[KyPython]

Relates to #238. Follows the merged documentation-only PR #239 (main 0b137992a45873beaf6e68764649237d2bb31fd0). No second issue, tracker, or automated coordinator.

Authorship: GPT-6, 2026-11-01, using the connected GitHub account. This is AI-authored documentation proposed for Ky's review; GitHub account appearance is not an owner-authenticated G-stage approval or Kiro specification.

Scope and actual changes

Update only the existing docs/operations/cucumber-bdd-rollout.md (one file, doc-only).

• Correct the stale "draft PR" wording now that docs(governance): propose per-stage approvals for BDD, SDD, TDD #239 is merged, without claiming G0–G6 enforcement.
• Add an explicit environment-neutral process requirement: equivalent local and cloud agents must receive identical admission decisions, scope boundaries and evidence obligations.
• Distinguish pre-mutation sandbox enforcement from independent publisher/GitHub admission checks; reject a local unconfined process or missing cloud/provider controls rather than downgrade security.
• Require independently authenticated owner decisions/content lineage, offline fail-closed modes and V1–V6 correct-reason negative + positive tests across one isolated local and one managed cloud environment.
• Reuse the existing Ky Cloud Control Plane parity design and existing AWS hold issue #4, not a new policy engine or cloud subscription. Related review-only doc corrections: https://github.com/KyLamportLogic/ky-cloud-control-plane/pull/5 .

Explicit non-goals and gates

No spec was authored, no code/test/CI/roles/pinned caller or protected security rule edited, no Cucumber installation, no cloud/local runtime provisioned or billed, and no local vs cloud parity pass claimed. The Kiro-first spec-only PR with EARS criteria and owner merge remains required before Codex gets implementation authority. Preserve existing AI_MONETIZATION_GATE, Human Skill Retention, ai-governance / verdict, role separation, distinct verifier and owner-only merge/deploy.

Verification

Against exact main 0b137992a45873beaf6e68764649237d2bb31fd0, the branch is ahead by one commit; the diff is one existing documentation file only. No project test suite was executed for this documentation-only edit. CI status, human review and approval remain to be observed. DRAFT, NOT MERGE-AUTHORIZED BY AN AGENT.

Universal mandatory enrollment addendum — 2026-11-01 (GPT-6, owner request)

The owner has now made mandatory by-default governance of every new venture, project, repository, and code change an explicit non-negotiable requirement. The same existing documentation file now carries the proposed governed project-creation/admission contract, scope inventory, trusted bootstrap/quarantine and no-code-before-GOVERNED_READY rule, local/cloud equivalence, role/identity enforcement, fail-closed owner-approved applicability, and adversarial tests for ungoverned creation, skipped checks and bypasses. Only the Cucumber runner is selectively optional; the governance process isn't. No new issue, PR, policy runtime or automation was created for this expansion.

Current observed blockers, not deployment claims

• Existing scripts/optin.sh and scripts/sweep.sh are retroactive/opt-in workflows with excluded scopes. They cannot stop the creation of ungoverned repos by themselves.
• Active organization ruleset 24443511 viewed via KyLamportLogic/buildlogic-governance requires PRs on default branches but has no required ai-governance / verdict status check, CODEOWNERS review or approving-review count. That repository's shared workflow caller is still pinned to old SHA efd0e11dde73a70d4867293e4ac2308d28be057e.
• A ruleset read on private KyLamportLogic/LamportLogic returned a GitHub plan-related 403; inability to verify protection is not evidence of protection. Organization-creation limits cannot restrict organization owners from creating repos; personal-account repos lie outside organization policies. Unmanaged local source creation likewise cannot be prevented by GitHub rules.
• Exact org/account billing, current protection for all repos, trusted publisher identity, signed owner receipt, sandbox OS enforcement and new-repo creation restriction remain unverified. Do not claim 100% coverage or start coding where the required controls are unknown.

Required next gated action

Kiro must incorporate this broadened invariant into the existing #238 specification-only PR (EARS, design, tasks, fail-closed/positive controls, per-account/private-plan limitations), which must pass current policy and be Ky-reviewed/merged before protected enforcement/runtime changes. Do not edit a ruleset/role map/workflow or create a new bootstrapper by treating this documentation change as implementation authorization. No automatic cost or provider setup.

[coderabbitai]

Important

• Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: a220a6a7-8a6f-4fdd-a476-cc7aab114cba

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-01T05:51:13.837926Z	a77bd1f	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[Copilot]

🟡 Changes recommended

The acceptance case incorrectly requires paid-tier protection universally, blocking valid enrollment for GitHub Free public repositories with effective required checks and branch protection.

1 open issue

• Require branch protection appropriate to repository visibility and plan · New

What changed in this PR

Expands the existing BDD rollout proposal with mandatory project governance enrollment and equivalent local/cloud admission requirements. This remains documentation only; enforcement requires a separately approved specification and implementation.

Changes:

• Defines governed project intake, quarantine, coverage reporting, and positive and negative acceptance checks.
• Requires equivalent local/cloud authorization, isolation, identity verification, and publication controls.
• Updates status wording to reflect merged PR #239 without claiming deployed enforcement.

File	Description
docs/​operations/​cucumber-bdd-rollout.md	Adds universal admission and local/cloud parity requirements; clarifies proposal status and implementation gates.

_{Review effort: Balanced}