governance: align review gate with solo-maintainer policy

[seonghobae]

Root cause

OriginWeave's local docs/quality-gates.md made required independent approval an unconditional merge gate even when no eligible non-author reviewer path existed. That produced a governance deadlock rather than independent review.

Fresh current-repository evidence now proves GitHub itself did not require a counted approving review for the latest protected merge: PR #20 merged to protected main at 804de47617edc7b045c59f484ba23d823aad7d31 after exact-head CI, Security Scan, SAST and review-thread validation with no formal review submission. Separately, issue #26 records that the independent-reviewers team route was rejected with HTTP 422 because the team is not a collaborator. Repeating that unchanged route cannot create a valid review.

Narrow governance repair

This PR does not weaken technical or security gates. It makes the repository-local review rule satisfiable and explicit:

• exact-head CI, repository security checks, 100% production function/line/region/branch coverage, rustdoc, resolved current review findings and branch protection remain mandatory;
• a formal non-author approval remains required whenever current GitHub rules require one or explicit current repository governance requires one and a legitimate review path exists;
• while fewer than two eligible repository-authorized non-author maintainers/reviewers exist and GitHub does not require counted approval, the extra local gate is explicitly ON HOLD (solo-maintainer) rather than silently bypassed;
• the gate is re-enabled when at least two eligible reviewers exist or GitHub rules require counted approval;
• self-approval, synthesized identities, comments/statuses/checks/reactions/model verdicts, and automated-review text cannot impersonate a counted approval;
• a regression test prevents automation from recreating the old impossible unconditional conjunction.

TDD lineage

1ec4ec8f97a715ead2610cd4b384514894206347 added the governance contract before the quality-gate document satisfied it. 133c506094189affd425696ddd8049c90b4d3e9d implements the minimal policy change.

The branch is exactly two paths over protected main: docs/quality-gates.md and tests/test_review_governance_contract.py.

Partial resolution of #26. Close #26 only after this exact head passes required checks, merges normally, and a subsequent technically clean PR is merge-tested under the reconciled policy.

[coderabbitai]

Warning

Review limit reached

@seonghobae, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 29 minutes

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 126d2d1f-2652-47c6-9c0f-4a06df770371

📥 Commits

Reviewing files that changed from the base of the PR and between 804de47 and 133c506.

📒 Files selected for processing (2)

• docs/quality-gates.md
• tests/test_review_governance_contract.py

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}