GOVERNANCE — repository controls for the RAIN RNG (GLI-19 App. B; GLI CSR §2.2 "Software Verification"; UKGC RTS 8.25/8.29)

This document says how the repository is protected, who may approve what, and how a lab can verify it from GitHub itself. It closes the review finding "CI in repo, two maintainers per PR" (lab/REVIEW-RESPONSE-R1.md item 4). Companion documents: lab/process/CHANGE-CONTROL.md (procedure per change), lab/process/SDLC.md (environments, tests), lab/process/SECURITY-PROGRAM.md (pen-test / audit / disclosure cadence).

1. Roles

Segregation of duties: the PR author can never be one of the two approvers. CODEOWNERS requires both teams on every path; branch protection turns that into an enforced gate.

2. Branch protection (to apply on main; identical on release branches release/*)

GitHub → Settings → Branches → Add rule for main (or a repository ruleset — same settings):

• Require a pull request before merging — no direct pushes, no admin bypass ("Do not allow bypassing the above settings")
  • Required approvals: 2
  • Dismiss stale approvals when new commits are pushed
  • Require review from Code Owners (→ .github/CODEOWNERS: both maintainer teams on every path)
  • Require approval of the most recent reviewable push (an author's own last push cannot self-approve)
• Require status checks to pass before merging, "Require branches to be up to date": required checks = ci / build · typecheck · unit (KATs, crash, selftest, e2e) · python mirror, ci / reproducible build · fingerprint drift (lab/FINGERPRINTS.json), ci / dependency review (supply chain, PRs only), ci / npm audit (production deps)
• Require signed commits
• Require linear history
• Require conversation resolution before merging
• Lock force pushes / deletions (both off for everyone including admins)
• Tag protection ruleset: sdk-v* tags may only be created by the two maintainer teams and must be signed (git tag -s).

Equivalent gh command (run once by an org owner; adjust the repo):

gh api -X PUT repos/Quecko-Org/<repo>/branches/main/protection --input - <<'JSON'
{ "required_status_checks": { "strict": true, "contexts": [
    "ci / build · typecheck · unit (KATs, crash, selftest, e2e) · python mirror",
    "ci / reproducible build · fingerprint drift (lab/FINGERPRINTS.json)",
    "ci / dependency review (supply chain, PRs only)", "ci / npm audit (production deps)" ] },
  "enforce_admins": true,
  "required_pull_request_reviews": { "required_approving_review_count": 2, "dismiss_stale_reviews": true,
    "require_code_owner_reviews": true, "require_last_push_approval": true },
  "restrictions": null, "required_linear_history": true, "allow_force_pushes": false, "allow_deletions": false,
  "required_conversation_resolution": true, "required_signatures": true }
JSON

3. What CI enforces on every PR (.github/workflows/ci.yml)

4. Release and tag policy

1. PR "release sdk-vX.Y.Z" (version bump, CHANGELOG, refreezed lab/FINGERPRINTS.json) — 2 approvals, CI green.
2. Release manager: git tag -s sdk-vX.Y.Z -m "..." on the merge commit; git push origin sdk-vX.Y.Z.
3. npm publish --provenance from a GitHub Actions release workflow (Sigstore attestation links the npm tarball to this repo + commit) — see PUBLISHING.md §3. Not yet executed: the owner decides the publication scope.
4. The lab receives: tag name, commit SHA, lab/FINGERPRINTS.json, CI run URL, tarball integrity hashes.

A lab can verify independently: git verify-tag sdk-vX.Y.Z (signature), gh run list --commit <sha> (CI), gh pr view <n> --json reviews (two approvals by code owners), npm run lab:verify-build (manifest).

5. Status — honest