Skip to content

chore: record the fidelity review of the GitHub settings audit - #1242

Merged
REPPL merged 1 commit into
mainfrom
records/audit-github-settings
Oct 30, 2026
Merged

REPPL merged 1 commit into
mainfrom
records/audit-github-settings

Conversation

@REPPL

@REPPL REPPL commented Oct 30, 2026

Copy link
Copy Markdown
Collaborator

Records only. This ingests the owed fidelity review rcp-6083de2cef52 of itd-2610290746077716 (the GitHub settings audit, #1225) and captures what it found diverged.

The review

One Opus intent-auditor read #1225's merged diff (merge commit 1b89a7e) against the intent's acceptance criteria and scope conditions, and abcd intent audit ingest wrote its verdict into the intent's Audit Notes.

  • Criteria: 7 met, 2 met with concerns (ac-8, ac-9), none unmet or inconclusive.
  • Scope conditions: 3 survived, 1 narrowed (cond-2610290749118129).

Captured

Each divergence is its own record, checked against the code before filing:

  • iss-2610292103069395: only the organization Actions policy read names the missing scope and the command that grants it; a repository settings read names the admin role with no next step, and a failed plan read gives no reason (ac-8).
  • iss-2610292103119559: the SHA-pinning advisory drops its count of unpinned uses when any workflow went unread, and an Actions answer without sha_pinning_required reads as unknown before the workflows are looked at (ac-9).
  • iss-2610292103166339: owed is inferred from the repository being private and from GitHub's refusal wording, not from the owner's plan (the narrowed condition). iss-2610161632245527 is its wider form.

The reviewer also noted that repo.visibility means two things: the install help reads it as whether abcd's records are committed, and the audit reads it as the repository's GitHub visibility. ac-5 asks for the second reading, so the double meaning comes from the intent itself; it is not captured here.

Refs: itd-2610290746077716
Refs: iss-2610292103069395
Refs: iss-2610292103119559
Refs: iss-2610292103166339
Refs: iss-2610161632245527

Assisted-by: Claude:claude-opus-5-5

The owed review rcp-6083de2cef52 of itd-2610290746077716, run against
#1225's merged diff, is ingested into the intent's Audit Notes: seven
criteria met, two met with concerns (ac-8, ac-9), none unmet; three
scope conditions survived and one narrowed.

Its three divergences are captured, each on its own record:
iss-2610292103069395 (only the organization Actions policy read names a
granting step), iss-2610292103119559 (the SHA-pinning advisory can drop
its count) and iss-2610292103166339 (owed is inferred from refusal
wording, not the plan).

Refs: itd-2610290746077716
Refs: iss-2610292103069395
Refs: iss-2610292103119559
Refs: iss-2610292103166339
Assisted-by: Claude:claude-opus-5-5
@REPPL
REPPL enabled auto-merge October 30, 2026 01:02
@REPPL
REPPL added this pull request to the merge queue Oct 30, 2026
Merged via the queue into main with commit e0c8532 Oct 30, 2026
14 checks passed
@REPPL
REPPL deleted the records/audit-github-settings branch October 30, 2026 02:28
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant