Compliance audit — 2026-10-16

Compliance Audit — 2026-10-16

This umbrella issue tracks all findings from the automated compliance audit run on 2026-10-16.
Findings are grouped by remediation category. Address each category together to avoid duplicate agent PRs.

Total findings: 67 across 13 repositories

Remediation Work Breakdown

Repository Settings (8 finding(s))

Remediation: apply-repo-settings.sh
Affected repos: software-factory, software-factory-canary

Repo	Check	Severity
`software-factory`	`allow_auto_merge`	`warning`
`software-factory`	`delete_branch_on_merge`	`warning`
`software-factory`	`has_wiki`	`warning`
`software-factory-canary`	`allow_auto_merge`	`warning`
`software-factory-canary`	`delete_branch_on_merge`	`warning`
`software-factory-canary`	`has_wiki`	`warning`
`software-factory-canary`	`has_discussions`	`error`
`software-factory-canary`	`missing-codeowners`	`error`

Push Protection & Secret Scanning (3 finding(s))

Remediation: apply-repo-settings.sh (security_and_analysis) + per-repo ci.yml and .gitignore
Affected repos: .github-private, software-factory-canary

Repo	Check	Severity
`.github-private`	`open_secret_alerts`	`error`
`software-factory-canary`	`secret_scan_ci_job_present`	`error`
`software-factory-canary`	`gitignore_baseline`	`error`

Repository Rulesets (15 finding(s))

Remediation: apply-rulesets.sh
Affected repos: .github-private, broodly, google-app-scripts, markets, software-factory, software-factory-canary

Repo	Check	Severity
`software-factory`	`missing-pr-quality`	`error`
`software-factory`	`missing-code-quality`	`error`
`software-factory`	`ruleset-bypass-orgadmin-main`	`error`
`software-factory`	`ruleset-bypass-dependabot-main`	`error`
`software-factory`	`legacy-ruleset-main`	`error`
`.github-private`	`ruleset-drift-code-quality-strict_required_status_checks_policy`	`error`
`broodly`	`ruleset-drift-pr-quality-require_code_owner_review`	`error`
`broodly`	`ruleset-drift-pr-quality-dismiss_stale_reviews_on_push`	`error`
`broodly`	`ruleset-drift-pr-quality-require_last_push_approval`	`error`
`markets`	`ruleset-bypass-orgadmin-code-quality`	`error`
`markets`	`ruleset-bypass-dependabot-code-quality`	`error`
`google-app-scripts`	`ruleset-drift-pr-quality-dismiss_stale_reviews_on_push`	`error`
`google-app-scripts`	`ruleset-drift-pr-quality-require_last_push_approval`	`error`
`software-factory-canary`	`missing-pr-quality`	`error`
`software-factory-canary`	`missing-code-quality`	`error`

Workflows (32 finding(s))

Remediation: per-repo workflow additions
Affected repos: .github-private, ContentTwin, TalkTerm, bmad-bgreat-suite, broodminder-data, empower-personal-dashboard, google-app-scripts, incubator, repo-template, software-factory, software-factory-canary

Repo	Check	Severity
`software-factory`	`missing-dev-lead.yml`	`error`
`software-factory`	`missing-dependabot-automerge.yml`	`error`
`software-factory`	`missing-dependency-audit.yml`	`error`
`software-factory`	`missing-agent-shield.yml`	`error`
`software-factory`	`missing-pr-review-mention.yml`	`error`
`software-factory`	`missing-feature-ideation.yml`	`error`
`software-factory`	`missing-pr-auto-review.yml`	`error`
`software-factory`	`missing-initiative-driver.yml`	`error`
`.github-private`	`non-stub-agent-shield.yml`	`error`
`empower-personal-dashboard`	`stub-surface-drift-persona-mention.yml-on`	`error`
`empower-personal-dashboard`	`verbatim-stub-drift-initiative-driver.yml`	`error`
`broodminder-data`	`stub-surface-drift-persona-mention.yml-on`	`error`
`broodminder-data`	`verbatim-stub-drift-initiative-driver.yml`	`error`
`incubator`	`stub-surface-drift-persona-mention.yml-on`	`error`
`incubator`	`verbatim-stub-drift-initiative-driver.yml`	`error`
`google-app-scripts`	`verbatim-stub-drift-initiative-driver.yml`	`error`
`ContentTwin`	`stub-surface-drift-agent-shield.yml-on`	`error`
`ContentTwin`	`verbatim-stub-drift-initiative-driver.yml`	`error`
`repo-template`	`stub-surface-drift-persona-mention.yml-on`	`error`
`repo-template`	`verbatim-stub-drift-initiative-driver.yml`	`error`
`TalkTerm`	`verbatim-stub-drift-initiative-driver.yml`	`error`
`bmad-bgreat-suite`	`verbatim-stub-drift-initiative-driver.yml`	`error`
`software-factory-canary`	`missing-ci.yml`	`error`
`software-factory-canary`	`missing-sonarcloud.yml`	`error`
`software-factory-canary`	`missing-dev-lead.yml`	`error`
`software-factory-canary`	`missing-dependabot-automerge.yml`	`error`
`software-factory-canary`	`missing-dependency-audit.yml`	`error`
`software-factory-canary`	`missing-agent-shield.yml`	`error`
`software-factory-canary`	`missing-pr-review-mention.yml`	`error`
`software-factory-canary`	`missing-feature-ideation.yml`	`error`
`software-factory-canary`	`missing-pr-auto-review.yml`	`error`
`software-factory-canary`	`missing-initiative-driver.yml`	`error`

