GitHub

SERVED 2026-10-27 (hello-23 cacheLimits, decisions/2026-10-27-2216 and decisions/2026-10-27-2310): the github.actions-cache-limits catalogue row retention-days, {max_cache_retention_days: 7}, GitHub's documented default (the dependency-caching reference, pinned under github.docs in coverage/provider-pins.yaml). Nobody in this data set changed the limit. Conformance holds it to the served /actions/caches list: no cache was last accessed more than 7 days before the anchor. Older artifacts answer the hello-23 generation gap

SERVED 2026-09-14 (hello-20 wave W-github): features.ciRunners mints ci_cache - one row per cache key a workflow actually restores, its size and digest READ OFF the artifact row it holds rather than stored twice, and its key composed at compile time as {platform}-{artifact name}-{sha256} over that artifact's real content digest. Scoped to the default branch only: a WorkflowRun records the commit it ran on and not the branch, so attributing a cache to a feature branch would attribute it to a ref canon does not say the run was on

SERVED 2026-09-14 (hello-20 wave W-github): the host's own ephemeral pool, off the same features.ciRunners table discriminated by ownership - GitHub keeps two routes because a hosted machine and a self-hosted one are two lists, and runnersByOwnership() is what keeps a machine off the wrong one. A hosted row is ONE PROVISIONED SLOT, so maximum_runners is 1 and the pool's concurrency is the row count; image_details and machine_size_details come off the github.runner-images-github-owned and github.runner-machine-sizes catalogues this artifact has carried since hello-16, so every image and size named here is one this same host publishes

this organization built no custom runner image - nothing in canon records the act, and every hosted machine names an image from GitHub's own github.runner-images-github-owned catalogue. The organization resolves, so the honest answer is the empty {total_count: 0, images: []} page at 200; the three by-id reads over it refuse (decisions/2026-09-14-0220, note 1, which names this split)

reader.refCatalog("github.runner-images-partner") - the one catalogue in this domain with a theme leg, since source: partner names third-party vendors. licence: NO GRANT NEEDED — source: "partner" names third-party vendors, which is exactly the objection the /vendors ruling met, and it settled it by making the catalogue FICTIONAL. No vendor's data is copied, so nothing has to be licensed. Older pins answer the refCatalogs generation-gap 404 rather than an empty catalogue, which on these rows would be a false claim about the HOST. SERVED 2026-09-09 (hello-16)

reader.refCatalog("github.runner-machine-sizes") in ord order (smallest first, which key order would reverse). licence: FACTUAL — the response is hardware numbers ({id: "8-core", cpu_cores, memory_gb, storage_gb} in actions-hosted-runner-machine-spec), which carry no authorship. Older pins answer the refCatalogs generation-gap 404 rather than an empty catalogue, which on these rows would be a false claim about the HOST. SERVED 2026-09-09 (hello-16)

SERVED 2026-09-14 (hello-20 wave W-github): features.ciPolicy mints ci_policy and ci_policy_allowance, one row per scope x audience, and EVERY FIELD IS READ OFF EVIDENCE THIS ARTIFACT ALREADY CARRIES (decisions/2026-09-14-0230): allowed_actions is selected because this organization's config policy hard-fails an unapproved source, default_permissions is read because the CI principal authors no commit and no review, the fork-PR posture is the strict one vacuously satisfied because every person on this roster is a member and the one repository is private, and the action allow-list is MEASURED off the .github/workflows blobs in this same artifact so it cannot permit an action the workflows do not use. Gated on hasCiPolicy()

SERVED 2026-09-14 (hello-20 wave W-github): features.ciPolicy mints ci_policy and ci_policy_allowance, one row per scope x audience, and EVERY FIELD IS READ OFF EVIDENCE THIS ARTIFACT ALREADY CARRIES (decisions/2026-09-14-0230): allowed_actions is selected because this organization's config policy hard-fails an unapproved source, default_permissions is read because the CI principal authors no commit and no review, the fork-PR posture is the strict one vacuously satisfied because every person on this roster is a member and the one repository is private, and the action allow-list is MEASURED off the .github/workflows blobs in this same artifact so it cannot permit an action the workflows do not use. Gated on hasCiPolicy()

SERVED 2026-09-14 (hello-20 wave W-github): features.ciPolicy mints ci_policy and ci_policy_allowance, one row per scope x audience, and EVERY FIELD IS READ OFF EVIDENCE THIS ARTIFACT ALREADY CARRIES (decisions/2026-09-14-0230): allowed_actions is selected because this organization's config policy hard-fails an unapproved source, default_permissions is read because the CI principal authors no commit and no review, the fork-PR posture is the strict one vacuously satisfied because every person on this roster is a member and the one repository is private, and the action allow-list is MEASURED off the .github/workflows blobs in this same artifact so it cannot permit an action the workflows do not use. Gated on hasCiPolicy()

SERVED 2026-09-14 (hello-20 wave W-github): features.ciPolicy mints ci_policy and ci_policy_allowance, one row per scope x audience, and EVERY FIELD IS READ OFF EVIDENCE THIS ARTIFACT ALREADY CARRIES (decisions/2026-09-14-0230): allowed_actions is selected because this organization's config policy hard-fails an unapproved source, default_permissions is read because the CI principal authors no commit and no review, the fork-PR posture is the strict one vacuously satisfied because every person on this roster is a member and the one repository is private, and the action allow-list is MEASURED off the .github/workflows blobs in this same artifact so it cannot permit an action the workflows do not use. Gated on hasCiPolicy()

SERVED 2026-09-14 (hello-20 wave W-github): features.ciPolicy mints ci_policy and ci_policy_allowance, one row per scope x audience, and EVERY FIELD IS READ OFF EVIDENCE THIS ARTIFACT ALREADY CARRIES (decisions/2026-09-14-0230): allowed_actions is selected because this organization's config policy hard-fails an unapproved source, default_permissions is read because the CI principal authors no commit and no review, the fork-PR posture is the strict one vacuously satisfied because every person on this roster is a member and the one repository is private, and the action allow-list is MEASURED off the .github/workflows blobs in this same artifact so it cannot permit an action the workflows do not use. Gated on hasCiPolicy()

SERVED 2026-09-14 (hello-20 wave W-github): features.ciPolicy mints ci_policy and ci_policy_allowance, one row per scope x audience, and EVERY FIELD IS READ OFF EVIDENCE THIS ARTIFACT ALREADY CARRIES (decisions/2026-09-14-0230): allowed_actions is selected because this organization's config policy hard-fails an unapproved source, default_permissions is read because the CI principal authors no commit and no review, the fork-PR posture is the strict one vacuously satisfied because every person on this roster is a member and the one repository is private, and the action allow-list is MEASURED off the .github/workflows blobs in this same artifact so it cannot permit an action the workflows do not use. Gated on hasCiPolicy()

SERVED 2026-09-14 (hello-20 wave W-github): features.ciRunners mints runner_group/runner/runner_label and one appended job.runner column, so a canonical Job now records what it ran ON (decisions/2026-09-14-0220). Each pool holds exactly the MEASURED PEAK CONCURRENCY of the jobs it ran - the smallest fleet that could have run this traffic without a job queueing, and the only fleet size this universe has evidence for - and which machine took which job is a queue rather than a draw. busy is 0 on every row because the anchor is not mid-build. Gated on hasCiRunners(), so the 127 pins frozen before hello-20 answer the generation

SERVED 2026-09-14 (hello-20 wave W-github): the host's own ephemeral pool, off the same features.ciRunners table discriminated by ownership - GitHub keeps two routes because a hosted machine and a self-hosted one are two lists, and runnersByOwnership() is what keeps a machine off the wrong one. A hosted row is ONE PROVISIONED SLOT, so maximum_runners is 1 and the pool's concurrency is the row count; image_details and machine_size_details come off the github.runner-images-github-owned and github.runner-machine-sizes catalogues this artifact has carried since hello-16, so every image and size named here is one this same host publishes

SERVED 2026-09-14 (hello-20 wave W-github): features.ciRunners mints runner_group/runner/runner_label and one appended job.runner column, so a canonical Job now records what it ran ON (decisions/2026-09-14-0220). Each pool holds exactly the MEASURED PEAK CONCURRENCY of the jobs it ran - the smallest fleet that could have run this traffic without a job queueing, and the only fleet size this universe has evidence for - and which machine took which job is a queue rather than a draw. busy is 0 on every row because the anchor is not mid-build. Gated on hasCiRunners(), so the 127 pins frozen before hello-20 answer the generation

SERVED 2026-09-14 (hello-20 wave W-github): features.ciRunners mints runner_group/runner/runner_label and one appended job.runner column, so a canonical Job now records what it ran ON (decisions/2026-09-14-0220). Each pool holds exactly the MEASURED PEAK CONCURRENCY of the jobs it ran - the smallest fleet that could have run this traffic without a job queueing, and the only fleet size this universe has evidence for - and which machine took which job is a queue rather than a draw. busy is 0 on every row because the anchor is not mid-build. Gated on hasCiRunners(), so the 127 pins frozen before hello-20 answer the generation

SERVED 2026-09-12 (hello-19 wave W-a): `ci_binding` + `ci_binding_scope` - the settings and credentials this organization hands its pipelines. GitHub publishes ONE object as two URL families, so a secret is a binding whose value may not be published and a variable is one whose value may; canon carries exactly that boolean (`masked`) and this row is the same read with a different filter. The `actions` family is canon's `pipeline` audience; served as `organization-actions-secret`, so `visibility` is published and `selected_repositories_url` only on a `selected` row - a link on an `all` row would advertise a route that answers 409. NO `value` MEMBER IS SERVED AND NONE EXISTS: `actions-secret` declares a name and two dates, `ci_binding.value` is NULL on every masked row, and conformance asserts the property is absent from every served secret rather than trusting the schema, which sets no `additionalProperties: false`

SERVED 2026-09-12 (hello-19 wave W-a): `ci_binding` + `ci_binding_scope` - the settings and credentials this organization hands its pipelines. GitHub publishes ONE object as two URL families, so a secret is a binding whose value may not be published and a variable is one whose value may; canon carries exactly that boolean (`masked`) and this row is the same read with a different filter. The `actions` family is canon's `pipeline` audience; the repositories the secret actually reaches - `all` reaches every one, `private` the private ones, `selected` the named ones. The vendored operation declares NO 409 on the secret form (only the variable form does), so this answers the 200 whatever the visibility, and conformance fetches every repository it names to prove the link resolves

