GitHub automation practice: reconcile with the live settings and the final catalog - #597

Scope

• What this PR changes: docs/github-automation.md gains a "Current practice (2026-10-02)" section, and catalogs/foundation/automation.json gains a current_practice_20261002 block, both from read-only gh api GETs of the live ruleset and repository settings:

  • 8 required checks (the doc listed 3) and squash merges only (it listed squash and rebase);
  • sota-sources is live;
  • the PR template's Lane line and SOTA sources section;
  • the merge guard, linked from docs/lanes.md;
  • gitleaks as the required secret gate beside the report-only betterleaks trial;
  • push protection on.

  Drifted sections are marked superseded. A decision record preregisters the checks around the clean-room definitive round announced in Final catalog of 2026-10-01: the blind GPT-6.1 Sol half of the clean-install selection and its comparison with the Claude record #595: P1 is the acceptance test the round's secrets pick passes before it replaces gitleaks in the required job, and P2 runs only if the round's families split on the structural-diff slot. No workflow, ruleset, required check, gate or selection changes.

• Base commit: 8b51946ee1.

• Lane: lane:foundation (docs/ and catalogs/foundation/; manifests/evidence.json only by registration, in the last commit).

• Owned paths touched:

  • docs/github-automation.md;
  • catalogs/foundation/automation.json;
  • docs/decisions/2026-10-02-github-automation-practice.md (new);
  • tests/test_github_automation_practice.py (new);
  • manifests/evidence.json (registration only).

SOTA sources

• GitHub rulesets and required status checks: https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/available-rules-for-rulesets. The live state comes from gh api repos/seathatflowsinourveins/native-agent-stack/rulesets/23739774 and gh api repos/seathatflowsinourveins/native-agent-stack (2026-10-02).
• Preregistered harnesses:
  • Samsung/CredData (https://github.com/Samsung/CredData) for the secret-scan gate;
  • promptfoo (https://github.com/promptfoo/promptfoo) for agent-answer A/B, as AGENTS.md names;
  • difftastic (https://github.com/Wilfred/difftastic) and sem (https://github.com/Ataraxy-Labs/sem).
• Standing picks and challengers: the final catalog of 2026-10-01 (Final catalog of 2026-10-01: the blind GPT-6.1 Sol half of the clean-install selection and its comparison with the Claude record #595), and decision M45 (docs/decisions/2026-09-28-community-sweep.md).

Evidence-class table

Local commands run

$ python3 -m unittest tests.test_github_automation_practice tests.test_workflow_hardening tests.test_gitleaks_config tests.test_merge_guard_doc tests.test_adoption_docs_consistency tests.test_workflow_security_coverage
Ran 171 tests ... OK (skipped=3)
$ python3 -m unittest tests.test_github_automation_practice tests.test_gitleaks_config tests.test_workflow_hardening   # after the reword
Ran 119 tests ... OK (skipped=2)
$ the locally runnable validate.yml steps (validate.py, evidence_manifest --check, zizmor offline, build_verdicts, component_matrix, new_host_grand_list, gap_crosswalk, gap_wave_ledger, build_ecosystem, the verdict gate, ...)
all exit 0
$ python3 scripts/validate.py
{"components": 69, "hashed_files": 8976, "profiles": 4, "receipts": 186, "status": "passed"}

Decision record

docs/decisions/2026-10-02-github-automation-practice.md:

• Alternatives: switching the gates now, or leaving the doc drifted.
• Overturn: a P1, P2 or P3 result, a live ruleset or settings change, or a new final-catalog edition.

Host evidence

Not applicable: no file under evidence/hosts/.

Checklist

• New/changed GitHub Actions are pinned to a full commit SHA with a version comment (no floating tags). None changed.
• New/changed workflows declare top-level permissions: contents: read (or a narrower, explicitly justified addition). None changed.
• No secrets are printed, logged or committed; no new required secret was added without a documented owner.
• No new paid hosting, subscription or billing surface was introduced.
• Peer-owned untracked files and worktrees were preserved (not deleted, moved or overwritten).

🤖 Generated with Claude Code