Dependabot Configuration (2 finding(s))

Remediation: per-repo .github/dependabot.yml
Affected repos: software-factory, software-factory-canary

Repo	Check	Severity
`software-factory`	`missing-config`	`error`
`software-factory-canary`	`missing-config`	`error`

Agent Standards (CLAUDE.md / AGENTS.md / copilot-setup-steps.yml) (7 finding(s))

Remediation: per-repo doc and workflow additions
Affected repos: .github-private, software-factory, software-factory-canary

Repo	Check	Severity
`software-factory`	`missing-copilot-setup-steps`	`warning`
`software-factory`	`missing-copilot-instructions`	`error`
`.github-private`	`agents-md-missing-org-ref`	`error`
`software-factory-canary`	`missing-claude-md`	`error`
`software-factory-canary`	`missing-agents-md`	`error`
`software-factory-canary`	`missing-copilot-setup-steps`	`warning`
`software-factory-canary`	`missing-copilot-instructions`	`error`

Generated by the weekly compliance audit on 2026-10-16 17:37 UTC.
Address each remediation category as a single coordinated PR to avoid duplicate agent work.

Dev-Lead Implementation Plan

Issue: #1343 — Compliance audit — 2026-10-16

Scope

Triage only. All 67 findings are real drift in other repos, and none of them come from a defect in combsmith/.github's audit or deploy tooling. That means no source change in this repo is warranted. The precedent is #1237, which changed this repo only to fix the audit tooling itself.

Triage (checked against the live repos and the previous audit #1265)

Group	Finding(s)	Verdict	Remediation (outside this repo)
New repos `software-factory` (created 2026-10-11) and `software-factory-canary` (created 2026-10-11, "throwaway")	49 of the 57 new findings: settings, rulesets, missing stubs, dependabot, CLAUDE.md/AGENTS.md/copilot	Real. These repos were never bootstrapped.	Run `scripts/bootstrap-new-repo.sh` (repo settings, rulesets, labels, ring), then the standards deploy sweep (`standards-deploy.yml`) for the stubs. Whether the throwaway canary should be excluded from the audit is a policy call for a maintainer. `compliance-audit.sh` has no repo-exclusion mechanism today.
`verbatim-stub-drift-initiative-driver.yml` (9 repos)	Deployed stubs still use inline `-f target_repo=${{ github.repository }}` and (TalkTerm, bmad-bgreat-suite) predate the rate-limit gate	Real. The template moved `target_repo` to an env var (zizmor template-injection) and the fleet hasn't been re-synced yet.	Standards deploy sweep (`deploy-standard-workflows.sh`).
`stub-surface-drift-persona-mention.yml-on` (4 repos)	Deployed stubs lack the `pull_request: [opened, ready_for_review, reopened]` trigger the template now carries (#1165)	Real. Rollout lag.	Standards deploy sweep. No `with:` forward is involved, so the channel-pin guardrail (#1052) doesn't apply.
`.github-private` `non-stub-agent-shield.yml`	Pins `agent-shield/v2-stable`. `.github-private` is ring0 for agent-shield, so the expected pin is `agent-shield/v2-ring0`.	Real under the F5 rule (#861): a wrong-tier v-form is drift.	Human PR. `agent-shield.yml` is an immutable file (`standards/workflow-exemptions.json`, `requires_human_review`).
`ContentTwin` `stub-surface-drift-agent-shield.yml-on`	Missing `merge_group:` trigger	Real. Same immutable file.	Human PR re-syncing `standards/workflows/agent-shield.yml`.
Ruleset drift and bypass (`.github-private`, `broodly`, `markets`, `google-app-scripts`)	Carried over from #1265	Real	`apply-rulesets.sh` / `fix-ruleset-bypass.sh` with org-admin credentials.
`.github-private` `open_secret_alerts`	New	Real	Needs a human to triage the secret-scanning alerts (rotate or revoke, then close). Agents can't do this.
`.github-private` `agents-md-missing-org-ref`	Carried over	Real	PR in `.github-private`.