SERVED 2026-09-12 (hello-19 wave W-a): `ci_binding` + `ci_binding_scope` - the settings and credentials this organization hands its pipelines. GitHub publishes ONE object as two URL families, so a secret is a binding whose value may not be published and a variable is one whose value may; canon carries exactly that boolean (`masked`) and this row is the same read with a different filter. The `actions` family is canon's `pipeline` audience; `organization-actions-variable`, whose `value` IS declared and is READ from the artifact row canon's `value_source` names - the telemetry exporter's endpoint and its protocol - so the setting and the thing it configures cannot drift apart

SERVED 2026-09-12 (hello-19 wave W-a): `ci_binding` + `ci_binding_scope` - the settings and credentials this organization hands its pipelines. GitHub publishes ONE object as two URL families, so a secret is a binding whose value may not be published and a variable is one whose value may; canon carries exactly that boolean (`masked`) and this row is the same read with a different filter. The vendored operation declares a 200 AND a body-less 409 - "Response when the visibility of the variable is not set to `selected`" - and BOTH branches have a row in this universe, which is the vendored document specifying what the organization has to look like. This one answers the 200: the organization's OTLP protocol variable is `selected` to the repository whose collector agent is configured for that wire format. The `agents` twin answers the 409

SERVED 2026-10-27 (hello-23 cacheLimits, decisions/2026-10-27-2216 and decisions/2026-10-27-2310): the same catalogue row the organization serves, because a repository may not exceed its organization and nobody changed either; 7 days, GitHub's documented default. Older artifacts answer the hello-23 generation gap

SERVED 2026-09-14 (hello-20 wave W-github): features.ciRunners mints ci_cache - one row per cache key a workflow actually restores, its size and digest READ OFF the artifact row it holds rather than stored twice, and its key composed at compile time as {platform}-{artifact name}-{sha256} over that artifact's real content digest. Scoped to the default branch only: a WorkflowRun records the commit it ran on and not the branch, so attributing a cache to a feature branch would attribute it to a ref canon does not say the run was on

every workflow run in this universe has reached a terminal conclusion, so no concurrency group is active; the check goes red the day canon grows an in-flight run

hello-13 JobLog carries this job's log text; the documented 302 is simulated in-app (founder ruling 2026-09-02) — the Location names a signed route on the service host that serves those exact bytes as text/plain

SERVED 2026-09-12 (hello-19 wave W-a): `ci_binding` + `ci_binding_scope` - the settings and credentials this organization hands its pipelines. GitHub publishes ONE object as two URL families, so a secret is a binding whose value may not be published and a variable is one whose value may; canon carries exactly that boolean (`masked`) and this row is the same read with a different filter. The `actions` family is canon's `pipeline` audience; the ORGANIZATION secrets this repository can see, and the visibility rule that decides which lives in `reader.orgBindingsVisibleToRepo` rather than in four renderers. Served as the PLAIN `actions-secret`, not the organization form - the vendored operation names that component here - so no `visibility` is published on this surface even though the rows are the organization's

SERVED 2026-09-14 (hello-20 wave W-github): features.ciPolicy mints ci_policy and ci_policy_allowance, one row per scope x audience, and EVERY FIELD IS READ OFF EVIDENCE THIS ARTIFACT ALREADY CARRIES (decisions/2026-09-14-0230): allowed_actions is selected because this organization's config policy hard-fails an unapproved source, default_permissions is read because the CI principal authors no commit and no review, the fork-PR posture is the strict one vacuously satisfied because every person on this roster is a member and the one repository is private, and the action allow-list is MEASURED off the .github/workflows blobs in this same artifact so it cannot permit an action the workflows do not use. Gated on hasCiPolicy()

SERVED 2026-09-14 (hello-20 wave W-github): features.ciPolicy mints ci_policy and ci_policy_allowance, one row per scope x audience, and EVERY FIELD IS READ OFF EVIDENCE THIS ARTIFACT ALREADY CARRIES (decisions/2026-09-14-0230): allowed_actions is selected because this organization's config policy hard-fails an unapproved source, default_permissions is read because the CI principal authors no commit and no review, the fork-PR posture is the strict one vacuously satisfied because every person on this roster is a member and the one repository is private, and the action allow-list is MEASURED off the .github/workflows blobs in this same artifact so it cannot permit an action the workflows do not use. Gated on hasCiPolicy()

SERVED 2026-09-14 (hello-20 wave W-github): features.ciPolicy mints ci_policy and ci_policy_allowance, one row per scope x audience, and EVERY FIELD IS READ OFF EVIDENCE THIS ARTIFACT ALREADY CARRIES (decisions/2026-09-14-0230): allowed_actions is selected because this organization's config policy hard-fails an unapproved source, default_permissions is read because the CI principal authors no commit and no review, the fork-PR posture is the strict one vacuously satisfied because every person on this roster is a member and the one repository is private, and the action allow-list is MEASURED off the .github/workflows blobs in this same artifact so it cannot permit an action the workflows do not use. Gated on hasCiPolicy()

SERVED 2026-09-14 (hello-20 wave W-github): features.ciPolicy mints ci_policy and ci_policy_allowance, one row per scope x audience, and EVERY FIELD IS READ OFF EVIDENCE THIS ARTIFACT ALREADY CARRIES (decisions/2026-09-14-0230): allowed_actions is selected because this organization's config policy hard-fails an unapproved source, default_permissions is read because the CI principal authors no commit and no review, the fork-PR posture is the strict one vacuously satisfied because every person on this roster is a member and the one repository is private, and the action allow-list is MEASURED off the .github/workflows blobs in this same artifact so it cannot permit an action the workflows do not use. Gated on hasCiPolicy()

SERVED 2026-09-14 (hello-20 wave W-github): features.ciRunners mints runner_group/runner/runner_label and one appended job.runner column, so a canonical Job now records what it ran ON (decisions/2026-09-14-0220). Each pool holds exactly the MEASURED PEAK CONCURRENCY of the jobs it ran - the smallest fleet that could have run this traffic without a job queueing, and the only fleet size this universe has evidence for - and which machine took which job is a queue rather than a draw. busy is 0 on every row because the anchor is not mid-build. Gated on hasCiRunners(), so the 127 pins frozen before hello-20 answer the generation

SERVED 2026-09-14 (hello-20 wave W-github): features.ciRunners mints runner_group/runner/runner_label and one appended job.runner column, so a canonical Job now records what it ran ON (decisions/2026-09-14-0220). Each pool holds exactly the MEASURED PEAK CONCURRENCY of the jobs it ran - the smallest fleet that could have run this traffic without a job queueing, and the only fleet size this universe has evidence for - and which machine took which job is a queue rather than a draw. busy is 0 on every row because the anchor is not mid-build. Gated on hasCiRunners(), so the 127 pins frozen before hello-20 answer the generation

the per-run twin of the repository concurrency-group list, held to the same fact: every workflow run has reached a terminal conclusion, so none holds a concurrency group

hello-13 JobLog carries every job's log text, so the run's zip is a container around canon, one member per job; the documented 302 is simulated in-app (founder ruling 2026-09-02)

SERVED 2026-09-12 (hello-19 wave W-a): `ci_binding` + `ci_binding_scope` - the settings and credentials this organization hands its pipelines. GitHub publishes ONE object as two URL families, so a secret is a binding whose value may not be published and a variable is one whose value may; canon carries exactly that boolean (`masked`) and this row is the same read with a different filter. The `actions` family is canon's `pipeline` audience; a name the list published

SERVED 2026-09-12 (hello-19 wave W-a): `ci_binding` + `ci_binding_scope` - the settings and credentials this organization hands its pipelines. GitHub publishes ONE object as two URL families, so a secret is a binding whose value may not be published and a variable is one whose value may; canon carries exactly that boolean (`masked`) and this row is the same read with a different filter. The repository's own published settings: its default branch and the tree path the orb document really sits at, both READ from the rows they name so a client that follows either finds the thing it points at

SERVED 2026-09-12 (hello-19 wave W-a): `ci_binding` + `ci_binding_scope` - the settings and credentials this organization hands its pipelines. GitHub publishes ONE object as two URL families, so a secret is a binding whose value may not be published and a variable is one whose value may; canon carries exactly that boolean (`masked`) and this row is the same read with a different filter. One scope per name `deployment.environment` actually carries, dated to the FIRST deployment to it. The environment has to resolve through the same derivation `/environments` publishes, so one named there is one this row answers for and one that is not is the ordinary 404

SERVED 2026-09-12 (hello-19 wave W-a): `ci_binding` + `ci_binding_scope` - the settings and credentials this organization hands its pipelines. GitHub publishes ONE object as two URL families, so a secret is a binding whose value may not be published and a variable is one whose value may; canon carries exactly that boolean (`masked`) and this row is the same read with a different filter. The environment scope's own 32 public-key bytes

SERVED 2026-09-12 (hello-19 wave W-a): `ci_binding` + `ci_binding_scope` - the settings and credentials this organization hands its pipelines. GitHub publishes ONE object as two URL families, so a secret is a binding whose value may not be published and a variable is one whose value may; canon carries exactly that boolean (`masked`) and this row is the same read with a different filter. A name the list published

refuse — olympus-labs is a standalone organization, not an enterprise account, so no enterprise slug in this universe resolves — GitHub's own 404 for an unknown enterprise is the whole answer

refuse — this organization built no custom runner image, so no image-definition id and no version under one can resolve - the LIST beside this row answers the empty page at 200, which is the list/id split decisions/2026-09-12-0348 states. Named as a ruling this wave inherits by decisions/2026-09-14-0220, note 1

refuse — this organization built no custom runner image, so no image-definition id and no version under one can resolve - the LIST beside this row answers the empty page at 200, which is the list/id split decisions/2026-09-12-0348 states. Named as a ruling this wave inherits by decisions/2026-09-14-0220, note 1

generateheld · data-licensing — the end-of-life dates of a runner version are GitHub's own release schedule for its runner binary, a fact about GitHub rather than about olympus-labs, which this project holds no grant to redistribute; dates served from a renderer constant would be the request-time vendor catalogue the /vendors ruling forbids, and an answer of null dates would claim GitHub set no schedule. Answers the coverage 404 at the organization scope until a licensed source exists (decisions/2026-10-27-2137-github-unclassified-eight.md)

refuse — the name half of the concurrency-group pair: with no group active, GitHub answers 404 for the group that does not exist

refuse — the by-id half of an honestly empty list, so no id resolves and GitHub's own answer is its 404: no Actions policy exists at either scope: an Actions policy is a named rule object for workflow execution protection, created by a write (POST .../actions/policies), and this data set has issued none. It is not the ci_policy row the .../actions/permissions family serves, which is the scope's Actions SETTINGS and exists whether or not anyone wrote a policy. RULED 2026-10-23 (fleet reserve, from the 2026-10-20 re-pin proposals)

refuse — REFUSED 2026-09-14 on the founder's ruling, and it opens a NEW CLASS: the vendor's own downloadable binaries. The runner-application tarballs are a fact about GITHUB rather than about olympus-labs, so no generation of this universe could carry them; RunnerApplication exists to be DOWNLOADED, so a row whose download_url resolves to nothing serves nobody; and the only url that does resolve is github.com's own release asset, which the per-item licence review held there is no grant to redistribute (coverage/reviews/2026-09-09-hello-15-stale-reasons-git-hosts.md §5.3, the finding /emojis, /zen and /octocat rest on). SERVING GITHUB'S REAL LIST WAS CONSIDERED AND WITHDRAWN on that licence hold plus the cost: a vendor catalogue reaches a renderer only as ref_catalog_entry rows the compiler writes, so it needs a new flag on a new generation and a cutover, not a wave (decisions/2026-09-14-1152). This is the FIRST GitHub refusal that is not GitHub's own - api.github.com answers 200 here - so the 404 carries a message naming what was attempted and why, rather than a bare Not Found (decisions/2026-09-14-1606)

the org list is the one org this universe carries

SERVED 2026-09-09 (hello-16): the pending org memberships WITH `failed_epoch` — reader.listMemberships("org", org) (reader.ts:2961). The failure is the clock's: `failed_epoch` IS `expires_epoch`, so nothing had to be invented to make an invitation fail and `failed_at` can never precede the offer — conformance asserts both, and that every row carries the reason the host printed

