Track ADR-0013 rollout: repository settings baseline audit

[ss-o]

Purpose

Tracking home for ADR-0013 (decisions/0013-repository-settings-baseline.md), covering:

1. The maintainer disposition record for its acceptance (below), since runbooks/adr.md requires that acceptance record a named decider and that the ADR's own PR/issue trail make the authorization visible -- unlike ADRs 0008/0009/0010/0011, ADR-0013 had no pre-existing GitHub-native decision-packet comment; the disposition below fills that gap.
2. Rollout tracking per the ADR's own "Rollout and rollback" section: a read-only audit of current branch protection/ruleset settings across all 86 active repositories (step 3), followed by deliberate, gated, per-repository application (step 4). No repository setting is changed by the ADR itself or by this issue on its own.

Maintainer disposition (2026-07-25)

Decider ss-o. PR #474 proposed ADR-0013 with one open question: whether class-1 (continuously-deployed) repositories should require linear history on their deployed branch.

Decision: drop the requirement for class 1. Issue #473 (merged the same day PR #474 was opened) documents that class-1 repositories promoting a persistent development branch (ADR-0008's next) into the deployed branch diverge after every promotion when linear history is required -- squash and rebase both mint commits the development branch does not have, and a merge commit, the one strategy that preserves ancestry, is exactly what linear history forbids. The only available fix was a direct, admin-bypassing push, and #473 records a near-miss where the bypass warning was silently truncated by piping through tail. Classes 2-4 are unaffected: their promotions are either infrequent (class 2 release tags) or nonexistent (trunk-only classes 3-4).

ADR-0013 is ACCEPTED on this basis, same authority and process as ADRs 0008/0009/0011 decided the same day. No repository configuration changes are authorized by this decision -- rollout stays gated per the ADR's own step 1 ("Accept this ADR. It changes no repository by itself").

Next: read-only settings audit

Per rollout step 3, the next step is a read-only survey of branch protection and ruleset settings across all 86 active, public, non-fork repositories, reusing PR #474's own audit methodology so the numbers reconcile with its 75/86 finding. Findings will be posted to this issue. No repository setting will be changed by the audit itself.

[ss-o]

Read-only settings audit (2026-07-25)

Reused PR #474's own methodology: all active, public, non-fork repositories (fork == false, archived == false, private == false). No repository setting was changed by this audit.

Methodology reconciles on every checkable figure

• Total repos: 86 (matches).
• Repositories with zero workflow files: 23 (matches exactly, same set).
• Default branch still master: z-shell/web (matches).
• z-shell/zunit (class 2 per ADR-0008) is a fork and correctly falls outside this 86-repo, non-fork set, consistent with PR docs(adr): propose a repository settings baseline by class #474's own stated scope.

The baseline evidence has already moved in 3 days

PR #474's snapshot (2026-07-22) found 75/86 (87%) repositories with no rules at all on the default branch. This audit finds 56/86 (65%) -- roughly 19 repositories gained real, repository-level rulesets or classic protection since that snapshot (verified these are genuine ruleset_source_type: Repository rules, not a detection artifact). That is good news operationally, but it means ADR-0013's cited percentages are already stale three days after acceptance. Worth a note that this table decays fast and any future citation of it should re-run the audit rather than quote the ADR's numbers.

Named repos vs. the accepted baseline -- the actionable part

Repo	Class	Linear history	enforce_admins	Notes
wiki	1	still required (ruleset)	false	Contradicts the disposition adopted today because of this repo's own #473 incident. The next next -> main promotion will hit the same divergence/bypass cycle unless this rule is removed.
src	1	still required (ruleset)	n/a (no classic)	Same conflict as wiki, same fix needed.
zd	1	not required	false	Conformant -- trunk-only, never had the promotion-divergence exposure.
zsh-lint	2	n/a	false	No ruleset at all; classic protection has required_approving_review_count: 0. This is the exact example that opened ADR-0013's Context section, still unaddressed.
zi	3	required (ruleset, S-level, fine)	true	ADR-0013 explicitly recommends against enforce_admins, citing this week's wiki deadlock as the reason it would become unrecoverable. zi currently has it enabled.
zsh-eza	3	required (ruleset, fine for class 3)	n/a (no classic)	Conformant.
z-a-meta-plugins	3	required (classic, fine)	false	Conformant; also has required_approving_review_count: 1.
zsh-fancy-completions	3	required (classic, fine)	false	Conformant.
.github	4	required (ruleset)	false	Conformant with this repo's own accepted baseline.