Implementation Checklist

Compare every new finding against the live downstream file or setting and the current template or standard
Check for audit false positives (the in-repo fix class from feat: implement issue #1236 — Compliance audit — 2026-10-02 #1237 and feat: implement issue #978 — Compliance audit — 2026-08-14 #993). None found.
No files in combsmith/.github to change

Tests to Write

None. There's no behaviour change in this repo, so the TDD exception applies.

Test Command

bash .dev-lead/scripts/dev-lead-lint.sh (lint-only verification of an unchanged tree)

Dev-Lead: Progress (in progress — not yet durable)

Provisional. Nothing is pushed yet. Treat these notes as intent, not delivered results.

Plan Execution (intended)

I re-checked the 2026-10-16 triage plan against main (43ec2a1) and the live repos on 2026-10-21. Its conclusion still holds: every finding is downstream drift, and no file in combsmith/.github needs to change.
Spot checks done again:
- The TalkTerm initiative-driver.yml still passes -f target_repo=${{ github.repository }} inline. The template now passes it through the TARGET_REPO env var.
- The incubator persona-mention.yml still lacks the [qa-lead reach 3/3] Serve the pull_request surface from the persona mention router (architect decision (b), ADR-0007 consolidation) #1165 pull_request surface.
- .github-private agent-shield.yml still pins agent-shield/v2-stable. .github-private is ring0, so it should pin v2-ring0.
software-factory-canary was created 2026-10-11 and describes itself as a "Throwaway repo... Nothing here is depended on". compliance-audit.sh still has no way to exclude a repo, so it gets audited like any other. Excluding it (or archiving it) is a maintainer decision.

Remediation still needed (outside this repo)

software-factory and software-factory-canary: run scripts/bootstrap-new-repo.sh, then the standards deploy sweep.
initiative-driver and persona-mention stub drift: standards deploy sweep (deploy-standard-workflows.sh).
agent-shield.yml in .github-private and ContentTwin: human PR. This file is immutable and needs human review.
Ruleset drift and bypass: apply-rulesets.sh / fix-ruleset-bypass.sh with org-admin credentials.
.github-private open_secret_alerts: a human has to triage these and rotate the secrets.

Files touched (this workspace, not yet pushed)

None.

Notes

I skipped TDD because nothing in this repo changes behaviour. dev-lead-lint.sh ran clean on the unchanged tree.

Dev-Lead: Progress (in progress — not yet durable)

Provisional. Nothing is pushed yet. Treat these notes as intent, not delivered results.

Plan Execution (intended)

Re-run on 2026-10-22. main is still at 43ec2a1, the same commit as the 2026-10-21 re-check, so the earlier triage still applies: every finding is downstream drift or needs a human or org-admin action. No file in combsmith/.github needs to change for this issue.

New since the last note

The maintainer has now decided the question about software-factory that the earlier triage left open. Exclude combsmith/software-factory from the compliance audit, the scorecard and the fleet monitor #1352 (opened 2026-10-19 on the Maintainer's word) asks for that repo to be excluded from the compliance audit, scorecard and fleet monitor. Its departures from the standards are deliberate (its ADR 0014). That covers 23 of the 67 findings here, which are won't-fix by design, not bootstrap work. Do not run bootstrap-new-repo.sh or the deploy sweep against software-factory.
compliance-audit.sh still has no way to exclude a repo. Adding one belongs to Exclude combsmith/software-factory from the compliance audit, the scorecard and the fleet monitor #1352, not this umbrella issue, so this run does not add it.
software-factory-canary is still open as a policy question: exclude it, archive it, or bootstrap it.

Files touched (this workspace, not yet pushed)

None.

Notes

I skipped TDD because nothing in this repo changes behaviour. dev-lead-lint.sh ran clean on the unchanged tree.

Dev-Lead: Progress (in progress — not yet durable)

Provisional. Nothing is pushed yet. Treat these notes as intent, not delivered results.