SERVED 2026-09-09 (hello-16): the pending org memberships WITHOUT `failed_epoch` — reader.listMemberships("org", org) (reader.ts:2961). An invitation is a membership that has not happened yet (`state: pending`, which is GitHub's own word for it on `team-membership`), so one column discriminates this surface from /orgs/{org}/failed_invitations and conformance asserts nothing appears on both. `login` and `email` are the pair GitHub types nullable on BOTH members because an invitation names a person or an address; canon sets exactly one, and the entry asserts the biconditional

SERVED 2026-09-09 (hello-16): reader.membershipFor("org", org, person) (packages/artifact/src/reader.ts:2977), validated against the vendored `org-membership`. Canon's five role keys collapse to GitHub's two — `owner` and `admin` both report `admin`, which is what GitHub itself reports for an organization owner — and `state` is canon's own word for the same fact. `permissions` is OMITTED rather than invented: its one member is `can_create_repository` and canon records no such grant. A login the organization does not carry is GitHub's own 404, which is what /orgs/{org}/members/{username} already answers for it

SERVED 2026-09-09 (hello-16): reader.listMemberships("org", org) (reader.ts:2961), narrowed to the active rows whose `publicized` bit is set. `publicized` is the ONE drawn preference in the access domain (the `disableSsh` exception) and is roughly half the roster, so this is neither the member list under a second name nor an empty one — the conformance entry asserts both bounds against /orgs/{org}/members and that every public login is a member. Paginated with GitHub's Link header, walked to the last page

immutable releases are not enabled on olympus-labs/parthenon — its three `release` rows carry no immutability marker and canon has no repository release-immutability setting; GitHub's own answer for a repository where immutable releases are not enabled is 404 with no body (the spec's own 404 description), and the ORGANIZATION's selected-repository list is therefore an empty `{total_count: 0, repositories: []}` at 200. RULED by the founder 2026-09-12

SERVED 2026-09-09 (hello-16): the same membership addressed by organization — reader.membershipFor("org", org, athena) (reader.ts:2977), byte-identical to the row the listing serves. An organization this host does not serve is GitHub's own 404

SERVED 2026-09-12 (hello-18 serving wave W-c): off `webhook_subscription`'s hello-18 git-host scopes (features.webhookFilters) through reader.orgWebhooks(), gated on hasWebhookFilters() so hello-17 and all eighty-one -g8..-g11 pins name the generation instead of claiming this organization configured no webhook. Canon stores NEUTRAL event names and this renderer spells them GitHub's way - ref.pushed->push, change.opened/change.merged->pull_request, issue.opened/issue.closed->issues, build.completed->check_run - many-to-one because GitHub subscribes by event NAME and puts the verb in the payload's `action`. `org-hook` is a DIFFERENT schema from `hook` and the differences are honoured: it declares neither test_url nor last_response, so neither is emitted even though the row carries the delivery columns.

SERVED 2026-09-14 (hello-20 wave W-github): the App's own hook is a webhook_subscription at a FOURTH SCOPE (filter_kind app_reference), not a new table - hello-18 already settled that a repository hook, an organization hook and a namespace hook are the same object at three scopes - and features.githubApp mints webhook_delivery, bounded at the last three deliveries per subscription. A delivery that happened has a log entry, which is what hello-18's own last_delivery_code column already asserted. duration is 0 on every row and that is a ruling rather than a gap: this universe's clock is whole seconds, so a delivery's request and response fall inside one recorded instant and its duration is below the resolution this universe measures at (decisions/2026-09-14-0345)

no artifact in this universe is attested — all 392 `artifact` rows are plain workflow-run uploads with no provenance bundle and none of the three workflows (`ci`, `lint`, `release`) runs an attestation step; GitHub's own answer for a subject digest with no attestations is `{attestations: []}` at 200 (the spec's 200 has NO required member). The operation also declares a 404 and the ORCHESTRATOR RULED the 200: a digest is a content address rather than a resource id, so asking about an artifact nobody signed is a well-formed question whose answer is "none". RULED by the founder 2026-09-12

nobody is blocked in this universe: the org's cast is its own employees and the outside contributors it works with, and a block only exists because someone created it

this replica records no request of its own, and nobody has viewed or cloned these repositories from outside - an API-insight or a traffic count would be a number with no fact behind it, which is the held-vs-invent line SPEC:220 draws. The scope resolves, so the honest answer is the report with an empty series (and, where the report carries them, the two zero counts that say the same thing) at 200. RULED by the founder 2026-09-14 (seed §A-R batch F1)

STALE REASON ("new canon entity IssueType"): there is no entity to build. GitHub's issue type is a NAME plus a nullable description, and the set this organization offers IS `select distinct kind from issue` — a closed canon vocabulary (bug, feature-request, incident, question, task) present in every generation. Conformance cross-checks the published list against every issue's kind in BOTH directions, so a type nothing can be and a kind nothing advertises are each red

SERVED 2026-09-09 (hello-16): the same catalog row by id — reader.listMembershipRoles() (reader.ts:2985) addressed by githubId(MembershipRoleRow.id), byte-identical to the row the catalog serves. An id the catalog does not carry is GitHub's own 404

SERVED 2026-09-09 (hello-16): the active org memberships whose role is this catalog row's key — reader.listMemberships("org", org) (reader.ts:2961). Conformance asserts the holders of all five roles TOGETHER are exactly the member list, so the catalog partitions the organization rather than covering part of it. `maintainer` and `reader` have no holders at org scope — maintainer is repository-scoped here and this universe has no outside contributor — which is a fact about the organization, not a gap

SERVED 2026-09-12 (hello-17): what the requested token would reach. `repository_selection` is `all` for the reason the granted twin gives — canon's personal-token acts as its owner everywhere its owner can act and carries no scope_ref, and every repository here belongs to the organization — so the answer is the organization's repositories through the same orgReposResponse /orgs/{org}/personal-access-tokens/{pat_id}/repositories uses. One request, one answer, and the two routes cannot describe different repositories; conformance asserts they agree and that an unminted pat_request_id is a 404. A hello-16 artifact answers the hello-17 generation gap and NOT hello-16's: it HAS the person_credential table — somebody else's keys are served off it — and none of these rows, which is why the gate is reader.hasCallerCredentials() and not reader.hasCredentials().

SERVED 2026-09-09 (hello-16): what a granted token reaches. `repository_selection` is `all` on every grant — a personal token acts as its owner wherever its owner can act and carries no `scope_ref` — so the answer is the organization's repositories through the same shaper /orgs/{org}/repos uses, and conformance asserts the two lists are identical. `pat_id` is the GRANT's own id and not the token's: the two are distinct numbers on one object, and the entry asserts the token id does NOT address it

no GitHub App installation is registered for external custom properties, so no installation has defined one: a registration needs an App holding the organization_external_properties_for_repos permission, and the one App in this data set holds checks, contents and metadata only (app_permission, served at /app). The documented answer for an installation that defined none is the empty array at 200, which `/orgs/{org}/properties/installations` beside it already answers for the same fact. The organization still resolves: an unknown one is the ordinary 404 (decisions/2026-10-27-2137-github-unclassified-eight.md)

one of twenty things nobody in this organization did: no org custom property was defined, no repository carries a value for one, no org issue field exists, no autolink was configured, and this replica keeps no global topic index of its own. The scope resolves, so the honest answer is the vendor's empty envelope at 200. RULED by the founder 2026-09-14 (seed §A-R batch F1)

no ruleset exists at either scope — canon's only ref-protection rows (`protected_ref`, 2) are scoped to `namespace-001`, a container GitHub has no counterpart for, and repo-01 carries an empty `namespace` column; classic branch protection on `main` (branch.protected=1, served by render-protection.ts) is GitHub's OTHER mechanism and does not imply a ruleset, so GitHub's own answer for a scope with no rulesets is `[]` at 200. RULED by the founder 2026-09-12

nobody launched a codespace, configured hosted-compute networking or registered a private registry - the last is hello-19's founder ruling F3 verbatim (olympus-labs runs no private package registry), which three already-terminal Dependabot rows rest on. The organization resolves, so the honest answer is the vendor's empty envelope at 200. RULED by the founder 2026-09-14 (seed §A-R batch F1)

refuse — no security product is enabled on olympus-labs and no vulnerability exists, so nothing is addressable here: this row reads an alert, an analysis, a database, a configuration or an upload by an id no collection on this host can hand out. GitHub's own answer for a thing that does not exist is 404, which is what this row mirrors; the 403 several of these operations declare for a product that is not enabled was deliberately not taken, because a 403 is a claim about the CALLER and this ruling is a claim about what nobody here ever created. RULED by the founder 2026-09-14 (seed §A-R batch F1)

refuse — no security product is enabled on olympus-labs and no vulnerability exists, so nothing is addressable here: this row reads an alert, an analysis, a database, a configuration or an upload by an id no collection on this host can hand out. GitHub's own answer for a thing that does not exist is 404, which is what this row mirrors; the 403 several of these operations declare for a product that is not enabled was deliberately not taken, because a 403 is a claim about the CALLER and this ruling is a claim about what nobody here ever created. RULED by the founder 2026-09-14 (seed §A-R batch F1)

