Report live repositories that deploy/ does not declare #305

🤖 Generated by the Agentic Engineer

Evidence

On 2026-09-27, two of the org's 23 live, non-archived repositories — cloudflare (created 2026-09-12) and data-product-controller (created 2026-08-29) — have no Repository resource in deploy/ and no team grant at all live. No check noticed: tests/declarative-coverage.sh compares the rendered deploy/ dimensions with each other, and the drift check reads only the repositories deploy/ declares. The maintenance repository's three team reports would have caught this, and #84 retires them.

Audience and problem

The maintainer and the agents that keep deploy/ the org's source of truth. A repository outside deploy/ gets no team access, labels, merge settings or Actions permissions, and stays that way silently.

Hypothesis and success signal

If a scheduled check compares the live org with deploy/ and opens a tracking issue on a gap, an undeclared repository is found within a day of its creation. Success: the first run on main names both current gaps, and the run after they are adopted closes the tracking issue.

Acceptance criteria

• A scheduled check fails on every live, non-archived repository that deploy/ does not declare, and names it.
• It fails closed when the live listing is empty, fails part-way, or cannot see a declared repository, rather than passing over a partial org.
• Its logic is pinned by offline fixture tests in CI, including each fail-closed case.
• A failing run on main opens or updates a tracking issue and the next passing run closes it.

Size

S.