From 5a0e5e59b70ff76a4239396eae5d322359407026 Mon Sep 17 00:00:00 2001
From: Remi Antczak <140408771+remigiusz-antczak@users.noreply.github.com>
Date: Fri, 30 Oct 2026 17:59:54 +0100
Subject: [PATCH] Wave 10: CI jobs a diff fires, repo-settings audit
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Delivery (refs #1559):
- ci_cost_advisor.py ROOT --diff BASE lists every pull_request workflow job
  the committed diff BASE...HEAD fires, with its run: lines, so a fix lane
  knows which CI jobs to run locally (or name "left to CI") before it pushes
  to a repo it does not own. It applies the cost model's types, branches,
  paths and paths-ignore rules; branches filters are matched against the
  branch BASE names, never against --default-branch, and a sha or tag BASE
  lists each branch-gated job tagged "(branches: unchecked)" instead of
  dropping it. A workflow the parser cannot read but that names pull_request
  is listed as UNPARSED, and one line names the workflows that start only on
  push, merge_group or workflow_run. Jobs that build images or start
  containers (including services: and container:) are tagged [runtime].
  Read-only and offline.
- A segment-leading **/ in a paths filter now also matches no directory, as
  GitHub's filter cheat sheet specifies, so **/Dockerfile matches a root
  Dockerfile. The fix is in the glob matcher shared with the cost model.
- scripts/test_ci_cost_advisor.py no longer leaves a temp dir behind on every
  run; NoTempLeak re-runs the file in a child with a private TMPDIR.

Security (repository settings):
- agentic-delivery/scripts/repo_settings_audit.py: a read-only audit of the
  GitHub settings a diff review cannot see (default-branch protection and
  rulesets together, the Actions token default, review approval and allowed
  actions, collaborator counts, write deploy keys, insecure webhooks,
  unprotected environments, secret scanning and push protection). A 403 or
  404, a reply missing a field the check reads, an unreadable list item and a
  list of 1000 or more are "not checked" rows, never clean; a 404 "Branch not
  protected" is a finding only when the reply shows admin for the token.
  Counts and booleans only: no login, email, key title, hook URL or API
  message text is printed. Routed from agentic-delivery/SKILL.md and
  references/tool-hub.md (legitify and OpenSSF Scorecard named as the OSS
  options); sources and fetch dates in docs/standards-index.md.
- scripts/test_skill_index_split.py: the script-lookup budget grows by 300
  bytes for the new index row (measured 22162).

size-budget-raise: .claude/skills/deep-code-review/references/parallel-audit.md 39795→40669 one routed bullet: run the CI jobs a fix diff fires, or name them left to CI
size-budget-raise: .claude/skills/agentic-delivery/SKILL.md 7202→7457 one route row for repo_settings_audit.py
size-budget-raise: .claude/skills/deep-code-review/references/tool-hub.md 14455→15368 one Repo settings section holding the repo_settings_audit.py row and its OSS options

Tests: 20/20 affected suites pass, run one at a time (19 on the tip before the budget bump, then test_skill_index_split 7/7 after it; repo_settings_audit 55/55, ci_cost_advisor 80 with 1 skip); test-ci-gates.sh left to CI.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .claude/skills/INDEX.md                       |   1 +
 .../skills/agentic-delivery/INDEX-scripts.md  |   1 +
 .claude/skills/agentic-delivery/INDEX.md      |   2 +-
 .claude/skills/agentic-delivery/SKILL.md      |   1 +
 .../scripts/repo_settings_audit.py            | 328 ++++++++++
 .claude/skills/deep-code-review/INDEX.md      |   4 +-
 .../references/parallel-audit.md              |  10 +
 .../deep-code-review/references/tool-hub.md   |   6 +
 .../scripts/ci_cost_advisor.py                | 173 +++++-
 SHA256SUMS                                    |  15 +-
 changelog.d/ci-jobs-for-diff.md               |   8 +
 changelog.d/repo-settings-audit.md            |   6 +
 docs/INDEX.md                                 |   2 +-
 docs/standards-index.md                       |  23 +
 scripts/ci-tests.d/repo-settings-audit.sh     |   2 +
 scripts/size-budgets.tsv                      |  12 +-
 scripts/test_ci_cost_advisor.py               | 319 +++++++++-
 scripts/test_repo_settings_audit.py           | 575 ++++++++++++++++++
 scripts/test_skill_index_split.py             |   2 +-
 19 files changed, 1450 insertions(+), 40 deletions(-)
 create mode 100644 .claude/skills/agentic-delivery/scripts/repo_settings_audit.py
 create mode 100644 changelog.d/ci-jobs-for-diff.md
 create mode 100644 changelog.d/repo-settings-audit.md
 create mode 100644 scripts/ci-tests.d/repo-settings-audit.sh
 create mode 100644 scripts/test_repo_settings_audit.py

diff --git a/.claude/skills/INDEX.md b/.claude/skills/INDEX.md
index bbeaf776d..a88c3b0cf 100644
--- a/.claude/skills/INDEX.md
+++ b/.claude/skills/INDEX.md
@@ -86,6 +86,7 @@ Run `python3 <skill>/scripts/<name>` (`bash` for `.sh`). `name: purpose — argu
 - queue_guard.py: single priority queue: print the next issue to pull, flag P0… — --issues issues.json --priorities…
 - reap_own.sh: kill your own dev servers older than MAX_AGE_S whose cwd is…
 - refix_gate.py: re-touching a recently-fixed file requires a class-level… — --base REF --head REF [--window-hours…
+- repo_settings_audit.py: read-only audit of the GitHub settings that decide who can… — OWNER/NAME [OWNER/NAME ...]…
 - review_digest.py: a returning reviewer's change digest, not a full re-read. — --since SHA [--head REF] [--paths PATH…
 - review_gate.py: pre-merge gate: every PR needs an independent deep-code-review… — check <pr> --head SHA [--repo R]
 - review_status.py: post a review verdict as commit status perun/review on an… — --sha <40-hex> --red N [--repo…
diff --git a/.claude/skills/agentic-delivery/INDEX-scripts.md b/.claude/skills/agentic-delivery/INDEX-scripts.md
index f5d05313e..b198341f7 100644
--- a/.claude/skills/agentic-delivery/INDEX-scripts.md
+++ b/.claude/skills/agentic-delivery/INDEX-scripts.md
@@ -83,6 +83,7 @@ Generated by `scripts/skill_index.py` (do not hand-edit). The script half of `IN
 | `scripts/refix_gate.py` | re-touching a recently-fixed file requires a class-level artifact. | refix_gate.py --base REF --head REF [--window-hours 72] [--class-glob GLOB ...] refix_gate.py --selftest |
 | `scripts/repeat_poll_guard.py` | PreToolUse(Bash) hook: nudge when the same command runs more than 3 times in one session. | — |
 | `scripts/reply_cap.py` | owner rule: chat replies max 3 lines, 500 chars. | — |
+| `scripts/repo_settings_audit.py` | repo_settings_audit.py: read-only audit of the GitHub settings that decide who can change a reposit… | repo_settings_audit.py OWNER/NAME [OWNER/NAME ...] [--repos-file FILE] [--json] --repos-file holds one OWNER/NAME per l… |
 | `scripts/restore_ledger.py` | classify every branch after a VCS history-rewrite incident. | — |
 | `scripts/review_digest.py` | a returning reviewer's change digest, not a full re-read. | review_digest.py --since SHA [--head REF] [--paths PATH ...] [--max-lines N] [--allow-diverged] review_digest.py --self… |
 | `scripts/review_gate.py` | pre-merge gate: every PR needs an independent deep-code-review DIFF pass plus an evil-twin check. | review_gate.py check <pr> --head SHA [--repo R] |
diff --git a/.claude/skills/agentic-delivery/INDEX.md b/.claude/skills/agentic-delivery/INDEX.md
index c94f4c03b..801f10afd 100644
--- a/.claude/skills/agentic-delivery/INDEX.md
+++ b/.claude/skills/agentic-delivery/INDEX.md
@@ -38,4 +38,4 @@ Generated by `scripts/skill_index.py` (do not hand-edit; rerun it after changing
 