Long tail (77 repos not named above, presumptively class 3 per ADR-0007)

• No rules at all: 56 (73%)
• Any rule present: 21
• Linear history active: 2
• A required-review rule (ruleset pull_request or classic count > 0): 5 total

This is broadly consistent with ADR-0013's own sequencing ("apply per repository, deliberately, starting with class 1 and class 2") -- class 3 lagging is expected, not a surprise finding.

Suggested priority if/when gated apply starts

1. wiki, src: remove the now-nonconformant required_linear_history rule -- this is the one live case actively reproducing the docs(runbooks): document the post-promotion branch reconcile #473 problem on every promotion.
2. zi: reconsider enforce_admins given the ADR's explicit warning.
3. zsh-lint: the original motivating example is still open.

No settings were changed. This comment is evidence only.

[ss-o]

Owning-repository rollout issues opened -- 2026-07-25

Derived from the audit above plus ADR-0009's now-accepted requirements, not templated:

• z-shell/wiki#813 -- mark existing CI as required status checks
• z-shell/zd#86 -- same, plus no pull_request rule at all
• z-shell/zsh-lint#90 -- require the Go suite before merge/release (ADR-0013's own motivating example)
• z-shell/zsh#17 -- bigger gap: the 9Z1 install/smoke-test workflow does not exist yet, not just a settings toggle
• z-shell/zunit#12 -- scope question, not a standard ask: zunit is a maintained fork of zunit-zsh/zunit

Repositories found already conformant on required checks (src, zsh-eza, zi) and class-3 validation-only repositories (z-a-meta-plugins, zsh-fancy-completions) did not get an issue -- no fabricated busywork.

[ss-o]

Gated apply, round 1 (2026-07-25)

Following ADR-0013's audit-then-gated-apply pattern, the first batch of maintainer-reviewed changes has been applied.

required_linear_history removed (the #473 contradiction)

Both z-shell/wiki (ruleset 5612688) and z-shell/src (ruleset 19649341) still had required_linear_history active on main, directly contradicting ADR-0013's class-1 disposition and reproducing the exact mechanism behind #473. Removed from both, all other rules on each ruleset left untouched and verified by re-GET after each change.

Required status checks added

• wiki (Mark existing CI checks as required status checks (ADR-0009) wiki#813, closed): added to the same ruleset 5612688. Required: Trunk Code Quality / Trunk Code Quality, Analyze (actions), Analyze (javascript-typescript). Excluded ci-perf.yml's checks (path-filtered, excludes docs/** and friends -- would block most PRs to a docs wiki) and Cloudflare Pages (external, fork-flaky).
• zd (Mark existing CI checks as required status checks (ADR-0009) zd#86, closed): new ruleset with pull_request + 11 required_status_checks contexts across docker.yml's versioned build matrix and test-native.yml's zunit matrix, all confirmed to fire unconditionally on PRs. zd#86's original text incorrectly named test-matrix.yml as one of the unenforced suites; corrected in the issue (it's schedule/dispatch-only and never runs on a PR -- test-native.yml was the real gap).

Not applied: zsh-lint (z-shell/zsh-lint#90, left open)

Verification found this one unsafe to apply as scoped: go-ci.yml is path-filtered (would permanently block any non-Go PR from merging once required), and main is independently already red on build-test (z-shell/zsh-lint#91, filed separately -- a Dependabot action-version bump drifted from a hardcoded contract-test expectation). Requiring the check needs a workflow change first; left for a maintainer decision rather than applied or silently worked around.