Plan Execution (intended)

Re-checked on 2026-10-22 against main at c2bc153. The only commit since the last check is fix(feature-ideation): source tooling from the reusable's own commit (#839) #1368, a feature-ideation tooling fix that doesn't touch anything in this audit. The earlier triage still holds: every finding is either drift in another repo or needs a human or org-admin action. No file in combsmith/.github needs to change for this issue.
Exclude combsmith/software-factory from the compliance audit, the scorecard and the fleet monitor #1352 (exclude software-factory from the audit) is still open, and scripts/compliance-audit.sh still has no way to exclude a repo. The 23 software-factory findings are still won't-fix by design and are waiting on Exclude combsmith/software-factory from the compliance audit, the scorecard and the fleet monitor #1352. Adding the exclusion stays in Exclude combsmith/software-factory from the compliance audit, the scorecard and the fleet monitor #1352's scope.
software-factory-canary is still a policy question for the maintainer: exclude it, archive it, or bootstrap it.

Files touched (this workspace, not yet pushed)

None.

Notes

I skipped TDD because nothing in this repo changes behaviour. dev-lead-lint.sh ran clean on the unchanged tree. What's still needed outside this repo is unchanged from the 2026-10-21 note: the deploy sweep for the stub drift, a human PR for agent-shield.yml, apply-rulesets.sh/fix-ruleset-bypass.sh run with org-admin credentials, and triage of the .github-private secret alerts.

Dev-Lead Implementation Plan + Progress (in progress — not yet durable)

Provisional. Nothing will be pushed from this run.

Scope

Re-checked on 2026-10-28. Nothing has changed since the 2026-10-27 check. main is still at 1ea9ee1, and no file in combsmith/.github needs to change for this issue.

Exclude combsmith/software-factory from the compliance audit, the scorecard and the fleet monitor #1352 (make the audit honour NOT_SERVED_REPOS) is still open. scripts/compliance-audit.sh still has no way to exclude a repo, so the software-factory and software-factory-canary findings (about two thirds of the 67) will keep coming back.
chore: sync 3 org-standard workflow stub(s) from combsmith/.github TalkTerm#551 (the initiative-driver stub sync) is still open.

Implementation Checklist / Tests

None. There is no behaviour change in this repo, so I skipped TDD.

Test Command

bash .dev-lead/scripts/dev-lead-lint.sh passes on the unchanged tree.

Maintainer actions still outstanding (unchanged)

Exclude combsmith/software-factory from the compliance audit, the scorecard and the fleet monitor #1352
Merge chore: sync 3 org-standard workflow stub(s) from combsmith/.github TalkTerm#551
Run scripts/apply-rulesets.sh / fix-ruleset-bypass.sh with an org-admin token for broodly, markets and google-app-scripts
Open a per-repo PR in .github-private (thin-stub agent-shield.yml, AGENTS.md org reference, code-quality ruleset), and triage its open secret-scanning alerts

Suggestion: pause dev-lead re-dispatch on this umbrella until #1352 lands. Further runs will keep reaching the same no-op result.

Dev-Lead: implementation deferred — automation PR queue is full

No pull request was opened for issue #1343. The org-wide
open-automation-PR queue is currently at its signed-off cap (see
standards/pr-limits.json in combsmith/.github).

This issue stays labeled dev-lead and will be re-attempted automatically once
the queue drains — no action is required.

Dev-Lead Implementation Plan + Progress (in progress — not yet durable)

Provisional. Nothing will be pushed from this run.

Scope

I re-checked on 2026-10-28 (second run today) and the result is the same: no change in combsmith/.github is needed for this issue. main is at 548b9e9. The only new commit is a dependency bump, which has nothing to do with these findings.

Exclude combsmith/software-factory from the compliance audit, the scorecard and the fleet monitor #1352 (make the audit honour NOT_SERVED_REPOS) is still OPEN. scripts/compliance-audit.sh still has no exclusion mechanism.
chore: sync 3 org-standard workflow stub(s) from combsmith/.github TalkTerm#551 (the initiative-driver stub sync) is still OPEN.

Implementation Checklist / Tests

None. There is no behaviour change in this repo, so I skipped TDD.

Test Command

bash .dev-lead/scripts/dev-lead-lint.sh passes on the unchanged tree.

Maintainer actions still outstanding

These are unchanged from the earlier comment: land #1352, merge TalkTerm#551, run the ruleset scripts with an org-admin token, and remediate .github-private per repo.

