNERS): records default reviewer ownership expectation. - PR accountability template (
.github/pull_request_template.md): requires contributors to disclose changed surfaces and local verification. - Maintainer runbook (README governance sections): documents manual branch protection and Cloudflare settings required for real blocking behavior.
The method contribution is integration, not novelty. It composes verification, accountability prompts, and governance documentation into a single control narrative.
Power dynamics examined
This stack reveals where platform administrators hold decisive power.
Repository contributors can improve CI and templates, but they cannot enforce branch protection through file edits alone. Enforcement authority remains with maintainers who control GitHub rulesets and Cloudflare production-branch settings.
That creates a classic governance asymmetry:
- technical evidence can be generated by many,
- blocking authority is concentrated in a small role set.
The entry addresses this by naming the asymmetry directly and documenting required manual settings in-repo, so concentration does not become invisibility.
Another dynamic concerns review quality. CODEOWNERS and templates can prompt accountability, but they can also be ritualized into box-checking. The method mitigates this by coupling prompts to executable checks and route probes.
Ethical stakes
The ethical stakes are transparency and non-deceptive assurance.
Claiming “this repo is gated” when branch protection is disabled is ethically misleading. It creates a false sense of safety for collaborators and readers.
This entry adopts a stricter ethic: each control is described with its enforcement domain.
- In-repo controls can run and fail.
- External controls determine whether failure blocks merge/deploy.
That separation improves trust because it prevents governance theater.
Recursive and systemic implications
The control stack supports recursive hardening.
Each failed check, flaky route, or review miss can produce targeted updates:
- broaden smoke route coverage,
- tighten template prompts,
- adjust ownership boundaries,
- revise manual runbook settings.
Because controls are distributed across files, improvements can be incremental and reversible. This is governance as continuous integration rather than annual policy rewrite.
Systemically, this repository functions as a micro-governance lab. It shows how publication systems can combine procedural docs and executable checks without pretending that code alone can replace institutional decision authority.
Relation to other entries in the corpus
This entry is the enforcement endpoint for the atlas.
- Corpus Ingestion and Governance Tree defines classification and naming governance.
- Recursive Governance Under Constraint defines why interruption and provenance controls matter conceptually.
- Scriptorium as Deterministic Recursive Infrastructure defines upstream production discipline for interpretable outputs.
Why it matters
Governance credibility depends on whether a system can refuse unsafe publication, not merely describe safety intentions. This entry matters because it maps that refusal capacity with precision.
By separating executable controls from external enforcement settings, it gives maintainers a truthful governance picture: what is already gated, what is still contingent, and where bypass risk remains. That clarity is essential for migration to larger suites later, where hidden assumptions about enforcement become expensive and politically difficult to unwind.