Still open in this round

• z-shell/zsh#17 (packaged-zsh release-gate smoke test, per 9Z1): in progress, requires authoring a new workflow, not just a settings change.
• z-shell/zunit#12 (fork-scope question): awaiting a maintainer answer before any settings apply is even considered there.
• zi's enforce_admins: true (flagged in the original audit as contradicting ADR-0013): not yet actioned.

[ss-o]

Gated apply: z-shell/.github ruleset reconciliation (2026-07-28)

PR #489 exposed a repeatable configuration mismatch. CodeQL Advanced / Analyze (actions) succeeded, and the dynamic CodeQL run succeeded for Go, Python, and Ruby, but the separate CodeQL merge-protection check was neutral because the default branch still had the stale advanced-setup category /language:python from .github/workflows/codeql.yml.

Live repository changes

Before this apply, the repository had three active rulesets plus classic main protection:

• main ruleset 19646747, including CodeQL merge protection, an empty deployments rule, no pull-request rule, and a second Copilot rule;
• next ruleset 19646720, although ADR-0008 assigns .github to trunk on main and no next branch exists;
• standalone Copilot ruleset 19506916; and
• classic protection applying alongside the rulesets.

Applied and verified:

1. Updated ruleset 19646747 in place, preserving all four bypass actors.
2. The single remaining main ruleset now contains exactly: deletion, non_fast_forward, required_linear_history, required_signatures, pull_request (code-owner review, zero approving-review count), and copilot_code_review (review on push and drafts).
3. Removed the CodeQL merge-protection rule, the empty deployments rule, and the duplicate Copilot configuration. No CodeQL analysis or alert history was deleted.
4. Deleted obsolete ruleset 19646720 and duplicate ruleset 19506916.
5. Deleted legacy classic main protection after the replacement ruleset was verified.

Post-apply evidence:

• GET /repos/z-shell/.github/rulesets returns only active ruleset 19646747.
• gh ruleset check main --repo z-shell/.github reports the six intended rules from that ruleset.
• The classic branch-protection endpoint returns the expected 404 while the main branch still reports protected: true through the ruleset.
• PR fix: use METRICS_TOKEN for cross-org repository template steps in metrics workflow #489 reports mergeable: MERGEABLE and mergeStateStatus: CLEAN.

Instruction impact review

1. Classification: private workspace routing/enforcement. The public ADRs and branch-protection runbook remain the canonical prose.
2. Consumers and contexts: every supported private workspace runtime performing branch-protection, repository-rulesets, or repository-settings work.
3. Canonical owner: unchanged: ADR-0008, ADR-0013, and runbooks/branch-protection.md in z-shell/.github.
4. Duplication or contradiction: none added. The private route links to public canonical sources rather than copying their rules.
5. Manifest impact: the private manifest gains a required repository-rulesets route. The public manifest already routes the canonical runbook for branch-protection, so no public ownership change is needed.
6. Mandatory delivery: the route is required and does not depend on an optional hook, agent, or skill.
7. Generated output and limits: AGENTS.md remains current; the private generator check, all 76 instruction contract tests, JSON validation, and git diff --check pass. The generated composite is unchanged because this is a routing-only update.

The private workspace patch is local and not published by this settings apply.

[ss-o]

Ruleset and instruction-routing follow-up completed:

• Repository ruleset main is active as the single branch ruleset, and PR fix: use METRICS_TOKEN for cross-org repository template steps in metrics workflow #489 was no longer blocked by the stale neutral CodeQL configuration.
• PR fix: use METRICS_TOKEN for cross-org repository template steps in metrics workflow #489 merged as df26c8e0ae1357dc454570dc539e0821c30605b2.
• The post-merge Z Metrics run succeeded, including all seven lowlighter/metrics steps: https://github.com/z-shell/.github/actions/runs/30406990580
• The private workspace routing fix merged as ss-o/z-shell#4 at 6536e5b74e5cc4509125afe25bb6a88393e8737f. It makes repository ruleset/settings tasks load ADR 0008, ADR 0013, and runbooks/branch-protection.md, with exact contract and selection tests.

Audit exception: GitHub synthesized a prohibited Co-authored-by trailer in the already-created squash commit for #489. Published main history was not rewritten. This is additional evidence for the enforcement gap tracked by #464.