Host Repository Configuration Only in the Hub

.agents/skills/audit-a-repo/SKILL.md

@@ -22,7 +22,7 @@ The audit is the fleet's measurement procedure, and the two failure shapes it gu
 - **Know what the runner does and does not prove.** `spec/audit.py` mechanizes the deterministic subset only: settings, rulesets, secret names, file and section presence, verbatim hashing, interface wiring, Dependabot coverage, branch facts. It evaluates no check under a type in `spec/project-types.json`, so every per-type check is judged by hand, and a clean run is no evidence for them (`AUDIT.md` section 4). Silence from a tool that was never looking reads exactly like a pass.
 - **Judge letter and intent per check** and keep the vocabulary: letter miss with intent satisfied is a drift finding, both missing is a defect, and operational is binary over the applicable set (`AUDIT.md` sections 4 and 7). Do not invent a parallel scheme.
 - **Assert the Actions implement `WORKFLOW.md`** by outcome, not by matching catalog snippets byte for byte: the 5A static audit with a `file:line` citation per applicable guarantee, then the 5B trace scenarios (`AUDIT.md` section 5). The `workflow-ci-contract` skill summarizes that contract.
-- **Diff live settings, rulesets, and secrets** against `repo-config/` with the normalized comparisons `AUDIT.md` section 6 gives, using its commands rather than hand-rolled ones, since the normalization details (rule sorting, `bypass_actors` deliberately excluded, the operational develop payload) are where hand-rolled diffs go wrong.
+- **Check live settings, rulesets, and secrets from a hub checkout at `main`** with `AUDIT.md` section 6. Run `repo-config/configure.sh check` with the target repository and model rather than constructing a local comparison. The hub payloads are the only repository-configuration source.
 
 ## Reporting
 

.agents/skills/comment-and-doc-style/SKILL.md

@@ -194,7 +194,7 @@ file type, operational-repo overrides, extensionless-script pins, and auditing,
 ## Carried files reference no coordination machinery
 
 `AGENTS.md`, `GOVERNANCE.md`, `CODESTYLE.md`, `WORKFLOW.md`, `.github/copilot-instructions.md`,
-the `repo-config/` and `spec/` files, and the carried `AUDIT.md` never reference the template repo
+the `spec/` files and the carried `AUDIT.md` never reference the template repo
 (in prose or a link), and never name a sibling fleet repo as an illustrative example. State the
 behavior a carried rule needs, not the coordination flow that produced it, the maintainer supplies
 the destination out of band. A contextually relevant link to a related project (the image this

.agents/skills/comment-and-doc-style/references/carried-doc-references.md

@@ -7,7 +7,7 @@ doc.
 ## Which files this governs
 
 `AGENTS.md`, `GOVERNANCE.md`, `CODESTYLE.md`, `WORKFLOW.md`, `.github/copilot-instructions.md`,
-the `repo-config/` and `spec/` files, and the carried `AUDIT.md`, the files the fleet carries
+the `spec/` files and the carried `AUDIT.md`, the files the fleet carries
 verbatim or at `intent` fidelity from the hub into every repo. This rule governs carried template
 content only. A repo's own `README.md` and topical docs are its own content, never carried
 verbatim, and this rule does not reach them.

.agents/skills/operational-vs-release-workflow/references/branch-protection-and-promotion.md

@@ -8,18 +8,13 @@ covers that case).
 
