#883 Remove standard PR validation approval gate (#884)

Co-authored-by: svelderrainruiz <noreply@github.com>

Author: svelderrainruiz

.github/workflows/validate.yml

@@ -59,12 +59,7 @@ jobs:
   lint:
     needs: smoke-gate
     if: needs.smoke-gate.outputs.skip != 'true'
-    environment:
-      name: validation
     runs-on: ubuntu-latest
-    concurrency:
-      group: validation-deploy-writer-${{ github.repository }}-validation
-      cancel-in-progress: false
     steps:
     - uses: actions/checkout@v5
     - name: Check PR mergeability
@@ -381,53 +376,6 @@ jobs:
           )
           $lines -join "`n" | Out-File -FilePath $env:GITHUB_STEP_SUMMARY -Append -Encoding utf8
         }
-  deployment-determinism:
-    needs: [smoke-gate, lint]
-    if: needs.smoke-gate.outputs.skip != 'true'
-    runs-on: ubuntu-latest
-    concurrency:
-      group: validation-deploy-writer-${{ github.repository }}-validation
-      cancel-in-progress: false
-    steps:
-    - uses: actions/checkout@v5
-    - name: Assert validation deployment determinism
-      shell: bash
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      run: |
-        node tools/npm/run-script.mjs priority:deployment:assert -- \
-          --repo "${{ github.repository }}" \
-          --environment validation \
-          --run-id "${{ github.run_id }}" \
-          --sha "${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}" \
-          --report tests/results/_agent/deployments/validation-deployment-determinism.json
-    - name: Normalize deployment determinism canary event
-      if: always()
-      shell: bash
-      run: |
-        set -euo pipefail
-        report_path="tests/results/_agent/deployments/validation-deployment-determinism.json"
-        if [ ! -f "$report_path" ]; then
-          echo "::warning::Deployment determinism report missing at $report_path; skipping canary normalization."
-          exit 0
-        fi
-        node tools/npm/run-script.mjs priority:event:ingest -- \
-          --source-type deployment-state \
-          --input "$report_path" \
-          --report tests/results/_agent/canary/validation-deployment-incident-event.json
-    - name: Upload deployment determinism report
-      if: always()
-      uses: actions/upload-artifact@v5
-      with:
-        name: validate-deployment-determinism
-        path: tests/results/_agent/deployments/validation-deployment-determinism.json
-    - name: Upload deployment determinism canary event report
-      if: always()
-      uses: actions/upload-artifact@v5
-      with:
-        name: validate-deployment-determinism-event
-        path: tests/results/_agent/canary/validation-deployment-incident-event.json
-        if-no-files-found: warn
   fixtures:
     runs-on: [self-hosted, Windows, X64]
     env:

docs/DEVELOPER_GUIDE.md

@@ -241,16 +241,17 @@ For Docker/Desktop VI history validation, run fast-loop lanes explicitly:
 
 ## Deployment approval gates
 
-- Pull-request validation deployments use the GitHub Actions `validation` environment (see `Validate / lint`).
+- Standard pull-request and merge-queue `Validate` runs are machine-gated only and do not target a protected
+  environment.
 - Tag releases use the GitHub Actions `production` environment (see `Release on tag / release`).
+- Monthly stability dispatch approvals use the `monthly-stability-release` environment gate.
 - Configure required reviewers in GitHub environment settings so deployment acknowledgement is explicit and review
   requests can be approved through GitHub web/mobile:
-  Settings -> Environments -> `validation` / `production` -> Required reviewers.
-- Run `node tools/npm/run-script.mjs priority:deployment:gate-policy` to verify both environments enforce
+  Settings -> Environments -> `production` / `monthly-stability-release` -> Required reviewers.
+- Run `node tools/npm/run-script.mjs priority:deployment:gate-policy` to verify the protected promotion environments enforce
   required reviewers and admin-bypass policy; report path:
   `tests/results/_agent/deployments/environment-gate-policy.json`.
 - `PR Auto-approve` and `PR Auto-approve Label` workflows were retired because branch policy requires `0` approvals.
-- Monthly stability dispatch approvals continue to use the `monthly-stability-release` environment gate.
 
 ### Release metadata
 
@@ -474,9 +475,9 @@ pwsh -File scripts/CompareVI.ps1 `
   fetch helper so they can operate on fork heads safely.
 - PR approval is no longer automated; merge queue admission relies on required checks and repository branch policy
   (currently `0` required reviewers on queue-managed branches).
-- Deployment acknowledgement now flows through GitHub Actions environment reviewers (`validation`, `production`,
-  `monthly-stability-release`) so approval notifications can be handled through GitHub's built-in deployment review UI
-  (web/mobile).
+- Deployment acknowledgement for protected promotion flows now uses GitHub Actions environment reviewers
+  (`production`, `monthly-stability-release`) so approval notifications can be handled through GitHub's built-in
+  deployment review UI (web/mobile).
 - Agent reviewer routing/policy is owner-agnostic: set repository variable `REQUIRED_AGENT_REVIEWER` to pin a specific
   login; when unset it defaults to `github.repository_owner`.
 - Manual `/vi-stage` and `/vi-history` workflows accept an optional `fetch_depth` input (default `20`). Increase it when

docs/DOWNSTREAM_RELEASE_TRAIN_ONBOARDING.md

@@ -46,7 +46,7 @@ What it evaluates:
 - workflow reference to the upstream compare-vi action
 - immutable certified ref pinning (stable semver tag or full commit SHA)
 - successful workflow consumption run
-- validation/production environment presence
+- protected production environment presence
 - visibility of policy-required branch checks
 