 ## Scripts
 
-108 scripts. Read `INDEX-scripts.md` when you need a script (a trigger and CLI per script). `../INDEX.md`, `### agentic-delivery`, has only each one-line purpose and arguments.
+109 scripts. Read `INDEX-scripts.md` when you need a script (a trigger and CLI per script). `../INDEX.md`, `### agentic-delivery`, has only each one-line purpose and arguments.
diff --git a/.claude/skills/agentic-delivery/SKILL.md b/.claude/skills/agentic-delivery/SKILL.md
index 9c3ac6964..e35440c64 100644
--- a/.claude/skills/agentic-delivery/SKILL.md
+++ b/.claude/skills/agentic-delivery/SKILL.md
@@ -24,6 +24,7 @@ Gated-delivery **pattern**, not a runtime or standing swarm. Does not replace `d
 | Verify or relay a result; slow pipeline | `verification-handback.md`; `pipeline-optimizer.md` |
 | Long session, compaction, new session, memory or docs bloat | `references/focus-kit.md`: update `.claude/handoff.md` (`scripts/focus_kit.py handoff set`) at each gate, before a context-heavy step, before handback |
 | New machine or fleet | `operating-discipline.md` |
+| Audit a repo's GitHub settings (branch protection, Actions token, deploy keys, webhooks) | run `python3 scripts/repo_settings_audit.py OWNER/NAME... [--repos-file FILE] [--json]`: read-only, a 403 or 404 is `not checked`; admin token for the full set |
 | PR state; hand off; changelog | `scripts/pr_state.py <n>`; `scripts/land_ready.py` (open PRs ready to land, or why not); `scripts/review_status.py --sha S --red N` (post `perun/review`); `scripts/premise_check.py <n>...`; `scripts/ci-gates.sh fragments` |
 | Cost cut, lane cap; "enforced" claim, CI cost | `cost-quality-guardrails.md`; `host-enforcement.md` |
 | Fan-out size, host probe | `fanout-host-sizing.md`, `fast-agentic-delivery.md` |
diff --git a/.claude/skills/agentic-delivery/scripts/repo_settings_audit.py b/.claude/skills/agentic-delivery/scripts/repo_settings_audit.py
new file mode 100644
index 000000000..c60c72f52
--- /dev/null
+++ b/.claude/skills/agentic-delivery/scripts/repo_settings_audit.py
@@ -0,0 +1,328 @@
+#!/usr/bin/env python3
+"""repo_settings_audit.py: read-only audit of the GitHub settings that decide who can change a repository and what its CI may do.
+
+WHY: a clean code review says nothing about a default branch anyone can force-push, a workflow token that can write,
+a deploy key that can push, or a webhook that skips TLS verification. Those live in repository settings, not in the
+diff, and they decide whether a review gate is worth anything. This lists them per repository, one row each: repo,
+check, severity, one-line fix. It reuses `pipeline_hub.gh_get` (bare `gh api` GET, with `gh_rest.fallback` for the
+macOS-sandbox TLS failure) and adds no analysis engine.
+
+Checks, per repository:
+  default branch    classic branch protection and rulesets (`/rules/branches/{branch}`) together: no protection,
+                    force pushes allowed, fewer than 1 required approving review, no required status checks, admins
+                    exempt (classic `enforce_admins`)
+  Actions           default workflow token has write, workflows can approve pull request reviews, allowed actions = all
+  people            collaborator counts: admins, outside collaborators
+  deploy keys       keys with write access (count)
+  webhooks          TLS verification off (`insecure_ssl`), plain http delivery (counts)
+  environments      environments with no protection rule (count)
+  security          secret scanning and push protection, from `security_and_analysis` (a private or internal
+                    organization repository needs GitHub Secret Protection for either; the fix text says so)
+
+A call the token cannot make (HTTP 403 or 404) is a `not checked (needs admin)` row, never a clean result. So is a
+reply that lacks a field the check reads, and a list of 1000 items or more (see Limits). A list holding one item the
+audit cannot read is `not checked` as a whole, since a count of it would be wrong. One reading is a finding on its
+own: a 404 `Branch not protected` on a branch no ruleset covers means the branch has no protection, but only when
+the repository reply shows admin for the token (`permissions.admin` true). The branch-protection REST page does not
+say what a token without admin gets for a protected branch, so with any other token (admin false, or the field
+missing) that 404 is `not checked`. A weakness inside the protection (force pushes, reviews, checks) is reported
+only when classic protection and rulesets were both readable, since either can fill what the other lacks. Not read:
+ruleset bypass lists (a `not checked` row says so whenever rulesets apply).
+
+USAGE: repo_settings_audit.py OWNER/NAME [OWNER/NAME ...] [--repos-file FILE] [--json]
+`--repos-file` holds one OWNER/NAME per line (blank lines and `#` comments ignored). A repository twice, in any case,
+is audited once. `--json` prints `{"rows": [{repo, check, severity, fix}], "summary": {repos, findings, not_checked}}`.
+Severity is high, medium, low, info (a count with nothing to fix) or not-checked.
+
+Exit codes: 0 the audit ran (findings do not change it), 2 usage: a bad slug, no repository, an unreadable
+--repos-file, or `gh` not on PATH.
+Side effects: `gh api` GET calls only (about a dozen per repository); nothing is written or changed.
+Limits: counts and booleans only. No login, email, key title or hook URL is printed, and no API message text, only
+fixed phrases. A list is read 100 items a page for up to 10 pages; one that fills all ten (1000 items or more) is
+`not checked`, not a truncated count. An archived repository is audited like any other. The full set needs an admin
+token (admin on the repository, plus an org owner or security manager for `security_and_analysis`); with less, the
+rows that need it say so.
+"""
+from __future__ import annotations
+
+import argparse
+import json
+import os
+import re
+import shutil
+import sys
+import urllib.parse
+
+sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+import pipeline_profile as pp  # noqa: E402
+from pipeline_hub import gh_get  # noqa: E402
+
+SLUG = re.compile(r"[A-Za-z0-9][A-Za-z0-9-]*/(?!\.{1,2}$)[A-Za-z0-9_.-]+")  # no `..` or `.`: the slug goes into a URL path
+SEVERITY = ("high", "medium", "low", "info", "not-checked")
+FINDING = SEVERITY[:3]
+MAX_PAGES = 10  # ponytail: 1000 items per list; a list that fills every page is `not checked`, raise if one ever matters
+NEEDS_ADMIN = ("needs admin", "re-run with a token that has admin access to the repository")
+NOT_FOUND = ("not found or no access", "check the OWNER/NAME slug and that the token can see the repository")
+NOT_REPORTED = ("not reported by the API", "check it in the repository settings, or re-run with a token that has admin access to the repository")
+UNEXPECTED, TOO_MANY = "unexpected reply", "too many items"  # error texts `why` turns into fixed `not checked` rows
+
+
+def dig(d, *keys):
+    """d[k1][k2]... or None as soon as a step is missing or not a dict (a surprising reply never raises)."""
+    for k in keys:
+        if not isinstance(d, dict):
+            return None
+        d = d.get(k)
+    return d
+
+
+def has(d, need=()):
+    """True when d is an object carrying every key path in `need` with a non-null value (a missing field is never
+    read as a clean one)."""
+    return isinstance(d, dict) and all(dig(d, *p) is not None for p in need)
+
+
+def read(get, path, kind, params=None, need=()):
+    """(reply, None) or (None, error): one GET through `get`. A reply that is not a `kind` (dict or list), a dict
+    missing a key path of `need`, a non-JSON reply and an API failure (OSError from `gh_get`) are all errors, so a
+    caller never has to type-check."""
+    try:
+        d = get(path, params) if params else get(path)
+        if not isinstance(d, kind) or (kind is dict and not has(d, need)):
+            raise ValueError(UNEXPECTED)
+        return d, None
+    except (OSError, ValueError) as e:
+        return None, e
+
+
+def listing(get, path, params=None, key=None, need=()):
+    """(items, None) or (None, error): every item of a list endpoint, 100 per page, at most MAX_PAGES pages. `key`
+    names the array inside an object reply (the environments list); without it the reply is the array. Every item
+    must be an object carrying the key paths in `need`, and a list that fills all MAX_PAGES pages is an error too (it
+    may be longer than what was read): a count of a list the audit could not read in full would be wrong."""
+    items = []
+    for page in range(1, MAX_PAGES + 1):
+        d, e = read(get, path, dict if key else list, dict(params or {}, per_page=100, page=page))
+        chunk = d.get(key) if key and d is not None else d
+        if e or not isinstance(chunk, list) or not all(has(i, need) for i in chunk):
+            return None, e or ValueError(UNEXPECTED)
+        items += chunk
+        if len(chunk) < 100:
+            return items, None
+    return None, ValueError(TOO_MANY)
+
+
+def why(e, miss=NEEDS_ADMIN):
+    """(label, fix) for a failed read, from the HTTP status only. 403 or 404 is `miss`; a rate limit and a plan limit
+    are told apart by their message (matched, never printed); an odd reply and a list too long to read in full have
+    their own labels; anything else is the status or `API error`."""
+    if str(e) == UNEXPECTED:
+        return NOT_REPORTED
+    if str(e) == TOO_MANY:
+        return "%d or more items" % (MAX_PAGES * 100), "review this list in the repository settings"
+    m = re.search(r"\(HTTP (\d+)\)$", str(e))
+    s, msg = int(m.group(1)) if m else None, str(e).lower()
+    if s in (403, 429) and "rate limit" in msg:
+        return "rate limited", "wait for the limit to reset, then re-run"
+    if s == 403 and "upgrade to github" in msg:
+        return "not available on this plan", "upgrade the plan or make the repository public, then re-run"
+    if s in (403, 404):
+        return miss
+    return ("HTTP %d" % s if s else "API error"), "re-run; if it persists check `gh auth status` and the network"
+
+
+def nc(check, reason):
+    """The row for a check that could not run: `<check>: not checked (<label>)` with the fix that would let it."""
+    label, fix = reason
+    return ("%s: not checked (%s)" % (check, label), "not-checked", fix)
+
+
+def protection(get, base, repo):
+    """Default-branch rows from classic protection and rulesets. A 404 `Branch not protected` is the classic 'none'
+    only when the repository reply shows admin for the token (`permissions.admin` true); with any other token it is
+    `not checked`, since the REST page does not say what a token without admin gets for a protected branch."""
+    b = dig(repo, "default_branch")
+    if not isinstance(b, str) or not b:
+        return [nc("default branch protection", ("default branch not reported", NEEDS_ADMIN[1]))]
+    q = urllib.parse.quote(b, safe="/")
+    classic, cerr = read(get, "%s/branches/%s/protection" % (base, q), dict,
+                         need=(("allow_force_pushes", "enabled"), ("enforce_admins", "enabled")))
+    rules, rerr = listing(get, "%s/rules/branches/%s" % (base, q))
+    none = bool(cerr) and "branch not protected" in str(cerr).lower() and dig(repo, "permissions", "admin") is True
+    fix = "protect the default branch: require a pull request and the CI checks, and block force pushes"
+    out = []
+    if cerr and not none:
+        out.append(nc("default branch protection", why(cerr)))
+    if rerr:
+        out.append(nc("default branch rulesets", why(rerr)))
+        if none:
+            out.append(("default branch has no classic protection rule (rulesets not checked)", "high", fix))
+    if (cerr and not none) or rerr:
+        return out
+    if none and not rules:
+        return [("default branch has no protection (no classic rule, no ruleset)", "high", fix)]
+    classic = {} if none else classic
+    force = none or dig(classic, "allow_force_pushes", "enabled") is True
+    counts = [dig(classic, "required_pull_request_reviews", "required_approving_review_count")]
+    checks = bool(dig(classic, "required_status_checks", "contexts") or dig(classic, "required_status_checks", "checks"))
+    for r in rules:
+        t = dig(r, "type")
+        if t == "pull_request":
+            counts.append(dig(r, "parameters", "required_approving_review_count"))
+        elif t == "non_fast_forward":
+            force = False
+        elif t == "required_status_checks" and dig(r, "parameters", "required_status_checks"):
+            checks = True
+    reviews = max([c for c in counts if isinstance(c, int)] or [0])  # the strictest source wins; none given = 0
+    if force:
+        out.append(("force pushes allowed on the default branch", "high",
+                    "block force pushes (allow_force_pushes off, or a non_fast_forward rule)"))
+    if reviews < 1:
+        out.append(("fewer than 1 required approving review on the default branch", "medium",
+                    "require at least 1 approving review (required_approving_review_count)"))
+    if not checks:
+        out.append(("no required status checks on the default branch", "medium", "require the CI checks that must pass before merge"))
+    if dig(classic, "enforce_admins", "enabled") is False:
+        out.append(("admins exempt from the default branch protection (enforce_admins off)", "low", "turn on enforce_admins"))
+    if rules:
+        out.append(nc("admins exempt from the rulesets", ("ruleset bypass lists are not read", "review each ruleset's bypass_actors")))
+    return out
+
+
+def actions(get, base):
+    """Rows from the repository's Actions permissions: token default, review approval, allowed actions."""
+    out = []
+    wf, e = read(get, base + "/actions/permissions/workflow", dict,
+                 need=(("default_workflow_permissions",), ("can_approve_pull_request_reviews",)))  # both required in the schema
+    if e:
+        out.append(nc("Actions workflow token", why(e)))
+    else:
+        if wf.get("default_workflow_permissions") == "write":
+            out.append(("default workflow token has write permission", "medium",
+                        "set default_workflow_permissions to read and grant write per workflow with `permissions:`"))
+        if wf.get("can_approve_pull_request_reviews") is True:
+            out.append(("workflows can approve pull request reviews", "medium", "set can_approve_pull_request_reviews to false"))
+    ap, e = read(get, base + "/actions/permissions", dict, need=(("enabled",),))  # `allowed_actions` is optional: see below
+    if e:
+        out.append(nc("allowed actions", why(e)))
+    elif ap.get("allowed_actions") == "all":
+        out.append(("all actions and reusable workflows are allowed", "low",
+                    "set allowed_actions to selected or local_only and list the allowed actions"))
+    elif ap["enabled"] is not False and ap.get("allowed_actions") not in ("selected", "local_only"):
+        out.append(nc("allowed actions", NOT_REPORTED))  # Actions is on but the reply carries no policy; off needs none
+    return out
+
+
+def collaborators(get, base):
+    """One row with the admin and outside-collaborator counts: low when any are outside, else info."""
+    n = {}
+    for k, params in (("admin", {"permission": "admin"}), ("outside", {"affiliation": "outside"})):
+        items, e = listing(get, base + "/collaborators", params)
+        if e:
+            return [nc("collaborators", why(e))]
+        n[k] = len(items)
+    return [("collaborators: %d admin, %d outside" % (n["admin"], n["outside"]), "low" if n["outside"] else "info",
+             "keep admin to the few who need it; remove outside collaborators who no longer need access")]
+
+
+def deploy_keys(get, base):
+    """A row when any deploy key can write (count only; titles and keys are never read out)."""
+    keys, e = listing(get, base + "/keys", need=(("read_only",),))
+    if e:
+        return [nc("deploy keys", why(e))]
+    n = sum(1 for k in keys if k["read_only"] is False)
+    return [("%d deploy key(s) with write access" % n, "medium", "replace each with a read-only key unless it must push")] if n else []
+
+
+def webhooks(get, base):
+    """Rows for webhooks that skip TLS verification or deliver over plain http (counts only; URLs are never read out)."""
+    hooks, e = listing(get, base + "/hooks", need=(("config", "url"), ("config", "insecure_ssl")))
+    if e:
+        return [nc("webhooks", why(e))]
+    off = sum(1 for h in hooks if str(h["config"]["insecure_ssl"]) == "1")
+    plain = sum(1 for h in hooks if str(h["config"]["url"]).startswith("http://"))
+    return ([("%d webhook(s) with TLS verification off (insecure_ssl)" % off, "medium", "set insecure_ssl to 0")] if off else []) + \
+           ([("%d webhook(s) delivering over plain http" % plain, "medium", "switch the payload URL to https")] if plain else [])
+
+
+def environments(get, base):
+    """A row when any deployment environment has no protection rule (reviewers, wait timer or branch policy)."""
+    envs, e = listing(get, base + "/environments", key="environments")
+    if e:
+        return [nc("environments", why(e))]
+    n = sum(1 for v in envs if not dig(v, "protection_rules"))
+    return [("%d environment(s) without protection rules" % n, "low",
+             "add required reviewers, a wait timer or a deployment branch policy to each")] if n else []
+
+
+def analysis(repo):
+    """Secret scanning and push protection from the repository object's `security_and_analysis` (admin-only field)."""
+    sa = dig(repo, "security_and_analysis")
+    if not sa or not isinstance(sa, dict):
+        return [nc("secret scanning and push protection", NEEDS_ADMIN)]
+    out = []
+    for key, what, sev in (("secret_scanning", "secret scanning", "medium"), ("secret_scanning_push_protection", "push protection", "low")):
+        st = dig(sa, key, "status")
+        if st is None:
+            out.append(nc(what, NOT_REPORTED))
+        elif st != "enabled":
+            out.append(("%s not enabled" % what, sev, "set security_and_analysis.%s.status to enabled (a private or internal "
+                        "organization repository needs GitHub Secret Protection)" % key))
+    return out
+
+
+def audit(slug, get=gh_get):
+    """Rows {repo, check, severity, fix} for one OWNER/NAME, worst first. `get(path, params=None)` -> parsed JSON or
+    raises OSError (default `gh_get`; tests inject a fake). A repository the token cannot read gives one not-checked
+    row; a failed check gives its own and never stops the others. Never raises on a failed or odd reply."""
+    base = "/repos/" + slug
+    repo, e = read(get, base, dict)
+    if e:
+        rows = [nc("repository", why(e, NOT_FOUND))]
+    else:
+        rows = [r for part in (protection(get, base, repo), actions(get, base), collaborators(get, base), deploy_keys(get, base),
+                               webhooks(get, base), environments(get, base), analysis(repo)) for r in part]
+    rows.sort(key=lambda r: SEVERITY.index(r[1]))  # stable: checks keep their order within a severity
+    return [{"repo": slug, "check": c, "severity": s, "fix": f} for c, s, f in rows]
+
+
+def render(rows, repos):
+    """Table (repo | severity | check | fix) plus a summary line; `--json` prints the same rows and counts."""
+    n_find = sum(1 for r in rows if r["severity"] in FINDING)
+    n_nc = sum(1 for r in rows if r["severity"] == "not-checked")
+    lines = ["| repo | severity | check | fix |", "|---|---|---|---|"]
+    lines += ["| %(repo)s | %(severity)s | %(check)s | %(fix)s |" % r for r in rows]
+    lines.append("\n%d repos, %d findings, %d not checked" % (repos, n_find, n_nc))
+    return "\n".join(lines), {"repos": repos, "findings": n_find, "not_checked": n_nc}
+
+
+def main(argv=None, get=gh_get):
+    ap = argparse.ArgumentParser(description=__doc__.split("\n")[0])
+    ap.add_argument("repos", nargs="*", metavar="OWNER/NAME")
+    ap.add_argument("--repos-file", help="file with one OWNER/NAME per line (blank lines and # comments ignored)")
+    ap.add_argument("--json", action="store_true", help="print JSON instead of a table")
+    a = ap.parse_args(argv)
+    names = list(a.repos)
+    if a.repos_file:
+        try:
+            with open(a.repos_file, encoding="utf-8") as f:
+                names += [ln.split("#", 1)[0].strip() for ln in f]
+        except (OSError, UnicodeDecodeError) as e:
+            pp.die("cannot read --repos-file: %s" % (getattr(e, "strerror", None) or "not UTF-8 text"))
+    slugs = {}  # lower-cased slug -> first spelling: a repository twice is audited once
+    for s in filter(None, names):
+        if not SLUG.fullmatch(s):
+            pp.die("not an OWNER/NAME slug: %r" % s)
+        slugs.setdefault(s.lower(), s)
+    if not slugs:
+        pp.die("no repositories: pass OWNER/NAME or --repos-file")
+    if get is gh_get and not shutil.which("gh"):
+        pp.die("gh not found on PATH")
+    rows = [r for s in slugs.values() for r in audit(s, get)]
+    text, summary = render(rows, len(slugs))
+    print(json.dumps({"rows": rows, "summary": summary}, indent=2) if a.json else text)
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())
diff --git a/.claude/skills/deep-code-review/INDEX.md b/.claude/skills/deep-code-review/INDEX.md
index 1bc7571c9..4f88105bc 100644
--- a/.claude/skills/deep-code-review/INDEX.md
+++ b/.claude/skills/deep-code-review/INDEX.md
@@ -106,7 +106,7 @@ Generated by `scripts/skill_index.py` (do not hand-edit; rerun it after changing
 | `references/nextjs-app-router.md` | next is a dependency (probe: grep '"next"' package.json) and the code uses the App Router (app/). | 537 |
 | `references/observability.md` | reviewing logging, metrics, traces, dashboards, alerting, audit trails, or "could we tell this brok… | 4860 |
 | `references/overlays.md` | recommending or installing an overlay, or wiring this skill's gates into a target's CI. | 359 |
-| `references/parallel-audit.md` | the target is large enough to review across parallel subagents (a FULL run of a large repo, or seve… | 9948 |
+| `references/parallel-audit.md` | the target is large enough to review across parallel subagents (a FULL run of a large repo, or seve… | 10167 |
 | `references/performance-db-cost.md` | the target has a database, makes external/API/LLM calls, runs batch jobs, or has any hot path where… | 7774 |
 | `references/performance-latency-depth.md` | the target has a server request handler, page loader or resolver that assembles one response from s… | 3364 |
 | `references/privacy-by-design.md` | the product will face a privacy-regulated user (EU/UK, California, children, and the like) or an en… | 1231 |
@@ -138,7 +138,7 @@ Generated by `scripts/skill_index.py` (do not hand-edit; rerun it after changing
 | `references/testing-ui.md` | the target renders a UI or ships browser / E2E specs. | 4868 |
 | `references/threat-modeling.md` | a change adds a trust boundary, an auth path, a data flow to a new party, an agent or tool capabili… | 2574 |
 | `references/time-date-correctness.md` | reviewing anything that stores, computes, schedules, or renders timestamps, durations, recurring ev… | 4809 |
-| `references/tool-hub.md` | a review should lean on external scanners via the tool hub (workflows, Python, Go, SBOM/lockfiles,… | 3613 |
+| `references/tool-hub.md` | a review should lean on external scanners via the tool hub (workflows, Python, Go, SBOM/lockfiles,… | 3842 |
 | `references/ux-components.md` | the target or diff renders one concept in more than one place: a shared component or design token,… | 7235 |
 | `references/ux-dataviz.md` | the target or diff renders a chart, sparkline, heat-map or calendar grid, a KPI / metric delta, a c… | 2787 |
 | `references/ux-gates.md` | a UI change is claimed verified on screenshot evidence, the project's auto-merge or CI policy gates… | 3756 |
diff --git a/.claude/skills/deep-code-review/references/parallel-audit.md b/.claude/skills/deep-code-review/references/parallel-audit.md
index 4b801f462..1900046fd 100644
--- a/.claude/skills/deep-code-review/references/parallel-audit.md
+++ b/.claude/skills/deep-code-review/references/parallel-audit.md
@@ -527,6 +527,16 @@ the fan-out's *shape***, reported **once** with a remedy — not one finding per
 - **Keep a documented one-command local full suite,** and require the **labelled full
   run** before merging an app change — the cheap gate speeds iteration without becoming
   the merge bar.
+- **Before a fix lane pushes, list the CI jobs its diff will fire.** Run
+  `python3 .claude/skills/deep-code-review/scripts/ci_cost_advisor.py <repo-dir> --diff <base>`,
+  with `<base>` the branch the PR targets, such as `origin/development`: `branches:` filters are
+  matched against it, and a sha or tag base tags each job such a filter gates
+  `(branches: unchecked)`. Every `pull_request` job the committed diff triggers (path filters
+  applied) prints with its `run:` lines; a job that builds an image, starts containers or has
+  `services:` is tagged `[runtime]`. Workflows on `push`, `merge_group` or `workflow_run` are only
+  named. Run each listed job locally, or name it `left to CI` under the PR body's `How to verify`;
+  a green unit run proves nothing about a `[runtime]` job, so a Dockerfile-only fix can pass every
+  local test and still break the image job.
 - **One canonical path→gate manifest when more than one surface routes by path.** CI `paths:`
   filters, a pre-push/pre-commit hook's file scoping, and the local suite's "which gates for
   which files" each encode the *same* **path→required-gates** map (which globs are gated areas and
diff --git a/.claude/skills/deep-code-review/references/tool-hub.md b/.claude/skills/deep-code-review/references/tool-hub.md
index a617d7159..c30492941 100644
--- a/.claude/skills/deep-code-review/references/tool-hub.md
+++ b/.claude/skills/deep-code-review/references/tool-hub.md
@@ -59,6 +59,12 @@ pinact (`pinact run`) is the fixer for unpinned-action findings; it needs the Gi
 - Exit 0 verdict printed; 1 hyperfine missing (`NOT CHECKED: hyperfine (install: brew install hyperfine)` on stderr, never a clean result) or the run failed (checkout, CMD or an unsupported export); 2 refused usage. The worktree is removed on exit and on HUP, INT or TERM.
 - `heavy_gate.py` holds a run while the machine is busy. Start it on an idle machine and repeat: one verdict is a lead.
 
+## Repo settings (own script, not run by `review_checks.sh`)
+
+| Tool | Covers | Command shape | Flags | Class |
+|---|---|---|---|---|
+| `repo_settings_audit.py` | Default-branch protection and rulesets, Actions token settings, collaborator counts, write deploy keys, insecure webhooks, unprotected environments, secret scanning; a 403 or 404 is `not checked`, never clean | `python3 .claude/skills/agentic-delivery/scripts/repo_settings_audit.py OWNER/NAME... [--repos-file FILE] [--json]` | own script, read-only GETs; fields read from the GitHub docs 2026-10-30. OSS options (READMEs read 2026-10-30, not run): `legitify` (`SCM_TOKEN=... legitify analyze --org ORG`; needs an `admin:org` token, fine-grained tokens unsupported) and OpenSSF Scorecard (some Branch-Protection settings need an admin token; `supply_chain_check.sh --scorecard owner/repo` runs it for a public repo) | own; OSS options route-only |
+
 ## Route-only skills (opt-in, never vendored)
 
 | Skill | License note | Rule |
diff --git a/.claude/skills/deep-code-review/scripts/ci_cost_advisor.py b/.claude/skills/deep-code-review/scripts/ci_cost_advisor.py
index 60d22c647..484a6784f 100644
--- a/.claude/skills/deep-code-review/scripts/ci_cost_advisor.py
+++ b/.claude/skills/deep-code-review/scripts/ci_cost_advisor.py
@@ -51,6 +51,21 @@
 cron, big matrices to weekly or local. The after-numbers re-price the PATCHED workflow text (one model, no second
 formula), then add "push each PR once" and "required checks cost `--cheap-minutes`".
 
+`--diff BASE` asks a different question: which CI jobs will THIS change start? A Dockerfile-only fix can pass every
+unit test and still break an image job (`docker compose up --wait`) that no local check ran. It lists every
+`pull_request` / `pull_request_target` job that the committed diff `BASE...HEAD` fires, with its `run:` lines (a
+backslash-continued command or a folded `run: >` body on one line), and tags `[runtime]` a job that builds an image or
+starts containers (`docker build|buildx|run`, `docker compose up|run|build`, `build-push-action`, `bake-action`, a
+`services:` or `container:` key), which a unit-test run never exercises. The same `types` and `paths`/`paths-ignore`
+filters as the cost model apply. A `branches` filter is matched against the branch BASE names (`dev`, `origin/dev` and
+`refs/remotes/origin/dev` are all `dev`; `--default-branch` is not used). A BASE that is no branch (a sha, a tag)
+cannot be matched, so its jobs are listed, never dropped, and each one a `branches` filter would have gated is tagged
+`(branches: unchecked)`. `push`, `schedule` and manual triggers never start a job here; one last line names the
+workflows on `push`, `merge_group` or `workflow_run` (not evaluated). A job `if:` is shown, not evaluated; a
+reusable-workflow call or a local action (`uses: ./...`) shows its `uses:` (its own steps are not read); a workflow the
+parser cannot read, or that has no readable `on:` (a BOM before it, say), and names `pull_request` is listed UNPARSED,
+never skipped. Offline and read-only.
+
 USAGE
 -----
   ci_cost_advisor.py [ROOT] [--visibility auto|public|private] [--plan free|pro|team|enterprise]
@@ -60,10 +75,13 @@
   ci_cost_advisor.py ROOT --decide                prints `local-first` or `cloud` (reason on stderr); the
                                                   `auto` mode of policy key `ci` (perun_policy.py ci)
   ci_cost_lint.py --advise ROOT                   the lint's findings, then this report
+  ci_cost_advisor.py ROOT --diff BASE             the pull_request jobs the committed diff BASE...HEAD fires, with their
+                                                  run lines (ROOT is the repo directory; `--repo` is OWNER/REPO, not a path;
+                                                  BASE is the branch the PR targets, e.g. origin/main)
 
 Visibility `auto` reads the `origin` remote and sends one unauthenticated HEAD to github.com (200 public, 404
 private or missing; cached 24h under the git dir). Anything unresolved is treated as private: the billable case.
-Exit 0; 2 when ROOT does not exist.
+Exit 0; 2 when ROOT does not exist or, with `--diff`, BASE...HEAD cannot be diffed.
 """
 from __future__ import annotations
 
@@ -76,6 +94,7 @@
 import re
 import subprocess
 import sys
+import textwrap
 import time
 import urllib.error
 import urllib.request
@@ -102,6 +121,7 @@
 AUTO_LOCAL_FRACTION = 0.5  # `ci: auto` goes local-first at >= this share of the plan's included minutes
 MAX_SKIP_SHARE = 0.5  # never propose a path filter that would have skipped more than this share of recent PRs
 DOC_GLOBS = ("**.md", "docs/**", "LICENSE")
+_PR_OPEN = {"opened", "reopened", "ready_for_review"}  # `pull_request` activity types that start a run on a new PR (a push adds `synchronize`)
 # Grouped per PR number and per run id otherwise: only a superseded PR run is cancelled; push and schedule runs
 # never share a group, so none is replaced while pending (a shared group would drop intermediate main runs).
 CONCURRENCY = "concurrency:\n  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}\n  cancel-in-progress: true\n"
@@ -130,12 +150,15 @@ class Ctx:
 
