Retire the Carried Copy of the Configure Script

[ptr727]

Step 2 of the resync, per the hub's RESYNC.md section 3. Follows #89, which carried the instruction set this step is judged against.

The deletion

The hub hosts repo-config/configure.sh and no repository carries it, per GOVERNANCE.md "Hub-Hosted Tooling" and a retire disposition in the hub's spec/divergences.json. That disposition is what authorizes the removal: an untriaged hit could be this repo's own content at a shared path, and deleting that would destroy work the hub never owned.

A carried copy is current only until the next fix to it, and this one was already a past revision.

The sweep is four more edits, and that is the point

The hub's RESYNC.md section 4 counts the inbound sweep as part of the deletion, because the removal is one edit and finishing the job usually takes several more.

File	Was	Now
repo-config/README.md	Described a local script with two modes	Described as hub-hosted, with the invocation naming this repo as its argument
AUDIT.md	A runnable command, repo-config/configure.sh check ptr727/Blog release	Same command, stated as running from a hub checkout, so the path resolves where it is typed
TODO.md	Listed the script among files that must not be edited	No longer, since there is no local copy to protect

A dead link disappoints; a documented command fails. That is why the AUDIT.md line mattered most.

Four mentions stay, deliberately

• GOVERNANCE.md carries two inside verbatim sections that name it as the hub's. This repo may not edit those and does not need to: Re-vendor the Carried Rule Sections From the Current Hub #89 re-vendored them from the hub revision that corrected the wording.
• TODO.md keeps two that are about the path rather than uses of it, one recording a past re-vendor and one stating what configure.sh check reports. Both stay true.
• reports/Blog/audit.md keeps its own. A committed audit report is a point-in-time record replaced wholesale by a new run rather than edited, per the hub's AUDIT.md section 8.

One unrelated correction in a file already being edited

repo-config/README.md described the ruleset payloads as carrying bypass_actors. No payload declares one, the field is deliberately unmanaged, and the hub corrected the same sentence in its own copy. That file is intent fidelity, so it is presence-checked only and nothing mechanical would ever have reported this — it is exactly the class the hub's RESYNC.md section 5 warns a resync cannot detect. Leaving a known-false claim in a file being edited is worse than the edit.

Verification

prose_lint --diff HEAD, repo_gate --check eol, markdownlint-cli2 on all three changed docs, editorconfig-checker: all clean. No workflow or config file referenced the script.

Still to come

host-tools.json, then the README structure work.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This PR removes the repository-carried repo-config/configure.sh in favor of the hub-hosted script, and updates the local documentation to reflect that configure.sh is run from a hub checkout (while this repo continues to carry the ruleset/settings payloads it is audited against).

Changes:

• Delete the carried repo-config/configure.sh (retired in favor of the hub-hosted copy).
• Update AUDIT.md and repo-config/README.md to document running repo-config/configure.sh from a hub checkout and explicitly naming the target repo.
• Update TODO.md to remove the retired script from the “do not edit carried files” list and explain the retirement.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

File	Description
TODO.md	Removes repo-config/configure.sh from the “do not edit” list and documents the retirement rationale.
repo-config/README.md	Rewords guidance to clarify configure.sh is hub-hosted and how to invoke it for this repo; clarifies bypass_actors is unmanaged.
repo-config/configure.sh	Deletes the carried script from this repository.
AUDIT.md	Adds an explicit note that the repo-config/configure.sh check ... command is run from a hub checkout.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.

Suppressed comments (2)

repo-config/README.md:7

• The README describes running the hub-hosted script as configure.sh ..., but from a hub checkout the script lives at repo-config/configure.sh (it won’t run unless the caller happens to have it on PATH / is in the script directory). Using the explicit path here (and in the later Repo Settings paragraph) keeps the documented commands runnable from the hub repo root, matching AUDIT.md.

- `configure.sh`: **hosted in the hub and run from a hub checkout, not carried here**, per the Hub-Hosted Tooling rule in `GOVERNANCE.md`. The payloads above are what this repo is audited against and stay with it. The script holds nothing per-repo and is one copy for the fleet, so a carried copy would only be current until the next fix to it. Name the target repository explicitly, since the command defaults to whichever repository the shell is sitting in. Two modes over the GitHub API. `configure.sh apply ptr727/Blog release` creates-or-updates the settings, the Dependabot security features, and the rulesets idempotently. `configure.sh check ptr727/Blog release` is the read-only inverse and exits non-zero on any drift, with the assertions driven by the committed payloads rather than a byte diff, so a GitHub-normalized stored ruleset does not false-positive.

repo-config/README.md:5

• This bullet explains the audit is assertion-based (not a byte diff), but then says “nothing diffs it” for bypass_actors. Using “asserts” here keeps the terminology consistent and avoids implying there’s still a diff-based check in this repo.