 ## Configuring branch protection: don't hand-build the rules
 
-Reconstructing rulesets by hand is error-prone and has gone wrong on past ports. First delete
-**all** legacy classic branch-protection rules and any stray rulesets (rulesets are the *only*
-mechanism used), then create **exactly two rulesets named `develop` and `main`** by importing the
-committed `repo-config/*.json` ruleset payloads via `gh api -X POST "repos/<owner>/<repo>/rulesets"`
-(`gh ruleset` is read-only). The names are load-bearing, other governance content and the
-workflows reference them. Operational repos import `repo-config/operational/develop.json` as their
-`develop` ruleset (the `main` ruleset is shared), and the hub's `repo-config/configure.sh`, run
-from a hub checkout against the repository named on its command line, selects the right `develop`
-payload from the registry `workflowModel` automatically. **Brownfield repos** (pre-existing
-history) need an extra step: `Require signed commits` rejects legacy unsigned commits and the
-admin bypass does not cover `git push --force`, so re-signing requires temporarily disabling the
-ruleset. See `repo-config/README.md` "Rulesets" for the configured state.
+Delete **all** classic branch-protection rules and stray rulesets because rulesets are the only
+protection mechanism. Create **exactly two rulesets named `develop` and `main`** from the hub's
+`repo-config/*.json` payloads. Run `repo-config/configure.sh apply <owner>/<repo>
+release|operational` from a hub checkout at `main`. The names are load-bearing because governance
+content and workflows reference them. The registry `workflowModel` selects the `develop` payload
+for a registered repository. Pass the model explicitly for a repository outside the registry.
+See `repo-config/README.md` "Rulesets" for the configured state.
 
 ## Executing a `develop -> main` promotion safely
 

.agents/skills/resync-a-repo/SKILL.md

@@ -63,7 +63,7 @@ earlier in the session.
 4. **Interface workflows.** Honor the named contract, required jobs, the ruleset-bound check name,
    the artifact-name handoff, rather than copying bytes.
 5. **Settings, rulesets, and secrets.** Run
-   `repo-config/configure.sh check <owner>/<repo> release|operational` against the repo by name,
+   `repo-config/configure.sh check <owner>/<repo> release|operational` from the hub at `main`,
    then `apply` for what it reports, never from a carried copy.
 6. **Intent files last, and by hand,** since nothing mechanical judges these.
 

.agents/skills/standup-a-repo/SKILL.md

@@ -75,7 +75,7 @@ maintainer can supply what section 0A lists.
 
 8. **Settings, rulesets, and secrets.** STANDUP.md section 4: confirm the remote and the GitHub
    repository agree before running anything else here, then apply with
-   `repo-config/configure.sh apply owner/repo release|operational` and check with the same
+   `repo-config/configure.sh apply owner/repo release|operational` from the hub at `main` and check with the same
    command's `check` subcommand, never from a hand-built or carried copy.
 
 9. **Verify with the audit.** STANDUP.md section 5: run `AUDIT.md` end to end. The repo is stood

.agents/skills/workflow-ci-contract/SKILL.md

@@ -21,7 +21,7 @@ description: >-
 ## Style Rules That Break in One-Line Diffs
 
 - **Pin every action to a commit SHA** with a trailing `# vX.Y.Z` comment, first-party included. The one documented no-pin exception is `dotnet/nbgv@master`. Invent no others.
-- **Names carry meaning**: `-task.yml` files and "task" names are reusable (`on: workflow_call`), entry points end in what they do and their names end in "action", every job `name:` ends in "job" and every step in "step". A ruleset-bound required check's job `name:` and the ruleset `context:` are one string renamed together, in the live ruleset and `repo-config/{develop,main}.json` in lockstep, or required-check enforcement silently breaks.
+- **Names carry meaning**: `-task.yml` files and "task" names are reusable (`on: workflow_call`), entry points end in what they do and their names end in "action", every job `name:` ends in "job" and every step in "step". A ruleset-bound required check's job `name:` and the ruleset `context:` are one string renamed together, in the live ruleset and the hub's `repo-config/` payloads in lockstep, or required-check enforcement silently breaks.
 - **Concurrency**: top-level workflows use `group: '${{ github.workflow }}-${{ github.ref }}'` with `cancel-in-progress: true`. The publisher is the documented exception: a global ref-independent group with `cancel-in-progress: false`, so publishes serialize and never cancel mid-push.
 - **Shells**: every multi-line bash `run:` starts `set -Eeuo pipefail`. Multi-line `if:` uses `>-`, never `|`.
 - **Boolean inputs** are declared in both trigger blocks and compared against both forms, `${{ inputs.foo == true || inputs.foo == 'true' }}`, since `workflow_dispatch` delivers strings.