 @lru_cache(maxsize=512)
 def _tokens(pat: str) -> tuple:
-    """A filter pattern as ((char predicate, repeat), ...), repeat one of "", "?", "+", "*"."""
+    """A filter pattern as ((char predicate, repeat), ...), repeat one of "", "?", "+", "*", or "**/": a never-matching marker
+    placed before a path-segment-leading `**` that is followed by `/`, so that `**` and `/` (the next two tokens) may vanish."""
     toks, i = [], 0
     while i < len(pat):
         c = pat[i]
         if c == "*":
             two = pat.startswith("**", i)
+            if two and pat.startswith("/", i + 2) and (i == 0 or pat[i - 1] == "/"):  # `**/` also matches no directory (the cheat sheet's `**/README.md` matches `README.md`)
+                toks.append((lambda ch: False, "**/"))
             toks.append(((lambda ch: True) if two else (lambda ch: ch != "/"), "*"))
             i += 2 if two else 1
         elif c in "?+" and toks and toks[-1][1] == "":
@@ -155,16 +178,18 @@ def _tokens(pat: str) -> tuple:
 @lru_cache(maxsize=1 << 16)
 def _glob(pat: str, s: str) -> bool:
     """GitHub filter-pattern match of the whole string (the "Filter pattern cheat sheet": `*` no slash, `**` anything,
-    `?`/`+` quantify the previous character, `[..]` a class). An NFA walk, O(pattern x string): a hostile pattern in a
-    scanned repo cannot cause regex backtracking."""
+    a segment-leading `**/` also no directory, `?`/`+` quantify the previous character, `[..]` a class). An NFA walk,
+    O(pattern x string): a hostile pattern in a scanned repo cannot cause regex backtracking."""
     toks = _tokens(pat)
 
-    def close(states):  # skip over optional tokens
-        out = set(states)
-        for i in states:
-            while i < len(toks) and toks[i][1] in ("?", "*"):
-                i += 1
-                out.add(i)
+    def close(states):  # skip over optional tokens; a `**/` marker may also skip the `**` and `/` after it
+        out, todo = set(states), list(states)
+        while todo:
+            i = todo.pop()
+            for j in {"?": (i + 1,), "*": (i + 1,), "**/": (i + 1, i + 3)}.get(toks[i][1] if i < len(toks) else "", ()):
+                if j not in out:
+                    out.add(j)
+                    todo.append(j)
         return out
 
     cur = close({0})
@@ -329,7 +354,7 @@ def monthly_runs(on: dict, ctx: Ctx, pushes: float) -> tuple[dict, list]:
         if ev in ("pull_request", "pull_request_target"):
             if _branch_ok(d, ctx.default_branch):
                 types = set(d.get("types") or [])
-                first = 1 if not types or types & {"opened", "reopened", "ready_for_review"} else 0
+                first = 1 if not types or types & _PR_OPEN else 0
                 more = pushes - 1 if not types or "synchronize" in types else 0
                 runs[ev] = ctx.prs * _share(d, ctx) * (first + more)
         elif ev == "push":
@@ -756,6 +781,129 @@ def report(root: str, texts: dict, ctx: Ctx, vis: tuple, notes: list) -> int:
     return 0
 
 
+# ---- --diff: the pull_request jobs a change starts -----------------------------------------------------------
+
+# A job whose lines build an image or start containers needs a container runtime that a unit-test or lint run never uses
+# (a job with `services:` or `container:` does too; `diff_jobs` checks those keys).
+_RUNTIME = re.compile(r"\bdocker\s+(?:build|buildx|run)\b|\bdocker(?:\s+|-)compose\b.*\b(?:up|run|build)\b|\b(?:build-push|bake)-action\b", re.I)
+_BLOCK = re.compile(r"(\s*(?:-\s+)?)run:\s*([|>])[+\-0-9]*(?:\s+#.*)?\s*$")  # `run: |`, `- run: >-` ...; group 1 = text before the key, 2 = literal or folded
+
+
+def _blocks(text: str) -> tuple[str, dict]:
+    """(text, {token: body}): each `run: |` or `run: >` block body replaced by a one-line token, because the lint's parser drops
+    block bodies and `run:` lines are the point here. The body is every following blank or deeper-indented line; a folded
+    (`>`) body has the lines of a paragraph joined by a space, as YAML folds them."""
+    out, bodies, lines, i = [], {}, text.split("\n"), 0
+    while i < len(lines):
+        m = _BLOCK.match(lines[i])
+        i += 1
+        if not m:
+            out.append(lines[i - 1])
+            continue
+        body = []
+        while i < len(lines) and (not lines[i].strip() or len(lines[i]) - len(lines[i].lstrip()) > len(m.group(1))):
+            body.append(lines[i])
+            i += 1
+        tok = f"RUN-BLOCK-{len(bodies)}"
+        bodies[tok] = textwrap.dedent("\n".join(body))
+        if m.group(2) == ">":
+            bodies[tok] = re.sub(r"(?<=\S)[ \t]*\n(?=\S)", " ", bodies[tok])
+        out.append(f"{m.group(1)}run: {tok}")
+    return "\n".join(out), bodies
+
+
+def _pr_fires(on: dict, files: list, branch: str | None) -> tuple[bool, bool]:
+    """(starts?, its `branches` filter went unchecked) for a PR into `branch` that changes `files`, under this normalized
+    `on:`. Same filters as `monthly_runs`: activity `types` (a push is `synchronize`), `branches`, `paths` / `paths-ignore`.
+    `branch` None (the base is no branch) skips the branch filter instead of guessing: the job is kept and flagged."""
+    for ev in ("pull_request", "pull_request_target"):
+        if ev in on:
+            # a lone string filter (`paths: src/**`) is one pattern; the shared helpers would read it character by character
+            d = {k: [v] if isinstance(v, str) else v for k, v in (on[ev] if isinstance(on[ev], dict) else {}).items()}
+            types = set(d.get("types") or [])
+            if (not types or types & (_PR_OPEN | {"synchronize"})) and _path_triggers(d, files) and (branch is None or _branch_ok(d, branch)):
+                return True, branch is None and bool(d.get("branches") or d.get("branches-ignore"))
+    return False, False
+
+
+def _job_lines(job: dict, bodies: dict) -> list:
+    """The job's run lines in step order (a backslash-continued command joined to one line, so `_RUNTIME` sees all of it), plus
+    any `uses:` that builds an image or is a local action, the job's own reusable-workflow call, and its `container:` image
+    and `services:` names."""
+    out = [f"uses: {job['uses']}"] if "uses" in job else []
+    c = job.get("container")
+    if c:
+        out.append(f"container: {c.get('image') if isinstance(c, dict) else c}")
+    if job.get("services"):
+        out.append("services: " + ", ".join(job["services"] if isinstance(job["services"], dict) else [str(job["services"])]))
+    for s in job.get("steps") or []:
+        if isinstance(s, dict):
+            uses = str(s.get("uses") or "")
+            if uses.startswith("./") or _RUNTIME.search(uses):
+                out.append(f"uses: {uses}")
+            run = str(s.get("run") or "")
+            out += [ln.rstrip() for ln in re.sub(r"\s*\\\r?\n\s*", " ", bodies.get(run, run)).splitlines() if ln.strip()]
+    return out
+
+
+def diff_jobs(texts: dict, files: list, branch: str | None) -> tuple[list, list, list]:
+    """(jobs, unreadable, other): `jobs` is [(workflow path, job id, [lines], runtime?, branches unchecked?, `if:` or None)] for the
+    jobs that a pull_request into `branch` (None: unknown) changing `files` starts. Only `pull_request` / `pull_request_target`
+    start a job (never push, schedule or manual). `unreadable` is [(path, why)]: a workflow that cannot be parsed, or has no
+    readable `on:`, and names `pull_request` is never dropped. `other` is the paths of the workflows that did not start but
+    are on `push`, `merge_group` or `workflow_run`, which this mode does not evaluate."""
+    jobs, bad, other = [], [], []
+    for path, text in texts.items():
+        try:
+            src, bodies = _blocks(text)
+            wf = lint.parse_workflow_yaml(src)
+            on = lint._normalize_on(wf.get("on"))
+            if not on and "pull_request" in text:  # e.g. a BOM turns the key into "\ufeffon"; an unread trigger must not read as "no jobs"
+                raise ValueError("no readable `on:` trigger")
+            fires, unchecked = _pr_fires(on, files, branch)
+            if fires:
+                for jid, job in (wf.get("jobs") or {}).items():
+                    if isinstance(job, dict):
+                        lines = _job_lines(job, bodies)
+                        runtime = bool(job.get("services") or job.get("container")) or any(_RUNTIME.search(ln) for ln in lines)
+                        jobs.append((path, jid, lines, runtime, unchecked, job.get("if")))
+            elif {"push", "merge_group", "workflow_run"} & set(on):
+                other.append(path)
+        except Exception as exc:  # fail closed like `estimate`: a workflow that cannot be read may still run
+            if "pull_request" in text:
+                bad.append((path, str(exc)))
+    return jobs, bad, other
+
+
+def _pr_base(root: str, base: str) -> str | None:
+    """The branch a PR that targets `base` is opened against: `main`, `origin/main` and `refs/remotes/up/main` are all `main`.
+    None when `base` is no branch (a sha, a tag, `HEAD~2`)."""
+    m = re.fullmatch(r"refs/(?:heads|remotes/[^/]+)/((?!HEAD$).+)", (_git(root, "rev-parse", "--symbolic-full-name", base) or "").strip())
+    return m.group(1) if m else None
+
+
+def report_diff(root: str, base: str, texts: dict) -> int:
+    """Print the pull_request jobs the committed diff `base...HEAD` fires, each with its run lines. Exit 2 (nothing on
+    stdout) when the diff cannot be taken: "no jobs" must never be the answer to a bad ref. Offline, read-only."""
+    out = None if not base or base.startswith("-") else _git(root, "diff", "--name-only", "--no-renames", "-z", f"{base}...HEAD")  # `-`: never a git option
+    if out is None:
+        print(f"ci_cost_advisor: cannot diff {base!r}...HEAD in {root} (not a git repo, or no such ref)", file=sys.stderr)
+        return lint.ERROR
+    files = [f for f in out.split("\0") if f]
+    jobs, bad, other = diff_jobs(texts, files, _pr_base(root, base)) if files else ([], [], [])
+    print(f"{len(files)} changed file(s) vs {base}: {len(jobs)} pull_request job(s) fire. Run each locally or name it `left to CI`;"
+          " `[runtime]` builds an image or starts containers (needs Docker).")
+    for path, jid, lines, runtime, unchecked, cond in jobs:
+        print(f"{path}: {jid}" + (" [runtime]" if runtime else "") + (" (branches: unchecked)" if unchecked else "") + (f" (if: {cond})" if cond else ""))
+        for ln in lines:
+            print(f"    {ln}")
+    for path, why in bad:
+        print(f"UNPARSED {path}: {why}; it names pull_request, so check it by hand")
+    if other:
+        print("not listed (they start on push, merge_group or workflow_run; not evaluated): " + ", ".join(os.path.basename(p) for p in other))
+    return 0
+
+
 def main(argv: list | None = None) -> int:
     p = argparse.ArgumentParser(description="Estimate GitHub Actions minutes and dollars and print a local-first plan with a ready patch. Never edits a workflow.")
     p.add_argument("root", nargs="?", default=".", help="repository root (expects .github/workflows/)")
@@ -772,6 +920,7 @@ def main(argv: list | None = None) -> int:
     p.add_argument("--doc-glob", action="append", metavar="GLOB", help="doc-only path pattern (default: **.md, docs/**, LICENSE); repeatable")
     p.add_argument("--decide", action="store_true", help="print local-first or cloud (reason on stderr) for policy `ci: auto`")
     p.add_argument("--patch", action="store_true", help="print only the unified diff")
+    p.add_argument("--diff", metavar="BASE", help="list the pull_request jobs the committed diff BASE...HEAD fires, with their run lines; BASE is the branch the PR targets (its `branches` filters match it; a sha cannot be matched); [runtime] marks image builds and container starts (offline, read-only)")
     a = p.parse_args(argv)
     try:
         texts = lint.load_workflows(a.root)
@@ -782,6 +931,8 @@ def main(argv: list | None = None) -> int:
         top = (_git(a.root, "rev-parse", "--show-toplevel") or "").strip()
         if top and os.path.isdir(os.path.join(top, ".github", "workflows")):
             a.root, texts = top, lint.load_workflows(top)
+    if a.diff is not None:  # before the visibility probe and any gh call: this mode never touches the network (`--diff ""` is an error, not the cost report)
+        return report_diff(a.root, a.diff, texts)
     mins = {"*": 5.0}
     for it in a.job_minutes:
         key, sep, val = it.rpartition("=")
diff --git a/SHA256SUMS b/SHA256SUMS
index 33a22ac5e..b4eed95a1 100644
--- a/SHA256SUMS
+++ b/SHA256SUMS
@@ -18,9 +18,9 @@ ef9e423362b12d0dd73c8e165faf32e9f53c4d4ac215b57c2e34002a88713838  .claude/skills
 71def6259e7016301932ac474dd4b7afea29349a8dd0b6284d74b5e9ebd16936  .claude/skills/agentic-ceo/scripts/token_ratchet.py
 372f7d86157392ebfab627f6a05a892e4dd3297db9b8bfc6f404759169c7500c  .claude/skills/agentic-ceo/scripts/token_report.py
 9521b057ff3db92d1e60923ebd88170713914f7e235ceb45717eb39419daf811  .claude/skills/agentic-ceo/scripts/weekly_receipt.py
-bb2f134ab9b07e2cf15c4c8a0fad4708bc398144195178960d63b8ea6fd4a2d4  .claude/skills/agentic-delivery/INDEX-scripts.md
-5d66d96d22947e0528fd3f337f789d3a8445dfeeb8240b41fe28303aa5a5c8ad  .claude/skills/agentic-delivery/INDEX.md
-4d303d0acad9e15f50bedebc2dbae988b3ac1e47a32c168813ab43e8203085bd  .claude/skills/agentic-delivery/SKILL.md
+001b7b0a350ff5b7d4e5b85ca2bc6060514410377461a4def7579a92ab7f187a  .claude/skills/agentic-delivery/INDEX-scripts.md
+29ffa479167c28a166aa0fe2cf189bb12335186256e391eccec68208fd5b36a0  .claude/skills/agentic-delivery/INDEX.md
+d21c5d4d2e5ce1106cd7ea0a3c6a23ba96b65d1c7712e51ed612d5b0e2d3cf70  .claude/skills/agentic-delivery/SKILL.md
 b2dcfd5d3e07a7f9fd383376ed4d95e26fe3af6a279f147f48aa6a2e4c7106b3  .claude/skills/agentic-delivery/VERSION
 94144c101f82399eb6c18f688321a00e1c195dd0ab334f3a5daa2543b40ff9f5  .claude/skills/agentic-delivery/evals/evals.json
 fba7699a2d0836b51b7c838d019b1f0cd20570522a362e8a32b8dacfb911298e  .claude/skills/agentic-delivery/evals/triggers.json
@@ -132,6 +132,7 @@ d9135da4b8af3e2aacc5de5edb28843d6370ced0185860f49afc5eca9918987f  .claude/skills
 7751faa8a51b96212785316fef3f3745ef486c98bfe7e4f6f43b071ee14d755b  .claude/skills/agentic-delivery/scripts/refix_gate.py
 65f54604f58fe814e3e9b3ee0343a8d8843a199b2803721328e70f2a86ae465f  .claude/skills/agentic-delivery/scripts/repeat_poll_guard.py
 3d947cd8311407cdfe680dc580fb56f560c281b58aebc8b1fd051b89e959f97e  .claude/skills/agentic-delivery/scripts/reply_cap.py
+c73d62555d50dd6409d38927ad8ad10b732ba24e009e35c493485ff9e2f5e50b  .claude/skills/agentic-delivery/scripts/repo_settings_audit.py
 413c2d01be5a64d85b1d2b6901404c634cba71c59bc55f397b08e88642d010dd  .claude/skills/agentic-delivery/scripts/restore_ledger.py
 4a6fb3e0620bf882a53698af6fbe0fa7b8c8d2e8bb4d9e457940f8a2980cbf35  .claude/skills/agentic-delivery/scripts/review_digest.py
 7a9d5796cfe88f55a94970bfb71e5de42e228a8c5f20171f66a2def877270d66  .claude/skills/agentic-delivery/scripts/review_gate.py
@@ -203,7 +204,7 @@ d98f3e4380da3496061ba63be7beebe75017ab4ee1734eda9a3e798e19007b0e  .claude/skills
 92d22cc5d0a60ba6bdb1f4a9b597823dec5b8412cec09a5be6cf93b3973f4226  .claude/skills/contribution/scripts/prefile_check.sh
 18f20db537ab784460ad33cf218f7a01ac0a172fc38413f14c0e19e1ce6821cc  .claude/skills/contribution/scripts/share_learning.py
 63e7d07ffa54b224a83abee280456f6a24dc8222b9b55f6e249b10ea0c7f5afc  .claude/skills/deep-code-review/INDEX-scripts.md
-251fb5029ebb1c672fdf66e56888e514c85ef6bddc675411d3dd8cb4edf2802b  .claude/skills/deep-code-review/INDEX.md
+848ddf8c618da617b98bbe76808e775e6ef4f25ccc71954a868a093411d5e9d4  .claude/skills/deep-code-review/INDEX.md
 a5bd5b6dc031e2d10a635c05b265c5766aab4ceb3cbd99c4b6e5215b17df4709  .claude/skills/deep-code-review/SKILL.md
 b2dcfd5d3e07a7f9fd383376ed4d95e26fe3af6a279f147f48aa6a2e4c7106b3  .claude/skills/deep-code-review/VERSION
 b97d95bc93cc23a8bc689e2e23db261a138367bcbc69d2f8a0452d5c2c6dfb68  .claude/skills/deep-code-review/evals/evals.json
@@ -308,7 +309,7 @@ fa28846f30a5bc94147a194832fb1da96832f03818ff74e84708a8d2f8321327  .claude/skills
 9fb5d5baceb7993e68b46c59efa82b4919bfbfbc70d4cfc510bc416c3c26c358  .claude/skills/deep-code-review/references/nextjs-app-router.md
 b6a253dc64fb6bc30f18e62421c0ff1fae24fa9f95d3765f94314cfd2df17d9b  .claude/skills/deep-code-review/references/observability.md
 d22260c6b6281656663111f6d2673a53fea3327f3396c5e4fd4a419735fc41d1  .claude/skills/deep-code-review/references/overlays.md
-0c278c040a88ec82cdb6572d4a9aee61d033c81229705fb5a3483112c97f0669  .claude/skills/deep-code-review/references/parallel-audit.md
+f62954f36179163e37b111a9cc156a0ad6b781c4e358ddd1c1573b95a330ec4e  .claude/skills/deep-code-review/references/parallel-audit.md
 b482362defbdf0b25ae4b5b91ef9410de80c34a36d6f2487fdc6cde7ee336efb  .claude/skills/deep-code-review/references/performance-db-cost.md
 85bf6b08fc890960452a77dc05a9df3b1ee42f026840b9ddb2f7052469b7f3bc  .claude/skills/deep-code-review/references/performance-latency-depth.md
 34baa1fa6c265df2849eb2669c190f4b89d835de1287f96945f29520f31db65b  .claude/skills/deep-code-review/references/privacy-by-design.md
@@ -340,7 +341,7 @@ a0ed7ad061b7e60230601ee9b38a00400841d6ddf3af386edbd4b34a981c9798  .claude/skills
 8581f0023aedc9e0a4dece61cb2ea876ca9ab57f6acda63ed16c9b54494a1bc8  .claude/skills/deep-code-review/references/testing-ui.md
 68df4819a34cbe23756eb19e9b513b9edcd675ad55da7d8c7624d95b124a9744  .claude/skills/deep-code-review/references/threat-modeling.md
 cf5218579b77d07ca49349165ab6d64c94b0145f61a4438cb09898a414793c68  .claude/skills/deep-code-review/references/time-date-correctness.md
-7ecbc85de05e551c2f01b194ff8eb0b9fd3975a6da857398c6866a84febe4ed3  .claude/skills/deep-code-review/references/tool-hub.md
+6211a88ef18f23b7f1dc23a9b6e1246efd2fd121107f77ef4a338041a54147f9  .claude/skills/deep-code-review/references/tool-hub.md
 bfda9dd8f0d1718725e0fb8c2d6890f4fc2742c9a0d7993112ecf459a3af9f9c  .claude/skills/deep-code-review/references/ux-components.md
 5e69c5a0c0ab8d94079f2f08e026bc0e700369c76cd7dfeee6e5c7c5c2f020bb  .claude/skills/deep-code-review/references/ux-dataviz.md
 68c40fe7134afac5fae125f107726136a911c67c1d4abdf0e4c627aee6751713  .claude/skills/deep-code-review/references/ux-gates.md
@@ -353,7 +354,7 @@ b7b85757362758f393b6ddaaafed0f8a5e5075c9a74b604d3a80fca0301bdd71  .claude/skills
 b05798db39365a53e913dee3910c1193de2560b00ef2ed47c91ec1608ce2a96f  .claude/skills/deep-code-review/references/web-render.md
 a125d270e13807ed494e48746d374b82318e9e04eeeafb3db004729938dee039  .claude/skills/deep-code-review/scripts/app_pentest.sh
 b4d0333271317c881d175dca1d06092cc1dd4859e33f0b375eb870a152a80e6c  .claude/skills/deep-code-review/scripts/binaries_gate.py
-59d4ba15b55581ef021a4866d64382660b5fbc6688e860102034ac14f897ba87  .claude/skills/deep-code-review/scripts/ci_cost_advisor.py
+47bb118346969518b3688f08fe1c28202d4b7c9d5ac8b7d09e1240af931121cb  .claude/skills/deep-code-review/scripts/ci_cost_advisor.py
 a0301aaa1b602fd8ca44955eaf66b17893905f99aee8fe7d8db0be981bcc25c2  .claude/skills/deep-code-review/scripts/ci_cost_lint.py
 ed0f0c1eebfdca4dcbaafbf5c2f7b5cc93884de38715b57db894e0f210a811f9  .claude/skills/deep-code-review/scripts/closes_lint.py
 88f14879c8cd1c5302aacb61a63bc0e8e50dcc50d43327809de097361e536f54  .claude/skills/deep-code-review/scripts/committed_personal_data.py
diff --git a/changelog.d/ci-jobs-for-diff.md b/changelog.d/ci-jobs-for-diff.md
new file mode 100644
index 000000000..ba70f8e50
--- /dev/null
+++ b/changelog.d/ci-jobs-for-diff.md
@@ -0,0 +1,8 @@
+### Added
+- `ci_cost_advisor.py ROOT --diff BASE`: lists every `pull_request` workflow job the committed diff `BASE...HEAD` fires, with its `run:` lines, so a fix lane knows which CI jobs to run locally (or name `left to CI`) before it pushes to a repo it does not own. It applies the same `types`, `branches`, `paths` and `paths-ignore` rules as the cost model, counts a renamed file under both its paths, reads a lone-string filter as one pattern, joins a backslash-continued command and a folded `run: >` body into one line, and tags a job that builds an image, starts containers or declares `services:` or `container:` (`docker build`, `docker buildx`, `docker compose up`, `build-push-action`) `[runtime]`. BASE is the branch the PR targets: `branches:` and `branches-ignore:` filters are matched against the branch BASE names (`dev`, `origin/dev` and `refs/remotes/origin/dev` all mean `dev`), never against `--default-branch`, so a repo whose PRs target `development` keeps its `development`-filtered jobs. A sha or tag BASE names no branch, so each job a branch filter gates is listed tagged `(branches: unchecked)` instead of dropped. A workflow the parser cannot read but that names `pull_request` (a BOM before `on:`, say) is listed as `UNPARSED` rather than dropped, and one last line names the workflows that start only on `push`, `merge_group` or `workflow_run`, which are not evaluated. An unusable BASE (unknown, empty or option-shaped) exits 2 with no job list. It is read-only and offline: it returns before the visibility probe and never calls the network. `DiffJobs` in `scripts/test_ci_cost_advisor.py` covers each rule.
+- One routed bullet in `references/parallel-audit.md` section 6: pass the branch the PR targets, run the listed jobs locally, or name each `left to CI` under the PR body's `How to verify`; a green unit run says nothing about a `[runtime]` job.
+
+### Fixed
+- A `**/` at the start of a path segment in a `paths:` filter now also matches no directory, as GitHub's filter pattern cheat sheet specifies, so `**/Dockerfile` matches a root `Dockerfile` (it still does not match `MyDockerfile`). The fix is in the glob matcher shared with the cost model, so the cost estimate stops dropping those workflows too. `Triggers` covers it, and the source and fetch date are logged in `docs/standards-index.md`.
+- `scripts/test_ci_cost_advisor.py` no longer leaves a `ci-advisor-test-*` directory in `$TMPDIR` on every run. Each temp dir now comes from one registry that `tearDownModule` removes, and `NoTempLeak` runs the whole file in a child process with a private `TMPDIR` and fails if anything is left behind.
+size-budget-raise: .claude/skills/deep-code-review/references/parallel-audit.md 39795→40669 one routed bullet: run the CI jobs a fix diff fires, or name them left to CI
diff --git a/changelog.d/repo-settings-audit.md b/changelog.d/repo-settings-audit.md
new file mode 100644
index 000000000..f4d8f50ca
--- /dev/null
+++ b/changelog.d/repo-settings-audit.md
@@ -0,0 +1,6 @@
+### Added
+- `.claude/skills/agentic-delivery/scripts/repo_settings_audit.py OWNER/NAME... [--repos-file FILE] [--json]`: a read-only audit of the GitHub settings a diff review cannot see. Per repository it reads the default branch's classic protection and rulesets together (no protection, force pushes allowed, fewer than 1 required review, no required checks, admins exempt), the Actions token default, review approval and allowed actions, collaborator counts (admins, outside), deploy keys with write, webhooks with `insecure_ssl` or plain http, environments without protection rules, and secret scanning and push protection. Each row is repo, check, severity and a one-line fix. A 403 or 404 is a `not checked (needs admin)` row, never a clean result; so is a reply that lacks a field the check reads, a list holding an item that is not an object, and a list of 1000 or more (lists, rulesets included, are read 100 a page). A 404 `Branch not protected` is a finding only when the repository reply shows `permissions.admin` true. The secret scanning and push protection fixes say a private or internal organization repository needs GitHub Secret Protection. Output is counts and booleans: no login, email, key title, hook URL or API message text is printed. It calls `pipeline_hub.gh_get` (bare `gh api` GETs, TLS fallback through `gh_rest.fallback`), so the getter is injectable, and it writes nothing. Exit 0 once the audit ran; 2 for a bad slug, no repository, an unreadable `--repos-file` or `gh` missing.
+- `scripts/test_repo_settings_audit.py` (55 offline tests on fictional acme/widgets fixtures, wired in `scripts/ci-tests.d/repo-settings-audit.sh`): every check, the not-checked rows (a 403 or 404, a missing field, an unreadable item, 1000 or more items), pagination, every wrong-shaped API reply (each must give a not-checked row, never a clean one), the privacy rule on text and JSON output, the CLI, and the default getter end to end through `gh api`.
+- A route row in `agentic-delivery/SKILL.md`, one `repo_settings_audit.py` row in `references/tool-hub.md` naming `legitify` (needs an `admin:org` token) and OpenSSF Scorecard as the OSS options, and the GitHub REST pages, the secret scanning and push protection pages, `legitify` and Scorecard sources with their 2026-10-30 fetch date in `docs/standards-index.md`.
+size-budget-raise: .claude/skills/agentic-delivery/SKILL.md 7202→7457 one route row for repo_settings_audit.py
+size-budget-raise: .claude/skills/deep-code-review/references/tool-hub.md 14455→15368 one Repo settings section holding the repo_settings_audit.py row and its OSS options
diff --git a/docs/INDEX.md b/docs/INDEX.md
index 0fab9f8f6..f9622ba65 100644
--- a/docs/INDEX.md
+++ b/docs/INDEX.md
@@ -23,7 +23,7 @@ Generated by `python3 .claude/skills/agentic-delivery/scripts/focus_kit.py docs-
 | `docs/scoreboard.md` | Perun scoreboard: Generated by scripts/scoreboard.py from committed results | 5143 |
 | `docs/security-heldout-table-1026/table.md` | Security held-out table, 2026-10-26: Generated by results.py (offline, $0, byte-identical on rerun). | 1847 |
 | `docs/self-improvement.md` | How Perun improves itself: Perun is improved by running Perun on Perun: its own review skill (deep-code-review), idea attack (idea-critic),… | 1268 |
-| `docs/standards-index.md` | Standards index: Every standard the skill relies on, split into what was verified by direct fetch for this release and what is referenced b… | 98826 |
+| `docs/standards-index.md` | Standards index: Every standard the skill relies on, split into what was verified by direct fetch for this release and what is referenced b… | 101855 |
 | `docs/team-install.md` | Team-wide install through a Claude Code plugin marketplace: This repository is its own marketplace (.claude-plugin/marketplace.json, name p… | 478 |
 | `docs/technical-overview.md` | Technical overview: you want the engineering detail that used to sit in the top-level README.md: the mechanisms table, the full "what you g… | 2288 |
 | `docs/token-cost-tips.md` | Token cost tips for teams: the biggest savings come from sending less context, using the cheapest model tier that clears its own gate, and… | 2127 |
diff --git a/docs/standards-index.md b/docs/standards-index.md
index 9ff6e3c3f..324aa9788 100644
--- a/docs/standards-index.md
+++ b/docs/standards-index.md
@@ -1673,6 +1673,7 @@ evaluation and its `[skip ci]` advice. Every row below was fetched on 2026-10-16
 | GitHub Docs — Skipping workflow runs | https://docs.github.com/en/actions/how-tos/manage-workflow-runs/skip-workflow-runs | Workflows triggered by `push` or `pull_request` are not triggered when the commit message of a push, or the HEAD commit of a pull request, contains `[skip ci]`, `[ci skip]`, `[no ci]`, `[skip actions]` or `[actions skip]` (or a `skip-checks: true` trailer); the instructions apply to those two events only. A workflow skipped this way, or by path or branch filtering, leaves its checks in a "Pending" state, and "A pull request that requires those checks to be successful will be blocked from merging." |
 | GitHub Docs — Troubleshooting required status checks | https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/collaborating-on-repositories-with-code-quality-features/troubleshooting-required-status-checks | Table "Handling skipped but required checks": a workflow skipped by path filtering, branch filtering or a commit message leaves its checks "Pending" and "block[s] merging" (fix: "Avoid requiring workflows that can be skipped"); a job skipped by a conditional "reports 'Success'". Successful check statuses are `success`, `skipped` and `neutral`. Basis for never proposing a path filter or `[skip ci]` for a required workflow. |
 | GitHub Docs — Workflow syntax for GitHub Actions | https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax | `paths`/`paths-ignore`: "When all the path names match patterns in `paths-ignore`, the workflow will not run. If any path names do not match patterns in `paths-ignore`, even if some path names match the patterns, the workflow will run."; in `paths` a matching `!` pattern after a positive match excludes the path and a later positive match includes it again; "Path patterns must match the whole path, and start from the repository's root"; with no changed files the workflow does not run; path filters are not evaluated for tag pushes. Filter pattern cheat sheet: `*` zero or more characters but not `/`; `**` zero or more of any character; `?` zero or one of the preceding character; `+` one or more of the preceding character; `[]` a character class; `!` at the start negates. `cancel-in-progress` may be an expression (`${{ !contains(github.ref, 'release/')}}` is the page's example). `jobs.<job_id>.timeout-minutes` default: 360. |
+| GitHub Docs — Workflow syntax, filter pattern cheat sheet (`**/`) and `pull_request` branches (`ci_cost_advisor.py --diff`) | https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax | Re-fetched 2026-10-30. "Patterns to match file paths" rows as the fetch tool quoted them: `'**/README.md'` is "A README.md file anywhere in the repository." and matches `README.md` and `js/README.md`; `docs/**/*.md` is "A file with a `.md` suffix anywhere in the `docs` directory." and matches `docs/README.md` and `docs/mona/hello-world.md`; `'**/docs/**'` matches `docs/hello.md`; `'**/*-post.md'` matches `my-post.md`; `'**/*src/**'` matches `my-src/code/js/app.js`. So a `**/` that starts a path segment also matches no directory, which `_glob` implements. Wildcard text: "`**`: Matches zero or more of any character." The `on.<pull_request|pull_request_target>.<branches|branches-ignore>` section reads "For example, the following workflow would run whenever there is a `pull_request` event for a pull request targeting:" followed by a branch list, and "The patterns defined in `branches` are evaluated against the Git ref's name." The text does not say "base branch" in so many words; "targeting" is the basis for matching a `pull_request` `branches` filter against the branch the PR targets. |
 
