Branch protection audit findings

[github-actions]

Findings

• Branch protection API inaccessible for main (HTTP 403); permission scope may be insufficient.

Audit status

• Status: inconclusive_permissions
• Run: https://github.com/Prekzursil/Reframe/actions/runs/22534048610

Required action

• Resolve policy drift, or grant branch-protection read scope for this workflow when status is inconclusive.

[github-actions]

Findings

• Branch protection API inaccessible for main (HTTP 403); permission scope may be insufficient.

Audit status

• Status: inconclusive_permissions
• Run: https://github.com/Prekzursil/Reframe/actions/runs/22564732690

Required action

• Resolve policy drift, or grant branch-protection read scope for this workflow when status is inconclusive.

[Prekzursil]

Latest branch-protection evidence refresh (PR #96 branch):

• Branch Protection Audit: https://github.com/Prekzursil/Reframe/actions/runs/22599126733
• strict23 preflight: https://github.com/Prekzursil/Reframe/actions/runs/22599125516

Both runs classify status as inconclusive_permissions due API response 403 Resource not accessible by integration for branch protection endpoints.

Keeping #89 open as the single active tracker for permission-scope closure. No current evidence of policy-drift mismatch in these runs; blocker is access scope, not context mapping drift.

[Prekzursil]

Post-merge evidence update (2026-03-02):

• Umbrella PR merged: feat: enterprise identity, collaboration, and multi-channel automation umbrella #96
• Merge commit on main: 664e95019c28338910308c168f912b2e5a5a69ff
• Post-merge readiness run on main: https://github.com/Prekzursil/Reframe/actions/runs/22599936721 (success)
• Readiness artifact status: READY (docs/plans/2026-03-02-release-readiness-summary.json in run artifact)

Current issue disposition:

• Keeping Branch protection audit findings #89 open as the single tracker for branch-protection audit permissions behavior (inconclusive_permissions handling), since that is distinct from product/runtime readiness and still policy-signal hygiene work.
• No new drift findings were introduced by PR feat: enterprise identity, collaboration, and multi-channel automation umbrella #96.

[Prekzursil]

Additional post-merge checkpoint (2026-03-02):

• Follow-up docs-sync PR merged: chore: sync section 26 post-merge evidence #99 (0e04dbd)
• Latest post-merge readiness on main after chore: sync section 26 post-merge evidence #99: https://github.com/Prekzursil/Reframe/actions/runs/22600367924 (success)
• main remains READY

Issue #89 remains the single tracker for Actions token scope limits around branch-protection API checks (inconclusive_permissions handling).