- `main.json` plus one `develop` variant: the branch rulesets as the managed part of the writable API subset (`name`, `target`, `enforcement`, `conditions`, `rules`). The `develop` payload is `develop.json` (`release` repos) or `operational/develop.json` (`operational` repos). These are the canonical expected payloads that the self-audit (`AUDIT.md`) validates the live rulesets against, by asserting rule presence, merge methods and required checks rather than diffing bytes, so a ruleset GitHub has normalized does not read as drift. `bypass_actors` is writable and deliberately unmanaged, so no payload declares one and nothing diffs it: who may bypass a ruleset is a human decision taken in the UI, which the configure script preserves on `apply` and reports without asserting on `check`.

[ptr727]

Both suppressed findings addressed in 31b8d2e, and the first one lands squarely on this pull request's own subject.

The invocations were not runnable. You are right. From a hub checkout root the script is at repo-config/configure.sh, so configure.sh apply ptr727/Blog release does not run unless the caller is already in that directory or has it on PATH, and AUDIT.md gives the same command with its path. Two carried documents disagreeing on the one string a reader copies.

Worth saying plainly: this pull request exists to fix non-runnable commands left behind by a deletion, and I introduced one while doing it. The hub's sweep rule singles out the runnable-command shape precisely because a documented command fails where a dead link merely disappoints, and I wrote a failing one into the fix.

Every invocation now carries its path, in the bullet and in the Repo Settings paragraph you also flagged. I left the bare form where prose names the check rather than presenting it as a command, at AUDIT.md:53, TODO.md:17 and TODO.md:135. The line I am drawing is that a string a reader would copy has to work, not that the name may never appear unqualified. Say if you would rather it were uniform.

The terminology slip is also right. The bullet establishes that the audit asserts rather than diffing bytes and then said "nothing diffs it" of bypass_actors two clauses later. It now reads "nothing asserts it", which is both consistent and the accurate description of what check does with that field: it reports the live bypass list without asserting against it.

Gates after the change: prose_lint --diff HEAD, markdownlint-cli2, editorconfig-checker all clean.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.

Suppressed comments (1)

repo-config/README.md:26

• This paragraph uses repo-config/configure.sh apply / check without the required repo/model arguments, which contradicts the earlier guidance to name the target repo explicitly and could lead to running the hub script against the current repo (e.g., the hub checkout) by accident. Use the fully-qualified invocation (or placeholders) here too so the backticked commands are safe to copy/paste.

The fleet-standard general settings live in [`settings.json`][settings-json] and are applied idempotently by `repo-config/configure.sh apply` alongside the rulesets (`gh api PATCH /repos/{owner}/{repo}`). The two settings that depend on per-repo state, `has_discussions` (visibility) and `default_branch` (main-must-exist), are computed by the script, not stored in the file. `repo-config/configure.sh apply` also enables Dependabot vulnerability alerts and automated security updates, fleet policy applied via the API rather than a `settings.json` key. `repo-config/configure.sh check` validates all of these and exits non-zero on drift.

[ptr727]

Fixed in 2a42120, and this one is a safety finding rather than a style one, so thank you for flagging it as sharply as you did.

The hazard, stated plainly. The Repo Settings paragraph invoked repo-config/configure.sh apply with a path and no arguments. Three paragraphs above, the same file says "the command defaults to whichever repository the shell is sitting in", and the whole point of the rewrite is that the script runs from a hub checkout. So a reader copying that line while sitting in the hub would have applied configuration to the hub, not to this repository. It is an apply, so it writes by default.

Every invocation in the file now names the repository and the model:

2x repo-config/configure.sh apply ptr727/Blog release
2x repo-config/configure.sh check ptr727/Blog release
0x argument-less apply or check

Worth recording how this got worse before it got better. This is the second correction to the same commands in this pull request. The previous round added the path so they would run at all. Adding the path is exactly what turned the missing arguments from harmless into dangerous: before it, the line did not execute; after it, it executed against the wrong target. A half-fix to a command can be worse than the broken original, and I would not have predicted that ordering.

Gates after the change: prose_lint --diff HEAD, markdownlint-cli2, editorconfig-checker all clean.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.