 **By name only (observed, not stated in the fetched docs):** an unauthenticated `HEAD https://github.com/<owner>/<repo>`
 answers 200 for a public repository (observed for this repository) and 404 for one that does not exist (observed);
@@ -1895,3 +1896,25 @@ Not fetched, by name only: the Homebrew formulae `gitleaks`, `trivy`, `osv-scann
 | GitHub Docs — repository roles for an organization | https://docs.github.com/en/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/repository-roles-for-an-organization | Fetched 2026-10-30 (twice, same rows), table "Permissions for each role": "Create, update, and delete GitHub Actions variables on GitHub.com" and the same "using the REST API" are Yes for Write, Maintain and Admin and No for Read and Triage. The rows do not separate repository from environment variables. Basis for "anyone with write access can create, update and delete repository variables" in the rule message. |
 | GitHub Docs — contexts | https://docs.github.com/en/actions/reference/workflows-and-actions/contexts | Fetched 2026-10-30, first 100000 of 113682 characters read: the `vars` context "contains custom configuration variables set at the organization, repository, and environment levels"; `github.actor` is "The username of the user that triggered the initial workflow run" and `github.triggering_actor` is "The username of the user that initiated the workflow run"; `vars` is available in `jobs.<job_id>.if`, `jobs.<job_id>.environment`, `jobs.<job_id>.steps.if`, `jobs.<job_id>.steps.run`, `jobs.<job_id>.steps.env` and `jobs.<job_id>.env`, and environment-level variables become available after the runner declares the environment. The last 13682 characters were not read. |
 | GitHub Docs — REST API for Actions variables | https://docs.github.com/en/rest/actions/variables | Fetched 2026-10-30: the repository and the environment create and update endpoints both say "Authenticated users must have collaborator access to a repository to create, update, or read variables." That wording names collaborator access, not `admin`, for environment variables, so it is looser than the how-to page above; the rule message cites only the how-to page's `admin` wording for creating an environment variable. No fine-grained token permission is named on the page. |
+
+## Verified by direct fetch (2026-10-30) — GitHub repository settings audit (`agentic-delivery/scripts/repo_settings_audit.py`, `references/tool-hub.md`)
+
+| Source | URL | What it grounds |
+|---|---|---|
+| GitHub Docs — REST API endpoints for branch protection | https://docs.github.com/en/rest/branches/branch-protection | Fetched 2026-10-30: the get-branch-protection response carries `required_status_checks` (`strict`, `contexts`, `checks[{context, app_id}]`), `enforce_admins.enabled`, `required_pull_request_reviews.required_approving_review_count` (0 to 6) and `allow_force_pushes.enabled`. The page documents only 200 and 404 ("Resource not found") for the GET, names no token permission, does not say what a token without admin gets for a protected branch, and does not mark `allow_force_pushes` or `enforce_admins` as required at the top level; its only admin statement is under the update call: "Protecting a branch requires admin or owner permissions to the repository." The message text `Branch not protected` is not on this page: the script's reading of that 404 rests on the hub4j issue below and on its rule that the 404 is a finding only when the repository object reports `permissions.admin` as true, so any other token gets `not checked`. A classic reply that lacks `allow_force_pushes.enabled` or `enforce_admins.enabled` is `not checked` too, since the page does not promise either. |
+| GitHub Docs — REST API endpoints for rules | https://docs.github.com/en/rest/repos/rules | Fetched 2026-10-30: `GET /repos/{owner}/{repo}/rules/branches/{branch}` returns an array of rules and leaves out rules of rulesets whose enforcement is `evaluate` or `disabled`; its only query parameters are `per_page` (default 30, at most 100) and `page` (default 1), so the script reads it 100 a page and treats a list that fills 10 pages as `not checked`. Each rule has `type` and `parameters`; the script reads `pull_request` (`required_approving_review_count`, 0 to 10), `required_status_checks` (an array of `{context, integration_id?}`) and `non_fast_forward` (no `parameters` shown). The page shows no `ruleset_id` or ruleset source on a rule. `bypass_actors` items have `actor_id`, `actor_type` and `bypass_mode` (`always`, `pull_request`, `exempt`); get-one returns `bypass_actors` only to a user with write access to the ruleset, and the page does not state the id of the Admin role. So the script does not read bypass lists: a `not checked` row says so whenever rulesets apply. |
+| GitHub Docs — REST API endpoints for GitHub Actions permissions | https://docs.github.com/en/rest/actions/permissions | Fetched 2026-10-30: `GET /repos/{owner}/{repo}/actions/permissions/workflow` returns `default_workflow_permissions` (`read` or `write`) and `can_approve_pull_request_reviews` (boolean); `GET /repos/{owner}/{repo}/actions/permissions` returns `enabled`, `allowed_actions` (`all`, `local_only`, `selected`), `selected_actions_url` and `sha_pinning_required`. `enabled` and both workflow fields are marked required; `allowed_actions` is not, and the page does not say it is left out when Actions is disabled. So the script treats a reply missing `enabled` or either workflow field as `not checked`, Actions enabled with no `allowed_actions` as `not checked`, and `enabled` false as needing no policy row. Classic tokens need the `repo` scope; only 200 is documented. |
+| GitHub Docs — REST API endpoints for collaborators | https://docs.github.com/en/rest/collaborators/collaborators | Fetched 2026-10-30: the list call takes `affiliation` (`outside`, `direct`, `all`, default `all`; `outside` is the outside collaborators of an organization-owned repository), `permission` (`pull`, `triage`, `triage_plus`, `push`, `maintain`, `admin`), `per_page` (at most 100) and `page`; items carry `permissions{pull, triage, push, maintain, admin}` and `role_name`. The caller needs write, maintain or admin on the repository (organization membership for an organization repository); documented statuses are 200 and 404. The script reads only the lengths of the `permission=admin` and `affiliation=outside` lists. |
+| GitHub Docs — REST API endpoints for deploy keys | https://docs.github.com/en/rest/deploy-keys/deploy-keys | Fetched 2026-10-30: `GET /repos/{owner}/{repo}/keys` items have `read_only` (boolean), `title`, `key` and `verified`; only 200 is documented and the access requirement is not stated. The script counts keys with `read_only` false and never reads a title or key. |
+| GitHub Docs — REST API endpoints for repository webhooks | https://docs.github.com/en/rest/repos/webhooks | Fetched 2026-10-30: `GET /repos/{owner}/{repo}/hooks` items carry `config` with `url`, `content_type`, `secret` and `insecure_ssl` (a string or a number); the create and update sections say `0` means SSL verification is performed and `1` means it is not. Documented statuses are 200 and 404 and the access requirement for the list is not stated. The script counts `insecure_ssl` equal to 1 and a `url` that starts with `http://`, and never prints a URL. |
+| GitHub Docs — REST API endpoints for deployment environments | https://docs.github.com/en/rest/deployments/environments | Fetched 2026-10-30: `GET /repos/{owner}/{repo}/environments` returns `{total_count, environments[]}`; each environment has `protection_rules[]` (a wait timer, a reviewers rule, and a bare `{id, node_id, type}` entry) and `deployment_branch_policy` (an object or null); `per_page` is at most 100. Public repositories need read access, private ones the `repo` scope. The page states plan limits for environments in private repositories. The script counts environments whose `protection_rules` is empty. |
+| GitHub Docs — REST API endpoints for repositories | https://docs.github.com/en/rest/repos/repos | Fetched 2026-10-30: `GET /repos/{owner}/{repo}` returns `default_branch`, `archived`, `permissions{admin, maintain, push, triage, pull}` and `security_and_analysis` (an object or null) with `advanced_security`, `secret_scanning` and `secret_scanning_push_protection`, each `{status}` of `enabled` or `disabled`. `security_and_analysis` is visible only with admin permissions, or to an organization owner or security manager. Documented statuses are 200, 301, 403 and 404. |
+| GitHub Docs — about secret scanning | https://docs.github.com/en/code-security/secret-scanning/introduction/about-secret-scanning | Fetched 2026-10-30 (three reads, same wording): "Secret scanning is available for the following repository types:" public repositories ("Secret scanning runs automatically for free."), organization-owned private and internal repositories ("Available with GitHub Secret Protection enabled on GitHub Team or GitHub Enterprise Cloud.") and user-owned repositories ("Available on GitHub Enterprise Cloud with Enterprise Managed Users."). The page does not mention push protection. Basis for "a private or internal organization repository needs GitHub Secret Protection" in the fix text of the `secret scanning not enabled` row. |
+| GitHub Docs — about push protection | https://docs.github.com/en/code-security/secret-scanning/introduction/about-push-protection | Fetched 2026-10-30 (three reads of the same item): under "Types of push protection", the "Push protection for repositories" list starts "Requires GitHub Secret Protection to be enabled" and also says it "Is disabled by default, and can be enabled by a repository administrator, organization owner, security manager, or enterprise owner". No item in that list separates repository types and the page does not say whether public repositories are exempt, so the fix text of the `push protection not enabled` row claims the requirement only for private and internal organization repositories. |
+| hub4j/github-api — issue 2062 | https://github.com/hub4j/github-api/issues/2062 | Fetched 2026-10-30 (issue opened Mar 16, 2025): a branch protected only through a ruleset has `isProtected()` true while `GET .../branches/main/protection` answers 404 with `{"message":"Branch not protected"}`. This is why the script also reads `/rules/branches/{branch}` and reports "no protection" only when classic protection is absent and that list is empty. A third-party issue report, not GitHub documentation. |
+| runatlantis/atlantis — pull request 3276 | https://github.com/runatlantis/atlantis/pull/3276 | Fetched 2026-10-30: handles an HTTP 403 whose message is "Upgrade to GitHub Pro or make this repository public to enable this feature." for a private repository on a Free plan. Basis for matching `upgrade to github` in a 403 message and labelling it `not available on this plan`. A third-party observation, not GitHub documentation. |
+| Legit-Labs/legitify — README | https://github.com/Legit-Labs/legitify | Fetched 2026-10-30: Apache-2.0; analyses GitHub and GitLab; the scopes for a full analysis are `admin:org`, `read:enterprise`, `admin:org_hook`, `read:org`, `repo` and `read:repo_hook`; fine-grained personal access tokens are not supported; `SCM_TOKEN=<token> legitify analyze [--org ...] [--repo ...] [--namespace ...] [-f human-readable\|json\|sarif] [--scorecard no\|yes\|verbose]`. The page showed no release; not installed or run here. Basis for the legitify clause in `tool-hub.md`. |
+| ossf/scorecard — README | https://github.com/ossf/scorecard | Fetched 2026-10-30: Apache-2.0; `scorecard --repo=github.com/ossf-tests/scorecard-check-branch-protection-e2e`; the token may come from `GITHUB_AUTH_TOKEN`, `GITHUB_TOKEN`, `GH_AUTH_TOKEN` or `GH_TOKEN`, and the page suggests the `public_repo` scope; `--format=json` is available. The page showed no release; not installed or run here. |
+| ossf/scorecard — checks, Branch-Protection | https://raw.githubusercontent.com/ossf/scorecard/main/docs/checks.md | Fetched 2026-10-30: risk High; five settings (`DismissStaleReviews`, `EnforceAdmins`, `RequireLastPushApproval`, `RequiresStatusChecks`, `UpToDateBeforeMerge`) need an admin token, and with a non-admin token the check scores only the settings a non-admin can read; `EnforceAdmins` is false when any bypass actor is defined on any rule; rulesets are covered under "Repo Rules". Basis for "some Branch-Protection settings need an admin token" in `tool-hub.md`. |
+
+Not fetched, no URL: a community report that a token without admin can get a 404 from the branch-protection endpoint for a branch that is protected (seen in a search result, the page was not opened). The script therefore reports `Branch not protected` as a finding only when the repository object reports `permissions.admin` as true. `repo_settings_audit.py` was run offline against fixtures only; no live GitHub call was made when it was written, so the exact 403 and 404 bodies of each endpoint are the documented statuses, not observed ones.
diff --git a/scripts/ci-tests.d/repo-settings-audit.sh b/scripts/ci-tests.d/repo-settings-audit.sh
new file mode 100644
index 000000000..061e65da4
--- /dev/null
+++ b/scripts/ci-tests.d/repo-settings-audit.sh
@@ -0,0 +1,2 @@
+# Registers the repo_settings_audit.py tests (branch protection and rulesets, Actions, collaborators, deploy keys, webhooks, environments, secret scanning, not-checked rows, privacy, CLI). Offline.
+python3 scripts/test_repo_settings_audit.py
diff --git a/scripts/size-budgets.tsv b/scripts/size-budgets.tsv
index e5936a4ac..a76af5280 100644
--- a/scripts/size-budgets.tsv
+++ b/scripts/size-budgets.tsv
@@ -32,7 +32,7 @@
 .claude/skills/agentic-ceo/references/chaos-playbook.md	7573
 .claude/skills/agentic-ceo/references/full-map.md	15848
 .claude/skills/agentic-ceo/references/improvement-loop.md	11646
-.claude/skills/agentic-delivery/SKILL.md	7202
+.claude/skills/agentic-delivery/SKILL.md	7457
 .claude/skills/agentic-delivery/references/cost-quality-guardrails.md	16230
 .claude/skills/agentic-delivery/references/dev-env-ownership.md	33694
 .claude/skills/agentic-delivery/references/fanout-host-sizing.md	49827
@@ -147,7 +147,7 @@
 .claude/skills/deep-code-review/references/mobile-appsec.md	25915
 .claude/skills/deep-code-review/references/model-tiering.md	16991
 .claude/skills/deep-code-review/references/observability.md	19440
-.claude/skills/deep-code-review/references/parallel-audit.md	39795
+.claude/skills/deep-code-review/references/parallel-audit.md	40669
 .claude/skills/deep-code-review/references/performance-db-cost.md	31096
 .claude/skills/deep-code-review/references/privacy-by-design.md	4924
 .claude/skills/deep-code-review/references/privacy-compliance.md	17463
@@ -208,10 +208,10 @@ README.md	16118
 .claude/skills/product-discovery/references/full-map.md	12384
 .claude/skills/growth-analytics/references/full-map.md	10661
 .claude/skills/positioning/references/full-map.md	9520
-.claude/skills/INDEX.md	16424
+.claude/skills/INDEX.md	16547
 .claude/skills/agentic-delivery/INDEX.md	4672
-.claude/skills/agentic-delivery/INDEX-scripts.md	17223
-.claude/skills/deep-code-review/INDEX.md	20552
+.claude/skills/agentic-delivery/INDEX-scripts.md	17490
+.claude/skills/deep-code-review/INDEX.md	20553
 .claude/skills/deep-code-review/INDEX-scripts.md	6642
 .claude/skills/agentic-delivery/references/pipeline-optimizer.md	19857
 .claude/skills/agentic-delivery/references/focus-kit.md	5235
@@ -234,7 +234,7 @@ README.md	16118
 .claude/skills/deep-code-review/references/small-diff-read-budget.md	526
 .claude/skills/deep-code-review/references/app-pentest.md	8135
 .claude/skills/deep-code-review/references/supply-chain-check.md	3646
-.claude/skills/deep-code-review/references/tool-hub.md	14455
+.claude/skills/deep-code-review/references/tool-hub.md	15368
 .claude/skills/deep-code-review/references/desktop-native-appsec.md	4724
 .claude/skills/deep-code-review/references/dynamic-probe.md	1890
 .claude/skills/agentic-delivery/references/flow-guards.md	2105
diff --git a/scripts/test_ci_cost_advisor.py b/scripts/test_ci_cost_advisor.py
index 2c5e188ab..566c9a7b5 100644
--- a/scripts/test_ci_cost_advisor.py
+++ b/scripts/test_ci_cost_advisor.py
@@ -1,6 +1,7 @@
 #!/usr/bin/env python3
 """Tests for ci_cost_advisor.py, the `ci` policy key, `ci_cost_lint.py --advise` and the pre-push re-push notice.
-Offline: the github.com visibility probe is stubbed, every repo is a throwaway temp dir."""
+Offline: the github.com visibility probe is stubbed, every repo is a throwaway temp dir that `tmp()` registers and
+`tearDownModule` removes (NoTempLeak proves a full run leaves none behind)."""
 import contextlib
 import io
 import json
@@ -122,12 +123,26 @@ def git(cwd, *a):
                           capture_output=True, text=True, check=True).stdout
 
