docs: record active moderation ruleset

GOVERNANCE.md

@@ -30,7 +30,7 @@ Set repository permissions **Contents**, **Pull requests**, **Commit statuses**,
 
 Generate one private key under the App's **Credentials → Key pairs** page. Store the App ID in the `rumble-bots` Actions secret `RUMBLE_MODERATOR_APP_ID` and the full PEM contents in `RUMBLE_MODERATOR_PRIVATE_KEY` at **rumble-bots → Settings → Secrets and variables → Actions → Repository secrets**. Never commit the PEM file. After the secrets are saved, check the installation and secret names, then delete the downloaded local PEM copy if it is no longer needed. Rotate the key through the same App settings and update the secret before revoking the old key.
 
-The organization installation created on 2026-10-20 has App ID `5402066`, slug `tank-royale-rumble-moderator`, and installation ID `173538338`. GitHub reports selected-repository access and the four write permissions above. Both named repository secrets were set on 2026-10-20; their values are not recorded here. The [documentation PR's moderation run](https://github.com/robocode-dev/rumble-bots/actions/runs/39499311781) successfully obtained an App token, set `bot-moderation` to pending, and commented as `tank-royale-rumble-moderator[bot]` because the PR changes protected documentation.
+The organization installation created on 2026-10-20 has App ID `5402066`, slug `tank-royale-rumble-moderator`, and installation ID `173538338`. GitHub reports selected-repository access and the four write permissions above. Both named repository secrets were set on 2026-10-20; their values are not recorded here. The initial documentation-PR run verified that the App could obtain a token, set `bot-moderation` to pending, and comment as `tank-royale-rumble-moderator[bot]` when a PR changes protected documentation.
 
 ## Catalog publisher App registration
 
@@ -40,7 +40,7 @@ Upload the [publisher App avatar](assets/tank-royale-rumble-publisher-avatar.png
 
 Generate a private key and save the Publisher App ID as `RUMBLE_PUBLISHER_APP_ID` and its full PEM contents as `RUMBLE_PUBLISHER_PRIVATE_KEY` in this repository's Actions secrets. Never commit the PEM file. Delete the downloaded local copy after securely storing the key, and rotate it in the App settings when needed.
 
-The organization-owned Publisher App created on 2026-10-21 has App ID `5415028` and slug `tank-royale-rumble-publisher`. GitHub reports **Contents: Read** and **Pull requests: Read & write** permissions. Both repository secrets were set on 2026-10-21; their values are not recorded here. The [first live publisher run](https://github.com/robocode-dev/rumble-bots/actions/runs/39653182830) obtained its installation token and opened [catalog PR #23](https://github.com/robocode-dev/rumble-bots/pull/23) after [test bot PR #22](https://github.com/robocode-dev/rumble-bots/pull/22) was approved and merged automatically. Catalog verification exposed a status-response issue, so completion of this live test remains pending until the corrected verifier runs.
+The organization-owned Publisher App created on 2026-10-21 has App ID `5415028` and slug `tank-royale-rumble-publisher`. GitHub reports **Contents: Read** and **Pull requests: Read & write** permissions. Both repository secrets were set on 2026-10-21; their values are not recorded here. In the successful live test, [bot PR #22](https://github.com/robocode-dev/rumble-bots/pull/22) was approved and merged automatically, [catalog PR #28](https://github.com/robocode-dev/rumble-bots/pull/28) was verified and merged automatically, and [verification run 39659079038](https://github.com/robocode-dev/rumble-bots/actions/runs/39659079038) completed successfully.
 
 ## GitHub Actions permissions
 
@@ -50,9 +50,9 @@ Repository Actions policy `8130`, **Allow trusted bot moderation event**, was ac
 
 Install a dedicated GitHub App on **only** `robocode-dev/rumble-bots`, with Contents, Pull requests, Commit statuses and Issues repository permissions set to write. Store its ID and private key as `RUMBLE_MODERATOR_APP_ID` and `RUMBLE_MODERATOR_PRIVATE_KEY` repository secrets. The verdict job obtains a short-lived installation token. It approves and merges only the tested head SHA after the required `bot-moderation` status succeeds; new commits invalidate that result. A failed bot gets a failing status and `REQUEST_CHANGES`. Ambiguous and non-bot PRs receive a pending status and a comment naming Flemming and the reason. Flemming may review a pending PR and comment `/moderation approve <reason>` to make its current head green; Flemming still merges that PR manually. Do not add the moderation App to branch-rule bypasses.
 
-Protect `main` with a required `bot-moderation` status from the moderation App, a pull-request requirement, and code-owner review for the protected paths listed in `CODEOWNERS`. Bot directories have no human code owner, so a clean bot can merge after the App's approval. Flemming needs a pull-request-only bypass for policy changes he authors, because GitHub will not count an author's approval of their own pull request; use this exception only after human review of the change. Do not grant any bypass to the moderation App. Verify the App, status source, branch rule and publisher on a test PR before enabling auto-merge. The automatic security screen is a conservative filter, not proof that arbitrary bot source is harmless; clients still execute bots in their own sandbox.
+The automatic security screen is a conservative filter, not proof that arbitrary bot source is harmless; clients still execute bots in their own sandbox.
 
-**Deployment hold:** GitHub rejected `github-actions[bot]` as a ruleset bypass actor with HTTP 422 (`Actor GitHub Actions integration must be part of the ruleset source or owner organization`). The organization also forbids `GITHUB_TOKEN` from creating PRs, so a separate publisher App must be installed. No required-status branch ruleset is active yet. The generated catalog PR path must pass a live test before the rule is enabled; until then, do not claim that a failing bot is blocked from manual merge by GitHub.
+The active [main ruleset](https://github.com/robocode-dev/rumble-bots/rules/25580362), `Rumble main moderation guard` (ID `25580362`), applies to the default branch. It requires pull requests, one approval, a successful `bot-moderation` status from Moderator App ID `5402066`, and code-owner approval for paths listed in `CODEOWNERS`; new commits dismiss existing approvals. Approval of the latest push and resolution of every review thread are not required, strict up-to-date checks are off, and merge, squash, and rebase are allowed. GitHub's extra approval for unattributed Copilot pull requests is disabled so it cannot add a second approval to this App-managed flow. The ruleset also blocks branch deletion and force pushes. Flemming (`flemming-n-larsen`, user ID `2179727`) is the only bypass actor and can bypass only through a pull request, because GitHub does not count an author's approval of their own PR. Use this exception only after human review; neither App can bypass the ruleset, and direct pushes are not permitted. The live moderation and catalog-publication path passed on PRs #22 and #28 before the ruleset was activated on 2026-10-21.
 
 After a bot pull request is merged by the App, the publisher runs on a push to `main` that changes a bot directory. It checks that the merged PR's exact head had a successful `bot-moderation` status, then checks out trusted `main` and runs static catalog generation without executing a submitted launcher. The moderator App pushes only a `catalog/pr-*` branch. The separate Publisher App opens its pull request, and the workflow dispatches catalog verification. Verification reads the pull request as data without executing its contents, checks its source submission and exact generated files against trusted `main`, then uses the moderator App to approve and merge only the verified head. The workflow's `GITHUB_TOKEN` needs `contents: write` for dispatch and `pull-requests: read` plus `statuses: read` for source verification; it uses no personal access token. Generated catalog files have no CODEOWNERS entry because the moderator App's verified approval satisfies the review requirement; policy and workflow files remain human-owned.