z-shell/.github main ruleset drifted: missing pull_request and non_fast_forward rules

[ss-o]

What happened

Manually running the new scripts/repo-settings-audit.rb (PR #511) against live z-shell/.github found that ruleset 19646747 on main currently has only:

deletion
required_linear_history
required_signatures
copilot_code_review

That is missing pull_request and non_fast_forward, both of which #478's 2026-07-28 "Gated apply: z-shell/.github ruleset reconciliation" comment explicitly recorded as present immediately after that apply:

The single remaining main ruleset now contains exactly: deletion, non_fast_forward, required_linear_history, required_signatures, pull_request (code-owner review, zero approving-review count), and copilot_code_review (review on push and drafts).

Confirmed directly via:

gh api repos/z-shell/.github/rulesets/19646747

ruleset.updated_at is 2026-08-16T13:12:29.895+01:00, so the rules changed sometime after 2026-07-28. Nothing in this session changed the ruleset -- this is a read-only finding from scripts/repo-settings-audit.rb, confirmed by direct gh api inspection.

Impact

• Per decisions/0013-repository-settings-baseline.md, class 4 (.github) requires pr_required and force_push_blocked ("R"). Both are currently unsatisfied on this repo's own main branch -- the same "declared but unenforced" pattern ADR-0013 and ci: enforce commit-trailer and commit-message policy org-wide, not in one repo #464 both describe, now on the meta repo itself.
• No classic branch protection exists as a fallback (404 on branches/main/protection), so nothing else is currently blocking a direct push or a force-push to main.

Suggested fix

Restore the ruleset to the shape #478's comment recorded, per runbooks/branch-protection.md's "Reference ruleset shape" section (main: deletion, required_linear_history, pull_request with code-owner review and 0 approving-review count, non_fast_forward, copilot_code_review, plus required_status_checks once a guard workflow exists). Verify with gh api repos/z-shell/.github/rulesets/19646747 after applying, and re-run scripts/repo-settings-audit.rb --repo z-shell/.github to confirm it reports clean.

Agent handoff

• Status: Ready for review
• Current state: Drift confirmed via live gh api, not yet remediated.
• Blockers: None; needs a maintainer decision on whether to restore via gh api ruleset PATCH or via the UI.
• Next steps: Restore pull_request and non_fast_forward rules on ruleset 19646747, then re-run the audit script to confirm.
• Related tracker/issues: Track ADR-0013 rollout: repository settings baseline audit #478, PR feat(scripts): add read-only repository settings audit #511 (introduces the audit tool that found this).

[ss-o]

Verification: drift already resolved

Re-checked live state:

$ gh api repos/z-shell/.github/rulesets/19646747 --jq '.rules[].type, .updated_at'
deletion
required_linear_history
required_signatures
copilot_code_review
pull_request
non_fast_forward
2026-08-16T14:00:00.011+01:00

All 6 rules from runbooks/branch-protection.md's reference shape are present again, including pull_request and non_fast_forward. The ruleset's updated_at (14:00:00+01:00) is later than this issue's filing (12:30:20Z / 13:30+01:00) and later than the drifted state this issue reported (13:12:29+01:00), so something restored the two missing rules after the issue was opened.

Confirmed with the actual audit tool:

$ ruby scripts/repo-settings-audit.rb --repo z-shell/.github
## z-shell/.github (class 4)
WARN (recommended, not satisfied):
- required_status_checks

No FAIL. The only remaining gap is required_status_checks, which is S (recommended, not required) for class 4 per decisions/0013-repository-settings-baseline.md -- pre-existing, not new drift.

Agent handoff

Status: Blocked (on root-cause, not on remediation -- remediation is already done)
Repository: z-shell/.github
Tracker/Issue: #512 (this issue), #478

Current state

• pull_request and non_fast_forward are both present on ruleset 19646747 again.
• scripts/repo-settings-audit.rb --repo z-shell/.github reports no FAIL, only the pre-existing required_status_checks recommendation.

Verification

• gh api repos/z-shell/.github/rulesets/19646747: 6/6 reference rules present, updated_at newer than this issue.
• ruby scripts/repo-settings-audit.rb --repo z-shell/.github: clean except recommended required_status_checks.

Blockers

• Root cause of the original removal (between 2026-07-28's Track ADR-0013 rollout: repository settings baseline audit #478 apply and this issue's 12:12 UTC check) is still unknown. Nothing in this or the filing session changed the ruleset; GitHub's audit log for ruleset history was not checked here.

Next steps

1. If chasing root cause: check the ruleset's change history via the repo's Settings > Rules UI (audit log) or gh api repos/z-shell/.github/rulesets/19646747/history if available, to identify the actor/timestamp of both the removal and the restoration.
2. Otherwise, close once satisfied the remediation is durable -- no further action needed on the rules themselves.