remigiusz-antczak · Oct 30, 2026 · Oct 30, 2026
diff --git a/.claude/skills/INDEX.md b/.claude/skills/INDEX.md
@@ -86,6 +86,7 @@ Run `python3 <skill>/scripts/<name>` (`bash` for `.sh`). `name: purpose — argu
 - queue_guard.py: single priority queue: print the next issue to pull, flag P0… — --issues issues.json --priorities…
 - reap_own.sh: kill your own dev servers older than MAX_AGE_S whose cwd is…
 - refix_gate.py: re-touching a recently-fixed file requires a class-level… — --base REF --head REF [--window-hours…
+- repo_settings_audit.py: read-only audit of the GitHub settings that decide who can… — OWNER/NAME [OWNER/NAME ...]…
 - review_digest.py: a returning reviewer's change digest, not a full re-read. — --since SHA [--head REF] [--paths PATH…
 - review_gate.py: pre-merge gate: every PR needs an independent deep-code-review… — check <pr> --head SHA [--repo R]
 - review_status.py: post a review verdict as commit status perun/review on an… — --sha <40-hex> --red N [--repo…

diff --git a/.claude/skills/agentic-delivery/INDEX-scripts.md b/.claude/skills/agentic-delivery/INDEX-scripts.md
@@ -83,6 +83,7 @@ Generated by `scripts/skill_index.py` (do not hand-edit). The script half of `IN
 | `scripts/refix_gate.py` | re-touching a recently-fixed file requires a class-level artifact. | refix_gate.py --base REF --head REF [--window-hours 72] [--class-glob GLOB ...] refix_gate.py --selftest |
 | `scripts/repeat_poll_guard.py` | PreToolUse(Bash) hook: nudge when the same command runs more than 3 times in one session. | — |
 | `scripts/reply_cap.py` | owner rule: chat replies max 3 lines, 500 chars. | — |
+| `scripts/repo_settings_audit.py` | repo_settings_audit.py: read-only audit of the GitHub settings that decide who can change a reposit… | repo_settings_audit.py OWNER/NAME [OWNER/NAME ...] [--repos-file FILE] [--json] --repos-file holds one OWNER/NAME per l… |
 | `scripts/restore_ledger.py` | classify every branch after a VCS history-rewrite incident. | — |
 | `scripts/review_digest.py` | a returning reviewer's change digest, not a full re-read. | review_digest.py --since SHA [--head REF] [--paths PATH ...] [--max-lines N] [--allow-diverged] review_digest.py --self… |
 | `scripts/review_gate.py` | pre-merge gate: every PR needs an independent deep-code-review DIFF pass plus an evil-twin check. | review_gate.py check <pr> --head SHA [--repo R] |

diff --git a/.claude/skills/agentic-delivery/INDEX.md b/.claude/skills/agentic-delivery/INDEX.md
@@ -38,4 +38,4 @@ Generated by `scripts/skill_index.py` (do not hand-edit; rerun it after changing
 
 ## Scripts
 
-108 scripts. Read `INDEX-scripts.md` when you need a script (a trigger and CLI per script). `../INDEX.md`, `### agentic-delivery`, has only each one-line purpose and arguments.
+109 scripts. Read `INDEX-scripts.md` when you need a script (a trigger and CLI per script). `../INDEX.md`, `### agentic-delivery`, has only each one-line purpose and arguments.
diff --git a/.claude/skills/agentic-delivery/SKILL.md b/.claude/skills/agentic-delivery/SKILL.md
@@ -24,6 +24,7 @@ Gated-delivery **pattern**, not a runtime or standing swarm. Does not replace `d
 | Verify or relay a result; slow pipeline | `verification-handback.md`; `pipeline-optimizer.md` |
 | Long session, compaction, new session, memory or docs bloat | `references/focus-kit.md`: update `.claude/handoff.md` (`scripts/focus_kit.py handoff set`) at each gate, before a context-heavy step, before handback |
 | New machine or fleet | `operating-discipline.md` |
+| Audit a repo's GitHub settings (branch protection, Actions token, deploy keys, webhooks) | run `python3 scripts/repo_settings_audit.py OWNER/NAME... [--repos-file FILE] [--json]`: read-only, a 403 or 404 is `not checked`; admin token for the full set |
 | PR state; hand off; changelog | `scripts/pr_state.py <n>`; `scripts/land_ready.py` (open PRs ready to land, or why not); `scripts/review_status.py --sha S --red N` (post `perun/review`); `scripts/premise_check.py <n>...`; `scripts/ci-gates.sh fragments` |
 | Cost cut, lane cap; "enforced" claim, CI cost | `cost-quality-guardrails.md`; `host-enforcement.md` |
 | Fan-out size, host probe | `fanout-host-sizing.md`, `fast-agentic-delivery.md` |

