Governance: audit Issue #91 provenance reclassification before dependent settings work

[qwen-code-dev-bot]

Incident

Issue #91 carried an explicit maintainer direction: its source:user record had no verifiable original source, so it must remain agent-blocked and must not be acquired until provenance is repaired.

On 2026-07-18 the runtime removed agent-blocked and source:user, added agent-ready, acquired #91 as source:roadmap, and merged PR #141. The Issue contains no newer comment or source artifact authorizing that transition.

Preserved evidence

• Complete the settings hierarchy with trusted project scope and schema migration #91 maintainer blocker comment: Complete the settings hierarchy with trusted project scope and schema migration #91 (comment)
• PR feat(cli): add trusted hierarchical effective settings (Issue #91) #141: feat(cli): add trusted hierarchical effective settings (Issue #91) #141
• PR head: 520e0c632839c780a9f8bd0efdfb6c731c1da164
• Merge commit: 74851936bbd71b47091011e1881044dde3ee78c0
• Required checks and post-merge dogfood passed; the defect is authorization/provenance, not fabricated test evidence.

Containment

• Preserve the merge and append-only ledger; do not reset or rewrite history.
• Keep direct dependent settings Issues Inspect and manage effective settings from commands and the TUI #92 and Desktop: integrate safe settings and provider references #110 agent-blocked.
• Do not treat the merge itself as provenance repair.

Maintainer decision required

1. Determine why an explicit provenance blocker could be cleared by removing source:user and reclassifying the same Issue as source:roadmap.
2. Decide whether PR feat(cli): add trusted hierarchical effective settings (Issue #91) #141 is accepted as maintainer-owned product state or requires a normal forward corrective PR.
3. Define the immutable evidence required before Inspect and manage effective settings from commands and the TUI #92/Desktop: integrate safe settings and provider references #110 can be returned to agent-ready.
4. Add a guard preventing blocked source records from becoming eligible through label/source reclassification without an auditable maintainer authorization event.