ariffazil/FORGE-pr-governance

PR Review Governance

Overview

Not all PRs are equal. This skill is the policy layer above github-pr-review. Where github-pr-review answers "what should I check on this PR?", this skill answers "who must approve it before it can merge?"

Risk tier maps to required reviewer roles. T3 autonomy means this skill refuses to relax rules without 888_JUDGE — separation of duties is the load- bearing property.

| Risk Tier | Required Reviewers | Judge Required? | |-----------|-------------------|-----------------| | low | 1 peer | No | | medium | 1 peer + 1 architect | No | | high | 2 peers + 1 auditor | Yes (888_JUDGE) | | critical | All of above + Arif | Yes |

When to Use

• Any PR marked high or critical risk
• Any PR touching constitutional files
• Any PR with >100 changed files
• Any PR deleting files

When NOT to Use

• Do NOT use for low-risk single-line docs fixes — over-process is entropy.
• Do NOT use to override the checklist in github-pr-review — this skill is policy, not procedure.
• Do NOT use to merge — branch protection + 888_JUDGE do that.

arifOS-ACT Embedding

Before using this skill on any mutating, irreversible, or high-blast-radius task:

1. ART — Attune (what is the real task?), Recognize (what class of power?), Test (fit · authority · evidence · blast · reversible).
2. Kernel — Route to arifOS for F1–F13 judgment if action class is Maker/Messenger/Mutator/Destroyer/Sovereign.
3. ACT — Apply narrow, Constrain scope, Trace witness, STOP before corruption.
4. Receipt — Leave evidence of what changed, why, and under whose authority.

Not all PRs are equal. This skill applies governance rules based on risk tier:

| Risk Tier | Required Reviewers | Judge Required? | |-----------|-------------------|-----------------| | low | 1 peer | No | | medium | 1 peer + 1 architect | No | | high | 2 peers + 1 auditor | Yes (888_JUDGE) | | critical | All of above + Arif | Yes |

When to Use

• Any PR marked high or critical risk
• Any PR touching constitutional files
• Any PR with >100 changed files
• Any PR deleting files

Procedure

Step 1: Risk Classification

Classify PR risk based on:

• Files touched
• Lines changed
• Repos affected
• Authority boundaries crossed

Step 2: Assign Reviewers

Per risk tier, assign required reviewer roles:

• peer (same domain)
• architect (cross-domain)
• auditor (compliance)
• judge (888_JUDGE for high/critical)

Step 3: Verify Separation of Duties

• Author ≠ approver
• Engineer cannot self-seal
• Proposer ≠ final approver for high-risk

Step 4: Block or Approve

| Condition | Action | |-----------|--------| | All required reviewers approved | Merge allowed | | Missing required reviewer | Block with comment | | Self-approval detected | Block + escalate | | Constitutional file changed | Block + 888_JUDGE |

Escalation Path

| Condition | Escalate To | |-----------|-------------| | Self-approval on high-risk PR | arifOS 888_JUDGE | | Constitutional file changed | arifOS 888_JUDGE | | Author disputes risk tier | Arif |

---

Skill version 1.0.0 — AAA Skill Library