Governance audit

The gates decide whether a verb is admitted. The live MR audit decides whether a governed repo stays conformant — continuously, at read time, independent of any single verb invocation. It is what turns the meta-rules from prose into an enforced, observable surface.

What it checks

host/src/sources/audit.ts evaluates each governed repo against thirteen meta-rules at runtime and renders each as a pass/fail row (on the dashboard and via petrova.governance.audit):

MR-1, MR-3, MR-4, MR-5, MR-7, MR-8, MR-10, MR-12, MR-13, MR-14, MR-15, MR-16, MR-17.

The canonical text for every rule is core/playbook/META-RULES.md (authored in eva-hq, mirrored here). Cite rules by number when justifying a change — the audit does.

The load-bearing rules

Most rows are conformance checks (dated decisions, verification rounds, milestone hygiene). Three carry the governance model itself:

Rule	What the audit enforces
MR-12	The control-plane firewall — registry-edit verbs stay human-merge unless the cosign opt-out is authorised.
MR-13 / MR-14	Intent vs observation stay separate. A probe result may demote a repo’s posture (.petrova/contract.yaml claim vs state/<slug>.yaml reality) but never silently promote it.
MR-16	Verb wrappers are audited against the spec catalogue, so the exposed verb surface cannot drift from spec/verbs/.

Reading a failing row

A failing audit row is not a verb error — it is a standing conformance gap the repo must close. To act on one:

1. Note the MR number on the failing row and read that rule in core/playbook/META-RULES.md.
2. The row names the offending artifact (a missing decision doc, a stale milestone, an intent/observation mismatch, an undocumented verb).
3. Close the gap through the normal verbs — e.g. open_decision for a missing ratification, verify_round for a skipped verification, a contract edit for an MR-13 mismatch.
4. The row clears on the next audit read; nothing needs manual “resolution” beyond fixing the underlying artifact.

Why it is separate from the gates

Admission gates are point-in-time: they judge one verb as it runs. The audit is standing: it re-derives conformance from the repo’s current state every time it is read, so drift introduced outside the verb path (a hand-edited file, a reverted PR, a stale probe) still surfaces. The two together are the model — gates keep bad writes out, the audit keeps good state honest.

See also

• Governance model — how the audit composes with the gates.
• Phase integrity — a related, write-time check.
• core/playbook/META-RULES.md — the canonical MR-1…MR-17 text.