docs(admin): add guide for enabling fullsend on private repositories

[fullsend-ai-coder]

defaults, AGENTS.md examples for preventing sensitive content reproduction, guardrail testing procedures, and deployment guidance based on data sensitivity.

Co-Authored-By: Claude Opus 4.6 noreply@anthropic.com

---

Closes #1188

Post-script verification

• Branch is not main/master (feat/1188-private-repo-admin-guide)
• Secret scan passed (gitleaks — 5f4e79e1610ae3ce8e8bcf95d530c1974ae6fcc1..HEAD)
• Pre-commit hooks passed (authoritative run on runner)
• Tests ran inside sandbox

[github-actions]

Site preview

Preview: https://f7dbfe8c-site.fullsend-ai.workers.dev

Commit: 58c23c58e9e1d9a335222b7f6b511187c087c9c0

[fullsend-ai-review]

Review

Findings

Low

• [docs-currency] docs/guides/admin/installation.md — The installation guide discusses .fullsend config repo visibility constraints and private repository behavior (the paragraph noting that making .fullsend private causes silent failures for public/internal repos) but does not cross-reference the new private-repositories.md guide. Adding a "see also" link would help administrators who encounter the visibility warning during initial setup find the comprehensive private-repo guidance without searching.
  Remediation: Add a cross-reference after the visibility paragraph in installation.md pointing to private-repositories.md.

Info

• [scope-note] docs/guides/admin/private-repositories.md — A contributor comment on Admin guide: enabling fullsend on private repositories #1188 requested coverage of indirect exposure paths — public repos with connections to private data (e.g., kustomize overlays, shared configs, cross-repo build dependencies). The guide partially addresses cross-visibility concerns (.fullsend config repo, retro agent) but does not cover the broader pattern of public repos inheriting private context. This could be addressed in a follow-up.

Previous run

Review

Findings

Info

• [intent-alignment] docs/guides/admin/private-repositories.md — The guide covers all five areas requested in Admin guide: enabling fullsend on private repositories #1188 but does not address the indirect exposure paths raised in the contributor comment: cross-repo build dependencies, kustomize overlays, and shared configs that create indirect data exposure between private and public repos. This is a meaningful gap worth covering in a follow-up.
  Remediation: Add a section covering indirect exposure paths — scenarios where public repos with agentic workflows inherit access to private data through cross-repo dependencies (e.g., kustomize overlays, shared configs, cross-repo build inputs).

[fullsend-ai-review]

[info] intent-alignment

The guide covers all five areas requested in #1188 but does not address the indirect exposure paths raised in a contributor comment: cross-repo build dependencies, kustomize overlays, and shared configs that create indirect data exposure between private and public repos. This is a meaningful gap worth covering in a follow-up.

Suggested fix: Add a section covering indirect exposure paths — scenarios where public repos with agentic workflows inherit access to private data through cross-repo dependencies (e.g., kustomize overlays, shared configs, cross-repo build inputs).

[fullsend-ai-review]

Review follow-ups

Created follow-up issues for actionable non-blocking review findings:

• #1223 — Installation guide discusses .fullsend visibility constraints for private repos but does not cross-reference the new private-repositories.md guide. A see-also link would help admins find comprehensive private-repo guidance.
• #1224 — Contributor comment on Admin guide: enabling fullsend on private repositories #1188 requested coverage of indirect exposure paths (public repos with connections to private data). The guide partially covers cross-visibility concerns but does not address the broader pattern. Could be a follow-up.

Previous run

Review follow-ups

Created follow-up issues for actionable non-blocking review findings:

• #1219 — The guide covers all five areas requested in Admin guide: enabling fullsend on private repositories #1188 but does not address the indirect exposure paths raised in a contributor comment: cross-repo build dependencies, kustomize overlays, and shared configs that create indirect data exposure between private and public repos. This is a meaningful gap worth covering in a follow-up.