Recommendation: remove the dev-lead label from this umbrella until #1352 lands. Every re-dispatch comes back with the same no-op result.

Dev-Lead Plan + Progress (in progress, not yet durable)

Provisional. This run will push nothing.

Scope

I re-checked on 2026-10-28 (third run) and nothing has changed: this issue needs no change in combsmith/.github. main is at acd8988, a mention-router security fix (#1413) that has nothing to do with these findings.

Exclude combsmith/software-factory from the compliance audit, the scorecard and the fleet monitor #1352 (make the audit honour NOT_SERVED_REPOS) is still OPEN. NOT_SERVED_REPOS exists only in scripts/deploy-standard-workflows.sh, and scripts/compliance-audit.sh still cannot exclude a repo. About two thirds of the findings are for software-factory and software-factory-canary, and they will keep coming back until it lands.
chore: sync 3 org-standard workflow stub(s) from combsmith/.github TalkTerm#551 (the initiative-driver stub sync) is still OPEN.
The other findings are fixed in other repos or with an org-admin token: rulesets for broodly, markets and google-app-scripts; .github-private stub, AGENTS.md reference and secret alerts; stub drift in downstream repos.

Implementation Checklist / Tests

None. There is no behaviour change in this repo, so I skipped TDD.

Notes

bash .dev-lead/scripts/dev-lead-lint.sh runs clean on the unchanged tree (local check only).

Recommendation (repeated): remove the dev-lead label from this umbrella until #1352 lands. Every re-dispatch reaches the same no-op result.

Dev-Lead Implementation Plan

Issue: #1343 — Compliance audit — 2026-10-16

Triage

Of the 67 findings, 43 are on software-factory (19) and software-factory-canary (24). Both repos are outside the org standard by the Maintainer's recorded decision. They are already on NOT_SERVED_REPOS in deploy-standard-workflows.sh (#1334), and #1352 asks for the audit to exclude them. That PR noted the audit "does not read this list". So these 43 findings are not remediable in those repos. The fix that belongs in this repo is to make the audit honour the same list.

The other 24 findings need no source change here. They need work in other repos or an org-admin token:

Rulesets (.github-private, broodly, markets, google-app-scripts): scripts/apply-rulesets.sh --repo combsmith/<repo> with an admin token. standards/rulesets/*.json is already correct.
Secret alert (.github-private open_secret_alerts): a person has to triage it in that repo.
Workflows: the verbatim-stub-drift-initiative-driver.yml (8 repos) and stub-surface-drift-* (5) findings are what the standards-deploy sweep re-syncs. .github-private non-stub-agent-shield.yml needs a per-repo PR.
Agent standards (.github-private agents-md-missing-org-ref): a per-repo doc edit.

Implementation Checklist

scripts/lib/not-served-repos.sh (new): one shared source of NOT_SERVED_REPOS and is_not_served_repo
scripts/deploy-standard-workflows.sh: source the lib instead of defining the list inline (no change in behaviour)
scripts/compliance-audit.sh: source the lib and drop not-served repos from the org listing before the audit loop and the issue-management loop. No findings, no issues and no label provisioning for them.
standards/workflow-exemptions.json / docs: note the exclusion where the audit's scope is described (only if such a place exists)

Tests to Write

test/scripts/lib/not-served-repos.bats: the list, case-insensitive matching, ordinary repos still served
test/scripts/compliance-audit/not-served-repos.bats: main with a stubbed org listing audits served repos and skips not-served ones
Existing test/scripts/deploy-standard-workflows/not-served-repos.bats keeps passing

Test Command

npx bats test/scripts/compliance-audit test/scripts/deploy-standard-workflows test/scripts/lib + bash .dev-lead/scripts/dev-lead-lint.sh

Scope note: this covers the compliance-audit part of #1352 only. Scorecard and fleet monitor stay out of scope.

Dev-Lead: Implementation Complete — PR #1426

The implementation for issue #1343 is durable: commits are pushed and a pull request is open. This record is backed by verifiable artifacts you can confirm in one click.

Pull request: feat: implement issue #1343 — Compliance audit — 2026-10-16 #1426
Head commit: cb222316aee2ab0bc0eb73d4a8cd196a11bbe5f1
Net change against main: 4 file(s), +139/-25 lines
Run: https://github.com/combsmith/.github/actions/runs/40797578293

Review happens on the PR. Acceptance criteria and test results are evidenced by the PR's diff and CI checks — not asserted here. If a later stage fails, this claim is retracted in place.

Compliance audit — 2026-10-16 #1343

Description