.claude-plugin/fleet-skills/.source-digest

@@ -1 +1 @@
-2a00d50463f7d04c
+d8de3601d734f326

.claude-plugin/fleet-skills/skills/audit-a-repo/SKILL.md

@@ -22,7 +22,7 @@ The audit is the fleet's measurement procedure, and the two failure shapes it gu
 - **Know what the runner does and does not prove.** `spec/audit.py` mechanizes the deterministic subset only: settings, rulesets, secret names, file and section presence, verbatim hashing, interface wiring, Dependabot coverage, branch facts. It evaluates no check under a type in `spec/project-types.json`, so every per-type check is judged by hand, and a clean run is no evidence for them (`AUDIT.md` section 4). Silence from a tool that was never looking reads exactly like a pass.
 - **Judge letter and intent per check** and keep the vocabulary: letter miss with intent satisfied is a drift finding, both missing is a defect, and operational is binary over the applicable set (`AUDIT.md` sections 4 and 7). Do not invent a parallel scheme.
 - **Assert the Actions implement `WORKFLOW.md`** by outcome, not by matching catalog snippets byte for byte: the 5A static audit with a `file:line` citation per applicable guarantee, then the 5B trace scenarios (`AUDIT.md` section 5). The `workflow-ci-contract` skill summarizes that contract.
-- **Diff live settings, rulesets, and secrets** against `repo-config/` with the normalized comparisons `AUDIT.md` section 6 gives, using its commands rather than hand-rolled ones, since the normalization details (rule sorting, `bypass_actors` deliberately excluded, the operational develop payload) are where hand-rolled diffs go wrong.
+- **Check live settings, rulesets, and secrets from a hub checkout at `main`** with `AUDIT.md` section 6. Run `repo-config/configure.sh check` with the target repository and model rather than constructing a local comparison. The hub payloads are the only repository-configuration source.
 
 ## Reporting
 

.claude-plugin/fleet-skills/skills/comment-and-doc-style/SKILL.md

@@ -194,7 +194,7 @@ file type, operational-repo overrides, extensionless-script pins, and auditing,
 ## Carried files reference no coordination machinery
 
 `AGENTS.md`, `GOVERNANCE.md`, `CODESTYLE.md`, `WORKFLOW.md`, `.github/copilot-instructions.md`,
-the `repo-config/` and `spec/` files, and the carried `AUDIT.md` never reference the template repo
+the `spec/` files and the carried `AUDIT.md` never reference the template repo
 (in prose or a link), and never name a sibling fleet repo as an illustrative example. State the
 behavior a carried rule needs, not the coordination flow that produced it, the maintainer supplies
 the destination out of band. A contextually relevant link to a related project (the image this

.claude-plugin/fleet-skills/skills/comment-and-doc-style/references/carried-doc-references.md

@@ -7,7 +7,7 @@ doc.
 ## Which files this governs
 
 `AGENTS.md`, `GOVERNANCE.md`, `CODESTYLE.md`, `WORKFLOW.md`, `.github/copilot-instructions.md`,
-the `repo-config/` and `spec/` files, and the carried `AUDIT.md`, the files the fleet carries
+the `spec/` files and the carried `AUDIT.md`, the files the fleet carries
 verbatim or at `intent` fidelity from the hub into every repo. This rule governs carried template
 content only. A repo's own `README.md` and topical docs are its own content, never carried
 verbatim, and this rule does not reach them.

.claude-plugin/fleet-skills/skills/operational-vs-release-workflow/references/branch-protection-and-promotion.md

@@ -8,18 +8,13 @@ covers that case).
 
