[imanimanyara]

Summary

The positive control added in #23 can pass while the gate is blind. checks: read is enforced on
private repositories only, so a probe that lands on a public repo reports "readable" even when
every private repository answers 403 — and the estate's Dependabot pull requests sit
overwhelmingly in private repos.

This sorts candidates private-first over a wide enough page, names the visibility that was
verified, and — where only a public repository was available — says that the read does not exercise
checks: read.

#23 misread the evidence, and this is the correction

I claimed "every pull request the gate examined errored" in run 41713055813. That was wrong. The
simtabi job examined one pull request and it passed:

merge (simtabi)  1 open Dependabot pull requests.
| simtabi/cli-kit-js | 24 | hold | update type not recognised (group tooling is not the policy group) |

A real policy decision, so check_runs succeeded — with the same token that answered 403 for four
other orgs. The discriminator is visibility, not the org:

repo	visibility	result
simtabi/cli-kit-js	public	read succeeded
simbi-prjs-clt/{staging.freeby.io,staging.legalmizer.com,swamari.com,theomaris.com}	private	403
simbi-prjs-int/creamer.simtabi.com	private	403
tusente/web-app	private	403
tayariai/{tayariai,gpt,v2}	private	403

So the run was five vacuous greens (0 pull requests) plus one genuine pass on a public repo,
not six vacuous ones.

Why that breaks the control as merged

Measured against main, the repository checks_readable() picks per org:

org	picks	visibility
simtabi	simtabi/go-notifykit	public
ichava	ichava/icon-sets-sync	public
laranail, tusente, tayariai, simbi-prjs-clt, simbi-prjs-int, brandgulp	various	private

For simtabi and ichava it would have reported "readable" under exactly the 2026-11-03
conditions. The other six pass only by luck of which repository was pushed most recently, which
changes constantly — so this is a latent false pass, not a fixed one.

Verification

• Suite 27 → 30, OK.

• Guard proven to have teeth: removing the private-first sort makes
  test_control_prefers_a_private_repository fail (FAILED (failures=1)); restoring it returns 30
  OK. Its fixture is the real shape — public repo readable, private repo 403 — and asserts the
  control returns False rather than passing on the public read.

• A public-only account still verifies (test_a_public_only_account_still_verifies): with no
  private repository there is no private blindness to detect.

• Live, read-only, against the two that previously picked public:

  simtabi   ok=True  verified on simtabi/somesha-ios@main   (private)
  ichava    ok=True  verified on ichava/ichava.com@main     (private)
  laranail  ok=True  verified on laranail/tayari-ui@main    (private)
  brandgulp ok=True  verified on brandgulp/brandgulp.com@main (private)
  tusente   ok=True  verified on tusente/web-app@main       (private)
  

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota. Try requesting a review at a lower effort level.