diff --git a/.claude/skills/agentic-delivery/scripts/repo_settings_audit.py b/.claude/skills/agentic-delivery/scripts/repo_settings_audit.py
diff --git a/.claude/skills/deep-code-review/INDEX.md b/.claude/skills/deep-code-review/INDEX.md
@@ -106,7 +106,7 @@ Generated by `scripts/skill_index.py` (do not hand-edit; rerun it after changing
 | `references/nextjs-app-router.md` | next is a dependency (probe: grep '"next"' package.json) and the code uses the App Router (app/). | 537 |
 | `references/observability.md` | reviewing logging, metrics, traces, dashboards, alerting, audit trails, or "could we tell this brok… | 4860 |
 | `references/overlays.md` | recommending or installing an overlay, or wiring this skill's gates into a target's CI. | 359 |
-| `references/parallel-audit.md` | the target is large enough to review across parallel subagents (a FULL run of a large repo, or seve… | 9948 |
+| `references/parallel-audit.md` | the target is large enough to review across parallel subagents (a FULL run of a large repo, or seve… | 10167 |
 | `references/performance-db-cost.md` | the target has a database, makes external/API/LLM calls, runs batch jobs, or has any hot path where… | 7774 |
 | `references/performance-latency-depth.md` | the target has a server request handler, page loader or resolver that assembles one response from s… | 3364 |
 | `references/privacy-by-design.md` | the product will face a privacy-regulated user (EU/UK, California, children, and the like) or an en… | 1231 |
@@ -138,7 +138,7 @@ Generated by `scripts/skill_index.py` (do not hand-edit; rerun it after changing
 | `references/testing-ui.md` | the target renders a UI or ships browser / E2E specs. | 4868 |
 | `references/threat-modeling.md` | a change adds a trust boundary, an auth path, a data flow to a new party, an agent or tool capabili… | 2574 |
 | `references/time-date-correctness.md` | reviewing anything that stores, computes, schedules, or renders timestamps, durations, recurring ev… | 4809 |
-| `references/tool-hub.md` | a review should lean on external scanners via the tool hub (workflows, Python, Go, SBOM/lockfiles,… | 3613 |
+| `references/tool-hub.md` | a review should lean on external scanners via the tool hub (workflows, Python, Go, SBOM/lockfiles,… | 3842 |
 | `references/ux-components.md` | the target or diff renders one concept in more than one place: a shared component or design token,… | 7235 |
 | `references/ux-dataviz.md` | the target or diff renders a chart, sparkline, heat-map or calendar grid, a KPI / metric delta, a c… | 2787 |
 | `references/ux-gates.md` | a UI change is claimed verified on screenshot evidence, the project's auto-merge or CI policy gates… | 3756 |

diff --git a/.claude/skills/deep-code-review/references/parallel-audit.md b/.claude/skills/deep-code-review/references/parallel-audit.md
@@ -527,6 +527,16 @@ the fan-out's *shape***, reported **once** with a remedy — not one finding per
 - **Keep a documented one-command local full suite,** and require the **labelled full
   run** before merging an app change — the cheap gate speeds iteration without becoming
   the merge bar.
+- **Before a fix lane pushes, list the CI jobs its diff will fire.** Run
+  `python3 .claude/skills/deep-code-review/scripts/ci_cost_advisor.py <repo-dir> --diff <base>`,
+  with `<base>` the branch the PR targets, such as `origin/development`: `branches:` filters are
+  matched against it, and a sha or tag base tags each job such a filter gates
+  `(branches: unchecked)`. Every `pull_request` job the committed diff triggers (path filters
+  applied) prints with its `run:` lines; a job that builds an image, starts containers or has
+  `services:` is tagged `[runtime]`. Workflows on `push`, `merge_group` or `workflow_run` are only
+  named. Run each listed job locally, or name it `left to CI` under the PR body's `How to verify`;
+  a green unit run proves nothing about a `[runtime]` job, so a Dockerfile-only fix can pass every
+  local test and still break the image job.
 - **One canonical path→gate manifest when more than one surface routes by path.** CI `paths:`
   filters, a pre-push/pre-commit hook's file scoping, and the local suite's "which gates for
   which files" each encode the *same* **path→required-gates** map (which globs are gated areas and

diff --git a/.claude/skills/deep-code-review/references/tool-hub.md b/.claude/skills/deep-code-review/references/tool-hub.md
@@ -59,6 +59,12 @@ pinact (`pinact run`) is the fixer for unpinned-action findings; it needs the Gi
 - Exit 0 verdict printed; 1 hyperfine missing (`NOT CHECKED: hyperfine (install: brew install hyperfine)` on stderr, never a clean result) or the run failed (checkout, CMD or an unsupported export); 2 refused usage. The worktree is removed on exit and on HUP, INT or TERM.
 - `heavy_gate.py` holds a run while the machine is busy. Start it on an idle machine and repeat: one verdict is a lead.
 
+## Repo settings (own script, not run by `review_checks.sh`)
+
+| Tool | Covers | Command shape | Flags | Class |
+|---|---|---|---|---|
+| `repo_settings_audit.py` | Default-branch protection and rulesets, Actions token settings, collaborator counts, write deploy keys, insecure webhooks, unprotected environments, secret scanning; a 403 or 404 is `not checked`, never clean | `python3 .claude/skills/agentic-delivery/scripts/repo_settings_audit.py OWNER/NAME... [--repos-file FILE] [--json]` | own script, read-only GETs; fields read from the GitHub docs 2026-10-30. OSS options (READMEs read 2026-10-30, not run): `legitify` (`SCM_TOKEN=... legitify analyze --org ORG`; needs an `admin:org` token, fine-grained tokens unsupported) and OpenSSF Scorecard (some Branch-Protection settings need an admin token; `supply_chain_check.sh --scorecard owner/repo` runs it for a public repo) | own; OSS options route-only |
+
 ## Route-only skills (opt-in, never vendored)
 
 | Skill | License note | Rule |
Original file line number	Diff line number	Diff line change
Expand Up		@@ -38,4 +38,4 @@ Generated by `scripts/skill_index.py` (do not hand-edit; rerun it after changing

		## Scripts

		108 scripts. Read `INDEX-scripts.md` when you need a script (a trigger and CLI per script). `../INDEX.md`, `### agentic-delivery`, has only each one-line purpose and arguments.
		109 scripts. Read `INDEX-scripts.md` when you need a script (a trigger and CLI per script). `../INDEX.md`, `### agentic-delivery`, has only each one-line purpose and arguments.