 ## Pilot stabilization loop

docs/RELEASE_OPERATIONS_RUNBOOK.md

@@ -11,7 +11,7 @@ Downstream onboarding runbook: `docs/DOWNSTREAM_RELEASE_TRAIN_ONBOARDING.md`.
 ## Scope
 
 - Promotion events (`rc -> stable -> lts`) and monthly stability cuts.
-- Deployment approval gates (`validation`, `production`, `monthly-stability-release`).
+- Deployment approval gates (`production`, `monthly-stability-release`).
 - Incident triage, escalation, and rollback communication.
 
 ## Roles and ownership
@@ -29,7 +29,6 @@ Configure these roles as required reviewers in GitHub repository environment set
 
 | Environment | Workflow entrypoints | Required reviewer role |
 | --- | --- | --- |
-| `validation` | PR validation flows (`Validate / lint`, deployment-backed PR checks) | Deployment gate approver |
 | `production` | Tag release flow (`Release on tag / release`) | Deployment gate approver |
 | `monthly-stability-release` | Scheduled/manual monthly stability cut | Deployment gate approver + incident commander (on exceptions) |
 

docs/knowledgebase/FEATURE_BRANCH_POLICY.md

@@ -260,9 +260,9 @@ to confirm each workflow includes both triggers.
 6. Autonomous merge tooling now requires upstream-owned PR heads. Fork-headed PRs are intentionally ineligible for
    `priority:queue:supervisor` and `priority:merge-sync`; mirror the branch to upstream and open the PR from the
    upstream-owned branch before queueing.
-7. Validate deployment evidence is run-scoped: `priority:deployment:assert` verifies the `validation` environment using
-   the current workflow run id, fails when the newest deployment is owned by another run, and tolerates terminal
-   `inactive` statuses only when they follow a successful deployment for the same run.
+7. Standard `Validate` PR and merge-queue runs are machine-gated only: they do not use a protected `validation`
+   deployment or require environment approval. Protected environment approvals are reserved for release/promotion
+   flows (`production`, `monthly-stability-release`).
 
 ### PR Metadata Contract (queue supervisor)
 - `Coupling: independent|soft|hard` (default: `independent`)

docs/knowledgebase/VICompare-Refs-Workflow.md

@@ -332,7 +332,7 @@ gh workflow run vi-compare-refs.yml `
 - The command-driven workflows (pr-vi-staging.yml, pr-vi-history.yml) now reuse the helper so they operate on fork commits safely without bespoke checkout logic.
 - Manual `/vi-stage` and `/vi-history` dispatches accept an optional `fetch_depth` input (default `20`) so you can deepen history when needed.
 - PRs no longer use auto-approval labels; queue admission depends on required checks and branch policy while deployment
-  acknowledgement uses environment reviewers (`validation` / `production`).
+  acknowledgement for protected promotion flows uses environment reviewers (`production` / `monthly-stability-release`).
 
 ### Acceptance checklist (bucket coverage)
 

tests/Workflow.ValidateGuard.Tests.ps1

@@ -15,4 +15,11 @@ Describe 'Validate workflow guard (delta integration)' -Tag 'Unit' {
     ($wf -match 'Append fixture summary') | Should -BeTrue
     ($wf -match 'Upload fixture summary artifact') | Should -BeTrue
   }
+
+  It 'keeps the standard Validate path free of validation environment approvals' {
+    $wf = Get-Content -LiteralPath (Join-Path $PSScriptRoot '..' '.github' 'workflows' 'validate.yml') -Raw
+    ($wf -match '(?ms)^\s*environment:\s*\r?\n\s*name:\s*validation\b') | Should -BeFalse
+    ($wf -match '(?m)^\s*deployment-determinism:\s*$') | Should -BeFalse
+    ($wf -match 'priority:deployment:assert') | Should -BeFalse
+  }
 }

tools/policy/downstream-onboarding-checklist.json

@@ -1,7 +1,6 @@
 {
   "schema": "priority/downstream-onboarding-policy@v1",
   "requiredEnvironments": [
-    "validation",
     "production"
   ],
   "requiredBranchChecks": [
@@ -39,10 +38,10 @@
     },
     {
       "id": "protected-environments-configured",
-      "description": "Validation and production environments exist for human-gated promotions.",
+      "description": "A protected production environment exists for human-gated promotions.",
       "required": false,
       "severity": "P2",
-      "recommendation": "Create validation/production environments and configure required reviewers."
+      "recommendation": "Create a production environment and configure required reviewers."
     },
     {
       "id": "required-checks-visible",