 
+_TMP = []
+
+
+def tmp():
+    """A fresh temp dir that tearDownModule removes: every dir this file makes comes from here, none is left to pile up."""
+    _TMP.append(Path(tempfile.mkdtemp(prefix="ci-advisor-test-")))
+    return _TMP[-1]
+
+
+def tearDownModule():
+    for d in _TMP:
+        shutil.rmtree(d, ignore_errors=True)
+
+
 def make_repo(files, use_git=False):
     """A temp repo whose .github/workflows holds {name: text}; committed when use_git."""
-    d = Path(tempfile.mkdtemp(prefix="ci-advisor-test-"))
+    d = tmp()
     (d / ".github/workflows").mkdir(parents=True)
     for name, text in files.items():
-        (d / ".github/workflows" / name).write_text(text)
+        (d / ".github/workflows" / name).write_text(text, encoding="utf-8")
     if use_git:
         (d / "README").write_text("x")
         git(d, "init", "-q", "-b", "main")
@@ -231,7 +246,7 @@ def test_path_filters_use_the_recent_history(self):
 
     def test_hostile_filter_patterns_cannot_hang_the_matcher(self):
         start = time.time()
-        for pat in ("**a" * 12 + "b", "a+" * 40 + "b", "[a-z]+" * 40 + "!", "*a" * 30 + "b"):  # regex backtracking bait
+        for pat in ("**a" * 12 + "b", "a+" * 40 + "b", "[a-z]+" * 40 + "!", "*a" * 30 + "b", "**/" * 30 + "b"):  # regex backtracking bait
             self.assertFalse(A._glob(pat, "a" * 400), pat)
         self.assertLess(time.time() - start, 2)
         self.assertTrue(A._glob("[a-z]+" * 3, "abcdef"))
@@ -244,6 +259,16 @@ def test_filter_pattern_semantics(self):
         self.assertFalse(A._select(["src/**", "!src/docs/**"], "src/docs/x.md"))
         self.assertTrue(A._select(["src/**", "!src/docs/**", "src/docs/keep.md"], "src/docs/keep.md"))
 
+    def test_a_segment_leading_double_star_slash_also_matches_no_directory(self):  # the cheat sheet: `**/README.md` matches `README.md`
+        for pat, s, want in [("**/Dockerfile", "Dockerfile", True), ("**/Dockerfile", "docker/Dockerfile", True), ("**/Dockerfile", "a/b/Dockerfile", True),
+                             ("**/Dockerfile", "MyDockerfile", False), ("**/Dockerfile", "Dockerfile.dev", False),
+                             ("docs/**/*.md", "docs/README.md", True), ("docs/**/*.md", "docs/a/b/x.md", True), ("docs/**/*.md", "src/README.md", False),
+                             ("**/docs/**", "docs/hello.md", True), ("**/docs/**", "dir/docs/my-file.txt", True), ("**/docs/**", "mydocs/x.md", False),
+                             ("**/*-post.md", "my-post.md", True), ("**/*src/**", "my-src/code/js/app.js", True),
+                             ("a/**/b/**/c", "a/b/c", True), ("a/**/b/**/c", "a/x/b/c", True), ("a/**/b/**/c", "a/b/y/c", True), ("a/**/b/**/c", "a/x/b/y/c", True),
+                             ("a**/b", "ab", False), ("a**/b", "a/b", True)]:  # only a `**/` that starts a segment may vanish
+            self.assertEqual(A._glob(pat, s), want, (pat, s))
+
 
 class Plan(unittest.TestCase):
     def test_public_repo_is_free_and_says_so(self):
@@ -389,7 +414,7 @@ def test_job_minutes_flag(self):
     def test_missing_root_exits_2_and_no_workflows_is_a_clean_verdict(self):
         with contextlib.redirect_stderr(io.StringIO()):
             self.assertEqual(A.main([os.path.join(tempfile.gettempdir(), "no-such-ci-advisor-root")]), 2)
-        empty = Path(tempfile.mkdtemp())
+        empty = tmp()
         self.assertIn("no workflows", advise(empty, "--visibility", "private")[1])
 
 
@@ -464,7 +489,7 @@ def test_unknown_visibility_is_treated_as_private(self):
         self.assertIn("unknown", err)
 
     def test_no_workflows_is_cloud(self):
-        self.assertEqual(advise(Path(tempfile.mkdtemp()), "--decide")[1].strip(), "cloud")
+        self.assertEqual(advise(tmp(), "--decide")[1].strip(), "cloud")
 
 
 class Patch(unittest.TestCase):
@@ -535,7 +560,7 @@ def test_history_counts_first_parent_commits_files_and_tags(self):
         self.assertEqual(len(prs), 3)  # base, code, and the merge (its feature commit is not a separate PR)
         self.assertIn({"src/b.py", "docs/c.md"}, prs)  # a merge commit shows what the PR changed
         self.assertEqual(sorted(tags), ["v1.0.0", "v1.0.1"])
-        self.assertEqual(A.hist_from_git(str(Path(tempfile.mkdtemp())), "main"), ([], []))
+        self.assertEqual(A.hist_from_git(str(tmp()), "main"), ([], []))
 
     def test_history_feeds_the_pr_count_and_the_report_says_where_it_came_from(self):
         d = make_repo({"ci.yml": UNIT}, use_git=True)
@@ -563,7 +588,7 @@ def test_visibility_probe_is_cached_and_unknown_is_not(self):
         with mock.patch.object(A, "_http_status", return_value=200) as probe:
             self.assertEqual(A.visibility(str(d2), None, "auto")[0], "public")  # the unknown answer was not cached
         self.assertEqual(A.visibility(str(d2), None, "private"), ("private", "--visibility"))
-        self.assertEqual(A.visibility(str(Path(tempfile.mkdtemp())), None, "auto")[0], "unknown")
+        self.assertEqual(A.visibility(str(tmp()), None, "auto")[0], "unknown")
 
     def test_local_gate_detection(self):
         d = make_repo({"ci.yml": UNIT}, use_git=True)
@@ -602,12 +627,12 @@ def test_default_run_only_hints_and_keeps_its_exit_code(self):
     def test_the_shared_loader_keeps_the_lints_missing_root_contract(self):
         with self.assertRaises(FileNotFoundError):
             L.load_workflows(os.path.join(tempfile.gettempdir(), "no-such-ci-advisor-root"))
-        self.assertEqual(L.load_workflows(str(Path(tempfile.mkdtemp()))), {})
+        self.assertEqual(L.load_workflows(str(tmp())), {})
 
 
 class PolicyCi(unittest.TestCase):
     def setUp(self):
-        self.d = Path(tempfile.mkdtemp())
+        self.d = tmp()
         self.pol = self.d / "policy.json"
         self.env = {k: v for k, v in os.environ.items() if k != "PERUN_GITHUB_ACTIONS"} | {"PERUN_POLICY": str(self.pol)}
 
@@ -685,7 +710,7 @@ def run_hook(self, ci, remote="old", ref="refs/heads/work"):
         git(d, "add", "-A")
         git(d, "commit", "-q", "-m", "second")
         head, first = git(d, "rev-parse", "HEAD").strip(), git(d, "rev-parse", "HEAD~1").strip()
-        pol = Path(tempfile.mkdtemp()) / "policy.json"  # outside the repo: the hook refuses a dirty tree
+        pol = tmp() / "policy.json"  # outside the repo: the hook refuses a dirty tree
         pol.write_text(json.dumps({"ci": ci}))
         env = {**os.environ, "PERUN_POLICY": str(pol), "DCR_PREPUSH_CMD": "true", "DCR_PREPUSH_DEFAULT_BRANCH": "main"}
         sha = first if remote == "old" else "0" * 40
@@ -705,5 +730,277 @@ def test_no_notice_in_cloud_mode_on_a_first_push_or_on_the_default_branch(self):
         self.assertNotIn("one push per PR", self.run_hook("local-first", ref="refs/heads/main").stderr)
 
