Change Controls

Which checks gate a merge to main on each source repository, who the rules bind, and what stays blocked. Measured against the live branch protections on 2026-10-18.

Platform repository (jagmarques/asqav)

Merges to main require all five status checks green: test (3.11), security, frontend, scan-pr-text and light-checks. No approving review is required. The rules bind administrators as well: no maintainer account merges around them. Force pushes and branch deletions are blocked, and no rulesets add further conditions.

SDK repository (jagmarques/asqav-sdk)

Merges to main require the single ci-ok aggregate check, enforced strictly, plus one approving review. The rules bind administrators as well. Force pushes and branch deletions are blocked.

What this page does not claim

This page states the enforced merge gates, not the review culture: pull requests carry independent review and critic scrutiny by project policy, but that policy is not what the branch protections enforce. Dependency scanning (Trivy and pip-audit) runs inside the required security check: an unfixed CVE or a HIGH/CRITICAL finding fails it. Nothing here is a compliance certification, a penetration-test result, or a statement about the deploy pipeline; it is the merge-time ruleset, nothing more.

How to verify

Anyone can re-derive every line above from the public API: read the branch protection for main on each repository to confirm the required checks, the approvals count, and that administrators are bound and force pushes and deletions are blocked, then list active rulesets to confirm none add further conditions. The SDK aggregate gate rolls the whole SDK suite into one required check, so a red SDK suite blocks its merge exactly as a red platform check blocks the platform merge. If any line on this page disagrees with what the API returns, the API wins and the page needs a correction.