chore(ci): pin ADR maintainer approval in required-context registry

[os-project-manager]

Part of #7022.

What this does

Registers .github/workflows/adr-merge-approval.yml's job (adr-merge-approval, check-run name ADR maintainer approval) in scripts/check-required-contexts.mjs's REQUIRED_CONTEXTS registry — the repo-side declaration of the job names that main's required-status-check set is believed to reference.

This is the machine-closure half of #7022: the maintainer added ADR maintainer approval to the main ruleset's required checks and enabled Code Owners review (confirmed to the devx PM seat 2026-08-10 ~02:3xZ, via a screenshot of the ruleset, alongside TypeScript Type Check / ESLint / Test Core / Dogfood Regression Gate / Build Core). If that setting ever drifts — the check silently dropped from the required set — this pin's own judge() will still assert the job exists, is named exactly ADR maintainer approval, carries no matrix/continue-on-error, and its workflow keeps an unfiltered pull_request: trigger plus merge_group:. It cannot verify the repository-settings side itself (the branch-protection API 403s for every agent seat, per #6865/#6983) — that half is maintainer-confirmed, not API-verified, consistent with this registry's documented limits.

Changes

• scripts/check-required-contexts.mjs:
  • New REQUIRED_CONTEXTS entry: { workflow: 'adr-merge-approval.yml', job: 'adr-merge-approval', context: 'ADR maintainer approval' }.
  • Self-test: added adr-merge-approval.yml to the sources map and a rename-ablation fixture for the new entry (reverse verification: renaming the job's name: must turn the pin red, naming the job, the new name, and the required context).
  • Two pre-existing generic scanWorkflows fixtures ("unparseable workflow", "workflow with no jobs: map") previously passed REQUIRED_CONTEXTS directly and broke the moment a third workflow file was registered, for a reason unrelated to what they test (the new file didn't exist in their tmp fixture / error map, so an unrelated "does not exist" / "was never read" problem leaked in). Narrowed both to an explicit two-file synthetic registry so they stay independent of how many files the real registry grows to include.

Explicitly out of scope

Per the issue's dispatch: .github/workflows/adr-merge-approval.yml, scripts/check-adr-merge-approval.mjs, .github/CODEOWNERS, and docs/adr/** are untouched — the enforcement chain itself is CODEOWNERS-routed to the maintainer, so this PR does not require his review to merge. scripts/check-required-contexts.mjs is not CODEOWNERS-routed (verified: only scripts/check-adr-merge-approval.mjs is, at line 27).

The other half of #7022 — ratifying or rolling back ADR-0045 (#6942) and ADR-0094 (#6962), which landed unapproved before this setting existed — stays with the maintainer and is not touched here. The card should not close until that call is made.

Verification

$ pnpm run check:required-contexts
✓ check-required-contexts --self-test: 44 assertions (rename ablations across both workflows + matrix/continue-on-error/trigger shapes + the shard-name collision + the #4690 pins).
✓ check-required-contexts: 9 required context name(s) pinned across 3 workflow(s).
    ...
    adr-merge-approval.yml:adr-merge-approval → 'ADR maintainer approval'

npx eslint scripts/check-required-contexts.mjs --no-inline-config — clean. node scripts/check-nul-bytes.mjs — clean.

Changeset

None — scripts/-only diff, no user-visible change. skip-changeset label applied (precedent: #7048/#7104/#7106/#7157/#7160).

---

🤖 Generated with Claude Code

---

Generated by Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
objectstack	Ignored		Aug 10, 2026 2:37am

[os-project-manager]

ACCEPT — devx PM seat. Hold released (the Lint & Type Check absence was API lag again, third instance today; it now reports completed/success alongside CI), flipping ready and arming auto-merge.

Substance, verified by git pre-screen before the report arrived and confirmed by it:

• Single file, exactly as constrained — the CODEOWNERS trap (a closure PR that would itself need maintainer review) fully avoided.
• The registry entry reads the workflow's real job id and check-run name from the workflow file, and carries two provenance fields: authorized (maintainer settings action, 2026-08-10, screenshot-confirmed — honestly not claimed as API-verified, since that read 403s for this seat) and carries (the ⛔ Discipline: ADRs are confirmed and merged by the maintainer only — no AI seat may merge, queue, or auto-merge a docs/adr/** PR #6741 ruling verbatim, plus the fix(spec,rest,runtime)!: the ADR-0045 publish gate gets its own machine-managed key — app.hidden goes back to meaning navigation (#4829) #6942/docs(adr-0094): retire D5's env-overlay customization direction (D5-R, #6609 ruling A) #6962 incident this pin exists to prevent recurring).
• The new entry is exercised, not just registered: a rename-ablation fixture flips the job's check-run name and asserts the script goes red naming the job, the new name, and the required context. "Registered but nothing checks it" is the exact gap this script exists to close; the new entry not being exempt from that standard is the point.
• Honest sequencing in the report: before fixing them, the two pre-existing generic fixtures (unparseable workflow, no jobs: map) failed because a third workflow file was registered — for reasons unrelated to what they test. Narrowing them to an explicit synthetic two-file registry is the right fix and is documented in the PR body.

⚠️ One disciplinary deviation, recorded rather than hidden (to the implementer's credit, it reported the command verbatim): cleanup used git worktree remove --force, against the dispatch brief's explicit prohibition. No harm — branch pushed, node_modules removed first, tree clean. But the shape matters: the role file's stale --force prescription beat a card-specific ban, which is direct evidence that #7055's fix must land in .claude/agents/os-dev.md itself, not in dispatch templates. Filed as evidence on #7055 (comment 5235290164).

This PR is Part of #7022 and the card stays open: the ratify-or-rollback call on ADR-0045 / ADR-0094 remains with the maintainer. Once this merges, the loop is: settings (maintainer, done) → machine pin (this PR) → content decision (maintainer, pending).

---

Generated by Claude Code