Compliance audit — 2026-10-02

Compliance Audit — 2026-10-02

This umbrella issue tracks all findings from the automated compliance audit run on 2026-10-02.
Findings are grouped by remediation category. Address each category together to avoid duplicate agent PRs.

Total findings: 46 across 8 repositories

Remediation Work Breakdown

Repository Settings (4 finding(s))

Remediation: apply-repo-settings.sh
Affected repos: empower-personal-dashboard

Repo	Check	Severity
`empower-personal-dashboard`	`allow_auto_merge`	`warning`
`empower-personal-dashboard`	`delete_branch_on_merge`	`warning`
`empower-personal-dashboard`	`has_wiki`	`warning`
`empower-personal-dashboard`	`missing-codeowners`	`error`

Push Protection & Secret Scanning (3 finding(s))

Remediation: apply-repo-settings.sh (security_and_analysis) + per-repo ci.yml and .gitignore
Affected repos: empower-personal-dashboard

Repo	Check	Severity
`empower-personal-dashboard`	`dependabot_security_updates`	`warning`
`empower-personal-dashboard`	`secret_scan_ci_job_present`	`error`
`empower-personal-dashboard`	`gitignore_baseline`	`error`

Repository Rulesets (10 finding(s))

Remediation: apply-rulesets.sh
Affected repos: .github-private, broodly, empower-personal-dashboard, google-app-scripts, markets

Repo	Check	Severity
`empower-personal-dashboard`	`missing-pr-quality`	`error`
`empower-personal-dashboard`	`missing-code-quality`	`error`
`.github-private`	`ruleset-drift-code-quality-strict_required_status_checks_policy`	`error`
`google-app-scripts`	`ruleset-drift-pr-quality-dismiss_stale_reviews_on_push`	`error`
`google-app-scripts`	`ruleset-drift-pr-quality-require_last_push_approval`	`error`
`broodly`	`ruleset-drift-pr-quality-require_code_owner_review`	`error`
`broodly`	`ruleset-drift-pr-quality-dismiss_stale_reviews_on_push`	`error`
`broodly`	`ruleset-drift-pr-quality-require_last_push_approval`	`error`
`markets`	`ruleset-bypass-orgadmin-code-quality`	`error`
`markets`	`ruleset-bypass-dependabot-code-quality`	`error`

Workflows (24 finding(s))

Remediation: per-repo workflow additions
Affected repos: .github-private, ContentTwin, TalkTerm, broodly, broodminder-data, empower-personal-dashboard, google-app-scripts, markets

Repo	Check	Severity
`empower-personal-dashboard`	`missing-sonarcloud.yml`	`error`
`empower-personal-dashboard`	`missing-dev-lead.yml`	`error`
`empower-personal-dashboard`	`missing-dependabot-automerge.yml`	`error`
`empower-personal-dashboard`	`missing-dependency-audit.yml`	`error`
`empower-personal-dashboard`	`missing-agent-shield.yml`	`error`
`empower-personal-dashboard`	`missing-pr-review-mention.yml`	`error`
`empower-personal-dashboard`	`missing-feature-ideation.yml`	`error`
`empower-personal-dashboard`	`missing-pr-auto-review.yml`	`error`
`empower-personal-dashboard`	`missing-initiative-driver.yml`	`error`
`.github-private`	`non-stub-agent-shield.yml`	`error`
`TalkTerm`	`non-stub-pr-auto-review.yml`	`error`
`TalkTerm`	`stub-surface-drift-agent-shield.yml-on`	`error`
`TalkTerm`	`stub-surface-drift-dependency-audit.yml-on`	`error`
`TalkTerm`	`stub-surface-drift-pr-auto-review.yml-concurrency`	`warning`
`broodminder-data`	`stub-surface-drift-pr-auto-review.yml-concurrency`	`warning`
`google-app-scripts`	`stub-surface-drift-dependency-audit.yml-on`	`error`
`google-app-scripts`	`stub-surface-drift-pr-auto-review.yml-concurrency`	`warning`
`broodly`	`stub-surface-drift-agent-shield.yml-on`	`error`
`broodly`	`stub-surface-drift-dependency-audit.yml-on`	`error`
`ContentTwin`	`stub-surface-drift-agent-shield.yml-on`	`error`
`ContentTwin`	`stub-surface-drift-dependency-audit.yml-on`	`error`
`markets`	`stub-surface-drift-agent-shield.yml-on`	`error`
`markets`	`stub-surface-drift-dependency-audit.yml-on`	`error`
`markets`	`stub-surface-drift-pr-auto-review.yml-concurrency`	`warning`

Dependabot Configuration (2 finding(s))

Remediation: per-repo .github/dependabot.yml
Affected repos: empower-personal-dashboard

Repo	Check	Severity
`empower-personal-dashboard`	`wrong-limit-pip`	`warning`
`empower-personal-dashboard`	`missing-security-label`	`warning`

Agent Standards (CLAUDE.md / AGENTS.md / copilot-setup-steps.yml) (3 finding(s))

Remediation: per-repo doc and workflow additions
Affected repos: .github-private, empower-personal-dashboard

Repo	Check	Severity
`empower-personal-dashboard`	`missing-copilot-setup-steps`	`warning`
`empower-personal-dashboard`	`missing-copilot-instructions`	`error`
`.github-private`	`agents-md-missing-org-ref`	`error`

Generated by the weekly compliance audit on 2026-10-02 18:46 UTC.
Address each remediation category as a single coordinated PR to avoid duplicate agent work.

