Measure review evidence separately from merge eligibility

A pull request can satisfy an automated merge gate without leaving evidence of independent human review. Audit three layers separately: required branch rules, recorded approvals or change requests, and informal review comments. If approvals are not required, report review coverage as unknown rather than assuming either thorough review or no review. Automated reviewers and author responses are useful signals but do not substitute for an independent reviewer when risk calls for one. Limits: review may occur in another linked system, so absence in the code host is a traceability gap, not proof that no review happened.

Applies when: evaluating code quality or governance from repository metadata. Keywords: pull request peer review approval branch protection traceability