github-policylisted

## Live context !`git rev-parse --show-toplevel >/dev/null 2>&1 && git remote get-url origin 2>/dev/null || echo "no github origin in cwd"` !`gh auth status 2>&1 | head -2 || echo "gh: not available"` # github-policy Hold GitHub repositories to one canonical policy — rulesets, branch settings, required checks, and Actions concurrency — and report honestly when they are not. **You are the interface and the judgement. `scripts/github-policy.sh` is the implementation.** Do not re-derive rules, re-implement API calls, or restate a required-check list here: the policy lives in `config/github/repository-policy.json` and nothing else may repeat it. Your job is to pick the right invocation, read the output, and tell the user what it means and what it will cost. **User guide:** [docs/user/github-policy.md](../../../docs/user/github-policy.md) --- ## The one rule that outranks everything below **Reading is free. Writing is not.** `audit`, `plan` and `verify` never write and never need permission. `apply` mutates live branch governance across repositories the user cannot easily un-break, so: - Never run `apply` before showing the user a `plan` and getting an answer. - Never pass `--yes` unless the user said so in this conversation. - Never pass `--allow-weakening` unless the user has seen the specific conflict and said the policy is right. - Never set `GITHUB_POLICY_ALLOW_LIVE=1`. It exists so an unattended caller has to declare itself; an agent setting it is an agent defeat