Compliance audit — 2026-09-25

Compliance Audit — 2026-09-25

This umbrella issue tracks all findings from the automated compliance audit run on 2026-09-25.
Findings are grouped by remediation category. Address each category together to avoid duplicate agent PRs.

Total findings: 33 across 9 repositories

Remediation Work Breakdown

Repository Rulesets (8 finding(s))

Remediation: apply-rulesets.sh
Affected repos: .github-private, broodly, google-app-scripts, markets

Repo	Check	Severity
`.github-private`	`ruleset-drift-code-quality-strict_required_status_checks_policy`	`error`
`broodly`	`ruleset-drift-pr-quality-require_code_owner_review`	`error`
`broodly`	`ruleset-drift-pr-quality-dismiss_stale_reviews_on_push`	`error`
`broodly`	`ruleset-drift-pr-quality-require_last_push_approval`	`error`
`markets`	`ruleset-bypass-orgadmin-code-quality`	`error`
`markets`	`ruleset-bypass-dependabot-code-quality`	`error`
`google-app-scripts`	`ruleset-drift-pr-quality-dismiss_stale_reviews_on_push`	`error`
`google-app-scripts`	`ruleset-drift-pr-quality-require_last_push_approval`	`error`

Workflows (24 finding(s))

Remediation: per-repo workflow additions
Affected repos: .github-private, ContentTwin, TalkTerm, bmad-bgreat-suite, broodly, broodminder-export, google-app-scripts, incubator, markets

Repo	Check	Severity
`.github-private`	`non-stub-agent-shield.yml`	`error`
`broodminder-export`	`stub-surface-drift-agent-shield.yml-on`	`error`
`broodminder-export`	`stub-surface-drift-dependency-audit.yml-on`	`error`
`broodminder-export`	`stub-surface-drift-pr-auto-review.yml-concurrency`	`warning`
`TalkTerm`	`non-stub-pr-auto-review.yml`	`error`
`TalkTerm`	`stub-surface-drift-agent-shield.yml-on`	`error`
`TalkTerm`	`stub-surface-drift-dependency-audit.yml-on`	`error`
`TalkTerm`	`stub-surface-drift-pr-auto-review.yml-concurrency`	`warning`
`broodly`	`stub-surface-drift-agent-shield.yml-on`	`error`
`broodly`	`stub-surface-drift-dependency-audit.yml-on`	`error`
`markets`	`stub-surface-drift-agent-shield.yml-on`	`error`
`markets`	`stub-surface-drift-dependency-audit.yml-on`	`error`
`markets`	`stub-surface-drift-pr-auto-review.yml-concurrency`	`warning`
`ContentTwin`	`stub-surface-drift-agent-shield.yml-on`	`error`
`ContentTwin`	`stub-surface-drift-dependency-audit.yml-on`	`error`
`google-app-scripts`	`stub-surface-drift-agent-shield.yml-on`	`error`
`google-app-scripts`	`stub-surface-drift-dependency-audit.yml-on`	`error`
`google-app-scripts`	`stub-surface-drift-pr-auto-review.yml-concurrency`	`warning`
`incubator`	`stub-surface-drift-agent-shield.yml-on`	`error`
`incubator`	`stub-surface-drift-dependency-audit.yml-on`	`error`
`incubator`	`stub-surface-drift-pr-auto-review.yml-concurrency`	`warning`
`bmad-bgreat-suite`	`stub-surface-drift-agent-shield.yml-on`	`error`
`bmad-bgreat-suite`	`stub-surface-drift-dependency-audit.yml-on`	`error`
`bmad-bgreat-suite`	`stub-surface-drift-pr-auto-review.yml-concurrency`	`warning`

Agent Standards (CLAUDE.md / AGENTS.md / copilot-setup-steps.yml) (1 finding(s))

Remediation: per-repo doc and workflow additions
Affected repos: .github-private

Repo	Check	Severity
`.github-private`	`agents-md-missing-org-ref`	`error`

Generated by the weekly compliance audit on 2026-09-25 17:51 UTC.
Address each remediation category as a single coordinated PR to avoid duplicate agent work.

Dev-Lead Scope Analysis — no in-repo remediation for this repo

Issue: #1185 — Compliance audit — 2026-09-25

Finding

After reading AGENTS.md, the standards/ tree, and the remediation scripts, none of the 33 findings can be remediated by a source-file change in petry-projects/.github. Every finding targets one of 9 other repositories (.github-private, broodly, markets, google-app-scripts, ContentTwin, TalkTerm, bmad-bgreat-suite, broodminder-export, incubator), and each remediation is an operation performed against those target repos — not an edit in this repo:

Category	Remediation	Mechanism	This-repo change?
Repository Rulesets (8)	`apply-rulesets.sh` / `fix-ruleset-bypass.sh`	`gh api PUT/POST repos/<target>/rulesets` from JSON already in `standards/rulesets/`	None
Workflows (24)	`deploy-standard-workflows.sh`	deploys stub workflows into target repos via the Contents API, from templates already in `standards/workflows/`	None
Agent Standards (1)	doc edit	add org ref to `.github-private`'s `AGENTS.md`	None (belongs in `.github-private`)

Verified against source:

scripts/compliance-audit.sh scans remote target repos and explicitly exempts .github as the template holder (check_dev_lead_stub / check_stub_surface skip .github).
apply-rulesets.sh discovers repos via gh repo list and mutates each via the rulesets API — the ruleset JSON source of truth (standards/rulesets/{code-quality,pr-quality,release-channel-tags}.json) is already present and correct here.
deploy-standard-workflows.sh reads/writes stub content in target repos; the canonical templates in standards/workflows/ are already correct.

The findings are drift in the target repos relative to the (correct) org source of truth in this repo — not defects in this repo.

Why no PR from this dev-lead

Editing shared fleet-consumed templates in standards/ to "fix" drift that lives elsewhere would introduce drift and could break every consuming repo — the opposite of the intent. There is no unrelated file in this repo I can legitimately change here.

Recommended routing

Rulesets & workflows: run the org remediation automation with an org/admin token against the affected repos — apply-rulesets.sh (+ fix-ruleset-bypass.sh and the ruleset-remediation-runbook.md admin procedure for the markets bypass-actor findings), and deploy-standard-workflows.sh for the workflow stub drift. These are the exact scripts named in the audit's remediation column and require elevated tokens + human authorization for cross-repo mutation.
.github-private AGENTS.md org-ref: dispatch a dev-lead against petry-projects/.github-private.

No source files were modified in this repo. Nothing is being pushed from this workspace for issue #1185.

Navigation Menu

Repository navigation

Compliance audit — 2026-09-25 #1185