 ## Configuring branch protection: don't hand-build the rules
 
-Reconstructing rulesets by hand is error-prone and has gone wrong on past ports. First delete
-**all** legacy classic branch-protection rules and any stray rulesets (rulesets are the *only*
-mechanism used), then create **exactly two rulesets named `develop` and `main`** by importing the
-committed `repo-config/*.json` ruleset payloads via `gh api -X POST "repos/<owner>/<repo>/rulesets"`
-(`gh ruleset` is read-only). The names are load-bearing, other governance content and the
-workflows reference them. Operational repos import `repo-config/operational/develop.json` as their
-`develop` ruleset (the `main` ruleset is shared), and the hub's `repo-config/configure.sh`, run
-from a hub checkout against the repository named on its command line, selects the right `develop`
-payload from the registry `workflowModel` automatically. **Brownfield repos** (pre-existing
-history) need an extra step: `Require signed commits` rejects legacy unsigned commits and the
-admin bypass does not cover `git push --force`, so re-signing requires temporarily disabling the
-ruleset. See `repo-config/README.md` "Rulesets" for the configured state.
+Delete **all** classic branch-protection rules and stray rulesets because rulesets are the only
+protection mechanism. Create **exactly two rulesets named `develop` and `main`** from the hub's
+`repo-config/*.json` payloads. Run `repo-config/configure.sh apply <owner>/<repo>
+release|operational` from a hub checkout at `main`. The names are load-bearing because governance
+content and workflows reference them. The registry `workflowModel` selects the `develop` payload
+for a registered repository. Pass the model explicitly for a repository outside the registry.
+See `repo-config/README.md` "Rulesets" for the configured state.
 
 ## Executing a `develop -> main` promotion safely
 

.claude-plugin/fleet-skills/skills/resync-a-repo/SKILL.md

@@ -63,7 +63,7 @@ earlier in the session.
 4. **Interface workflows.** Honor the named contract, required jobs, the ruleset-bound check name,
    the artifact-name handoff, rather than copying bytes.
 5. **Settings, rulesets, and secrets.** Run
-   `repo-config/configure.sh check <owner>/<repo> release|operational` against the repo by name,
+   `repo-config/configure.sh check <owner>/<repo> release|operational` from the hub at `main`,
    then `apply` for what it reports, never from a carried copy.
 6. **Intent files last, and by hand,** since nothing mechanical judges these.
 

.claude-plugin/fleet-skills/skills/standup-a-repo/SKILL.md

@@ -75,7 +75,7 @@ maintainer can supply what section 0A lists.
 
 8. **Settings, rulesets, and secrets.** STANDUP.md section 4: confirm the remote and the GitHub
    repository agree before running anything else here, then apply with
-   `repo-config/configure.sh apply owner/repo release|operational` and check with the same
+   `repo-config/configure.sh apply owner/repo release|operational` from the hub at `main` and check with the same
    command's `check` subcommand, never from a hand-built or carried copy.
 
 9. **Verify with the audit.** STANDUP.md section 5: run `AUDIT.md` end to end. The repo is stood

.claude-plugin/fleet-skills/skills/workflow-ci-contract/SKILL.md

@@ -21,7 +21,7 @@ description: >-
 ## Style Rules That Break in One-Line Diffs
 
 - **Pin every action to a commit SHA** with a trailing `# vX.Y.Z` comment, first-party included. The one documented no-pin exception is `dotnet/nbgv@master`. Invent no others.
-- **Names carry meaning**: `-task.yml` files and "task" names are reusable (`on: workflow_call`), entry points end in what they do and their names end in "action", every job `name:` ends in "job" and every step in "step". A ruleset-bound required check's job `name:` and the ruleset `context:` are one string renamed together, in the live ruleset and `repo-config/{develop,main}.json` in lockstep, or required-check enforcement silently breaks.
+- **Names carry meaning**: `-task.yml` files and "task" names are reusable (`on: workflow_call`), entry points end in what they do and their names end in "action", every job `name:` ends in "job" and every step in "step". A ruleset-bound required check's job `name:` and the ruleset `context:` are one string renamed together, in the live ruleset and the hub's `repo-config/` payloads in lockstep, or required-check enforcement silently breaks.
 - **Concurrency**: top-level workflows use `group: '${{ github.workflow }}-${{ github.ref }}'` with `cancel-in-progress: true`. The publisher is the documented exception: a global ref-independent group with `cancel-in-progress: false`, so publishes serialize and never cancel mid-push.
 - **Shells**: every multi-line bash `run:` starts `set -Eeuo pipefail`. Multi-line `if:` uses `>-`, never `|`.
 - **Boolean inputs** are declared in both trigger blocks and compared against both forms, `${{ inputs.foo == true || inputs.foo == 'true' }}`, since `workflow_dispatch` delivers strings.