refuse — this replica records no request of its own, so no actor and no user has an API-insight statistic to read - the subject and interval COLLECTIONS beside this row answer the empty list at 200, and a row addressed through an actor id over them cannot resolve. RULED by the founder 2026-09-14 (seed §A-R batch F1)

refuse — this replica records no request of its own, so no actor and no user has an API-insight statistic to read - the subject and interval COLLECTIONS beside this row answer the empty list at 200, and a row addressed through an actor id over them cannot resolve. RULED by the founder 2026-09-14 (seed §A-R batch F1)

refuse — this replica records no request of its own, so no actor and no user has an API-insight statistic to read - the subject and interval COLLECTIONS beside this row answer the empty list at 200, and a row addressed through an actor id over them cannot resolve. RULED by the founder 2026-09-14 (seed §A-R batch F1)

refuse — this replica records no request of its own, so no actor and no user has an API-insight statistic to read - the subject and interval COLLECTIONS beside this row answer the empty list at 200, and a row addressed through an actor id over them cannot resolve. RULED by the founder 2026-09-14 (seed §A-R batch F1)

refuse — the by-id half of a list that is already an honest empty. No person in olympus-labs owns anything publishable - every repository belongs to the organization (the hello-16 ownership ruling) - so the /user and /users/{username} package collections are empty and no package name can resolve under them; the ruleset reads are addressed over four green/empty ruleset lists (founder, 2026-09-12: no ruleset exists at either scope); the two environment reads are addressed over three armed empties; and the personal projectsV2 reads are addressed over a personal project list nobody here keeps. RULED by the founder 2026-09-14 (seed §A-R batch F1)

refuse — the by-id half of a list that is already an honest empty. No person in olympus-labs owns anything publishable - every repository belongs to the organization (the hello-16 ownership ruling) - so the /user and /users/{username} package collections are empty and no package name can resolve under them; the ruleset reads are addressed over four green/empty ruleset lists (founder, 2026-09-12: no ruleset exists at either scope); the two environment reads are addressed over three armed empties; and the personal projectsV2 reads are addressed over a personal project list nobody here keeps. RULED by the founder 2026-09-14 (seed §A-R batch F1)

refuse — nobody launched a codespace, configured hosted-compute networking or registered a private registry, so nothing here is addressable: this row reads a registry by name, a network configuration by id, or a codespace default for a repository nobody has ever started one in. RULED by the founder 2026-09-14 (seed §A-R batch F1)

no repository in this universe is a fork and none has been forked: the org owns every repo and there is no account outside it to fork into

SERVED 2026-09-12 (hello-17 `repoOwnership`): the content-file object for tools/README.md, read through the same fileAt/shapeContentFile path /repos/{o}/{r}/contents/{path} uses — one blob, one answer, whichever route asks, which conformance asserts by comparing the two objects. hello-17 puts a README inside a directory for the first time (decisions/2026-09-11-2256): tools/ holds probe/ and report/, both real programs with real source in the tree, so every sentence in the document names something a caller can open — which is the whole reason a folder README is safe to write (invariant #5), and conformance checks it. A DIRECTORY WITH NO README IS GITHUB'S OWN 404 and carries no coverage header: /readme/src is a fact about that directory rather than a gap, and conformance asserts both. An artifact whose tree carries neither ownership file answers the hello-17 generation gap instead, because on it NO directory has a README and the row is unanswerable rather than negative

the file model already carries the tree, so the archive is a ustar+gzip container around the same blobs the contents endpoints and the git transport serve; the documented 302 is simulated in-app (founder ruling 2026-09-02) and the Location names the resolved commit sha

STALE REASON ("new canon entity RepoTopic"): there is no entity to build. `repo.topics_json` holds the list and `shapeRepo` has published it inside the repository object since GitHub coverage began; `topic`'s one required member is `names`, and conformance asserts the standalone list and the embedded one agree

SERVED 2026-09-12 (hello-18 serving wave W-c): off `webhook_subscription`'s hello-18 git-host scopes (features.webhookFilters) through reader.repoWebhooks(), gated on hasWebhookFilters() so hello-17 and all eighty-one -g8..-g11 pins name the generation instead of claiming this organization configured no webhook. Canon stores NEUTRAL event names and this renderer spells them GitHub's way - ref.pushed->push, change.opened/change.merged->pull_request, issue.opened/issue.closed->issues, build.completed->check_run - many-to-one because GitHub subscribes by event NAME and puts the verb in the payload's `action`. Byte-identical to the object the list publishes - one shaper - and the ORGANIZATION's hook id 404s here, which is the scope separation reader.repoWebhooks() enforces one layer down.

SERVED 2026-09-14 (hello-20 wave W-github): the App's own hook is a webhook_subscription at a FOURTH SCOPE (filter_kind app_reference), not a new table - hello-18 already settled that a repository hook, an organization hook and a namespace hook are the same object at three scopes - and features.githubApp mints webhook_delivery, bounded at the last three deliveries per subscription. A delivery that happened has a log entry, which is what hello-18's own last_delivery_code column already asserted. duration is 0 on every row and that is a ruling rather than a gap: this universe's clock is whole seconds, so a delivery's request and response fall inside one recorded instant and its duration is below the resolution this universe measures at (decisions/2026-09-14-0345)

no artifact in this universe is attested — all 392 `artifact` rows are plain workflow-run uploads with no provenance bundle and none of the three workflows (`ci`, `lint`, `release`) runs an attestation step; GitHub's own answer for a subject digest with no attestations is `{attestations: []}` at 200 (the spec's 200 has NO required member). The operation also declares a 404 and the ORCHESTRATOR RULED the 200: a digest is a content address rather than a resource id, so asking about an artifact nobody signed is a well-formed question whose answer is "none". RULED by the founder 2026-09-12

STALE REASON ("new canon entity IssueType"): there is no entity to build. GitHub's issue type is a NAME plus a nullable description, and the set this organization offers IS `select distinct kind from issue` — a closed canon vocabulary (bug, feature-request, incident, question, task) present in every generation. Conformance cross-checks the published list against every issue's kind in BOTH directions, so a type nothing can be and a kind nothing advertises are each red

no ruleset exists at either scope — canon's only ref-protection rows (`protected_ref`, 2) are scoped to `namespace-001`, a container GitHub has no counterpart for, and repo-01 carries an empty `namespace` column; classic branch protection on `main` (branch.protected=1, served by render-protection.ts) is GitHub's OTHER mechanism and does not imply a ruleset, so GitHub's own answer for a scope with no rulesets is `[]` at 200. RULED by the founder 2026-09-12

no ruleset exists at either scope — canon's only ref-protection rows (`protected_ref`, 2) are scoped to `namespace-001`, a container GitHub has no counterpart for, and repo-01 carries an empty `namespace` column; classic branch protection on `main` (branch.protected=1, served by render-protection.ts) is GitHub's OTHER mechanism and does not imply a ruleset, so GitHub's own answer for a scope with no rulesets is `[]` at 200. RULED by the founder 2026-09-12

refuse — immutable releases are not enabled on olympus-labs/parthenon — its three `release` rows carry no immutability marker and canon has no repository release-immutability setting; GitHub's own answer for a repository where immutable releases are not enabled is 404 with no body (the spec's own 404 description). The renderer answers the `basic-error` body every GitHub 404 on this host carries, pointing at THIS operation's docs page: the spec declares no schema for the 404, and GitHub's API never sends a bodyless one. RULED by the founder 2026-09-12

refuse — no GitHub security product is enabled on olympus-labs/parthenon — canon carries no security-finding entity and no code-security configuration, and the org's only repository is private; GitHub's own answer for a repository not enabled with vulnerability alerts is 404 with no body (the spec declares only 204 and 404 for this operation). RULED by the founder 2026-09-12

refuse — the by-id half of a list that is already an honest empty. No person in olympus-labs owns anything publishable - every repository belongs to the organization (the hello-16 ownership ruling) - so the /user and /users/{username} package collections are empty and no package name can resolve under them; the ruleset reads are addressed over four green/empty ruleset lists (founder, 2026-09-12: no ruleset exists at either scope); the two environment reads are addressed over three armed empties; and the personal projectsV2 reads are addressed over a personal project list nobody here keeps. RULED by the founder 2026-09-14 (seed §A-R batch F1)

refuse — the by-id half of a list that is already an honest empty. No person in olympus-labs owns anything publishable - every repository belongs to the organization (the hello-16 ownership ruling) - so the /user and /users/{username} package collections are empty and no package name can resolve under them; the ruleset reads are addressed over four green/empty ruleset lists (founder, 2026-09-12: no ruleset exists at either scope); the two environment reads are addressed over three armed empties; and the personal projectsV2 reads are addressed over a personal project list nobody here keeps. RULED by the founder 2026-09-14 (seed §A-R batch F1)

issue lists across the repo, org and authenticated persona

assignable users are the repo's collaborators; assignment is already on the issue

assignable users are the repo's collaborators; assignment is already on the issue

SERVED 2026-09-12 (hello-17): reader.linksFor(issue) narrowed to `blocks` rows whose TARGET is this issue — the prerequisites that finished before it started. hello-17 `issueLinks` (decisions/2026-09-11-0200) groups issues by (epic, sprint) — a team's slice of one storyline inside one iteration, the tightest grouping the tracker already holds — and writes ONE row per adjacent pair, whose kind the dates decide: `blocks` when the earlier issue closed strictly before the later one opened, `relates` otherwise. One row per pair is what makes "no link is its own inverse" true by construction rather than by a filter, and the direction is read off source/target. Conformance re-derives the canon rule on the wire: every blocker must be closed, and closed strictly before the asking issue was created. A pull-request number carries no dependency and is GitHub's 404, because canon links issues to issues