 
+IMAGE = """name: image
+on:
+  pull_request:
+    paths:
+      - Dockerfile
+      - 'src/**'
+jobs:
+  image:
+    if: github.event.pull_request.draft == false
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: build and smoke
+        run: |
+          docker build -t app .
+          docker compose -f ci.yml up --wait
+
+          docker compose down
+        env:
+          APP_ENV: ci
+      - run: echo done # not part of the command
+  unit:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: ./.github/actions/setup
+      - run: pytest -q
+  publish:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: docker/build-push-action@v6
+        with:
+          push: false
+  call:
+    uses: ./.github/workflows/shared.yml
+"""
+BLOCKS = """name: blocks
+on: pull_request
+jobs:
+  a:
+    runs-on: ubuntu-latest
+    steps:
+      - run: |  # literal, with a comment after the indicator
+          make one
+            --indented
+      - name: folded
+        run: >-
+          make two
+          three
+        shell: bash
+      - run: make inline
+"""
+CONTINUED = """on: pull_request
+jobs:
+  smoke:
+    runs-on: ubuntu-latest
+    steps:
+      - run: |
+          docker compose \\
+            -f ci.yml \\
+            up --wait
+          echo ok
+"""
+
+
+def wf(on, run="pytest -q"):
+    """A one-job workflow with the given `on:` text (full YAML, ending in a newline)."""
+    return f"name: t\n{on}jobs:\n  a:\n    runs-on: ubuntu-latest\n    steps:\n      - run: {run}\n"
+
+
+def diff_repo(workflows, changed):
+    """A repo whose `fix` branch commits `changed` files on top of `main`, which holds `workflows`."""
+    d = make_repo(workflows, use_git=True)
+    git(d, "checkout", "-q", "-b", "fix")
+    for f in changed:
+        (d / f).parent.mkdir(parents=True, exist_ok=True)
+        (d / f).write_text("x")
+    git(d, "add", "-A")
+    git(d, "commit", "-q", "-m", "fix")
+    return d
+
+
+def fired(workflows, changed):
+    """(rc, stdout, stderr) of `--diff main` in a repo whose fix commits `changed`."""
+    return advise(diff_repo(workflows, changed), "--diff", "main")
+
+
+class DiffJobs(unittest.TestCase):
+    def test_a_paths_hit_lists_each_job_with_its_run_lines_and_tags_the_runtime_ones(self):
+        rc, out, err = fired({"image.yml": IMAGE}, ["Dockerfile"])
+        self.assertEqual((rc, err), (0, ""))
+        self.assertIn("1 changed file(s) vs main: 4 pull_request job(s) fire", out)
+        w = ".github/workflows/image.yml: "
+        self.assertIn(w + "image [runtime] (if: github.event.pull_request.draft == false)\n"
+                      "    docker build -t app .\n    docker compose -f ci.yml up --wait\n    docker compose down\n    echo done\n", out)
+        self.assertIn(w + "unit\n    uses: ./.github/actions/setup\n    pytest -q\n", out)  # no [runtime]; a local action shows its uses
+        self.assertIn(w + "publish [runtime]\n    uses: docker/build-push-action@v6\n", out)
+        self.assertIn(w + "call\n    uses: ./.github/workflows/shared.yml\n", out)  # a reusable-workflow call shows its uses
+        self.assertNotIn("APP_ENV", out)  # a step's env is not a run line
+        self.assertNotIn("actions/checkout", out)  # nor is an ordinary action
+
+    def test_paths_filter_hit_and_miss(self):
+        w = {"w.yml": wf("on:\n  pull_request:\n    paths:\n      - Dockerfile\n      - 'src/**'\n")}
+        self.assertIn("1 pull_request job(s) fire", fired(w, ["src/a/b.py"])[1])
+        miss = fired(w, ["README.md", "docs/x.md"])[1]
+        self.assertIn("2 changed file(s) vs main: 0 pull_request job(s) fire", miss)
+        self.assertNotIn("w.yml", miss)
+
+    def test_paths_ignore_skips_only_a_diff_made_entirely_of_ignored_files(self):
+        w = {"w.yml": wf("on:\n  pull_request:\n    paths-ignore:\n      - '**.md'\n      - docs/**\n")}
+        self.assertIn(" 0 pull_request job(s) fire", fired(w, ["README.md", "docs/a/b.txt"])[1])
+        self.assertIn(" 1 pull_request job(s) fire", fired(w, ["README.md", "src/a.py"])[1])
+
+    def test_no_filter_fires_on_any_file(self):
+        self.assertIn(" 1 pull_request job(s) fire", fired({"w.yml": wf("on: pull_request\n")}, ["anything.txt"])[1])
+
+    def test_only_pull_request_triggers_count(self):
+        flows = {
+            "push.yml": wf("on:\n  push:\n    branches: [main]\n", "docker build ."),
+            "cron.yml": wf('on:\n  schedule:\n    - cron: "0 2 * * *"\n  workflow_dispatch:\n', "docker build ."),
+            "reusable.yml": wf("on:\n  workflow_call:\n", "docker build ."),
+            "labeled.yml": wf("on:\n  pull_request:\n    types: [labeled]\n", "docker build ."),
+            "release.yml": wf("on:\n  pull_request:\n    branches: [release]\n", "docker build ."),
+            "ok.yml": wf("on:\n  pull_request:\n    types: [synchronize]\n"),  # the positive control
+        }
+        out = fired(flows, ["src/a.py"])[1]
+        self.assertIn(" 1 pull_request job(s) fire", out)
+        self.assertIn(".github/workflows/ok.yml: a\n    pytest -q\n", out)
+        self.assertEqual([ln.split(":")[0] for ln in out.splitlines() if ln.startswith(W)], [W + "ok.yml"])  # push.yml is only named, on the last line
+
+    def test_list_form_and_pull_request_target_count(self):
+        flows = {"list.yml": wf("on: [push, pull_request]\n"), "target.yml": wf("on:\n  pull_request_target:\n")}
+        self.assertIn(" 2 pull_request job(s) fire", fired(flows, ["src/a.py"])[1])
+
+    def test_block_scalars_keep_their_order_and_a_folded_one_joins_its_lines(self):
+        out = fired({"b.yml": BLOCKS}, ["x"])[1]
+        self.assertIn(".github/workflows/b.yml: a\n    make one\n      --indented\n    make two three\n    make inline\n", out)
+
+    def test_a_backslash_continued_command_is_one_line_and_still_tagged(self):  # `compose` and `up` sit on different physical lines
+        out = fired({"c.yml": CONTINUED}, ["x"])[1]
+        self.assertIn(".github/workflows/c.yml: smoke [runtime]\n    docker compose -f ci.yml up --wait\n    echo ok\n", out)
+
+    def test_a_job_with_services_or_a_container_is_runtime_and_a_folded_command_is_joined(self):
+        w = (
+            "on: pull_request\njobs:\n"
+            "  db:\n    runs-on: ubuntu-latest\n    services:\n      postgres:\n        image: postgres:16\n      cache:\n        image: redis:7\n"
+            "    steps:\n      - run: pytest -q\n"
+            "  boxed:\n    runs-on: ubuntu-latest\n    container:\n      image: node:20\n    steps:\n      - run: npm test\n"
+            "  shorthand:\n    runs-on: ubuntu-latest\n    container: node:20\n    steps:\n      - run: npm test\n"
+            "  folded:\n    runs-on: ubuntu-latest\n    steps:\n      - run: >\n          docker compose -f ci.yml\n          up --wait\n"
+            "  plain:\n    runs-on: ubuntu-latest\n    steps:\n      - run: npm test\n")
+        out = fired({"w.yml": w}, ["x"])[1]
+        p = W + "w.yml: "
+        self.assertIn(p + "db [runtime]\n    services: postgres, cache\n    pytest -q\n", out)
+        self.assertIn(p + "boxed [runtime]\n    container: node:20\n    npm test\n", out)
+        self.assertIn(p + "shorthand [runtime]\n    container: node:20\n    npm test\n", out)
+        self.assertIn(p + "folded [runtime]\n    docker compose -f ci.yml up --wait\n", out)  # the two folded lines are one command
+        self.assertIn(p + "plain\n    npm test\n", out)
+
+    def test_a_branches_filter_is_matched_against_the_branch_the_base_names(self):
+        flows = {"dev.yml": wf("on:\n  pull_request:\n    branches: [development]\n"), "main.yml": wf("on:\n  pull_request:\n    branches: [main]\n"),
+                 "rel.yml": wf("on:\n  pull_request:\n    branches: ['release/**']\n"), "ign.yml": wf("on:\n  pull_request:\n    branches-ignore: [main]\n"),
+                 "any.yml": wf("on: pull_request\n")}
+        d = diff_repo(flows, ["src/a.py"])
+        for ref in ("refs/heads/development", "refs/remotes/origin/development", "refs/remotes/origin/main", "refs/remotes/up/release/1.x"):
+            git(d, "update-ref", ref, "main")
+        git(d, "symbolic-ref", "refs/remotes/origin/HEAD", "refs/remotes/origin/development")  # what a clone sets: `origin/HEAD` follows its target
+
+        def fires(base):
+            out = advise(d, "--diff", base)[1]
+            self.assertNotIn("unchecked", out)  # a base that names a branch is always checked
+            return sorted(ln.split(":")[0][len(W):] for ln in out.splitlines() if ln.startswith(W))
+
+        for base, want in [("main", ["any.yml", "main.yml"]), ("origin/main", ["any.yml", "main.yml"]),
+                           ("development", ["any.yml", "dev.yml", "ign.yml"]), ("origin/development", ["any.yml", "dev.yml", "ign.yml"]),
+                           ("refs/remotes/origin/development", ["any.yml", "dev.yml", "ign.yml"]), ("origin/HEAD", ["any.yml", "dev.yml", "ign.yml"]),
+                           ("up/release/1.x", ["any.yml", "ign.yml", "rel.yml"])]:
+            self.assertEqual(fires(base), want, base)
+
+    def test_a_base_that_is_no_branch_keeps_each_branch_filtered_job_and_flags_it(self):
+        flows = {"dev.yml": wf("on:\n  pull_request:\n    branches: [development]\n"), "ign.yml": wf("on:\n  pull_request:\n    branches-ignore: [main]\n"),
+                 "any.yml": wf("on: pull_request\n"), "docs.yml": wf("on:\n  pull_request:\n    paths: ['docs/**']\n")}
+        d = diff_repo(flows, ["src/a.py"])
+        git(d, "tag", "v1", "main")
+        git(d, "update-ref", "refs/remotes/up/HEAD", "main")  # a plain ref that happens to be called HEAD
+        for base in (git(d, "rev-parse", "main").strip(), "v1", "main~0", "up/HEAD"):  # a sha, a tag, a revision expression, HEAD of a remote
+            out = advise(d, "--diff", base)[1]
+            self.assertIn(W + "dev.yml: a (branches: unchecked)\n", out, base)
+            self.assertIn(W + "ign.yml: a (branches: unchecked)\n", out, base)
+            self.assertIn(W + "any.yml: a\n", out, base)  # no branch filter, nothing to flag
+            self.assertNotIn("docs.yml", out)  # the paths filter still applies
+
+    def test_a_double_star_slash_path_filter_fires_for_a_root_file(self):
+        w = {"w.yml": wf("on:\n  pull_request:\n    paths:\n      - '**/Dockerfile'\n")}
+        for f in ("Dockerfile", "images/api/Dockerfile"):
+            self.assertIn(" 1 pull_request job(s) fire", fired(w, [f])[1], f)
+        self.assertIn(" 0 pull_request job(s) fire", fired(w, ["Dockerfile.md"])[1])
+
+    def test_a_lone_string_filter_is_one_pattern_not_a_list_of_characters(self):
+        w = {"w.yml": wf("on:\n  pull_request:\n    types: opened\n    branches: main\n    paths: src/**\n")}
+        self.assertIn(" 1 pull_request job(s) fire", fired(w, ["src/a.py"])[1])
+        self.assertIn(" 0 pull_request job(s) fire", fired(w, ["docs/a.md"])[1])
+
+    def test_a_workflow_the_parser_cannot_read_is_listed_only_when_it_names_pull_request(self):
+        bad = "on: pull_request\njobs: &a\n  x: 1\n"
+        out = fired({"bad.yml": bad, "other.yml": bad.replace("pull_request", "push")}, ["x"])[1]
+        self.assertIn("UNPARSED .github/workflows/bad.yml:", out)
+        self.assertNotIn("other.yml", out)
+
+    def test_a_workflow_with_no_readable_on_is_listed_when_it_names_pull_request(self):
+        jobs = "jobs:\n  a:\n    runs-on: ubuntu-latest\n    steps:\n      - run: pytest -q\n"
+        # a byte-order mark before the first key turns `on` into `\ufeffon`, which parses to no trigger at all
+        out = fired({"bom.yml": "\ufeffon: pull_request\n" + jobs, "quiet.yml": "\ufeffon: push\n" + jobs}, ["x"])[1]
+        self.assertIn(" 0 pull_request job(s) fire", out)
+        self.assertIn("UNPARSED .github/workflows/bom.yml: no readable `on:` trigger; it names pull_request, so check it by hand", out)
+        self.assertNotIn("quiet.yml", out)
+
+    def test_workflows_on_push_merge_group_or_workflow_run_are_named_on_one_last_line(self):
+        flows = {"a-push.yml": wf("on:\n  push:\n    branches: [main]\n"), "b-queue.yml": wf("on:\n  merge_group:\n"),
+                 "c-chain.yml": wf("on:\n  workflow_run:\n    workflows: [a]\n    types: [completed]\n"),
+                 "d-cron.yml": wf('on:\n  schedule:\n    - cron: "0 2 * * *"\n'), "e-both.yml": wf("on: [push, pull_request]\n"),
+                 "f-miss.yml": wf("on:\n  push:\n  pull_request:\n    paths: ['docs/**']\n")}
+        out = fired(flows, ["src/a.py"])[1]
+        self.assertTrue(out.endswith("not listed (they start on push, merge_group or workflow_run; not evaluated): a-push.yml, b-queue.yml, c-chain.yml, f-miss.yml\n"), out)
+        self.assertIn(" 1 pull_request job(s) fire", out)  # e-both.yml is a listed job, so it is not also named
+        self.assertNotIn("not listed", fired({"p.yml": wf("on: pull_request\n")}, ["x"])[1])
+
+    def test_a_renamed_file_counts_under_both_its_paths(self):  # the superset: a job is never missed
+        d = make_repo({"w.yml": wf("on:\n  pull_request:\n    paths: ['old/**']\n")}, use_git=True)
+        (d / "old").mkdir()
+        (d / "old/a.py").write_text("a")
+        git(d, "add", "-A")
+        git(d, "commit", "-q", "-m", "add")
+        git(d, "checkout", "-q", "-b", "fix")
+        (d / "new").mkdir()
+        git(d, "mv", "old/a.py", "new/a.py")
+        git(d, "commit", "-q", "-m", "move")
+        self.assertIn(" 1 pull_request job(s) fire", advise(d, "--diff", "main")[1])
+
+    def test_an_undiffable_base_is_an_error_never_an_empty_answer(self):
+        d = diff_repo({"w.yml": wf("on: pull_request\n")}, ["x"])
+        for base in ("no-such-ref", "--output=leak", ""):  # "": an unset shell variable must not fall back to the cost report
+            rc, out, err = advise(d, f"--diff={base}")
+            self.assertEqual((rc, out), (2, ""))
+            self.assertIn("cannot diff", err)
+        self.assertEqual([p.name for p in d.iterdir() if "leak" in p.name], [])  # a base is never handed to git as an option
+
+    def test_it_is_offline_and_read_only(self):  # the module stubs the visibility probe to raise
+        d = diff_repo({"w.yml": wf("on: pull_request\n")}, ["x"])
+        with mock.patch.object(L, "_lookup_strict", side_effect=AssertionError("gh must not run")):
+            rc, out, err = advise(d, "--diff", "main", "--repo", "acme/widgets")
+        self.assertEqual((rc, err), (0, ""))
+        self.assertIn(" 1 pull_request job(s) fire", out)
+        self.assertEqual(git(d, "status", "--porcelain"), "")
+
+    def test_runtime_pattern(self):
+        for s in ("docker build -t app .", "docker buildx build .", "docker run --rm app", "docker compose up --wait", "docker-compose -f ci.yml up -d",
+                  "docker compose -f a.yml run test", "docker compose build", "uses: docker/build-push-action@v6", "uses: docker/bake-action@v5"):
+            self.assertTrue(A._RUNTIME.search(s), s)
+        for s in ("docker login -u x", "docker compose down", "docker ps", "pytest -q", "make build", "echo docker"):
+            self.assertFalse(A._RUNTIME.search(s), s)
+
+
+class NoTempLeak(unittest.TestCase):
+    @unittest.skipIf(os.environ.get("CI_ADVISOR_LEAK_CHILD"), "the child run of this very check")
+    def test_a_full_run_leaves_no_temp_dir_behind(self):
+        with tempfile.TemporaryDirectory() as sandbox:  # the child's TMPDIR: whatever it leaves is listed here
+            r = subprocess.run([sys.executable, str(Path(__file__).resolve())], capture_output=True, text=True,
+                               env={**os.environ, "TMPDIR": sandbox, "CI_ADVISOR_LEAK_CHILD": "1"})
+            self.assertIn("\nRan ", r.stderr, r.stderr)  # the child ran its whole suite
+            self.assertEqual(os.listdir(sandbox), [])
+
+
 if __name__ == "__main__":
     unittest.main()
diff --git a/scripts/test_repo_settings_audit.py b/scripts/test_repo_settings_audit.py
new file mode 100644
index 000000000..5f0604389
--- /dev/null
+++ b/scripts/test_repo_settings_audit.py
@@ -0,0 +1,575 @@
+#!/usr/bin/env python3
+"""Offline tests for repo_settings_audit.py: every check (default-branch protection from classic rules and rulesets,
+Actions, collaborators, deploy keys, webhooks, environments, secret scanning), the not-checked rows (a 403 or 404, a
+missing field, an unreadable item and a list of 1000 or more are never a clean result; `Branch not protected` is a
+finding only for a token shown to have admin), pagination, odd API replies, the privacy rule (counts only: no login,
+email, key title, hook URL or API message text in any output), the CLI (slugs, --repos-file, --json, exit 2) and the
+default getter end to end through `gh api`. Synthetic data only: fictional acme/widgets, no network, no real names."""
+import contextlib
+import io
+import json
+import subprocess
+import sys
+import tempfile
+import unittest
+from pathlib import Path
+from unittest import mock
+
+ROOT = Path(__file__).resolve().parent.parent
+SCRIPTS = ROOT / ".claude/skills/agentic-delivery/scripts"
+sys.path.insert(0, str(SCRIPTS))
+import pipeline_hub as hub  # noqa: E402
+import repo_settings_audit as rsa  # noqa: E402
+
+SLUG = "acme/widgets"
+B = "/repos/" + SLUG
+PROT, RULES = B + "/branches/main/protection", B + "/rules/branches/main"
+WF, AP = B + "/actions/permissions/workflow", B + "/actions/permissions"
+COLLAB, KEYS, HOOKS, ENVS = B + "/collaborators", B + "/keys", B + "/hooks", B + "/environments"
+NOT_PROTECTED = OSError("Branch not protected (HTTP 404)")
+NOT_FOUND = OSError("Not Found (HTTP 404)")
+FORBIDDEN = OSError("Resource not accessible by personal access token (HTTP 403)")
+STRONG = {"required_pull_request_reviews": {"required_approving_review_count": 2}, "allow_force_pushes": {"enabled": False},
+          "enforce_admins": {"enabled": True}, "required_status_checks": {"contexts": ["ci"], "checks": [{"context": "ci"}]}}
+FORCE = {"allow_force_pushes": {"enabled": True}, "enforce_admins": {"enabled": True}}  # classic protection that allows force pushes
+RULESET_FULL = [{"type": "pull_request", "parameters": {"required_approving_review_count": 1}}, {"type": "non_fast_forward"},
+                {"type": "required_status_checks", "parameters": {"required_status_checks": [{"context": "ci"}]}}]
+
+
+def pages(items, key=None):
+    """A list endpoint that honours per_page and page, as the API does."""
+    def f(params):
+        n, p = params["per_page"], params["page"]
+        chunk = items[(p - 1) * n:p * n]
+        return {"total_count": len(items), key: chunk} if key else chunk
+    return f
+
+
+def collab(admins=0, outside=0):
+    """/collaborators: the admin filter and the outside filter each return their own list (logins and emails included)."""
+    def f(params):
+        n = outside if params.get("affiliation") == "outside" else admins
+        return pages([{"login": "jane-smith-%d" % i, "email": "jane@example.com"} for i in range(n)])(params)
+    return f
+
+
+def many(n, key=None):
+    """A list endpoint of n items that every list check can read (a collaborator, a read-only key, a safe hook, a
+    protected environment, a rule), paged as the API pages it."""
+    item = {"login": "jane-smith", "read_only": True, "config": {"url": "https://hooks.example.com/a", "insecure_ssl": "0"},
+            "name": "prod", "protection_rules": [{"type": "wait_timer"}], "type": "creation"}
+    return pages([item] * n, key)
+
+
+def healthy():
