[Vivswan]

input (under repository:)                today                       now
private: true  + visibility: public      parses; drift line only     parses; same drift line + a note naming the pair and the fix
private: false + visibility: private     parses; drift line only     parses; same drift line + the note
private: false + visibility: internal    parses; drift line only     parses; same drift line + the note
security_and_analysis: null              parses; drift line only     parses; same drift line + a note naming the key and the fix
private: true  + visibility: private     no note                     no note (control)
private: true  + visibility: internal    no note                     no note (control)
security_and_analysis: {a mapping}       no note                     no note (control)

• No file that ran before stops running. Nothing new is refused, and the drift lines are unchanged.
• The refusals wait behind two COMPAT(v4) markers. Taking them before the next major is the owner's decision.

Before

$ bun test/e2e/run.ts --scenario repository-private-visibility-contradiction-note --print-stdout | grep -E '::notice::|drift: |result: '
        drift: repository.private: true != false
        result: drift
          stdout missing: ::notice::repository.private: true contradicts repository.visibility: "public"
$ bun test/e2e/run.ts --scenario repository-null-security-and-analysis-note --print-stdout | grep -E '::notice::|drift: |result: '
        drift: repository.security_and_analysis: expected empty, live has {"secret_scanning":{"status":"enabled"}}
        result: drift

After

$ bun test/e2e/run.ts --scenario repository-private-visibility-contradiction-note --print-stdout | grep -E '::notice::|drift: |result: '
        ::notice::repository.private: true contradicts repository.visibility: "public", which means private: false, so if GitHub keeps only one of them check reports the other as drift on every run. Remove private or visibility from the settings file
        drift: repository.private: true != false
        result: drift
$ bun test/e2e/run.ts --scenario repository-null-security-and-analysis-note --print-stdout | grep -E '::notice::|drift: |result: '
        ::notice::repository.security_and_analysis: null names no feature to turn off, so check reports drift while the live repository has the mapping, and if GitHub ignores the null no apply clears it. Remove the key, or write each feature's status ("enabled" or "disabled") instead
        drift: repository.security_and_analysis: expected empty, live has {"secret_scanning":{"status":"enabled"}}
        result: drift

How

• The notes come from the declaration alone: declarationNotes seeds plan.notes, the path the phantom-key note uses.
• One table decides the pair: public means private: false, and private and internal mean true. Any other visibility draws nothing.
• Both notes say "if": the PATCH's descriptor says neither which of the two fields wins nor what a null does.
• Library: searched the section and src/engine/diff.ts. No helper words a declaration-only note.

Proof

• Tests: bun test test/sections/repository/ ends 124 pass, 0 fail. The four new note rows fail on main.
• e2e: bun test/e2e/run.ts --sections repository ends 48/48 passed. Both new scenarios fail on main.

Technical details

• Before revision: main with the two new scenario files copied in, where both scenarios fail on stdout missing.
• Third Before line: the harness names the pinned notice as missing, and the grep prints that line because the pin holds ::notice::.
• Key printed once: the engine leaves alone a line that already leads with its section key, so both notes print under repository. with no second key.
• Why a note and not a refusal: each of the four noted inputs completes its apply on main (exit 0, result: applied, PATCH 200), so each ran before.
• How that was read: each input ran through the e2e runner's parseScenario and runScenario, in check mode and in apply mode with fixpoint: converges.
• No documented failure: the vendored descriptor types the PATCH's security_and_analysis nullable: true and documents no rule between private and visibility.
• The pair, by the descriptor's words: private is "true to make the repository private or false to make it public".
• Internal means private: true: classifyVisibility in src/github/repo-visibility.ts and its test hold that reading.
• The e2e mock keeps a contradictory pair and a null: test/sections/repository/mock.ts stores the PATCH body verbatim, so the check after an apply reads clean there on both revisions.
• The mock is unchanged: nothing in the repository says which of the two keys GitHub follows, or what a null does.
• Null with no live mapping: the check reads clean and the note still prints, since the note reads the declaration alone.
• Both modes print the notes: the plan carries them, and the engine prints a plan's notes in check and in apply.
• No plan, no note: a run whose repository section fails or is skipped before it has a plan, or is not selected, prints neither note, like every other note of the section.
• A failed or denied write keeps the notes: a section whose plan succeeded prints them ahead of the failure, and ahead of the skipped line when the token is denied the write.
• Unit rows: the six private by visibility combinations of the table's three visibilities, plus null and a declared mapping.
• Unit controls: three pairs and null draw a note, and the other four rows draw none on both revisions.
• COMPAT(v4) on visibility: refuse the pair in RepositoryConfig's check, then delete the pair note.
• COMPAT(v4) on security_and_analysis: drop .nullable() so the validator's null rule refuses it, then delete the null note.
• Published schema: it accepts the same inputs as before, and the descriptions of visibility and security_and_analysis now state the notes.
• Docs: docs/sections/repository.docs.yml states both notes, and docs/reference/coverage.md is regenerated from it.
• e2e scenarios run in check mode: an apply with visibility: internal fails the harness's contract validator, since the pinned descriptor's PATCH enum omits internal.
• Gates: typecheck, lint, lint:arch, knip, check:compat, and build:check exit 0.
• Files: src/sections/repository/{index.ts,schema.ts}, test/sections/repository/repository.test.ts, test/sections/repository/scenarios/{repository-private-visibility-contradiction-note.yml,repository-null-security-and-analysis-note.yml}, docs/sections/repository.docs.yml, docs/reference/coverage.md.

