feat: add github admin-plane plugin

.claude-plugin/marketplace.json

@@ -410,6 +410,12 @@
       "source": "./plugins/adhd",
       "category": "personal",
       "tags": ["adhd", "output", "accessibility", "action-first", "focus", "response-style", "brevity", "skill"]
+    },
+    {
+      "name": "github",
+      "source": "./plugins/github",
+      "category": "operations",
+      "tags": ["github", "audit", "advise", "governance", "org-admin", "billing", "security-posture", "rulesets", "actions-policy", "drift", "skill"]
     }
   ],
   "renames": {

README.md

@@ -135,6 +135,7 @@ user opts in with `/plugin enable`; an existing install is never flipped by cata
 ### Operations
 
 - [`machine-health`](plugins/machine-health) — Workstation health audit: OS-specific checks (disk, OS updates, security posture, CISA KEV correlation) run from a versioned catalog with trend-aware severity, approval-gated remediations, and dated markdown reports. Windows fully implemented; macOS/Linux scaffolded (report UNKNOWN and stop). Machine state persists in the plugin data directory; the report directory and check catalog are configurable.
+- [`github`](plugins/github) — GitHub admin-plane audit, advice, and guided setup over the authenticated user's own gh CLI: billing and cost control, security posture, rulesets and settings drift, Actions policy, and every other org/repo/enterprise settings area. Grounded in live state and current official GitHub docs (zero vendored knowledge); read-only by default, every mutation user-in-loop.
 
 ### Learning
 

docs/MIGRATION-PLAYBOOK.md

@@ -689,6 +689,57 @@ plugins-reference, and hooks pages 2026-07-17; re-verify per the `CLAUDE.md` fre
 Record accept/deny + rationale for any plugin touching surfaces 2, 5, 6, or 7; a later version bump
 that introduces a new surface re-triggers this review.
 
+### Review record — `github` (ACCEPT, 2026-07-21)
+
+Recorded here as the single SSOT (miro §2 precedent). Reviewed at `0.1.0`; a version bump adding a
+new trust surface re-triggers this review.
+
+- **Code execution (1).** No hooks, no scripts wired to any event. The plugin ships prompt
+  artifacts only (skills + reference markdown) plus `github.test.sh`, a repo-CI contract test
+  referenced by nothing in the manifest — inert in a consumer install.
+- **MCP servers (2).** None.
+- **Consumer config (3).** One `userConfig` boolean (`offer_browser_automation`, non-sensitive,
+  documented, default `true`). No credential options: authentication stays entirely in the
+  consumer's own `gh` CLI login — the plugin never prompts for, stores, or transports a token.
+  Consumer-side routing/conventions files live at the documented `.claude/github/` project layers
+  and `~/.claude/github/` user-global layer (sanctioned read per criterion 4's operator-home
+  carve-out).
+- **Cache isolation (4).** All intra-plugin references anchor at `${CLAUDE_PLUGIN_ROOT}` (skills)
+  or resolve inside the plugin directory (reference cross-links). No `../` reach-outs beyond the
+  plugin root, no constructed absolute paths.
+- **Data egress (5).** Three channels, all consumer-initiated, no telemetry:
+  - `api.github.com` via the consumer's **own** `gh` auth. Bare invocations are read-only by
+    written contract (write-capability guard: no field/input flags, no non-GET method, no GraphQL
+    `mutation`); writes exist only behind `--apply` → consumer-declared routing → per-step user
+    confirm naming the exact command and its doc provenance.
+  - Official GitHub docs (`docs.github.com` et al.) runtime fetches for grounding — the D4
+    zero-vendored-knowledge posture; read-only, with a fetch-integrity rung and a
+    refuse-recall-as-grounded branch.
+  - **Browser automation over the consumer's authenticated GitHub session** — the heavy surface,
+    accepted with layered gates: presence-gated (claude-in-chrome tool probe / playwright
+    plugin-installed seam), **never auto-fires**, each action individually offered and confirmed
+    with the resolved settings URL, intended action, and mechanics provenance; post-write
+    read-back verification where an API read exists; guided-manual + deep-link fallback always
+    available. `offer_browser_automation: false` suppresses the offer — recorded honestly as an
+    **advisory, model-honored gate layered under the per-action confirm, not a runtime-enforced
+    kill switch**; the hard gate is the per-action user confirm. Accept rationale: some org-admin
+    surfaces are UI-only, the session and credentials remain the user's own, and every action is
+    user-in-loop; denying the surface would only push users to unassisted manual clicking with no
+    provenance trail.
+- **Prompt injection via ingested GitHub content (explicit item).** Everything fetched from GitHub
+  (repo names, descriptions, issue/PR bodies, webhook URLs, custom property values) is declared
+  **untrusted data, never instructions** as a standing instruction in both ingesting skills
+  (`audit`, `advise`); an injected instruction must not trigger a write, browser action, or
+  routing change. Evidence: anti-pattern eval cases (audit id 5, advise id 9). Defense in depth:
+  every write path is already user-in-loop, so a successful steer still lands on a human confirm.
+- **Provenance & third-party trust (6).** First-party authored (`author` = Melodic Software),
+  MIT. No third-party SaaS delegation: the only vendor wired is GitHub itself, reached through the
+  consumer's pre-existing `gh` relationship.
+- **Main-thread / PATH (7).** No `settings.json` `agent`, no `bin/`.
+
+**Verdict: ACCEPT** — surfaces 1/2/7 absent; 3/4 conform; 5's browser-automation channel accepted
+with the layered gates above; 6 first-party.
+
 ## Local development loop
 
 For a plugin that already ships here, iterate against your local clone without re-publishing and

docs/conventions/consumer-config-layering/README.md

@@ -203,6 +203,7 @@ open.
 | `source-control` | `.claude/source-control.md` | team only | single-layer; migration to all three in flight (#647) |
 | `toolchain` / `ecosystem-commands` | `.claude/ecosystems/<ecosystem>.yaml` | all three | conforms |
 | `codebase-health` | `.claude/codebase-health.md` | all three | conforms (concatenating, with a declared empty-list opt-out) |
+| `github` | `.claude/github/` (`routing.yaml` per-key override, `conventions.md` concatenating) | all three | conforms; policy-floor inversion on write-posture routing keys, declared in the plugin's `change-routing.md` |
 | `autonomy` | `.claude/autonomy/binding.json` | all three, plus an org rung | declared deviation |
 | `standards` (`planning`, `review`) | `<standards_dir>/`, rooted by `.claude/standards.yaml` | all three | precedence inversion ratified via policy-floor class (#649); layer location outside `.claude/` still observed, not ratified |
 | `disk-hygiene` | `.claude/disk-hygiene.json` | user-global + team | declared deviation; no overlay layer |