SERVED 2026-10-23 (fleet reserve): reader.linksFor(issue) narrowed to `relates` rows, from EITHER end, because a relates link has no direction GitHub publishes. hello-17 `issueLinks` (decisions/2026-09-11-0200) writes one row per adjacent pair in an (epic, sprint) slice and calls it `relates` when the earlier issue had not closed before the later one opened, so conformance re-derives that rule on the wire: every related issue overlaps the asking one in time, and the asking issue appears in each related issue's own list. A pull-request number carries no link and is GitHub's 404

no issue in this universe carries a Copilot suggestion — canon's AI telemetry attributes work to commits (`ai_commit`, 110), pulls (`ai_pull`, 14) and sessions (`agent_session`, 72) and never to an issue; GitHub's own answer for an issue with no suggestions is `[]` at 200. RULED by the founder 2026-09-12

repo-wide issue comments over issue_comment (122-hit demand cluster, telemetry 2026-09-01)

issue events over the canonical event log and issue_transition

labels over issue_label/label

scratch — ACCEPTED into the per-key 24-hour overlay for a scratch-enabled key: 201 + GitHub's own `issue` object + `Location`, validated against the vendored OpenAPI by packages/conformance/src/github/scratch.test.ts. The NUMBER is minted off the shared issue/pull sequence GitHub really uses - `max(issue.number, pull.number) + N` for this key's Nth scratch issue in this repository - so it can never collide with a real one, and two keys on the same repo mint the same numbers and never see each other's rows. The AUTHOR is an existing canonical persona chosen deterministically per (key, repository) from the repo's collaborators (founder ruling 2), so `user.login` resolves at `/users/{login}` like every other user object; the response says who you were rendered as in `X-SandboxAPIs-Scratch-As`. `assignees`, `labels`, `milestone` and `type` are REFUSED with GitHub's 422 rather than dropped. Over 65,536 body characters is GitHub's own 422; past the key's row cap is GitHub's own secondary-rate-limit 403. An issue created with no body renders `body: null`, which is what api.github.com sends and what the vendored `issue` schema declares (`string | null`); `IssueRow.body` stays a string because the artifact's column is NOT NULL, so the turn happens in the shape layer and only where scratch is responsible - an artifact issue nobody edited is untouched. Without a scratch-enabled key this path is the read-only 403, byte for byte.

scratch — ACCEPTED into the per-key 24-hour overlay for a scratch-enabled key: 201 + GitHub's own `issue-comment` object + `Location`, validated against the vendored OpenAPI by packages/conformance/src/github/scratch.test.ts. Comments attach to a SCRATCH issue or to an ARTIFACT one and are merged into `GET /issues/{n}/comments`, the repo-wide `/issues/comments` listing, `/issues/comments/{id}`, the `comments` COUNT on the issue object and the GraphQL `Issue.comments` connection - one merged row list, before every pager, so totals and `Link` headers stay right. The AUTHOR is the same canonical persona the key writes issues as. A PULL REQUEST number answers GitHub's 404, and `search`, the cross-repository issue listings and the event/timeline surfaces do NOT merge in phase 1 and say so with `X-SandboxAPIs-Scratch: unmerged`. Without a scratch-enabled key this path is the read-only 403, byte for byte.

the caller-scoped twin of the org block list, held to the same fact: nobody is blocked in this universe

SERVED 2026-09-12 (hello-17): reader.followers(athena) behind reader.hasSocialGraph(), shaped as `simple-user` through the same shaper /orgs/{org}/members uses, so a login here is a login that fetches. hello-17 `socialGraph` (decisions/2026-09-11-0200) derives the follow graph from the review log and draws nothing: a reviewer follows the author whose changes they read, and an author follows back ONLY a reviewer who APPROVED. Without that second, narrower rule the graph would be the symmetric closure of the review graph wearing two columns, so `followers` and `following` are genuinely different lists rather than one list served twice. The same person_follow table answers GitLab's /users/{id}/followers, which is the cross-host parity that provider's coverage reason already committed to. Conformance asserts this list and /users/athena/followers are the same list, and that every follower reports following the caller from the other end. An artifact that predates the domain answers the hello-17 generation gap: [] there would assert that nobody in THAT universe follows anybody, a statement its canon never made.

SERVED 2026-09-12 (hello-17): GitHub's 204 when the edge exists and its 404 when it does not, with no body either way. The 404 is a fact about the graph rather than a coverage miss, so it carries no coverage header; conformance drives a person the caller does follow, a member she does not, and a login nobody carries, so a green is not "this route says yes to everything". An artifact that predates the domain answers the hello-17 generation gap: [] there would assert that nobody in THAT universe follows anybody, a statement its canon never made.

SERVED 2026-09-12 (hello-17): the caller's own GPG key by its number, the same object the list publishes (conformance compares them field for field). hello-17 `callerCredentials` (decisions/2026-09-11-0151) replaces the credential pass's activity thresholds with a rule — THE FOUNDING MEMBER HOLDS ONE OF EVERY CREDENTIAL KIND THIS ORGANIZATION ACCEPTS — and makes the founding member the TEMPLATE'S FIRST PERSONA, which is the login VIEWER_LOGIN resolves to. That is what answers the hello-16 ask on this row ("the authenticated persona holds none of this kind"), and it answers it structurally rather than by moving a threshold until it happened to catch her. A hello-16 artifact answers the hello-17 generation gap and NOT hello-16's: it HAS the person_credential table — somebody else's keys are served off it — and none of these rows, which is why the gate is reader.hasCallerCredentials() and not reader.hasCredentials().

SERVED 2026-09-12 (hello-17): the caller's own key by its number, through the same reader.credentialsForPerson(athena, "ssh-auth") read the list uses, so the two are the SAME object field for field (conformance compares them). hello-17 `callerCredentials` (decisions/2026-09-11-0151) replaces the credential pass's activity thresholds with a rule — THE FOUNDING MEMBER HOLDS ONE OF EVERY CREDENTIAL KIND THIS ORGANIZATION ACCEPTS — and makes the founding member the TEMPLATE'S FIRST PERSONA, which is the login VIEWER_LOGIN resolves to. That is what answers the hello-16 ask on this row ("the authenticated persona holds none of this kind"), and it answers it structurally rather than by moving a threshold until it happened to catch her. A key id that belongs to somebody ELSE is GitHub's 404 here rather than that person's key, which is the whole difference between this operation and /users/{username}/keys — conformance walks hermes's ids and asserts every one 404s. A hello-16 artifact answers the hello-17 generation gap and NOT hello-16's: it HAS the person_credential table — somebody else's keys are served off it — and none of these rows, which is why the gate is reader.hasCallerCredentials() and not reader.hasCredentials().

SERVED 2026-09-09 (hello-16): reader.credentialsForPerson(athena, "social") (reader.ts:3016). Two providers, and the omissions are the design (packages/canon/src/credentials.ts): a row claiming a large proprietary network would carry a URL at somebody else's live service, naming an account that either does not exist or belongs to a real person. Both values resolve inside this organization's own domain, and conformance asserts the caller's list and /users/athena/social_accounts are byte-identical

SERVED 2026-09-12 (hello-17): the caller's own signing key by its number, the same object the list publishes. hello-17 `callerCredentials` (decisions/2026-09-11-0151) replaces the credential pass's activity thresholds with a rule — THE FOUNDING MEMBER HOLDS ONE OF EVERY CREDENTIAL KIND THIS ORGANIZATION ACCEPTS — and makes the founding member the TEMPLATE'S FIRST PERSONA, which is the login VIEWER_LOGIN resolves to. That is what answers the hello-16 ask on this row ("the authenticated persona holds none of this kind"), and it answers it structurally rather than by moving a threshold until it happened to catch her. A hello-16 artifact answers the hello-17 generation gap and NOT hello-16's: it HAS the person_credential table — somebody else's keys are served off it — and none of these rows, which is why the gate is reader.hasCallerCredentials() and not reader.hasCredentials().

SERVED 2026-09-12 (hello-17): anybody's followers, off the same reader.followers() read the caller's list uses. hello-17 `socialGraph` (decisions/2026-09-11-0200) derives the follow graph from the review log and draws nothing: a reviewer follows the author whose changes they read, and an author follows back ONLY a reviewer who APPROVED. Without that second, narrower rule the graph would be the symmetric closure of the review graph wearing two columns, so `followers` and `following` are genuinely different lists rather than one list served twice. The same person_follow table answers GitLab's /users/{id}/followers, which is the cross-host parity that provider's coverage reason already committed to. THE ORG LOGIN IS A VALID {username} AND FOLLOWS NOBODY — the rule /users/{org}/repos already follows, because a 404 here would say the account does not exist while /users/{org} says it does — and conformance asserts the organization account answers [] at 200. An artifact that predates the domain answers the hello-17 generation gap: [] there would assert that nobody in THAT universe follows anybody, a statement its canon never made.

SERVED 2026-09-12 (hello-17): GitHub's 204/404 pair for any ordered pair of people. Nobody follows themselves — person_follow has no self-edge by construction — and conformance asserts the self-check is a 404, which is where that construction shows on the wire. An artifact that predates the domain answers the hello-17 generation gap: [] there would assert that nobody in THAT universe follows anybody, a statement its canon never made.

the person table already answers the user list, the by-account-id read and the hovercard

SERVED 2026-09-09 (hello-16): reader.credentialsForPerson(person, "social") (reader.ts:3016) — the same rows /user/social_accounts serves for the caller, which conformance asserts are byte-identical for the same person

refuse — the id half of the caller block pair: with nobody blocked, GitHub answers 404 to the per-user block check

SERVED 2026-09-14 (hello-20 wave W-github): NO Notification ENTITY IS NEEDED and none was built - an inbox thread is a SUBJECT (an issue or a pull), a REASON (author/assign/comment/review_requested/subscribed, every one a relationship this artifact already records), an UPDATED_AT and an UNREAD bit, so the inbox is features.watchGraph's preference applied to the activity log and composed by the renderer the way JQL and WIQL are composed from saved_filter. The preference decides membership: a person at disabled has an empty inbox, one at watch sees every thread in the repository, one at participating sees only the threads they are in. A thread is unread when its last activity is later than that person's own last recorded action anywhere - you have not been back since

SERVED 2026-09-14 (hello-20 wave W-github): NO Notification ENTITY IS NEEDED and none was built - an inbox thread is a SUBJECT (an issue or a pull), a REASON (author/assign/comment/review_requested/subscribed, every one a relationship this artifact already records), an UPDATED_AT and an UNREAD bit, so the inbox is features.watchGraph's preference applied to the activity log and composed by the renderer the way JQL and WIQL are composed from saved_filter. The preference decides membership: a person at disabled has an empty inbox, one at watch sees every thread in the repository, one at participating sees only the threads they are in. A thread is unread when its last activity is later than that person's own last recorded action anywhere - you have not been back since

SERVED 2026-09-14 (hello-20 wave W-github): features.watchGraph mints repo_star - a STAR IS A BOOKMARK ON WORK YOU HAVE DONE, so every person who has authored a commit or submitted a review here has one, dated at the earlier of those two firsts. That is 15 of 17 people at 90 d and not the whole roster: the persona who has only filed issues never landed a commit or read a pull, and the CI identity keeps no bookmarks (decisions/2026-09-14-0315). The founder's cross-host rule is honoured by construction - one table, two renderings, so a starred repo is the same repo on GitHub and GitLab. stargazers_count on every repository object is now this same list's length

SERVED 2026-10-23 (fleet reserve): the same repo_star rows bucketed into calendar weeks, newest first, from the week of the artifact's anchor back to the repository's creation week, with zero weeks present. Weeks start Sunday 00:00 UTC (GitHub says its boundaries need not align with UTC), `days` counts each day from Sunday, per_page is GitHub's maximum of 30 and the Link header pages backward. The anchor, not a clock, ends the series, so a pin answers the same on two days. Older artifacts answer the watch-graph generation gap

