docs(adr): record Phase II step 3 applied — required check live, skip-actor exception

[kyle-sexton]

What

• ADR 0002 step-3 addendum: security-review-gate org ruleset ACTIVE (github-iac#193 ruleset + chore: sync standards components #194 App-grant widening, production deploy verified: security-review / security-review in required_status_checks on this repo's main); operator-ratified skip-actor exception (dependabot[bot], melodic-standards-sync[bot]) with rationale and bounds; the PR-branch caller-file bound stated plainly. New revisit trigger: any skip-actors addition re-opens the exception.
• Roadmap PLAN: Phase II [DONE] + step-3 status note.

Closes #509.

Related

• ci-workflows#189, standards#229/feat(session-flow)!: rename orchestration-brief skill to orchestrate #234, ci(security-review): adopt always-report shape — paths input replaces workflow-level filter #825, docs(roadmap): record Phase II steps 1-2 landed #828, github-iac#193/chore: sync standards components #194
• Deploy run: https://github.com/melodic-software/github-iac/actions/runs/29822200383

🤖 Generated with Claude Code

[claude]

Claude finished @kyle-sexton's task in 1m 48s —— View job

---

PR Review: docs(adr): record Phase II step 3 applied

• Gather context and read changed files
• Review ADR 0002 addendum
• Review PLAN.md update
• Post findings

---

Summary

Pure documentation PR recording the completion of Phase II step 3 — no code changes. Both files are accurate, internally consistent, and the security reasoning is sound. No blocking issues. One minor clarity nit below.

---

ADR 0002 — step-3 addendum

Overall: High quality. The addendum correctly records what happened, honestly discloses the known structural limitation of Actions-based required checks, and provides bounded rationale for each skip-actor.

Factual accuracy ✅
The ruleset details (security-review-gate, property-gated on requires-security-review, context name security-review / security-review) are consistent with the PR body's linked deploy run and the earlier addenda.

Skip-actor exception reasoning ✅

• dependabot[bot]: Rationale references the reviewed runner-policy contract — input-surface changes require a standards-reviewed policy entry, which means security-sensitive Dependabot PRs have a human-review backstop. Solid.
• melodic-standards-sync[bot]: Rationale is "byte-exact content reviewed upstream." This is reasonable but slightly underspecified — it doesn't name where "upstream" review happens (presumably melodic-software/standards PR process). For a security rationale that's being operator-ratified, a pointer to the upstream review mechanism would make this more auditable in future.

Structural-bounds disclosure ✅
The paragraph on PR-branch caller-file mutability is the most important part of this addendum from a security standpoint. It correctly identifies the limitation (a PR can alter its own paths/skip-actors on the head) and the mitigation (workflow diffs are themselves security-review surface; caller file is human-reviewed). Characterizing this as a "consensus-accepted bound" is accurate — this is an inherent limitation of pull_request-triggered required checks documented by GitHub themselves.

Revisit trigger ✅
The new trigger at line 127–128 correctly closes the loop: any future skip-actors addition reopens this deliberation. The instruction to "record the rationale beside the addendum above" establishes the right precedent.

---

PLAN.md

Overall: Accurate and concise. The [DOING] → [DONE] flip is appropriate. The step-3 status block correctly references github-iac#193/#194, the App permission widening (organization_administration: write) rationale, and the cross-link to the ADR. No issues.

---

Minor observation (non-blocking)

The melodic-standards-sync[bot] rationale would be more auditable with a specific pointer — e.g. "byte-exact content reviewed upstream in the melodic-software/standards repo's PR process." Without it, a future operator adding a new skip-actor has no clear comparator for what "upstream review" means. Fix this →

---

Verdict: Approve. The rationale is sound, the bounds are honestly stated, and the revisit trigger is properly wired. The minor nit can be addressed in a follow-up if desired.