Compliance audit — 2026-10-16 #1343

Activity

1. don-petry

   added

   compliance-auditAutomated compliance audit findingAutomated compliance audit finding

   dev-leadFor dev-lead agent pickupFor dev-lead agent pickup

   on Oct 16, 2026
2. don-petry commented on Oct 16, 2026

   

   don-petry

   on Oct 16, 2026

   ContributorAuthor

   More actions

   Dev-Lead Implementation Plan

   Issue: #1343 — Compliance audit — 2026-10-16

   Scope

   Triage only. All 67 findings are real drift in other repos, and none of them come from a defect in combsmith/.github's audit or deploy tooling. That means no source change in this repo is warranted. The precedent is #1237, which changed this repo only to fix the audit tooling itself.

   Triage (checked against the live repos and the previous audit #1265)

   Group	Finding(s)	Verdict	Remediation (outside this repo)
   New repos software-factory (created 2026-10-11) and software-factory-canary (created 2026-10-11, "throwaway")	49 of the 57 new findings: settings, rulesets, missing stubs, dependabot, CLAUDE.md/AGENTS.md/copilot	Real. These repos were never bootstrapped.	Run scripts/bootstrap-new-repo.sh (repo settings, rulesets, labels, ring), then the standards deploy sweep (standards-deploy.yml) for the stubs. Whether the throwaway canary should be excluded from the audit is a policy call for a maintainer. compliance-audit.sh has no repo-exclusion mechanism today.
   verbatim-stub-drift-initiative-driver.yml (9 repos)	Deployed stubs still use inline -f target_repo=${{ github.repository }} and (TalkTerm, bmad-bgreat-suite) predate the rate-limit gate	Real. The template moved target_repo to an env var (zizmor template-injection) and the fleet hasn't been re-synced yet.	Standards deploy sweep (deploy-standard-workflows.sh).
   stub-surface-drift-persona-mention.yml-on (4 repos)	Deployed stubs lack the pull_request: [opened, ready_for_review, reopened] trigger the template now carries (#1165)	Real. Rollout lag.	Standards deploy sweep. No with: forward is involved, so the channel-pin guardrail (#1052) doesn't apply.
   .github-private non-stub-agent-shield.yml	Pins agent-shield/v2-stable. .github-private is ring0 for agent-shield, so the expected pin is agent-shield/v2-ring0.	Real under the F5 rule (#861): a wrong-tier v-form is drift.	Human PR. agent-shield.yml is an immutable file (standards/workflow-exemptions.json, requires_human_review).
   ContentTwin stub-surface-drift-agent-shield.yml-on	Missing merge_group: trigger	Real. Same immutable file.	Human PR re-syncing standards/workflows/agent-shield.yml.
   Ruleset drift and bypass (.github-private, broodly, markets, google-app-scripts)	Carried over from #1265	Real	apply-rulesets.sh / fix-ruleset-bypass.sh with org-admin credentials.
   .github-private open_secret_alerts	New	Real	Needs a human to triage the secret-scanning alerts (rotate or revoke, then close). Agents can't do this.
   .github-private agents-md-missing-org-ref	Carried over	Real	PR in .github-private.

   Implementation Checklist

   • Compare every new finding against the live downstream file or setting and the current template or standard
   • Check for audit false positives (the in-repo fix class from feat: implement issue #1236 — Compliance audit — 2026-10-02 #1237 and feat: implement issue #978 — Compliance audit — 2026-08-14 #993). None found.
   • No files in combsmith/.github to change

   Tests to Write

   • None. There's no behaviour change in this repo, so the TDD exception applies.

   Test Command

   bash .dev-lead/scripts/dev-lead-lint.sh (lint-only verification of an unchanged tree)
3. don-petry

   added

   dev-leadFor dev-lead agent pickupFor dev-lead agent pickup

   and removed

   dev-leadFor dev-lead agent pickupFor dev-lead agent pickup

   on Oct 21, 2026
4. don-petry commented on Oct 21, 2026

   

   don-petry

   on Oct 21, 2026

   ContributorAuthor

   More actions

   Dev-Lead: Progress (in progress — not yet durable)

   Provisional. Nothing is pushed yet. Treat these notes as intent, not delivered results.

   Plan Execution (intended)

   • I re-checked the 2026-10-16 triage plan against main (43ec2a1) and the live repos on 2026-10-21. Its conclusion still holds: every finding is downstream drift, and no file in combsmith/.github needs to change.
   • Spot checks done again:
     • The TalkTerm initiative-driver.yml still passes -f target_repo=${{ github.repository }} inline. The template now passes it through the TARGET_REPO env var.
     • The incubator persona-mention.yml still lacks the [qa-lead reach 3/3] Serve the pull_request surface from the persona mention router (architect decision (b), ADR-0007 consolidation) #1165 pull_request surface.
     • .github-private agent-shield.yml still pins agent-shield/v2-stable. .github-private is ring0, so it should pin v2-ring0.
   • software-factory-canary was created 2026-10-11 and describes itself as a "Throwaway repo... Nothing here is depended on". compliance-audit.sh still has no way to exclude a repo, so it gets audited like any other. Excluding it (or archiving it) is a maintainer decision.