+    """Replies for a repository that passes every check (fresh dicts each call)."""
+    return {
+        B: {"default_branch": "main", "permissions": {"admin": True},
+            "security_and_analysis": {"secret_scanning": {"status": "enabled"}, "secret_scanning_push_protection": {"status": "enabled"}}},
+        PROT: dict(STRONG), RULES: [],
+        WF: {"default_workflow_permissions": "read", "can_approve_pull_request_reviews": False},
+        AP: {"enabled": True, "allowed_actions": "selected"},
+        COLLAB: collab(1, 0),
+        KEYS: [{"title": "ci read key", "read_only": True}],
+        HOOKS: [{"config": {"url": "https://hooks.example.com/a", "insecure_ssl": "0"}}],
+        ENVS: {"total_count": 1, "environments": [{"name": "prod", "protection_rules": [{"type": "required_reviewers"}]}]},
+    }
+
+
+class Fake:
+    """The injected getter: replies keyed by path (data, an Exception to raise, or a callable of the params). A path
+    the test did not provide raises KeyError, so an unexpected call fails loudly."""
+
+    def __init__(self, replies):
+        self.replies, self.calls = replies, []
+
+    def __call__(self, path, params=None):
+        self.calls.append((path, params))
+        v = self.replies[path]
+        if isinstance(v, Exception):
+            raise v
+        return v(params) if callable(v) else v
+
+
+def run(over=None):
+    return rsa.audit(SLUG, Fake({**healthy(), **(over or {})}))
+
+
+def summary(rows, skip=("info",)):
+    """[(severity, check)] without the always-present collaborator count row."""
+    return [(r["severity"], r["check"]) for r in rows if r["severity"] not in skip]
+
+
+def cli(*argv, get=None):
+    """(exit code, stdout, stderr) of main(); `get=None` leaves the default getter (`gh api`) in place."""
+    out, err = io.StringIO(), io.StringIO()
+    with contextlib.redirect_stdout(out), contextlib.redirect_stderr(err):
+        try:
+            rc = rsa.main(list(argv), **({"get": get} if get else {}))
+        except SystemExit as e:
+            rc = e.code
+    return rc, out.getvalue(), err.getvalue()
+
+
+class Helpers(unittest.TestCase):
+    def test_dig_walks_dicts_and_returns_none_on_any_miss(self):
+        self.assertEqual(rsa.dig({"a": {"b": 1}}, "a", "b"), 1)
+        for d in ({"a": 1}, {"a": None}, {}, None, [1], "a"):
+            self.assertIsNone(rsa.dig(d, "a", "b"))
+
+    def test_read_returns_reply_or_error_never_raises_on_odd_replies(self):
+        self.assertEqual(rsa.read(lambda p: {"a": 1}, "/x", dict), ({"a": 1}, None))
+        for bad in (OSError("Server Error (HTTP 502)"), ValueError("not json")):
+            def get(path, bad=bad):
+                raise bad
+            self.assertEqual(rsa.read(get, "/x", dict), (None, bad))
+        for reply in ([], "x", None, 5):  # a list where a dict is expected, and the reverse
+            d, e = rsa.read(lambda p, r=reply: r, "/x", dict)
+            self.assertEqual((d, str(e)), (None, "unexpected reply"))
+        d, e = rsa.read(lambda p: {}, "/x", list)
+        self.assertEqual((d, str(e)), (None, "unexpected reply"))
+
+    def test_read_needs_every_key_path_present_and_not_null(self):
+        need = (("a", "b"), ("c",))
+        self.assertEqual(rsa.read(lambda p: {"a": {"b": False}, "c": 0}, "/x", dict, need=need)[1], None)  # false and 0 are values
+        for reply in ({}, {"a": {"b": 1}}, {"c": 1}, {"a": {}, "c": 1}, {"a": {"b": None}, "c": 1}, {"a": 1, "c": 1}):
+            d, e = rsa.read(lambda p, r=reply: r, "/x", dict, need=need)
+            self.assertEqual((d, str(e)), (None, "unexpected reply"), reply)
+
+    def test_why_gives_a_fixed_label_from_the_status_never_the_message(self):
+        for msg, label in (("Not Found (HTTP 404)", "needs admin"),
+                           ("Resource not accessible by integration (HTTP 403)", "needs admin"),
+                           ("API rate limit exceeded for user ID 1 (HTTP 403)", "rate limited"),
+                           ("You have exceeded a secondary rate limit (HTTP 429)", "rate limited"),
+                           ("Upgrade to GitHub Pro or make this repository public to enable this feature. (HTTP 403)",
+                            "not available on this plan"),
+                           ("Server Error (HTTP 502)", "HTTP 502"), ("Bad credentials (HTTP 401)", "HTTP 401"),
+                           ("gh api failed", "API error"), ("unexpected reply", "not reported by the API"),
+                           ("too many items", "1000 or more items")):
+            got_label, fix = rsa.why(OSError(msg))
+            self.assertEqual(got_label, label, msg)
+            self.assertTrue(fix and "\n" not in fix, msg)
+        self.assertEqual(rsa.why(NOT_FOUND, rsa.NOT_FOUND)[0], "not found or no access")
+        self.assertEqual(rsa.why(OSError("Server Error (HTTP 502)"), rsa.NOT_FOUND)[0], "HTTP 502")  # only 403/404 use `miss`
+
+    def test_nc_row_shape(self):
+        self.assertEqual(rsa.nc("x", ("needs admin", "fix it")), ("x: not checked (needs admin)", "not-checked", "fix it"))
+
+    def test_slug_accepts_owner_name_and_refuses_anything_that_could_leave_the_path(self):
+        for ok in ("acme/widgets", "Acme-Co/widgets.v2", "a1/.github", "a/b_c"):
+            self.assertTrue(rsa.SLUG.fullmatch(ok), ok)
+        for bad in ("acme", "acme/", "/widgets", "acme/widgets/x", "acme/..", "acme/.", "../widgets", "-acme/widgets", "acme/wid gets",
+                    "acme/widgets?x=1", "acme/wid%2Fgets", "acme/widgets\n", "jane@example.com"):
+            self.assertFalse(rsa.SLUG.fullmatch(bad), repr(bad))
+
+    def test_listing_pages_through_the_list_and_stops_at_a_short_page(self):
+        f = Fake({"/x": pages([{"i": i} for i in range(250)])})
+        items, e = rsa.listing(f, "/x", {"permission": "admin"})
+        self.assertEqual((len(items), e), (250, None))
+        self.assertEqual([c[1] for c in f.calls], [{"permission": "admin", "per_page": 100, "page": p} for p in (1, 2, 3)])
+        f = Fake({"/x": pages([{}] * 100)})  # a full last page costs one more call and ends on the empty one
+        self.assertEqual((len(rsa.listing(f, "/x")[0]), len(f.calls)), (100, 2))
+        f = Fake({"/x": pages([{}] * 130, key="environments")})  # the array inside an object reply
+        self.assertEqual((len(rsa.listing(f, "/x", key="environments")[0]), len(f.calls)), (130, 2))
+
+    def test_listing_that_fills_every_page_is_an_error_not_a_truncated_list(self):
+        endless = Fake({"/x": lambda p: [{}] * 100})
+        items, e = rsa.listing(endless, "/x")
+        self.assertEqual((items, str(e), len(endless.calls)), (None, "too many items", 10))  # 10 pages of 100: stop, do not guess
+        f = Fake({"/x": many(1000)})  # exactly 1000 cannot be told from more, so it is an error too, without an 11th call
+        self.assertEqual((rsa.listing(f, "/x")[0], len(f.calls)), (None, 10))
+        f = Fake({"/x": many(999)})  # one short of a full last page is read in full
+        items, e = rsa.listing(f, "/x")
+        self.assertEqual((len(items), e, len(f.calls)), (999, None, 10))
+        f = Fake({"/x": many(1000, key="environments")})  # the same rule inside an object reply
+        self.assertEqual(str(rsa.listing(f, "/x", key="environments")[1]), "too many items")
+
+    def test_listing_refuses_an_item_it_cannot_read(self):
+        need = (("read_only",),)
+        for items in ([{"read_only": True}, {}], [{"read_only": None}], [{"read_only": True}, None], [5], ["x"], [[]], [{"a": 1}]):
+            items_, e = rsa.listing(Fake({"/x": items}), "/x", need=need)
+            self.assertEqual((items_, str(e)), (None, "unexpected reply"), items)
+        self.assertEqual(rsa.listing(Fake({"/x": [{"read_only": False}, {"read_only": True}]}), "/x", need=need)[1], None)
+        for items in ([None], [5]):  # without `need` an item must still be an object
+            self.assertIsNone(rsa.listing(Fake({"/x": items}), "/x")[0], items)
+        self.assertIsNone(rsa.listing(Fake({"/x": {"environments": [None]}}), "/x", key="environments")[0])
+
+    def test_listing_reports_a_failed_page(self):
+        def flaky(params):
+            if params["page"] > 1:
+                raise OSError("Server Error (HTTP 502)")
+            return [{}] * 100
+        items, e = rsa.listing(Fake({"/x": flaky}), "/x")  # one failed page loses the whole list: a count would be wrong
+        self.assertEqual((items, str(e)), (None, "Server Error (HTTP 502)"))
+        for reply in ({}, [], {"environments": "x"}):
+            self.assertIsNone(rsa.listing(Fake({"/x": reply}), "/x", key="environments")[0])
+
+    def test_render_counts_findings_and_not_checked(self):
+        rows = [{"repo": "a/b", "check": c, "severity": s, "fix": "f"} for c, s in
+                (("c1", "high"), ("c2", "low"), ("c3", "info"), ("c4", "not-checked"), ("c5", "not-checked"))]
+        text, counts = rsa.render(rows, 2)
+        self.assertEqual(counts, {"repos": 2, "findings": 2, "not_checked": 2})
+        lines = text.splitlines()
+        self.assertEqual((lines[0], lines[-1]), ("| repo | severity | check | fix |", "2 repos, 2 findings, 2 not checked"))
+        self.assertIn("| a/b | high | c1 | f |", lines)
+
+
+class Protection(unittest.TestCase):
+    def test_a_healthy_repository_has_no_finding_and_no_not_checked_row(self):
+        rows = run()
+        self.assertEqual([(r["severity"], r["check"]) for r in rows], [("info", "collaborators: 1 admin, 0 outside")])
+        self.assertTrue(all(set(r) == {"repo", "check", "severity", "fix"} and r["repo"] == SLUG for r in rows))
+
+    def test_no_protection_at_all_is_one_high_finding_not_four(self):
+        rows = run({PROT: NOT_PROTECTED})
+        self.assertEqual(summary(rows), [("high", "default branch has no protection (no classic rule, no ruleset)")])
+
+    def test_weak_classic_protection_gives_each_finding_worst_first(self):
+        rows = run({PROT: {"allow_force_pushes": {"enabled": True}, "enforce_admins": {"enabled": False}}})
+        self.assertEqual(summary(rows), [
+            ("high", "force pushes allowed on the default branch"),
+            ("medium", "fewer than 1 required approving review on the default branch"),
+            ("medium", "no required status checks on the default branch"),
+            ("low", "admins exempt from the default branch protection (enforce_admins off)")])
+
+    def test_zero_required_reviews_and_empty_check_lists_count_as_missing(self):
+        rows = run({PROT: {**STRONG, "required_pull_request_reviews": {"required_approving_review_count": 0},
+                           "required_status_checks": {"contexts": [], "checks": []}}})
+        self.assertEqual([c for _, c in summary(rows)],
+                         ["fewer than 1 required approving review on the default branch", "no required status checks on the default branch"])
+
+    def test_a_classic_reply_without_its_force_push_or_admin_setting_is_not_checked_never_clean(self):
+        gone = "default branch protection: not checked (not reported by the API)"
+        for reply in ({k: v for k, v in STRONG.items() if k != "allow_force_pushes"},  # the REST page marks neither setting required
+                      {k: v for k, v in STRONG.items() if k != "enforce_admins"},
+                      {**STRONG, "allow_force_pushes": {}}, {**STRONG, "enforce_admins": {"enabled": None}}, {}):
+            self.assertEqual(summary(run({PROT: reply})), [("not-checked", gone)], reply)  # no guessed finding either
+
+    def test_a_ruleset_alone_can_protect_the_branch(self):
+        rows = run({PROT: NOT_PROTECTED, RULES: RULESET_FULL})
+        self.assertEqual(summary(rows), [("not-checked", "admins exempt from the rulesets: not checked (ruleset bypass lists are not read)")])
+
+    def test_ruleset_and_classic_rules_fill_each_others_gaps(self):
+        weak = {"allow_force_pushes": {"enabled": True}, "enforce_admins": {"enabled": True}}  # no reviews, no checks, force allowed
+        rows = run({PROT: weak, RULES: RULESET_FULL})
+        self.assertEqual([s for s, _ in summary(rows)], ["not-checked"])  # nothing weak is left; only the bypass-list note
+
+    def test_a_weak_ruleset_is_still_weak(self):
+        rows = run({PROT: NOT_PROTECTED, RULES: [{"type": "pull_request", "parameters": {"required_approving_review_count": 0}},
+                                                 {"type": "required_status_checks", "parameters": {"required_status_checks": []}}]})
+        self.assertEqual([c for s, c in summary(rows) if s != "not-checked"],
+                         ["force pushes allowed on the default branch", "fewer than 1 required approving review on the default branch",
+                          "no required status checks on the default branch"])
+
+    def test_the_strictest_review_count_across_sources_wins(self):
+        weak_rule = [{"type": "pull_request", "parameters": {"required_approving_review_count": 0}}]
+        self.assertNotIn("fewer than 1 required approving review on the default branch",
+                         [c for _, c in summary(run({RULES: weak_rule}))])  # classic requires 2
+        strong_rule = [{"type": "pull_request", "parameters": {"required_approving_review_count": 1}}]
+        weak = {**STRONG, "required_pull_request_reviews": {"required_approving_review_count": 0}}
+        self.assertNotIn("fewer than 1 required approving review on the default branch",
+                         [c for _, c in summary(run({PROT: weak, RULES: strong_rule}))])
+
+    def test_a_404_that_is_not_branch_not_protected_is_not_checked_not_a_finding(self):
+        for err in (NOT_FOUND, FORBIDDEN):
+            rows = run({PROT: err})
+            self.assertEqual(summary(rows), [("not-checked", "default branch protection: not checked (needs admin)")])
+
+    def test_branch_not_protected_is_a_finding_only_when_the_reply_shows_admin_true(self):
+        no_field = {k: v for k, v in healthy()[B].items() if k != "permissions"}
+        for repo in ({**healthy()[B], "permissions": {"admin": False, "push": True}}, no_field,  # not admin, or unknown
+                     {**healthy()[B], "permissions": None}, {**healthy()[B], "permissions": {}},
+                     {**healthy()[B], "permissions": {"push": True}}, {**healthy()[B], "permissions": {"admin": None}},
+                     {**healthy()[B], "permissions": {"admin": 1}}, {**healthy()[B], "permissions": {"admin": "true"}}):
+            rows = run({B: repo, PROT: NOT_PROTECTED})
+            self.assertEqual(summary(rows), [("not-checked", "default branch protection: not checked (needs admin)")],
+                             repo.get("permissions", "no permissions field"))
+        rows = run({B: {**healthy()[B], "permissions": {"admin": True}}, PROT: NOT_PROTECTED})  # a conclusive 404
+        self.assertEqual(summary(rows), [("high", "default branch has no protection (no classic rule, no ruleset)")])
+
+    def test_unreadable_rulesets_hide_weaknesses_but_not_a_missing_classic_rule(self):
+        rows = run({RULES: FORBIDDEN, PROT: FORCE})
+        self.assertEqual(summary(rows), [("not-checked", "default branch rulesets: not checked (needs admin)")])  # a ruleset might block force
+        rows = run({RULES: FORBIDDEN, PROT: NOT_PROTECTED})
+        self.assertEqual(summary(rows), [("high", "default branch has no classic protection rule (rulesets not checked)"),
+                                         ("not-checked", "default branch rulesets: not checked (needs admin)")])
+
+    def test_rulesets_are_read_page_by_page(self):
+        rules = [{"type": "creation"}] * 100 + RULESET_FULL  # the rules that block force pushes and require review sit on page 2
+        f = Fake({**healthy(), PROT: NOT_PROTECTED, RULES: pages(rules)})
+        rows = rsa.audit(SLUG, f)
+        self.assertEqual(summary(rows), [("not-checked", "admins exempt from the rulesets: not checked (ruleset bypass lists are not read)")])
+        self.assertEqual([c[1] for c in f.calls if c[0] == RULES], [{"per_page": 100, "page": 1}, {"per_page": 100, "page": 2}])
+
+    def test_a_rule_list_that_fills_every_page_is_not_checked_not_judged_on_its_first_1000(self):
+        rows = run({PROT: NOT_PROTECTED, RULES: many(1000)})
+        self.assertEqual(summary(rows), [("high", "default branch has no classic protection rule (rulesets not checked)"),
+                                         ("not-checked", "default branch rulesets: not checked (1000 or more items)")])
+        rows = run({PROT: FORCE, RULES: many(1000)})  # a weakness is not reported from half of the evidence
+        self.assertEqual(summary(rows), [("not-checked", "default branch rulesets: not checked (1000 or more items)")])
+
+    def test_both_sources_unreadable_gives_two_not_checked_rows(self):
+        rows = run({PROT: FORBIDDEN, RULES: FORBIDDEN})
+        self.assertEqual([s for s, _ in summary(rows)], ["not-checked", "not-checked"])
+
+    def test_the_branch_name_is_url_encoded_but_keeps_its_slashes(self):
+        for branch, enc in (("release/1.x", "release/1.x"), ("odd #1", "odd%20%231")):
+            replies = healthy()
+            replies[B]["default_branch"] = branch
+            replies[B + "/branches/%s/protection" % enc], replies[B + "/rules/branches/%s" % enc] = replies.pop(PROT), replies.pop(RULES)
+            self.assertEqual(summary(rsa.audit(SLUG, Fake(replies))), [], branch)  # a wrong path would be a KeyError
+
+    def test_a_missing_default_branch_is_not_checked(self):
+        replies = healthy()
+        replies[B] = {"permissions": {"admin": True}}
+        rows = rsa.audit(SLUG, Fake(replies))
+        self.assertIn("default branch protection: not checked (default branch not reported)", [r["check"] for r in rows])
+
+
+class OtherChecks(unittest.TestCase):
+    def test_actions_token_write_review_approval_and_all_actions_allowed(self):
+        rows = run({WF: {"default_workflow_permissions": "write", "can_approve_pull_request_reviews": True},
+                    AP: {"enabled": True, "allowed_actions": "all"}})
+        self.assertEqual(summary(rows), [("medium", "default workflow token has write permission"),
+                                         ("medium", "workflows can approve pull request reviews"),
+                                         ("low", "all actions and reusable workflows are allowed")])
+
+    def test_actions_checks_fail_independently(self):
+        rows = run({WF: FORBIDDEN, AP: {"enabled": True, "allowed_actions": "all"}})
+        self.assertEqual(summary(rows), [("low", "all actions and reusable workflows are allowed"),
+                                         ("not-checked", "Actions workflow token: not checked (needs admin)")])
+        rows = run({AP: OSError("Upgrade to GitHub Pro or make this repository public to enable this feature. (HTTP 403)")})
+        self.assertEqual(summary(rows), [("not-checked", "allowed actions: not checked (not available on this plan)")])
+
+    def test_collaborator_counts(self):
+        f = Fake({**healthy(), COLLAB: collab(3, 2)})
+        rows = rsa.audit(SLUG, f)
+        self.assertEqual([(r["severity"], r["check"]) for r in rows], [("low", "collaborators: 3 admin, 2 outside")])
+        self.assertEqual({tuple(c[1].items())[0] for c in f.calls if c[0] == COLLAB},
+                         {("permission", "admin"), ("affiliation", "outside")})  # one filtered list per count