SERVED 2026-09-14 (hello-20 wave W-github): features.watchGraph mints notification_preference and there is NO repo_subscription table - a subscription and a notification level are ONE FACT SPELLED BY TWO VENDORS, so GitHub's subscribed/ignored pair and GitLab's level enum read the same column. A WATCH IS ACCOUNTABILITY and follows standing rather than activity: whoever administers the organization hears about all of it, whoever maintains the repository hears about that one, everybody else keeps the vendor default, and the machine account is disabled. A row exists only where it DIFFERS from what it would inherit, so watchersOf() resolves the inheritance in the reader and five of the nine watchers carry no repository row at all

SERVED 2026-09-14 (hello-20 wave W-github): features.watchGraph mints repo_star - a STAR IS A BOOKMARK ON WORK YOU HAVE DONE, so every person who has authored a commit or submitted a review here has one, dated at the earlier of those two firsts. That is 15 of 17 people at 90 d and not the whole roster: the persona who has only filed issues never landed a commit or read a pull, and the CI identity keeps no bookmarks (decisions/2026-09-14-0315). The founder's cross-host rule is honoured by construction - one table, two renderings, so a starred repo is the same repo on GitHub and GitLab. stargazers_count on every repository object is now this same list's length

SERVED 2026-09-14 (hello-20 wave W-github): features.watchGraph mints repo_star - a STAR IS A BOOKMARK ON WORK YOU HAVE DONE, so every person who has authored a commit or submitted a review here has one, dated at the earlier of those two firsts. That is 15 of 17 people at 90 d and not the whole roster: the persona who has only filed issues never landed a commit or read a pull, and the CI identity keeps no bookmarks (decisions/2026-09-14-0315). The founder's cross-host rule is honoured by construction - one table, two renderings, so a starred repo is the same repo on GitHub and GitLab. stargazers_count on every repository object is now this same list's length

SERVED 2026-09-14 (hello-20 wave W-github): features.githubApp mints app/app_permission/app_installation - ONE App, because this roster holds one bot and app.actor resolves to it, which is what makes the App's check runs the same actor everything else already attributes them to (decisions/2026-09-14-0345). A PERMISSION EXISTS BECAUSE THE ACTOR DID THE THING: checks:write because it wrote 101 check runs, contents:read because every one names a commit it had to read, metadata:read because no App on any of these hosts exists without it - and it holds neither issues nor pull-requests, because it commented on nothing and reviewed nothing. /app answers authenticatingApp() rather than the first row. Gated on hasGithubApp()

SERVED 2026-09-14 (hello-20 wave W-github): the App's own hook is a webhook_subscription at a FOURTH SCOPE (filter_kind app_reference), not a new table - hello-18 already settled that a repository hook, an organization hook and a namespace hook are the same object at three scopes - and features.githubApp mints webhook_delivery, bounded at the last three deliveries per subscription. A delivery that happened has a log entry, which is what hello-18's own last_delivery_code column already asserted. duration is 0 on every row and that is a ruling rather than a gap: this universe's clock is whole seconds, so a delivery's request and response fall inside one recorded instant and its duration is below the resolution this universe measures at (decisions/2026-09-14-0345)

an installation request exists because somebody who could not install an App asked an owner to. This organization WROTE this App and installed it on itself the moment it existed, so nobody ever asked - the honest answer is the empty list under an App that resolves. Rides the founder's 2026-09-14 batch on the App's own fact (decisions/2026-09-14-0345: one App, because this roster holds one bot)

SERVED 2026-09-14 (hello-20 wave W-github): features.githubApp mints app/app_permission/app_installation - ONE App, because this roster holds one bot and app.actor resolves to it, which is what makes the App's check runs the same actor everything else already attributes them to (decisions/2026-09-14-0345). A PERMISSION EXISTS BECAUSE THE ACTOR DID THE THING: checks:write because it wrote 101 check runs, contents:read because every one names a commit it had to read, metadata:read because no App on any of these hosts exists without it - and it holds neither issues nor pull-requests, because it commented on nothing and reviewed nothing. /app answers authenticatingApp() rather than the first row. Gated on hasGithubApp()

SERVED 2026-09-14 (hello-20 wave W-github): features.githubApp mints app/app_permission/app_installation - ONE App, because this roster holds one bot and app.actor resolves to it, which is what makes the App's check runs the same actor everything else already attributes them to (decisions/2026-09-14-0345). A PERMISSION EXISTS BECAUSE THE ACTOR DID THE THING: checks:write because it wrote 101 check runs, contents:read because every one names a commit it had to read, metadata:read because no App on any of these hosts exists without it - and it holds neither issues nor pull-requests, because it commented on nothing and reviewed nothing. /app answers authenticatingApp() rather than the first row. Gated on hasGithubApp()

SERVED 2026-09-14 (hello-20 wave W-github): features.githubApp mints app/app_permission/app_installation - ONE App, because this roster holds one bot and app.actor resolves to it, which is what makes the App's check runs the same actor everything else already attributes them to (decisions/2026-09-14-0345). A PERMISSION EXISTS BECAUSE THE ACTOR DID THE THING: checks:write because it wrote 101 check runs, contents:read because every one names a commit it had to read, metadata:read because no App on any of these hosts exists without it - and it holds neither issues nor pull-requests, because it commented on nothing and reviewed nothing. /app answers authenticatingApp() rather than the first row. Gated on hasGithubApp()

SERVED 2026-09-14 (hello-20 wave W-github): features.githubApp mints app/app_permission/app_installation - ONE App, because this roster holds one bot and app.actor resolves to it, which is what makes the App's check runs the same actor everything else already attributes them to (decisions/2026-09-14-0345). A PERMISSION EXISTS BECAUSE THE ACTOR DID THE THING: checks:write because it wrote 101 check runs, contents:read because every one names a commit it had to read, metadata:read because no App on any of these hosts exists without it - and it holds neither issues nor pull-requests, because it commented on nothing and reviewed nothing. /app answers authenticatingApp() rather than the first row. Gated on hasGithubApp()

refuse — the org is neither a GitHub Marketplace listing nor a purchaser, and GitHub answers 404 to marketplace reads for an account with no listing

refuse — the org is neither a GitHub Marketplace listing nor a purchaser, and GitHub answers 404 to marketplace reads for an account with no listing

refuse — the org is neither a GitHub Marketplace listing nor a purchaser, and GitHub answers 404 to marketplace reads for an account with no listing

refuse — the org is neither a GitHub Marketplace listing nor a purchaser, and GitHub answers 404 to marketplace reads for an account with no listing

no repository in this universe carries a `.devcontainer`, so the repo's devcontainer list is truthfully empty

refuse — no persona in this universe launches a Codespace: every Codespaces object exists only because a write created one, and this universe accepts no writes

refuse — no persona in this universe launches a Codespace: every Codespaces object exists only because a write created one, and this universe accepts no writes

refuse — no persona in this universe launches a Codespace: every Codespaces object exists only because a write created one, and this universe accepts no writes

refuse — no persona in this universe launches a Codespace: every Codespaces object exists only because a write created one, and this universe accepts no writes

refuse — nobody launched a codespace, configured hosted-compute networking or registered a private registry, so nothing here is addressable: this row reads a registry by name, a network configuration by id, or a codespace default for a repository nobody has ever started one in. RULED by the founder 2026-09-14 (seed §A-R batch F1)

refuse — no persona in this universe launches a Codespace: every Codespaces object exists only because a write created one, and this universe accepts no writes

refuse — no persona in this universe launches a Codespace: every Codespaces object exists only because a write created one, and this universe accepts no writes

refuse — no persona in this universe launches a Codespace: every Codespaces object exists only because a write created one, and this universe accepts no writes

refuse — no persona in this universe launches a Codespace: every Codespaces object exists only because a write created one, and this universe accepts no writes

refuse — no persona in this universe launches a Codespace: every Codespaces object exists only because a write created one, and this universe accepts no writes

SERVED 2026-09-14 (hello-20 wave W-github): the coding-agent audience of the same features.ciPolicy table - a pipeline policy and an agent policy are one SHAPE at two audiences, and twelve columns are NULL on an agent row because an agent does not run an action. The content-exclusion rules are the generated LOCKFILES in that repository's own head tree, measured at compile time, so a rule naming a file the tree does not hold would be a policy about nothing; the four security tools on the cloud-agent configuration are all off, which is the founder's ruling of 2026-09-12 (no security product is enabled on olympus-labs) applied to the surface that asks about them

SERVED 2026-09-14 (hello-20 wave W-github): the coding-agent audience of the same features.ciPolicy table - a pipeline policy and an agent policy are one SHAPE at two audiences, and twelve columns are NULL on an agent row because an agent does not run an action. The content-exclusion rules are the generated LOCKFILES in that repository's own head tree, measured at compile time, so a rule naming a file the tree does not hold would be a policy about nothing; the four security tools on the cloud-agent configuration are all off, which is the founder's ruling of 2026-09-12 (no security product is enabled on olympus-labs) applied to the surface that asks about them

SERVED 2026-09-14 (hello-20 wave W-github): the coding-agent audience of the same features.ciPolicy table - a pipeline policy and an agent policy are one SHAPE at two audiences, and twelve columns are NULL on an agent row because an agent does not run an action. The content-exclusion rules are the generated LOCKFILES in that repository's own head tree, measured at compile time, so a rule naming a file the tree does not hold would be a policy about nothing; the four security tools on the cloud-agent configuration are all off, which is the founder's ruling of 2026-09-12 (no security product is enabled on olympus-labs) applied to the surface that asks about them

refuse — olympus-labs is a standalone organization, not an enterprise account, so no enterprise slug in this universe resolves — GitHub's own 404 for an unknown enterprise is the whole answer. The identical ruling already governs every sibling under this prefix (see `github|rest|GET|/enterprises/{enterprise}/teams`, reviewed 2026-09-01); serving a Copilot report here would require minting the enterprise those fifteen rows deny. RULED by the founder 2026-09-09

refuse — olympus-labs is a standalone organization, not an enterprise account, so no enterprise slug in this universe resolves — GitHub's own 404 for an unknown enterprise is the whole answer. The identical ruling already governs every sibling under this prefix (see `github|rest|GET|/enterprises/{enterprise}/teams`, reviewed 2026-09-01); serving a Copilot report here would require minting the enterprise those fifteen rows deny. RULED by the founder 2026-09-09

refuse — olympus-labs is a standalone organization, not an enterprise account, so no enterprise slug in this universe resolves — GitHub's own 404 for an unknown enterprise is the whole answer. The identical ruling already governs every sibling under this prefix (see `github|rest|GET|/enterprises/{enterprise}/teams`, reviewed 2026-09-01); serving a Copilot report here would require minting the enterprise those fifteen rows deny. RULED by the founder 2026-09-09

