P0 admin gate: protect the governance plane and install least-privilege organization controls

[BunsDev]

Why this is a separate gate

Repository files can declare and verify governance policy, but they cannot by themselves enforce GitHub organization permissions, rulesets, environment protection, app scopes, or emergency access. OpenCoven/.github/main is currently unprotected, so the governance plane must not be treated as an administrative write gate until these settings are applied and independently verified.

Required .github/main ruleset

• Require pull requests before merging.
• Require at least one approval; require CODEOWNER approval for governance, schema, workflow, security, and decision paths.
• Dismiss stale approvals after new commits.
• Require all conversations to be resolved.
• Require the Governance CI / validate status check.
• Block force pushes and branch deletion.
• Require non-fast-forward changes to pass through a PR.
• Restrict routine bypass; maintain a separately controlled break-glass path.
• Record the resulting ruleset identifier and exported configuration as evidence.

Organization and Actions baseline

• Set default repository member permission to the least privilege compatible with current operations.
• Restrict repository creation, visibility changes, transfer, archive, deletion, and ruleset administration to accountable administrators.
• Require two-factor authentication for organization members.
• Review outside collaborators, dormant administrators, GitHub Apps, OAuth apps, deploy keys, and classic PAT use.
• Prefer GitHub Apps and OIDC over long-lived personal tokens.
• Limit allowed Actions and require immutable commit pins for third-party actions.
• Keep fork-pull-request secrets and privileged runners unavailable to untrusted code.
• Create a protected governance-admin environment for any future settings reconciler.

Bot and reconciliation identity

Use separate identities and permissions:

1. Read-only drift observer: public repository metadata and contents read; issues write only in OpenCoven/.github for deduplicated drift reports.
2. Administrative reconciler: no standing token; GitHub App installation token minted only inside the protected environment, with narrowly scoped administration permissions and reviewed plans.

The observer must never mutate repository settings. The reconciler must run in plan-first mode, bind application to the reviewed immutable plan, emit before/after evidence, and fail closed on moved state.

Break-glass and recovery

• Name at least two accountable break-glass custodians when available.
• Require hardware-backed MFA for organization owners and break-glass access.
• Store recovery material outside GitHub using an approved secure process.
• Test repository export, ruleset reconstruction, app revocation, and ownership recovery.
• Log every bypass and require a post-event review with an expiry for temporary exceptions.

Evidence required to close

• ruleset export or API snapshot;
• organization permission and Actions-policy snapshot;
• installed-app scope inventory;
• protected-environment configuration;
• break-glass runbook and completed tabletop result;
• proof that direct pushes to .github/main are rejected while an approved PR with required checks succeeds.

Authority boundary

Completing this issue hardens GitHub repository administration only. It does not grant or replace Familiar Contract principal authority, Threads authorization, Psyche orchestration authority, Coven runtime/persistence authority, or release/publication approvals in their owning systems.