+        self.assertEqual(run({COLLAB: collab(2, 0)})[0]["severity"], "info")  # no outside collaborator: a count, not a finding
+
+    def test_collaborators_unreadable(self):
+        self.assertEqual(summary(run({COLLAB: FORBIDDEN}), skip=()), [("not-checked", "collaborators: not checked (needs admin)")])
+        self.assertEqual(summary(run({COLLAB: lambda p: pages([])(p) if "permission" in p else (_ for _ in ()).throw(NOT_FOUND)}),
+                                 skip=()), [("not-checked", "collaborators: not checked (needs admin)")])  # the second call fails
+
+    def test_deploy_keys_with_write_are_counted_read_only_ones_are_not(self):
+        keys = [{"title": "a", "read_only": False}, {"title": "b", "read_only": True}, {"title": "c", "read_only": False}]
+        self.assertEqual(summary(run({KEYS: keys})), [("medium", "2 deploy key(s) with write access")])
+        self.assertEqual(summary(run({KEYS: [{"read_only": True}]})), [])
+        self.assertEqual(summary(run({KEYS: FORBIDDEN})), [("not-checked", "deploy keys: not checked (needs admin)")])
+
+    def test_a_deploy_key_without_a_read_only_flag_makes_the_list_not_checked_never_clean(self):
+        gone = [("not-checked", "deploy keys: not checked (not reported by the API)")]
+        for keys in ([{"read_only": False}, {"title": "d"}], [{"read_only": None}], [{}], [None], [5], ["x"], [[]]):
+            self.assertEqual(summary(run({KEYS: keys})), gone, keys)  # not even a count of the keys it could read
+
+    def test_webhooks_with_tls_verification_off_or_plain_http(self):
+        hooks = [{"config": {"url": "http://hooks.example.com/a", "insecure_ssl": "1"}},  # both problems
+                 {"config": {"url": "https://hooks.example.com/b", "insecure_ssl": 1}},  # the API may send a number
+                 {"config": {"url": "https://hooks.example.com/c", "insecure_ssl": "0"}}]
+        self.assertEqual(summary(run({HOOKS: hooks})), [("medium", "2 webhook(s) with TLS verification off (insecure_ssl)"),
+                                                        ("medium", "1 webhook(s) delivering over plain http")])
+        self.assertEqual(summary(run({HOOKS: FORBIDDEN})), [("not-checked", "webhooks: not checked (needs admin)")])
+
+    def test_a_webhook_without_a_url_or_insecure_ssl_makes_the_list_not_checked_never_clean(self):
+        ok = {"config": {"url": "http://hooks.example.com/a", "insecure_ssl": "1"}}
+        gone = [("not-checked", "webhooks: not checked (not reported by the API)")]
+        for bad in ({"config": {"url": "https://hooks.example.com/b"}}, {"config": {"insecure_ssl": "0"}}, {"config": {}},
+                    {"config": None}, {}, None, 5):
+            self.assertEqual(summary(run({HOOKS: [ok, bad]})), gone, bad)  # the readable hook is not counted either
+
+    def test_an_actions_reply_missing_a_field_is_not_checked_never_clean(self):
+        wf_gone = [("not-checked", "Actions workflow token: not checked (not reported by the API)")]
+        for wf in ({}, {"default_workflow_permissions": "write"}, {"can_approve_pull_request_reviews": True},
+                   {"default_workflow_permissions": None, "can_approve_pull_request_reviews": False}):
+            self.assertEqual(summary(run({WF: wf})), wf_gone, wf)  # a lone field is not reported as a finding
+        ap_gone = [("not-checked", "allowed actions: not checked (not reported by the API)")]
+        for ap in ({}, {"allowed_actions": "selected"}, {"enabled": None}, {"enabled": True}, {"enabled": True, "allowed_actions": "other"}):
+            self.assertEqual(summary(run({AP: ap})), ap_gone, ap)  # Actions on and no policy named: not a clean answer
+        for ap in ({"enabled": False}, {"enabled": True, "allowed_actions": "local_only"}, {"enabled": True, "allowed_actions": "selected"}):
+            self.assertEqual(summary(run({AP: ap})), [], ap)  # Actions off needs no policy row; allowed_actions is optional in the schema
+
+    def test_a_list_with_an_item_that_is_not_an_object_is_not_checked_never_clean(self):
+        def envs(items):
+            return {"total_count": len(items), "environments": items}
+        for path, name, wrap in ((COLLAB, "collaborators", list), (HOOKS, "webhooks", list), (ENVS, "environments", envs)):
+            for items in ([None], [5], ["x"], [[]]):
+                rows = run({path: wrap(items)})
+                self.assertEqual(summary(rows), [("not-checked", "%s: not checked (not reported by the API)" % name)], (name, items))
+        self.assertEqual(summary(run({ENVS: envs([{}])})), [("low", "1 environment(s) without protection rules")])  # an object with no rules is unprotected
+
+    def test_environments_without_a_protection_rule(self):
+        envs = {"total_count": 3, "environments": [{"protection_rules": []}, {"protection_rules": [{"type": "wait_timer"}]}, {}]}
+        self.assertEqual(summary(run({ENVS: envs})), [("low", "2 environment(s) without protection rules")])
+        self.assertEqual(summary(run({ENVS: {"total_count": 0, "environments": []}})), [])
+        self.assertEqual(summary(run({ENVS: NOT_FOUND})), [("not-checked", "environments: not checked (needs admin)")])
+
+    def test_secret_scanning_and_push_protection(self):
+        sa = {"secret_scanning": {"status": "disabled"}, "secret_scanning_push_protection": {"status": "disabled"}}
+        repo = {**healthy()[B], "security_and_analysis": sa}
+        self.assertEqual(summary(run({B: repo})), [("medium", "secret scanning not enabled"), ("low", "push protection not enabled")])
+        repo["security_and_analysis"] = {"secret_scanning": {"status": "enabled"}}  # a key the API did not report
+        self.assertEqual(summary(run({B: repo})), [("not-checked", "push protection: not checked (not reported by the API)")])
+        for none in (None, {}):  # admin-only field: absent or null without admin
+            repo["security_and_analysis"] = none
+            self.assertEqual(summary(run({B: repo})), [("not-checked", "secret scanning and push protection: not checked (needs admin)")])
+
+    def test_the_secret_scanning_fixes_name_github_secret_protection_for_private_organization_repositories(self):
+        sa = {"secret_scanning": {"status": "disabled"}, "secret_scanning_push_protection": {"status": "disabled"}}
+        rows = run({B: {**healthy()[B], "security_and_analysis": sa}})
+        fixes = [r["fix"] for r in rows if r["severity"] in rsa.FINDING]
+        self.assertEqual(len(fixes), 2)  # secret scanning and push protection
+        for fix in fixes:
+            self.assertIn("private or internal organization repository needs GitHub Secret Protection", fix)
+
+    def test_a_list_of_1000_is_not_checked_on_every_list_check_and_999_are_read_in_full(self):
+        for path, name in ((COLLAB, "collaborators"), (KEYS, "deploy keys"), (HOOKS, "webhooks")):
+            self.assertEqual(summary(run({path: many(1000)})), [("not-checked", "%s: not checked (1000 or more items)" % name)], name)
+        envs = run({ENVS: many(1000, key="environments")})
+        self.assertEqual(summary(envs), [("not-checked", "environments: not checked (1000 or more items)")])
+        read_in_full = run({COLLAB: many(999), KEYS: many(999), HOOKS: many(999), ENVS: many(999, key="environments")})
+        self.assertEqual([(r["severity"], r["check"]) for r in read_in_full], [("low", "collaborators: 999 admin, 999 outside")])
+
+    def test_an_unreadable_repository_is_one_row_and_its_other_calls_are_skipped(self):
+        for err, label in ((NOT_FOUND, "not found or no access"), (FORBIDDEN, "not found or no access"), (OSError("Server Error (HTTP 502)"), "HTTP 502"),
+                           (OSError("Upgrade to GitHub Pro or make this repository public to enable this feature. (HTTP 403)"), "not available on this plan")):
+            f = Fake({B: err})
+            rows = rsa.audit(SLUG, f)
+            self.assertEqual([(r["severity"], r["check"]) for r in rows], [("not-checked", "repository: not checked (%s)" % label)])
+            self.assertEqual(f.calls, [(B, None)])
+
+    def test_rows_are_sorted_worst_first_within_a_repository(self):
+        rows = run({PROT: FORCE, WF: FORBIDDEN, KEYS: [{"read_only": False}],
+                    COLLAB: collab(1, 1), B: {**healthy()[B], "security_and_analysis": None}})
+        order = [rsa.SEVERITY.index(r["severity"]) for r in rows]
+        self.assertEqual(order, sorted(order))
+        self.assertEqual((rows[0]["severity"], rows[-1]["severity"]), ("high", "not-checked"))
+
+    def test_every_odd_reply_is_a_not_checked_row_never_a_clean_one(self):
+        """For each endpoint and each wrong-shaped reply the owning check says `not checked`; the one reply that stays
+        clean is a valid empty list from a list endpoint."""
+        owner = {B: ("repository", "default branch protection", "secret scanning and push protection"), PROT: ("default branch protection",),
+                 RULES: ("default branch rulesets",), WF: ("Actions workflow token",), AP: ("allowed actions",),
+                 COLLAB: ("collaborators",), KEYS: ("deploy keys",), HOOKS: ("webhooks",), ENVS: ("environments",)}
+        self.assertEqual(set(owner), set(healthy()))  # a new endpoint must be added here
+        for path, names in owner.items():
+            for value in (None, "text", 7, [], {}, [None, 5, "x"], [[], {}]):
+                rows = rsa.audit(SLUG, Fake({**healthy(), path: value}))
+                self.assertTrue(all(r["severity"] in rsa.SEVERITY and r["check"] and r["fix"] for r in rows), (path, value))
+                said = [r["check"] for r in rows if r["severity"] == "not-checked" and r["check"].startswith(names)]
+                valid_empty_list = value == [] and path in (RULES, COLLAB, KEYS, HOOKS)
+                self.assertEqual(bool(said), not valid_empty_list, (path, value, rows))
+
+
+class Cli(unittest.TestCase):
+    def fleet(self, *slugs):
+        replies = {}
+        for s in slugs:
+            replies.update({k.replace(SLUG, s): v for k, v in healthy().items()})
+        return Fake(replies)
+
+    def test_text_table_and_summary_line(self):
+        rc, out, err = cli(SLUG, get=Fake({**healthy(), PROT: NOT_PROTECTED, KEYS: FORBIDDEN}))
+        lines = out.splitlines()
+        self.assertEqual((rc, err, lines[0]), (0, "", "| repo | severity | check | fix |"))
+        self.assertEqual(lines[2].split(" | ")[:3], ["| acme/widgets", "high", "default branch has no protection (no classic rule, no ruleset)"])
+        self.assertEqual(lines[-1], "1 repos, 1 findings, 1 not checked")
+
+    def test_json_rows_and_summary(self):
+        rc, out, _ = cli(SLUG, "--json", get=Fake({**healthy(), PROT: NOT_PROTECTED, KEYS: FORBIDDEN}))
+        rep = json.loads(out)
+        self.assertEqual(rc, 0)
+        self.assertEqual(rep["summary"], {"repos": 1, "findings": 1, "not_checked": 1})
+        self.assertEqual([r["severity"] for r in rep["rows"]], ["high", "info", "not-checked"])
+        self.assertTrue(all(set(r) == {"repo", "check", "severity", "fix"} for r in rep["rows"]))
+
+    def test_a_failing_repository_does_not_stop_the_sweep(self):
+        f = self.fleet("acme/gadgets")
+        f.replies[B] = NOT_FOUND  # acme/widgets is unreadable, acme/gadgets is fine
+        rc, out, _ = cli(SLUG, "acme/gadgets", "--json", get=f)
+        rep = json.loads(out)
+        self.assertEqual((rc, rep["summary"]), (0, {"repos": 2, "findings": 0, "not_checked": 1}))
+        self.assertEqual([(r["repo"], r["severity"]) for r in rep["rows"]], [(SLUG, "not-checked"), ("acme/gadgets", "info")])
+
+    def test_repos_file_skips_blanks_and_comments_and_audits_each_repository_once(self):
+        with tempfile.TemporaryDirectory() as d:
+            p = Path(d) / "repos.txt"
+            p.write_text("# fleet\nacme/widgets\nAcme/Widgets   # same repository, other case\n\n  acme/gadgets  # second\n", encoding="utf-8")
+            f = self.fleet("acme/gadgets", SLUG)
+            rc, out, _ = cli("acme/gadgets", "--repos-file", str(p), "--json", get=f)  # an argument repeats a file line
+        self.assertEqual(rc, 0)
+        self.assertEqual(json.loads(out)["summary"]["repos"], 2)
+        self.assertEqual([c[0] for c in f.calls if c[0].count("/") == 3], ["/repos/acme/gadgets", "/repos/acme/widgets"])  # argv order, no repeat
+
+    def test_a_bad_slug_exits_2_before_any_api_call(self):
+        for bad in ("acme", "acme/..", "../widgets", "acme/widgets/x", " acme/widgets", "jane@example.com"):
+            f = Fake({})
+            rc, out, err = cli(SLUG, bad, get=f)  # one good slug first: still nothing is audited
+            self.assertEqual((rc, out, f.calls), (2, "", []), bad)
+            self.assertIn("not an OWNER/NAME slug", err)
+
+    def test_no_repository_exits_2(self):
+        rc, _, err = cli(get=Fake({}))
+        self.assertEqual(rc, 2)
+        self.assertIn("no repositories", err)
+
+    def test_an_unreadable_repos_file_exits_2(self):
+        with tempfile.TemporaryDirectory() as d:
+            rc, _, err = cli("--repos-file", str(Path(d) / "missing.txt"), get=Fake({}))
+            self.assertEqual(rc, 2)
+            self.assertIn("cannot read --repos-file", err)
+            (Path(d) / "binary.txt").write_bytes(b"\xff\xfe\x00acme/widgets")
+            rc, _, err = cli("--repos-file", str(Path(d) / "binary.txt"), get=Fake({}))
+            self.assertEqual(rc, 2)
+            self.assertIn("cannot read --repos-file: not UTF-8 text", err)
+
+    def test_missing_gh_exits_2_with_the_default_getter_only(self):
+        with mock.patch.object(rsa.shutil, "which", return_value=None), mock.patch.object(hub.subprocess, "run") as r:
+            rc, out, err = cli(SLUG)
+            self.assertEqual((rc, out, r.call_count), (2, "", 0))
+            self.assertIn("gh not found on PATH", err)
+            self.assertEqual(cli(SLUG, get=Fake(healthy()))[0], 0)  # an injected getter does not need gh
+
+    def test_output_never_carries_logins_emails_key_titles_hook_urls_or_api_text(self):
+        private = ["jane-smith", "jane@example.com", "Jane laptop key", "ssh-ed25519 AAAA-fixture", "hooks.example.com/secret-path-123",
+                   "hook-fixture-value", "tok-fixture-9z", "Resource not accessible"]
+        over = {PROT: FORCE, COLLAB: collab(2, 1),
+                KEYS: [{"title": "Jane laptop key", "key": "ssh-ed25519 AAAA-fixture", "read_only": False}],
+                HOOKS: [{"name": "web", "config": {"url": "http://hooks.example.com/secret-path-123", "insecure_ssl": "1", "secret": "hook-fixture-value"}}],
+                WF: OSError("Resource not accessible by token tok-fixture-9z (HTTP 403)"),
+                ENVS: {"total_count": 1, "environments": [{"name": "jane-smith-env", "protection_rules": []}]}}
+        for argv in ((SLUG,), (SLUG, "--json")):
+            f = Fake({**healthy(), **over})
+            rc, out, err = cli(*argv, get=f)
+            self.assertEqual(rc, 0)
+            for word in ("1 deploy key(s) with write access", "1 webhook(s) with TLS verification off", "1 webhook(s) delivering over plain http",
+                         "collaborators: 2 admin, 1 outside", "Actions workflow token: not checked (needs admin)",
+                         "1 environment(s) without protection rules"):
+                self.assertIn(word, out)  # the output is not vacuous
+            for secret in private:
+                self.assertNotIn(secret, out + err, secret)
+
+    def test_default_getter_makes_only_plain_gh_api_gets(self):
+        replies = {**healthy(), COLLAB: []}  # PROT is answered by the 404 below
+        calls = []
+
+        def fake_run(args, **kw):
+            calls.append(args)
+            path = args[2].split("?")[0]
+            if path == PROT:
+                return subprocess.CompletedProcess(args, 1, "", "gh: Branch not protected (HTTP 404)\n")
+            return subprocess.CompletedProcess(args, 0, json.dumps(replies[path]), "")
+        with mock.patch.object(hub.subprocess, "run", side_effect=fake_run), mock.patch.object(rsa.shutil, "which", return_value="/usr/bin/gh"):
+            rc, out, _ = cli(SLUG, "--json")
+        rep = json.loads(out)
+        self.assertEqual(rc, 0)
+        self.assertEqual([r["check"] for r in rep["rows"] if r["severity"] == "high"],
+                         ["default branch has no protection (no classic rule, no ruleset)"])
+        self.assertTrue(calls and all(len(a) == 3 and a[:2] == ["gh", "api"] and a[2].startswith(B) for a in calls), calls)  # no -X, -f or --input
+        self.assertIn(COLLAB + "?permission=admin&per_page=100&page=1", [a[2] for a in calls])
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/scripts/test_skill_index_split.py b/scripts/test_skill_index_split.py
index 80c402d8a..51d98ac79 100644
--- a/scripts/test_skill_index_split.py
+++ b/scripts/test_skill_index_split.py
@@ -92,7 +92,7 @@ def test_lookup_cost_is_measured_not_assumed(self):
         d = ROOT / ".claude/skills/agentic-delivery"
         core, lazy = (d / "INDEX.md").stat().st_size, (d / si.SCRIPTS_INDEX).stat().st_size
         self.assertLess(core, 16962)  # a reference lookup reads core only
-        self.assertLess(core + lazy, 16962 + 5000)  # a script lookup reads both: about the old size, not far above; +130 for the reply_cap and decision_gate rows, +820 for the destructive_guard_core, file_finding, repeat_poll_guard, stage_run and subagent_brief_lint rows, +150 for the feeder_order row, +200 for the train_yield row, +100 for the lkg row, +200 for the red_main row and the stage-weights/serial CLI text, +400 = +348 INDEX-scripts.md (14732->15080: host_installer, peer_ack, pregate_parity rows) +51 skills/INDEX.md (14295->14346), +100 for the vendor_drift row, +200 = +284 INDEX-scripts.md growth (admission_check, host_accept rows) plus INDEX.md regen, +100 for the lane_worktree row, +50 for the bg_admit row, +150 for wave L28 rows (council, flow_health), +1000 for wave AL rows (reply_cap, fitness_tick, flake_holder, finding_guard, baseline_guard, freeze_gate, flow_alarm, prevention_lint, quarantine; measured 21360), +300 for the freeze_hook and flow-guards rows (measured 21617), +300 for the pipeline_hub row (measured 21895)
+        self.assertLess(core + lazy, 16962 + 5300)  # a script lookup reads both: about the old size, not far above; +130 for the reply_cap and decision_gate rows, +820 for the destructive_guard_core, file_finding, repeat_poll_guard, stage_run and subagent_brief_lint rows, +150 for the feeder_order row, +200 for the train_yield row, +100 for the lkg row, +200 for the red_main row and the stage-weights/serial CLI text, +400 = +348 INDEX-scripts.md (14732->15080: host_installer, peer_ack, pregate_parity rows) +51 skills/INDEX.md (14295->14346), +100 for the vendor_drift row, +200 = +284 INDEX-scripts.md growth (admission_check, host_accept rows) plus INDEX.md regen, +100 for the lane_worktree row, +50 for the bg_admit row, +150 for wave L28 rows (council, flow_health), +1000 for wave AL rows (reply_cap, fitness_tick, flake_holder, finding_guard, baseline_guard, freeze_gate, flow_alarm, prevention_lint, quarantine; measured 21360), +300 for the freeze_hook and flow-guards rows (measured 21617), +300 for the pipeline_hub row (measured 21895), +300 for the repo_settings_audit row (measured 22162)
 
     def test_entry_index_points_at_the_lazy_file(self):
         self.assertIn(si.SCRIPTS_INDEX, (ROOT / ".claude/skills/INDEX.md").read_text(encoding="utf-8"))