SERVED 2026-09-09 (hello-16): the pending TEAM memberships — reader.listMemberships("team", team) (reader.ts:2961), rendered in the `organization-invitation` shape the operation declares. The invitee is somebody this organization already knows, so `login` is set and `email` is null, and the same row answers /orgs/{org}/teams/{team_slug}/memberships/{username} with `state: pending`

SERVED 2026-09-09 (hello-16): reader.membershipFor("team", team, person) (reader.ts:2977), validated against `team-membership`. `state: pending` is real on this universe — one person is on a team's roster by invitation and not yet by membership — and /orgs/{org}/teams/{team_slug}/invitations serves that same row from the other side

teams, their repo grants and the caller's own team list, over team/team_member

teams, their repo grants and the caller's own team list, over team/team_member

team members over team_member, addressed by legacy team id

SERVED 2026-09-09 (hello-16): the same row through the legacy team id — teamByLegacyId (render-access.ts) plus reader.membershipFor("team", team, person) (reader.ts:2977). `url` is the address the caller used, and conformance asserts the legacy and slug forms agree about role and state

teams, their repo grants and the caller's own team list, over team/team_member

teams, their repo grants and the caller's own team list, over team/team_member

no security product is enabled on olympus-labs and no vulnerability exists, so there is no alert, no analysis, no configuration and no custom pattern to list - and it cannot be built either: render-sbom.ts parses the repository's REAL manifests, so this replica publishes express@4.18.2, github.com/google/uuid v1.3.0 and httpx==0.24.1, and a generated finding over one of them would be a false claim about a real upstream project. The collection's parent resolves, so the truthful answer is GitHub's empty list at 200 rather than a 404 that would deny the operation exists. RULED by the founder 2026-09-14 (seed §A-R batch F1)

no security product is enabled on olympus-labs and no vulnerability exists, so there is no alert, no analysis, no configuration and no custom pattern to list - and it cannot be built either: render-sbom.ts parses the repository's REAL manifests, so this replica publishes express@4.18.2, github.com/google/uuid v1.3.0 and httpx==0.24.1, and a generated finding over one of them would be a false claim about a real upstream project. The collection's parent resolves, so the truthful answer is GitHub's empty list at 200 rather than a 404 that would deny the operation exists. RULED by the founder 2026-09-14 (seed §A-R batch F1)

refuse — no security product is enabled on olympus-labs, so AI Scan was never configured at the organization scope and the question gets GitHub's own 404, the answer `/repos/{owner}/{repo}/code-scanning/default-setup` gives on this host under the founder's 2026-09-14 batch (fact R1). The 403 the operation declares for a caller who is not an owner or security manager is deliberately not taken, for that batch's reason: a 403 is a claim about the caller, and this is a claim about what nobody here configured. Classified 2026-10-27 by applying fact R1 (decisions/2026-10-27-2137-github-unclassified-eight.md)

refuse — no security product is enabled on olympus-labs and no vulnerability exists, so nothing is addressable here: this row reads an alert, an analysis, a database, a configuration or an upload by an id no collection on this host can hand out. GitHub's own answer for a thing that does not exist is 404, which is what this row mirrors; the 403 several of these operations declare for a product that is not enabled was deliberately not taken, because a 403 is a claim about the CALLER and this ruling is a claim about what nobody here ever created. RULED by the founder 2026-09-14 (seed §A-R batch F1)

refuse — no security product is enabled on olympus-labs and no vulnerability exists, so nothing is addressable here: this row reads an alert, an analysis, a database, a configuration or an upload by an id no collection on this host can hand out. GitHub's own answer for a thing that does not exist is 404, which is what this row mirrors; the 403 several of these operations declare for a product that is not enabled was deliberately not taken, because a 403 is a claim about the CALLER and this ruling is a claim about what nobody here ever created. RULED by the founder 2026-09-14 (seed §A-R batch F1)

refuse — no security product is enabled on olympus-labs and no vulnerability exists, so nothing is addressable here: this row reads an alert, an analysis, a database, a configuration or an upload by an id no collection on this host can hand out. GitHub's own answer for a thing that does not exist is 404, which is what this row mirrors; the 403 several of these operations declare for a product that is not enabled was deliberately not taken, because a 403 is a claim about the CALLER and this ruling is a claim about what nobody here ever created. RULED by the founder 2026-09-14 (seed §A-R batch F1)

refuse — no security product is enabled on olympus-labs and no vulnerability exists, so nothing is addressable here: this row reads an alert, an analysis, a database, a configuration or an upload by an id no collection on this host can hand out. GitHub's own answer for a thing that does not exist is 404, which is what this row mirrors; the 403 several of these operations declare for a product that is not enabled was deliberately not taken, because a 403 is a claim about the CALLER and this ruling is a claim about what nobody here ever created. RULED by the founder 2026-09-14 (seed §A-R batch F1)

refuse — no security product is enabled on olympus-labs and no vulnerability exists, so nothing is addressable here: this row reads an alert, an analysis, a database, a configuration or an upload by an id no collection on this host can hand out. GitHub's own answer for a thing that does not exist is 404, which is what this row mirrors; the 403 several of these operations declare for a product that is not enabled was deliberately not taken, because a 403 is a claim about the CALLER and this ruling is a claim about what nobody here ever created. RULED by the founder 2026-09-14 (seed §A-R batch F1)

olympus-labs publishes its image to the CONTAINER registry and has never used the legacy docker.pkg.github.com one, so nothing could collide on a migration off it. features.packageRegistry makes this answerable rather than populated: the organization now publishes packages, and this list is the one family of them that is truthfully empty. Rides the founder's 2026-09-14 batch on the fact it shares with the /user(s) docker-conflict rows beside it

SERVED 2026-09-14 (hello-20 wave W-github): features.packageRegistry mints Package/PackageVersion/PackageFile - one package per manifest in the head tree, one version per release at that release's own commit, and a file whose sha256 the compiler MEASURED over bytes @sandboxapis/archive rebuilds on demand (founder ruling F4, decisions/2026-09-14-0158). GitHub's package_type is a CLOSED enum (npm|maven|rubygems|docker|nuget|container) and canon's is npm|golang|pypi|generic, so this host publishes the npm package and the container registry and GitLab publishes the Go module and the PyPI distribution - a package_type outside the vendored enum would be invariant #2 broken to make a number look better. Gated on hasPackageRegistry(), so the 127 pins frozen before hello-20 answer the generation

SERVED 2026-09-14 (hello-20 wave W-github): features.packageRegistry mints Package/PackageVersion/PackageFile - one package per manifest in the head tree, one version per release at that release's own commit, and a file whose sha256 the compiler MEASURED over bytes @sandboxapis/archive rebuilds on demand (founder ruling F4, decisions/2026-09-14-0158). GitHub's package_type is a CLOSED enum (npm|maven|rubygems|docker|nuget|container) and canon's is npm|golang|pypi|generic, so this host publishes the npm package and the container registry and GitLab publishes the Go module and the PyPI distribution - a package_type outside the vendored enum would be invariant #2 broken to make a number look better. Gated on hasPackageRegistry(), so the 127 pins frozen before hello-20 answer the generation

no person in olympus-labs owns anything publishable - every repository belongs to the organization (the hello-16 ownership ruling) - so a personal package namespace has nothing in it and nothing in it could collide on a registry migration. The person resolves, so the honest answer is GitHub's empty list at 200. RULED by the founder 2026-09-14 (seed §A-R batch F1)

no person in olympus-labs owns anything publishable - every repository belongs to the organization (the hello-16 ownership ruling) - so a personal package namespace has nothing in it and nothing in it could collide on a registry migration. The person resolves, so the honest answer is GitHub's empty list at 200. RULED by the founder 2026-09-14 (seed §A-R batch F1)

refuse — the by-id half of a list that is already an honest empty. No person in olympus-labs owns anything publishable - every repository belongs to the organization (the hello-16 ownership ruling) - so the /user and /users/{username} package collections are empty and no package name can resolve under them; the ruleset reads are addressed over four green/empty ruleset lists (founder, 2026-09-12: no ruleset exists at either scope); the two environment reads are addressed over three armed empties; and the personal projectsV2 reads are addressed over a personal project list nobody here keeps. RULED by the founder 2026-09-14 (seed §A-R batch F1)

refuse — the by-id half of a list that is already an honest empty. No person in olympus-labs owns anything publishable - every repository belongs to the organization (the hello-16 ownership ruling) - so the /user and /users/{username} package collections are empty and no package name can resolve under them; the ruleset reads are addressed over four green/empty ruleset lists (founder, 2026-09-12: no ruleset exists at either scope); the two environment reads are addressed over three armed empties; and the personal projectsV2 reads are addressed over a personal project list nobody here keeps. RULED by the founder 2026-09-14 (seed §A-R batch F1)

refuse — the by-id half of a list that is already an honest empty. No person in olympus-labs owns anything publishable - every repository belongs to the organization (the hello-16 ownership ruling) - so the /user and /users/{username} package collections are empty and no package name can resolve under them; the ruleset reads are addressed over four green/empty ruleset lists (founder, 2026-09-12: no ruleset exists at either scope); the two environment reads are addressed over three armed empties; and the personal projectsV2 reads are addressed over a personal project list nobody here keeps. RULED by the founder 2026-09-14 (seed §A-R batch F1)

the changed-file list and the merge check are computable from the PR's commits and git trees

a single review and its comments over review/review_comment

no pull request in this universe is stacked on another — all 24 `pull` rows carry `base_branch='main'` and no pull's base is another pull's head (0 rows on that self-join); GitHub's own answer for a repository with no stacks is `[]` at 200. RULED by the founder 2026-09-12

refuse — one of twenty things nobody in this organization did: no custom property, no autolink, no interaction limit, no immutable-release setting and no pull-request stack was ever created, so nothing here is addressable by name or number. RULED by the founder 2026-09-14 (seed §A-R batch F1)

SERVED 2026-09-12 (hello-19 wave W-a): `ci_binding` + `ci_binding_scope` - the settings and credentials this organization hands its pipelines. GitHub publishes ONE object as two URL families, so a secret is a binding whose value may not be published and a variable is one whose value may; canon carries exactly that boolean (`masked`) and this row is the same read with a different filter. The `agents` family is canon's `coding-agent` audience - GitHub's newest family, whose vendored operations mirror the Actions ones byte-for-byte and reuse the identical components; served as `organization-actions-secret`, so `visibility` is published and `selected_repositories_url` only on a `selected` row - a link on an `all` row would advertise a route that answers 409. NO `value` MEMBER IS SERVED AND NONE EXISTS: `actions-secret` declares a name and two dates, `ci_binding.value` is NULL on every masked row, and conformance asserts the property is absent from every served secret rather than trusting the schema, which sets no `additionalProperties: false`