[github-actions]

File size check

0 over a hard cap (fails), 6 warning(s).

File	Size	Tier	Cap
src/engine/diff.ts:56	11 comment lines	warn	10
src/github/api-error.ts:9	11 comment lines	warn	10
src/problem.ts:73	18 comment lines	warn	10
src/sections/contract/errors.ts:18	11 comment lines	warn	10
src/sections/contract/module.ts:55	12 comment lines	warn	10
src/sections/shared/list/decl.ts:265	14 comment lines	warn	10

Split the file, wrap the line, shorten or exempt the comment, or list the path in .file-size-allow.local with a # reason.

5 managed file(s) skipped; repo-platform owns them.

[github-actions]

Member shape check

16 finding(s).

File	Line	Rule
src/action/io.ts	24	one-line-comment
src/cli/actions.ts	12	one-line-comment
src/github/api.ts	55	one-line-comment
src/sections/pages/index.ts	71	one-line-comment
test/cli/actions.test.ts	45	one-line-comment
test/scripts/release-pipeline-fixture.test.ts	25	one-line-comment
test/scripts/release-pipeline-fixture.ts	53	one-line-comment
test/sections/contract/validate-hook.test.ts	80	all-or-none
test/sections/teams/teams.test.ts	20	all-or-none
test/sections/teams/teams.test.ts	23	all-or-none
test/sections/teams/teams.test.ts	24	all-or-none
test/sections/teams/teams.test.ts	25	all-or-none
test/sections/teams/teams.test.ts	26	all-or-none
test/sections/teams/teams.test.ts	28	all-or-none
test/sections/teams/teams.test.ts	31	all-or-none
test/sections/teams/teams.test.ts	34	constant-spacing

Add the blank lines, make the comment one line directly above the item, comment every field or none, or list the path in .member-shape-allow.local with a # reason.

4 generated file(s) skipped.

[Copilot]

🟢 Approval recommended

No active review issues were identified in the repository-setting informational-note changes.

No open issues 🎉

What changed in this PR

Adds informational repository-setting notes to help users resolve contradictory private/visibility values and security_and_analysis: null. Existing input acceptance, drift reporting, and apply behavior remain unchanged.

Changes:

• Adds declaration-based notes that identify the problematic settings and explain how to fix them.
• Covers contradictory pairs, null security settings, and valid controls with unit tests and check-mode scenarios.
• Documents the notes and adds comment-only COMPAT(v4) markers for future validation changes.

File	Description
test/​sections/​repository/​scenarios/​repository-private-visibility-contradiction-note.yml	Adds a check-mode scenario verifying the pair note and unchanged drift.
test/​sections/​repository/​scenarios/​repository-null-security-and-analysis-note.yml	Adds a check-mode scenario verifying the null note and unchanged drift.
test/​sections/​repository/​repository.test.ts	Tests note text, drift, and valid controls.
src/​sections/​repository/​schema.ts	Adds comments describing validation changes deferred to v4.
src/​sections/​repository/​index.ts	Generates declaration-based notes and includes them in repository plans.
docs/​sections/​repository.docs.yml	Documents both notes in coverage and schema descriptions.
docs/​reference/​coverage.md	Updates generated coverage documentation with both notes.

_{Review effort: Balanced}

[Copilot]

🟢 Approval recommended

No active review issues are blocking the repository settings note changes.

No open issues 🎉

_{Review effort: Balanced}

[Copilot]

🟢 Approval recommended

No active review issues require changes.

No open issues 🎉

_{Review effort: Balanced}

[Copilot]

🟢 Approval recommended

The repository-settings diagnostic changes have no active review issues.

No open issues 🎉

_{Review effort: Balanced}