Drop the private-repo premise, and stop auditing the hub against itself

[ptr727]

Found by running the live audit against the hub itself while checking that the tooling handles the shape Blog is about to become. Two defects in one check, both in spec/audit.py's carried-file template-reference rule.

1. The stated reason is false

The check justified itself this way, in the code comment, the finding text, and the recurring.norepoxref assertion in spec/project-types.json:

private, so it 404s for the carrying repo's readers

This repository has been public since 2026-07-26, confirmed live:

$ gh api repos/ptr727/ProjectTemplate --jq '{private, visibility}'
{"private": false, "visibility": "public"}

So a reference does not 404, and that half of the justification is dead.

The rule itself survives, on the second reason project-types.json already gave: the coordination flow is machinery a consumer should not see, so a carried file states the behavior rather than the destination. The wording now rests on that alone, corrected in all three places that carried the dead premise.

This matters beyond tidiness. A rule whose stated reason is checkably false is a rule the next agent argues with, and a downstream repo carrying the assertion inherits the false claim.

2. It fired on the hub itself

Auditing ProjectTemplate reported its own AGENTS.md as drift for naming the repository it lives in:

DRIFT carried: AGENTS.md references the template repo by name or link ...

That is a false positive. The hub's carried files are the source, and naming itself there is correct and unavoidable. A downstream repo naming it is still flagged, which is the actual point of the rule.

The fix reuses the guard the section check at the same layer already uses (entry.get("name") != HUB_NAME), whose comment states the same rationale: "Skip the hub itself: its copies are the source." The idiom existed; this check had simply omitted it.

Verification

The check reads the repo over the API, so it is not reachable from the offline --selftest. The evidence is the live audit before and after, not a unit test.

Before:

== ProjectTemplate (source-only, docs; release) @ main@6501479 ==
DEFECT settings: has_discussions live=False expected=True
DRIFT carried: AGENTS.md references the template repo by name or link (private - 404s ...)
1 repo(s) audited; 1 defect/letter/error finding(s).

After:

== ProjectTemplate (source-only, docs; release) @ main@6501479 ==
DEFECT settings: has_discussions live=False expected=True
1 repo(s) audited; 1 defect/letter/error finding(s).

The false DRIFT is gone and the real defect is untouched.

python3 spec/audit.py --selftest SELFTEST PASS
python3 spec/validate.py OK, 21 cataloged
python3 scripts/test_prose_lint.py 141 tests, OK
python3 scripts/repo_gate.py eol 0, sha-pin 0
prose_lint --check charset --check dupword --check spelling clean

spec/audit.py carries a large pre-existing comment backlog. This PR does not sweep it, but the rewritten block leaves the file slightly better rather than worse: 105 -> 103.

A separate finding this surfaced, for the maintainer

has_discussions is false on this repository while repo-config/settings.json and configure.sh expect true for a public repo. It is a real settings drift, not a tooling bug, and repo-config/configure.sh apply would set it. Enabling Discussions is a visible change to the repository, so it is left for the maintainer rather than applied here.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This PR updates the hub’s live-audit “carried files must not reference the template repo” rule to (1) remove the now-false “template is private” premise and (2) avoid falsely flagging the hub repository when it audits itself.

Changes:

• Updates the recurring.norepoxref intent assertion to remove the “private repo / 404” justification.
• Adjusts spec/audit.py to skip the template-reference check when auditing the hub itself, preventing a self-audit false positive.
• Refines the drift message/commentary to focus on “coordination machinery” as the reason.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
spec/project-types.json	Updates the documented intent for the “no coordination references in carried files” rule.
spec/audit.py	Changes the carried-file template-reference check to skip the hub itself while continuing to flag downstream repos.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Suppressed comments (1)

spec/audit.py:626

• The comment says this check targets the "agent-instruction files", but the path list includes GOVERNANCE.md, which is primarily rule text. Consider rewording to something like "carried guidance docs" (or explicitly listing the files) to avoid misleading future maintainers about what’s being scanned.

 # The coordination flow is machinery a consumer should not see, so a carried file states the behavior rather than the destination.
# This checks the agent-instruction files, where a stale "report drift upstream" paragraph once spread.
# Skip the hub itself, whose own carried files are the source, where naming the repo they live in is correct.

[ptr727]

Closing the loop on the suppressed finding from the second round, since a suppressed finding gets verified rather than skipped.

Real, and fixed in 21f67da. The comment described the scanned paths as "the agent-instruction files" while the tuple includes GOVERNANCE.md, which is rule text rather than agent instructions:

forpathin ("AGENTS.md", "GOVERNANCE.md", ".github/copilot-instructions.md"):

This is the same mismatch the previous round raised against spec/project-types.json, and I had only half-fixed it: the spec assertion got the three names, the code comment kept the wrong collective noun. It now names them too, so the code and the spec describe the same three paths in the same terms.

Worth noting the two rounds found the identical defect in two places. Naming the files rather than characterizing them is what stops it recurring.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.