   Remediation still needed (outside this repo)

   • software-factory and software-factory-canary: run scripts/bootstrap-new-repo.sh, then the standards deploy sweep.
   • initiative-driver and persona-mention stub drift: standards deploy sweep (deploy-standard-workflows.sh).
   • agent-shield.yml in .github-private and ContentTwin: human PR. This file is immutable and needs human review.
   • Ruleset drift and bypass: apply-rulesets.sh / fix-ruleset-bypass.sh with org-admin credentials.
   • .github-private open_secret_alerts: a human has to triage these and rotate the secrets.

   Files touched (this workspace, not yet pushed)

   • None.

   Notes

   I skipped TDD because nothing in this repo changes behaviour. dev-lead-lint.sh ran clean on the unchanged tree.
5. don-petry

   added

   dev-leadFor dev-lead agent pickupFor dev-lead agent pickup

   and removed

   dev-leadFor dev-lead agent pickupFor dev-lead agent pickup

   on Oct 22, 2026
6. don-petry commented on Oct 22, 2026

   

   don-petry

   on Oct 22, 2026

   ContributorAuthor

   More actions

   Dev-Lead: Progress (in progress — not yet durable)

   Provisional. Nothing is pushed yet. Treat these notes as intent, not delivered results.

   Plan Execution (intended)

   • Re-run on 2026-10-22. main is still at 43ec2a1, the same commit as the 2026-10-21 re-check, so the earlier triage still applies: every finding is downstream drift or needs a human or org-admin action. No file in combsmith/.github needs to change for this issue.

   New since the last note

   • The maintainer has now decided the question about software-factory that the earlier triage left open. Exclude combsmith/software-factory from the compliance audit, the scorecard and the fleet monitor #1352 (opened 2026-10-19 on the Maintainer's word) asks for that repo to be excluded from the compliance audit, scorecard and fleet monitor. Its departures from the standards are deliberate (its ADR 0014). That covers 23 of the 67 findings here, which are won't-fix by design, not bootstrap work. Do not run bootstrap-new-repo.sh or the deploy sweep against software-factory.
   • compliance-audit.sh still has no way to exclude a repo. Adding one belongs to Exclude combsmith/software-factory from the compliance audit, the scorecard and the fleet monitor #1352, not this umbrella issue, so this run does not add it.
   • software-factory-canary is still open as a policy question: exclude it, archive it, or bootstrap it.

   Files touched (this workspace, not yet pushed)

   • None.

   Notes

   I skipped TDD because nothing in this repo changes behaviour. dev-lead-lint.sh ran clean on the unchanged tree.
7. don-petry

   added

   dev-leadFor dev-lead agent pickupFor dev-lead agent pickup

   and removed

   dev-leadFor dev-lead agent pickupFor dev-lead agent pickup

   on Oct 22, 2026
8. don-petry commented on Oct 22, 2026

   

   don-petry

   on Oct 22, 2026

   ContributorAuthor

   More actions

   Dev-Lead: Progress (in progress — not yet durable)

   Provisional. Nothing is pushed yet. Treat these notes as intent, not delivered results.

   Plan Execution (intended)

   • Re-checked on 2026-10-22 against main at c2bc153. The only commit since the last check is fix(feature-ideation): source tooling from the reusable's own commit (#839) #1368, a feature-ideation tooling fix that doesn't touch anything in this audit. The earlier triage still holds: every finding is either drift in another repo or needs a human or org-admin action. No file in combsmith/.github needs to change for this issue.
   • Exclude combsmith/software-factory from the compliance audit, the scorecard and the fleet monitor #1352 (exclude software-factory from the audit) is still open, and scripts/compliance-audit.sh still has no way to exclude a repo. The 23 software-factory findings are still won't-fix by design and are waiting on Exclude combsmith/software-factory from the compliance audit, the scorecard and the fleet monitor #1352. Adding the exclusion stays in Exclude combsmith/software-factory from the compliance audit, the scorecard and the fleet monitor #1352's scope.
   • software-factory-canary is still a policy question for the maintainer: exclude it, archive it, or bootstrap it.

   Files touched (this workspace, not yet pushed)

   • None.

   Notes

   I skipped TDD because nothing in this repo changes behaviour. dev-lead-lint.sh ran clean on the unchanged tree. What's still needed outside this repo is unchanged from the 2026-10-21 note: the deploy sweep for the stub drift, a human PR for agent-shield.yml, apply-rulesets.sh/fix-ruleset-bypass.sh run with org-admin credentials, and triage of the .github-private secret alerts.
9. don-petry

   added

   dev-leadFor dev-lead agent pickupFor dev-lead agent pickup

   and removed

   dev-leadFor dev-lead agent pickupFor dev-lead agent pickup

   on Oct 22, 2026
10. 25 remaining items

    Load more
11. don-petry

    added

    dev-leadFor dev-lead agent pickupFor dev-lead agent pickup

    and removed

    dev-leadFor dev-lead agent pickupFor dev-lead agent pickup

    on Oct 24, 2026