Plan MIL-013: source code comments are in English

Adds MIL-013 (accepted, RC-083), objective O7 to the Business Case (RC-084),
the schedule row, risk and dependency to the Project Plan, and the
traceability rows. No code is added by this commit.

docs/business-case.md

@@ -9,8 +9,8 @@
 ## Version History
 | Date | Status | Author | Reviewer | Change | Commit |
 | --- | --- | --- | --- | --- | --- |
-| 2026-10-14 | Deprecated | Jens Tirsvad Nielsen | AI as stand-in for S01 | Objective O5, scope item and success criterion 5: shared workflow for code metrics and coverage badges (MIL-010); reviewed (RC-067) | [5002450] |
-| 2026-10-19 | Accepted | Jens Tirsvad Nielsen | S01 | Objective O6, scope item, assumption, constraint and success criterion 6: shared actions that bring a VPN up for a deployment job (MIL-012); reviewed (RC-081), accepted by the author in chat as stand-in for S01 | [c5d5941] |
+| 2026-10-19 | Deprecated | Jens Tirsvad Nielsen | S01 | Objective O6, scope item, assumption, constraint and success criterion 6: shared actions that bring a VPN up for a deployment job (MIL-012); reviewed (RC-081), accepted by the author in chat as stand-in for S01 | [c5d5941] |
+| 2026-10-19 | Accepted | Jens Tirsvad Nielsen | S01 | Objective O7, scope item, assumption, constraint and success criterion 7: a shared workflow that checks that the comments in source code are in English (MIL-013); reviewed (RC-084), accepted by the author in chat as stand-in for S01 | pending |
 
 ---
 
@@ -65,6 +65,9 @@ made once.
 - **O6:** Offer shared, versioned actions that bring a VPN (WireGuard or
   Tailscale) up for a deployment job on a Gitea runner, so the job can reach a
   private network.
+- **O7:** Offer a shared workflow that checks that the comments in the source
+  code of a pull request are written in English, blocks the pull request when
+  they are not, and tells its author which comment and why.
 
 ## Scope
 
@@ -76,6 +79,7 @@ made once.
 - Validation of workflow files and their documentation.
 - A shared workflow for code metrics and coverage badges (MIL-010).
 - Shared composite actions that connect a deployment job to a private network through WireGuard or Tailscale (MIL-012).
+- A shared workflow that checks that comments in source code are in English and tells the author (MIL-013).
 
 ### Out of Scope
 
@@ -114,6 +118,7 @@ accepted plans.
 | 4 | Repositories consuming a shared workflow | At least 1 besides this one by MIL-002 | Consumer list in README |
 | 5 | Repositories that show the code metrics and coverage badges from the shared workflow | At least 1 besides this one by MIL-010 | README of the consuming repository |
 | 6 | VPN actions that connect a deployment job on the instance, with no secret in the run log | 2 (WireGuard and Tailscale) by MIL-012 | Recorded runs of MIL-012 tasks 3 to 5 |
+| 7 | Comments in source code that are not in English and reach the default branch of a repository that calls the check | 0 after MIL-013 | The check's run on the default branch; a throwaway pull request with a finding that cannot be merged |
 
 ## Risks
 
@@ -130,12 +135,14 @@ accepted plans.
 - A mirrored repository has at most one GitHub push mirror. Repositories without a GitHub mirror are skipped successfully.
 - S01 (Product Owner) and S05 (DevOps owner and security authority) are both maintainers.
 - For the VPN actions (MIL-012), S03 provides a runner whose container has the capability `NET_ADMIN` and the device `/dev/net/tun`, and the test peers; the actions do not configure the runner.
+- For the English-comments check (MIL-013), S03 provides a Gitea token that may comment on pull requests, as an organization secret, and S01 or S03 decide which repositories mark the check as required; the workflow does not change branch protection.
 
 ## Constraints
 
 - Workflows use only tools available on the runner; the current workflow uses the Python standard library only.
 - Secrets are supplied as repository or organization secrets, never committed.
 - A VPN key or token never appears in a log, an artifact or a command line (MIL-012).
+- The English-comments check (MIL-013) runs without sending source text to a service outside the instance, and its token never appears in a log.
 - Nothing is written under `src/` or `tests/` before the matching milestone is accepted.
 
 ## Cost–Benefit Assessment
@@ -161,5 +168,4 @@ Proceed — the first milestone fixes a known defect in the only existing workfl
 ---
 
 [SA-001]: ./stakeholder-analysis.md
-[5002450]: https://git.tirsystem.com/TirSystem/github-action/commit/50024505fe788b1c5e3021c0d1fc3d079590070e
 [c5d5941]: https://git.tirsystem.com/TirSystem/github-action/commit/c5d59418698316866807388bf61dcb6166d9fa8b