The two governance gates answer different questions. make governance compares
the working tree to HEAD; the CI job compares base..head. Diagnostics that
are properties of the branch rather than of the edit — GOV-INTENT-003,
GOV-TICKET-001, and workstream scope over the full diff — are therefore
structurally invisible before a push.
This is not a missing feature. project/governance-check.sh already accepts
--actor ci --base --head and reproduces the CI verdict locally in under a
second. The gap is purely that nothing prompts anyone to run it, so the
verdict arrives from a failed pull request instead.
integration is held by ticket-048.Makefile target resolving the base via
git merge-base origin/main HEAD and delegating to the existing checker.make
governance, is what must be green before a push.README.md, section “Bramka governance przed pushem”: the CI-form
invocation is now a documented pre-push obligation with a blocking exit
policy, naming the diagnostics the working-tree form cannot see and requiring
the check to run from the branch being pushed.The original plan targeted Makefile, then AGENTS.md. Both were dropped
after the constraints were verified rather than assumed: Makefile matches
requiredForPaths and raises GOV-INTEGRATION-001 under a governance
ticket, and AGENTS.md is hash-locked in managedFiles — the attempted edit
raised GOV-SYNC-001 and was reverted. README.md is the only
governance-owned, unlocked document outside ticket directories.
Little is lost: the capability already existed and only the obligation was
missing. Two follow-ups remain — a make governance-ci wrapper as an
integration ticket, and moving the rule into AGENTS.md through a pinned
standard upgrade.
major_outage means a push would move a
pull-request head onto a commit with no check runs.