docs(merge-policy): explain why PR Governance / Canonical issue and evidence are absent from gate 2

[Copilot]

Canonical issue

Outcome

Anyone auditing the escape-path topology described in the issue (job-level Canonical issue and evidence reporting success while only the custom PR Governance check carried the honest neutral) now finds, directly in MERGE_POLICY.md gate 2, why neither name appears in the required-checks list and what to do if a similar gate is ever reintroduced.

Scope

• Included: a documentation note in MERGE_POLICY.md gate 2.
• Explicitly excluded: any workflow, script, or test changes — pr-governance.yml (the sole source of both check names) was already retired outright by Remove retired PR Governance gate #1665, so the reported defect can no longer occur in this repo.

Investigation:

• Traced pr-governance.yml / Canonical issue and evidence history and confirmed the gate was removed entirely (not narrowed) by Remove retired PR Governance gate #1665, which also stripped both names from MERGE_POLICY.md gate 2 and deleted its test file.
• Confirmed no remaining code, workflow, or active doc still emits either check name.
• Confirmed gate 3 (Review) already documents that a reviewer skipping for configuration reasons satisfies the gate — covering the analogous CodeRabbit "Review skipped → success" concern raised in the issue thread.

Change:

• Added a note next to the existing trivy/Trivy case-sensitivity trap in gate 2, explaining the original defect, why the omission is deliberate, and requiring that any future canonical-issue gate name its authoritative check here before it's added to branch protection.

Risk

• Risk level: low
• Failure mode: documentation-only change; no functional risk. Worst case is imprecise wording, correctable without any code implications.
• Rollback: git revert, no migration or config impact.

Verification

• Focused tests: test_required_checks_match_merge_policy (regex-parses gate 2's required list — confirmed unaffected by the new paragraph) plus full test_dependabot_automation_workflow.py and test_gh_aw_workflow_governance.py suites.
• Required CI
• Review threads resolved

Production evidence

Not applicable — documentation-only change to MERGE_POLICY.md, no runtime or code surface touched.

Agent handoff

• One canonical issue is linked
• No competing PR implements the same issue
• Acceptance criteria are satisfied
• Required checks pass on the current head
• Human decision is requested only for product, security, irreversible infrastructure, or production approval

• Fixes ci: governance escape paths report success on the job-level check, not "not applicable" #1436

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
v0-uvai	Ready	Preview, v0	Sep 12, 2026 9:47am UTC

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: c7325183-3b6c-4fd1-a8ae-29b3c34392c6

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Snapshot Warnings

⚠️: No snapshots were found for the head SHA 0cb29d1.

Ensure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice.

Scanned Files

None