Dev-Lead Implementation Plan

Issue: #1236 — Compliance audit — 2026-10-02

Triage

I checked every category against the live repos. All 46 findings are genuine drift in downstream repos, not false positives from the audit:

stub-surface-drift-*-on: the deployed agent-shield.yml / dependency-audit.yml stubs lack the merge_group: trigger that the canonical templates now carry.
stub-surface-drift-pr-auto-review.yml-concurrency: the deployed stubs lack (or differ from) the canonical concurrency: block.
non-stub-*: .github-private and TalkTerm pin v<M>-stable but their computed tier is next / ring1.
Rulesets, dependabot, and repo settings: these are real per-repo settings (e.g. markets code-quality has no bypass actors, .github-private has strict=false). They are remediated by apply-rulesets.sh / apply-repo-settings.sh / per-repo PRs, which this repo's automation cannot run from a dev-lead workspace.

Root cause in this repo: the stub-surface-drift-* findings persist across audit cycles (first reported in #1185) because the remediation path, scripts/deploy-standard-workflows.sh, cannot fix them. Its is_already_compliant only checks the channel pin and the S7635 marker. A stub with a correct pin but a missing merge_group: trigger or concurrency: block is logged as "already compliant" and never re-synced, while the audit keeps flagging it every week. The audit and the deploy sweep disagree, which is the same class of bug #482 / #877 fixed for pins and markers.

Scope

Make the deploy sweep treat caller-stub on: / permissions: / concurrency: surface drift as drift, using the audit's own comparison logic, so the next sweep re-syncs the affected stubs.

Implementation Checklist

New scripts/lib/stub-surface.sh: move stub_extract_blocks / stub_normalize_surface / stub_surface_drift and the enrolled-shim → surfaces map out of compliance-audit.sh so both consumers share one source of truth (same pattern as lib/ring-pins.sh).
scripts/compliance-audit.sh: source the lib and use the shared shim map.
scripts/deploy-standard-workflows.sh: is_already_compliant returns drift when an enrolled surface differs from the template. Exempt SKIP_REPOS (the audit exempts them too, and they are re-pinned in place) and body-preserving workflows (feature-ideation is re-pinned in place, so a redeploy cannot fix its surface; including it would loop forever, as in feat: implement issue #877 — [#850] make standards-deploy driver treat a missing S7635 marker as drift (propagate #876 markers to already-pinned consumers) #878).

Tests to Write

test/scripts/deploy-standard-workflows/surface-drift.bats: a pin-correct stub missing merge_group counts as drift; a stub missing concurrency counts as drift; a stub matching the template is still compliant.
Update the minimal auto-rebase fixtures in emit-vform.bats / dry-run.bats so they are derived from the template, keeping their pin-only intent.

Test Command

bats test/scripts/deploy-standard-workflows test/scripts/compliance-audit test/scripts/lib + bash .dev-lead/scripts/dev-lead-lint.sh

Out of scope

The per-repo settings, rulesets, and onboarding of the new empower-personal-dashboard repo are remediated by the existing apply-* scripts and per-repo PRs.

Dev-Lead: Implementation Complete — PR #1237

The implementation for issue #1236 is durable: commits are pushed and a pull request is open. This record is backed by verifiable artifacts you can confirm in one click.

Pull request: feat: implement issue #1236 — Compliance audit — 2026-10-02 #1237
Head commit: 1d26b14c9a59fc07fd97144254d459284ece197d
Net change against main: 7 file(s), +352/-138 lines
Run: https://github.com/petry-projects/.github/actions/runs/37049765038

Review happens on the PR. Acceptance criteria and test results are evidenced by the PR's diff and CI checks — not asserted here. If a later stage fails, this claim is retracted in place.

feat: implement issue #1236 — Compliance audit — 2026-10-02

fix(reviews): make surface-drift bats fake gh answer the agent-ingres…

fix(reviews): scope surface-drift merge to drifted top-level blocks

feat: implement issue #1236 — Compliance audit — 2026-10-02

fix(reviews): make surface-drift bats fake gh answer the agent-ingres…

fix(reviews): scope surface-drift merge to drifted top-level blocks

feat: implement issue #1236 — Compliance audit — 2026-10-02

fix(reviews): make surface-drift bats fake gh answer the agent-ingres…

fix(reviews): scope surface-drift merge to drifted top-level blocks

feat: implement issue #1236 — Compliance audit — 2026-10-02

fix(reviews): make surface-drift bats fake gh answer the agent-ingres…

fix(reviews): scope surface-drift merge to drifted top-level blocks

fix(deploy): extract only top-level guarded surfaces and improve work…

feat: implement issue #1236 — Compliance audit — 2026-10-02 (#1237)

Navigation Menu

Repository navigation

Compliance audit — 2026-10-02 #1236