Audit organization-wide adoption and override drift

[cervantesh]

Maturity context

• Project maturity: developing (51/100)
• Dimension: operations_observability
• Priority: medium

Evidence

• README.md relies on GitHub default inheritance
• No workflow or report verifies which repositories inherit or override each file
• GitHub community profile reports 87% only for this repository

Scope

• Build a read-only scheduled audit of active organization repositories and their community-profile endpoints.
• Report inherited, overridden, missing, and stale policy/template coverage per repository.
• Flag unreachable contact links and repositories without a usable private security path.
• Publish a bounded artifact or summary without exposing private repository content.

Acceptance criteria

• The audit enumerates every active in-scope repository and all default community-health file categories.
• Each result distinguishes inherited, repository override, and missing states.
• The job uses read-only permissions, redacts private metadata from public artifacts, and never mutates repositories.
• A documented owner and review cadence exist for audit failures.

Help wanted

Suitable for a GitHub API contributor; organization owners should review privacy boundaries for private-repository reporting.

---

Generated from the repository maturity assessment dated 2026-07-11. Do not include credentials, customer data, or local-only files in public discussion.

[cervantesh]

Completed by PR #9. The merged governance change adds portable issue forms, private security reporting and response targets, CODEOWNERS/continuity policy, read-only adoption auditing, a maintained public project directory, and documented inheritance/override verification.