tools/priority/__tests__/deployment-gate-policy-schema.test.mjs

@@ -16,9 +16,9 @@ test('environment gate policy report validates schema', async () => {
   const schema = JSON.parse(await readFile(schemaPath, 'utf8'));
 
   const requestGitHubJsonFn = async (url) => {
-    if (String(url).endsWith('/environments/validation')) {
+    if (String(url).endsWith('/environments/production')) {
       return {
-        name: 'validation',
+        name: 'production',
         can_admins_bypass: false,
         protection_rules: [
           {
@@ -38,7 +38,7 @@ test('environment gate policy report validates schema', async () => {
       };
     }
     return {
-      name: 'production',
+      name: 'monthly-stability-release',
       can_admins_bypass: false,
       protection_rules: [
         {
@@ -64,7 +64,7 @@ test('environment gate policy report validates schema', async () => {
     args: {
       reportPath: 'tests/results/_agent/deployments/environment-gate-policy.json',
       repo: 'owner/repo',
-      environments: ['validation', 'production'],
+      environments: ['production', 'monthly-stability-release'],
       failOnAdminBypass: true,
       failOnMissingReviewers: true,
       help: false

tools/priority/__tests__/deployment-gate-policy.test.mjs

@@ -6,7 +6,7 @@ import { evaluateEnvironmentGatePolicy, parseArgs, runDeploymentGatePolicy } fro
 
 function makeEnvironment(payload = {}) {
   return {
-    name: 'validation',
+    name: 'production',
     can_admins_bypass: false,
     protection_rules: [
       {
@@ -30,7 +30,7 @@ function makeEnvironment(payload = {}) {
 test('parseArgs applies defaults and explicit flags', () => {
   const defaults = parseArgs(['node', 'check-deployment-gates.mjs']);
   assert.equal(defaults.reportPath.endsWith('environment-gate-policy.json'), true);
-  assert.deepEqual(defaults.environments, ['validation', 'production']);
+  assert.deepEqual(defaults.environments, ['production', 'monthly-stability-release']);
   assert.equal(defaults.failOnAdminBypass, true);
   assert.equal(defaults.failOnMissingReviewers, true);
 
@@ -42,13 +42,13 @@ test('parseArgs applies defaults and explicit flags', () => {
     '--repo',
     'owner/repo',
     '--environments',
-    'validation',
+    'production',
     '--allow-admin-bypass',
     '--allow-no-reviewers'
   ]);
   assert.equal(parsed.reportPath, 'out.json');
   assert.equal(parsed.repo, 'owner/repo');
-  assert.deepEqual(parsed.environments, ['validation']);
+  assert.deepEqual(parsed.environments, ['production']);
   assert.equal(parsed.failOnAdminBypass, false);
   assert.equal(parsed.failOnMissingReviewers, false);
 });
@@ -75,8 +75,8 @@ test('evaluateEnvironmentGatePolicy fails when reviewer rule missing or admin by
 
 test('runDeploymentGatePolicy emits fail when an environment is missing', async () => {
   const requestGitHubJsonFn = async (url) => {
-    if (String(url).endsWith('/environments/validation')) {
-      return makeEnvironment({ name: 'validation' });
+    if (String(url).endsWith('/environments/production')) {
+      return makeEnvironment({ name: 'production' });
     }
     const error = new Error('missing');
     error.statusCode = 404;
@@ -88,7 +88,7 @@ test('runDeploymentGatePolicy emits fail when an environment is missing', async
     args: {
       reportPath: 'tests/results/_agent/deployments/environment-gate-policy.json',
       repo: 'owner/repo',
-      environments: ['validation', 'production'],
+      environments: ['production', 'monthly-stability-release'],
       failOnAdminBypass: true,
       failOnMissingReviewers: true,
       help: false
@@ -100,17 +100,17 @@ test('runDeploymentGatePolicy emits fail when an environment is missing', async
 
   assert.equal(exitCode, 1);
   assert.equal(report.summary.status, 'fail');
-  assert.deepEqual(report.summary.failingEnvironments, ['production']);
+  assert.deepEqual(report.summary.failingEnvironments, ['monthly-stability-release']);
 });
 
 test('runDeploymentGatePolicy passes when all environments are protected', async () => {
   const requestGitHubJsonFn = async (url) => {
-    if (String(url).endsWith('/environments/validation')) {
-      return makeEnvironment({ name: 'validation' });
-    }
     if (String(url).endsWith('/environments/production')) {
       return makeEnvironment({ name: 'production' });
     }
+    if (String(url).endsWith('/environments/monthly-stability-release')) {
+      return makeEnvironment({ name: 'monthly-stability-release' });
+    }
     throw new Error(`unexpected url: ${url}`);
   };
 
@@ -119,7 +119,7 @@ test('runDeploymentGatePolicy passes when all environments are protected', async
     args: {
       reportPath: 'tests/results/_agent/deployments/environment-gate-policy.json',
       repo: 'owner/repo',
-      environments: ['validation', 'production'],
+      environments: ['production', 'monthly-stability-release'],
       failOnAdminBypass: true,
       failOnMissingReviewers: true,
       help: false