Compliance audit — 2026-09-25

[don-petry]

Compliance Audit — 2026-09-25

This umbrella issue tracks all findings from the automated compliance audit run on 2026-09-25.
Findings are grouped by remediation category. Address each category together to avoid duplicate agent PRs.

Total findings: 33 across 9 repositories

---

Remediation Work Breakdown

Repository Rulesets (8 finding(s))

Remediation: apply-rulesets.sh
Affected repos: .github-private, broodly, google-app-scripts, markets

Repo	Check	Severity
.github-private	ruleset-drift-code-quality-strict_required_status_checks_policy	error
broodly	ruleset-drift-pr-quality-require_code_owner_review	error
broodly	ruleset-drift-pr-quality-dismiss_stale_reviews_on_push	error
broodly	ruleset-drift-pr-quality-require_last_push_approval	error
markets	ruleset-bypass-orgadmin-code-quality	error
markets	ruleset-bypass-dependabot-code-quality	error
google-app-scripts	ruleset-drift-pr-quality-dismiss_stale_reviews_on_push	error
google-app-scripts	ruleset-drift-pr-quality-require_last_push_approval	error

Workflows (24 finding(s))

Remediation: per-repo workflow additions
Affected repos: .github-private, ContentTwin, TalkTerm, bmad-bgreat-suite, broodly, broodminder-export, google-app-scripts, incubator, markets

Repo	Check	Severity
.github-private	non-stub-agent-shield.yml	error
broodminder-export	stub-surface-drift-agent-shield.yml-on	error
broodminder-export	stub-surface-drift-dependency-audit.yml-on	error
broodminder-export	stub-surface-drift-pr-auto-review.yml-concurrency	warning
TalkTerm	non-stub-pr-auto-review.yml	error
TalkTerm	stub-surface-drift-agent-shield.yml-on	error
TalkTerm	stub-surface-drift-dependency-audit.yml-on	error
TalkTerm	stub-surface-drift-pr-auto-review.yml-concurrency	warning
broodly	stub-surface-drift-agent-shield.yml-on	error
broodly	stub-surface-drift-dependency-audit.yml-on	error
markets	stub-surface-drift-agent-shield.yml-on	error
markets	stub-surface-drift-dependency-audit.yml-on	error
markets	stub-surface-drift-pr-auto-review.yml-concurrency	warning
ContentTwin	stub-surface-drift-agent-shield.yml-on	error
ContentTwin	stub-surface-drift-dependency-audit.yml-on	error
google-app-scripts	stub-surface-drift-agent-shield.yml-on	error
google-app-scripts	stub-surface-drift-dependency-audit.yml-on	error
google-app-scripts	stub-surface-drift-pr-auto-review.yml-concurrency	warning
incubator	stub-surface-drift-agent-shield.yml-on	error
incubator	stub-surface-drift-dependency-audit.yml-on	error
incubator	stub-surface-drift-pr-auto-review.yml-concurrency	warning
bmad-bgreat-suite	stub-surface-drift-agent-shield.yml-on	error
bmad-bgreat-suite	stub-surface-drift-dependency-audit.yml-on	error
bmad-bgreat-suite	stub-surface-drift-pr-auto-review.yml-concurrency	warning

Agent Standards (CLAUDE.md / AGENTS.md / copilot-setup-steps.yml) (1 finding(s))

Remediation: per-repo doc and workflow additions
Affected repos: .github-private

Repo	Check	Severity
.github-private	agents-md-missing-org-ref	error

---

Generated by the weekly compliance audit on 2026-09-25 17:51 UTC.
Address each remediation category as a single coordinated PR to avoid duplicate agent work.

[don-petry]

Dev-Lead Scope Analysis — no in-repo remediation for this repo

Issue: #1185 — Compliance audit — 2026-09-25

Finding

After reading AGENTS.md, the standards/ tree, and the remediation scripts, none of the 33 findings can be remediated by a source-file change in petry-projects/.github. Every finding targets one of 9 other repositories (.github-private, broodly, markets, google-app-scripts, ContentTwin, TalkTerm, bmad-bgreat-suite, broodminder-export, incubator), and each remediation is an operation performed against those target repos — not an edit in this repo:

Category	Remediation	Mechanism	This-repo change?
Repository Rulesets (8)	apply-rulesets.sh / fix-ruleset-bypass.sh	gh api PUT/POST repos/<target>/rulesets from JSON already in standards/rulesets/	None
Workflows (24)	deploy-standard-workflows.sh	deploys stub workflows into target repos via the Contents API, from templates already in standards/workflows/	None
Agent Standards (1)	doc edit	add org ref to .github-private's AGENTS.md	None (belongs in .github-private)

Verified against source:

• scripts/compliance-audit.sh scans remote target repos and explicitly exempts .github as the template holder (check_dev_lead_stub / check_stub_surface skip .github).
• apply-rulesets.sh discovers repos via gh repo list and mutates each via the rulesets API — the ruleset JSON source of truth (standards/rulesets/{code-quality,pr-quality,release-channel-tags}.json) is already present and correct here.
• deploy-standard-workflows.sh reads/writes stub content in target repos; the canonical templates in standards/workflows/ are already correct.

The findings are drift in the target repos relative to the (correct) org source of truth in this repo — not defects in this repo.

Why no PR from this dev-lead

Editing shared fleet-consumed templates in standards/ to "fix" drift that lives elsewhere would introduce drift and could break every consuming repo — the opposite of the intent. There is no unrelated file in this repo I can legitimately change here.

Recommended routing

• Rulesets & workflows: run the org remediation automation with an org/admin token against the affected repos — apply-rulesets.sh (+ fix-ruleset-bypass.sh and the ruleset-remediation-runbook.md admin procedure for the markets bypass-actor findings), and deploy-standard-workflows.sh for the workflow stub drift. These are the exact scripts named in the audit's remediation column and require elevated tokens + human authorization for cross-repo mutation.
• .github-private AGENTS.md org-ref: dispatch a dev-lead against petry-projects/.github-private.

No source files were modified in this repo. Nothing is being pushed from this workspace for issue #1185.