Audit live repository admin-team parity before maintenance retirement #395

🤖 Generated by the Agentic Engineer

The rendered Admins-team policy checks declared resources, but it cannot detect additional live admin teams or a live repository omitted from the render. Before retiring the legacy maintenance service, audit every active organization repository and every page of its effective team permissions.

PR #400 is merged as 6d7a19f3b37722806610ade51da745d939eef7e5. Its read-only auditor rejects incomplete, malformed, contradictory or changing evidence with UNKNOWN and emits only aggregate diagnostics. The documented built-in permission shape and typed effective custom-role metadata share one canonical policy calculation.

Verified delivery

• Complete active repository census, all team pages, exactly one secret Admins admin team and repeated stable joins.
• 61 behavior cases and 11 workflow credential/source-boundary controls, including a reproduced documented-permission regression.
• Independent organization-admin evaluation passes all 23 active repositories.
• Actual opted-in main App run passes all 23 active repositories from the merged source. The installation proof establishes all-repository selection, organization identity and unsuspended state; the mint requests Metadata(read) and Administration(read) with unrestricted owner scope, and the post-job handler logs token revocation.
• False-input main control skips the audit job with zero steps and no credential mint.

Routine replacement and activation

• PR #409 delivers the daily combined completeness/admin workflow and a separate issue-only reporter from reviewed main.
• Enabled combined main audit, disabled main control, and standalone coverage control all pass from merged source 906a5bc34421f6aa5b458cd11d3ec83d64b5993c. Both complete checks pass in the enabled run, and its App token is revoked.
• PR #412 activates daily admission. The policy read back at merged source 0cb9acb7f06fddecf6e4dae8b52159fd1aa08c20 has the strict Boolean scheduled: true.
• Post-activation manual opt-out succeeds on that merged source: admission passes, audit and report are skipped with zero steps, and no App token is minted.

Completed lifecycle gates

• Observe a natural daily scheduled run completing both full checks and its reporter (Migrate governance intent from devantler-tech/maintenance into .github (declarative) and retire the maintenance repo #84).
• Prove remaining caller adoption and retire the experiment flags after the scheduled replacement is proven. The deliberate coverage exemption remains tracked by Merge devantler-tech/actions into devantler-tech/.github as the single home for GitHub software and configuration #164/Fully delete devantler-tech/actions after verified consumer migration #240.

Part of #84. Scheduled observation and flag retirement are complete. The successful manual proof does not authorize a settings write, credential/grant change, maintenance archive or irreversible deletion. Unsupported organization-settings and provider-adoption gates remain separate.

Completed runtime delivery — 2026-10-04

PR #444 is merged at 9115566. Both input-free workflows read back byte-identical to the reviewed source. The combined main dispatch completed admission, both full audits and its success reporter. The standalone main dispatch also passed. Both audit jobs completed all 23 active repositories and confirmed post-job token revocation. The experiment controls are retired. Broader maintenance-retirement and failure-reporting gates remain tracked separately.