SERVED 2026-09-12 (hello-19 wave W-a): `ci_binding` + `ci_binding_scope` - the settings and credentials this organization hands its pipelines. GitHub publishes ONE object as two URL families, so a secret is a binding whose value may not be published and a variable is one whose value may; canon carries exactly that boolean (`masked`) and this row is the same read with a different filter. The `agents` family is canon's `coding-agent` audience - GitHub's newest family, whose vendored operations mirror the Actions ones byte-for-byte and reuse the identical components; the repositories the secret actually reaches - `all` reaches every one, `private` the private ones, `selected` the named ones. The vendored operation declares NO 409 on the secret form (only the variable form does), so this answers the 200 whatever the visibility, and conformance fetches every repository it names to prove the link resolves

SERVED 2026-09-12 (hello-19 wave W-a): `ci_binding` + `ci_binding_scope` - the settings and credentials this organization hands its pipelines. GitHub publishes ONE object as two URL families, so a secret is a binding whose value may not be published and a variable is one whose value may; canon carries exactly that boolean (`masked`) and this row is the same read with a different filter. The `agents` family is canon's `coding-agent` audience - GitHub's newest family, whose vendored operations mirror the Actions ones byte-for-byte and reuse the identical components; `organization-actions-variable`, whose `value` IS declared and is READ from the artifact row canon's `value_source` names - the telemetry exporter's endpoint and its protocol - so the setting and the thing it configures cannot drift apart

SERVED 2026-09-12 (hello-19 wave W-a): `ci_binding` + `ci_binding_scope` - the settings and credentials this organization hands its pipelines. GitHub publishes ONE object as two URL families, so a secret is a binding whose value may not be published and a variable is one whose value may; canon carries exactly that boolean (`masked`) and this row is the same read with a different filter. THE 409 BRANCH of the same operation, and the only answer this organization can give it: its one coding-agent variable is the workspace the agent operates in, which every repository sees, so its visibility is `all`. The vendored 409 declares no body and neither does this. The `actions` twin answers the 200, so the two rows together exercise both branches the document declares

SERVED 2026-09-12 (hello-19 wave W-a): `ci_binding` + `ci_binding_scope` - the settings and credentials this organization hands its pipelines. GitHub publishes ONE object as two URL families, so a secret is a binding whose value may not be published and a variable is one whose value may; canon carries exactly that boolean (`masked`) and this row is the same read with a different filter. The `agents` family is canon's `coding-agent` audience; the organization variables this repository can see, through the same reader rule as its secret twin

SERVED 2026-09-12 (hello-19 wave W-a): `ci_binding` + `ci_binding_scope` - the settings and credentials this organization hands its pipelines. GitHub publishes ONE object as two URL families, so a secret is a binding whose value may not be published and a variable is one whose value may; canon carries exactly that boolean (`masked`) and this row is the same read with a different filter. The `agents` family is canon's `coding-agent` audience; a name the list published

SERVED 2026-09-12 (hello-19 wave W-a) as GitHub's empty envelope at 200: this organization hands its coding agent ONE setting at the REPOSITORY scope and it is a SECRET - the push token the agent runs with - so there is no repository-scoped variable to publish. The one published agent setting, the workspace it operates in, is ORGANIZATION-scoped and reaches this repository through `/repos/{owner}/{repo}/agents/organization-variables`, which is green; duplicating it here would publish one setting as two. The route is the SAME code as its `actions` twin, so the day canon gives the agent a repository variable this row stops being empty on its own, and conformance drives it (`expectsEmpty`) rather than asserting nothing

STALE REASON ("new canon entity Board"): a projectsV2 PROJECT is not a board. It is a titled, dated container of issues with an owner, a creator and an open/closed state, which is canon's `epic` exactly (22 rows) — the same entity renderer-linear/src/pm.ts already publishes as a Linear project. The BOARD (its views, columns and field definitions) is the part canon still lacks and no row here publishes one. Gated on hello-16's portfolio columns, four of which are REQUIRED members of `projects-v2`

SERVED 2026-09-14 (hello-20 wave W-github): features.boards mints board_column and board_field and NO board row - a projectsV2 project is already canon's epic, and a second object for one thing would be the duplication invariant #5 catches (decisions/2026-09-14-0233). A board's columns are the workflow states its issues ACTUALLY PASSED THROUGH, in issue_transition order, so the Status field's options are a measurement of this project's own work rather than a layout somebody chose; there is no WIP limit, because a peak is an observation and a limit is a policy nobody here set. Gated on hasBoards() as well as hasPortfolio()

STALE REASON ("new canon entity Board"): the items of an epic ARE its issues (reader.epicIssues()), and each item's `content` is the object `/repos/{owner}/{repo}/issues/{issue_number}` already serves — so the two cross-check. Every item is an `Issue`: canon attaches a pull request to an issue rather than to an epic, and a draft issue exists only because somebody typed one into a project

SERVED 2026-09-14 (hello-20 wave W-github): features.boards mints board_column and board_field and NO board row - a projectsV2 project is already canon's epic, and a second object for one thing would be the duplication invariant #5 catches (decisions/2026-09-14-0233). A board's columns are the workflow states its issues ACTUALLY PASSED THROUGH, in issue_transition order, so the Status field's options are a measurement of this project's own work rather than a layout somebody chose; there is no WIP limit, because a peak is an observation and a limit is a policy nobody here set. Gated on hasBoards() as well as hasPortfolio()

refuse — the by-id half of a list that is already an honest empty. No person in olympus-labs owns anything publishable - every repository belongs to the organization (the hello-16 ownership ruling) - so the /user and /users/{username} package collections are empty and no package name can resolve under them; the ruleset reads are addressed over four green/empty ruleset lists (founder, 2026-09-12: no ruleset exists at either scope); the two environment reads are addressed over three armed empties; and the personal projectsV2 reads are addressed over a personal project list nobody here keeps. RULED by the founder 2026-09-14 (seed §A-R batch F1)

refuse — the by-id half of a list that is already an honest empty. No person in olympus-labs owns anything publishable - every repository belongs to the organization (the hello-16 ownership ruling) - so the /user and /users/{username} package collections are empty and no package name can resolve under them; the ruleset reads are addressed over four green/empty ruleset lists (founder, 2026-09-12: no ruleset exists at either scope); the two environment reads are addressed over three armed empties; and the personal projectsV2 reads are addressed over a personal project list nobody here keeps. RULED by the founder 2026-09-14 (seed §A-R batch F1)

refuse — the by-id half of a list that is already an honest empty. No person in olympus-labs owns anything publishable - every repository belongs to the organization (the hello-16 ownership ruling) - so the /user and /users/{username} package collections are empty and no package name can resolve under them; the ruleset reads are addressed over four green/empty ruleset lists (founder, 2026-09-12: no ruleset exists at either scope); the two environment reads are addressed over three armed empties; and the personal projectsV2 reads are addressed over a personal project list nobody here keeps. RULED by the founder 2026-09-14 (seed §A-R batch F1)

no security product is enabled on olympus-labs and no vulnerability exists, so there is no alert, no analysis, no configuration and no custom pattern to list - and it cannot be built either: render-sbom.ts parses the repository's REAL manifests, so this replica publishes express@4.18.2, github.com/google/uuid v1.3.0 and httpx==0.24.1, and a generated finding over one of them would be a false claim about a real upstream project. The collection's parent resolves, so the truthful answer is GitHub's empty list at 200 rather than a 404 that would deny the operation exists. RULED by the founder 2026-09-14 (seed §A-R batch F1)

SERVED 2026-09-12 (hello-19 wave W-a): `ci_binding` + `ci_binding_scope` - the settings and credentials this organization hands its pipelines. GitHub publishes ONE object as two URL families, so a secret is a binding whose value may not be published and a variable is one whose value may; canon carries exactly that boolean (`masked`) and this row is the same read with a different filter. The Dependabot scope's own 32 X25519 public-key bytes. GREEN even though the collection beside it is empty by founder ruling F3, because that is exactly what GitHub does: the key is what a client would encrypt a NEW secret to, so it is published whether or not one exists

SERVED 2026-09-12 (hello-19 wave W-a) as GitHub's empty envelope at 200, by FOUNDER RULING F3 (2026-09-12): olympus-labs runs no private package registry, so a dependency bot has nothing private to reach and this repository holds no Dependabot secret. The SCOPE is real - canon mints it and `.../dependabot/secrets/public-key` is green beside this row, exactly as GitHub publishes a Dependabot public key whether or not a secret exists - and the empty list is only an honest `[]` once something says the scope exists, which is why this row is gated on `hasCiBindings()` and answers the generation on an older artifact. `compiler/src/hello19.test.ts` coherence check 9 asserts the emptiness in canon at both windows, so the ruling is falsifiable the day this organization gains a private registry

refuse — olympus-labs is a standalone organization, not an enterprise account, so no enterprise slug in this universe resolves — GitHub's own 404 for an unknown enterprise is the whole answer

refuse — no security product is enabled on olympus-labs and no vulnerability exists, so nothing is addressable here: this row reads an alert, an analysis, a database, a configuration or an upload by an id no collection on this host can hand out. GitHub's own answer for a thing that does not exist is 404, which is what this row mirrors; the 403 several of these operations declare for a product that is not enabled was deliberately not taken, because a 403 is a claim about the CALLER and this ruling is a claim about what nobody here ever created. RULED by the founder 2026-09-14 (seed §A-R batch F1)

refuse — REFUSED 2026-09-12 (hello-19 wave W-a) with GitHub's own 404: the secret whose repositories this asks for does not exist - see the by-name row beside it

refuse — REFUSED 2026-09-12 (hello-19 wave W-a) with GitHub's own 404: no name resolves over the empty collection founder ruling F3 leaves at this scope

generate — new canon entity Discussion. The 2026-09-14 batch rules that nobody in olympus-labs enabled discussions - has_discussions is false on every repository object this host serves - but a GraphQL entity row cannot be armed empty or refused today: MODES.yaml's empty mode is driven by an expectsEmpty conformance entry, which runs a REST fetch, and no graphql row in the fleet carries one. THE ASK: an empty/refuse mechanism for a GraphQL entity row. Reported by the 2026-09-14 GitHub serving wave

refuse — no branch in this repository restricts who may push — canon's only two `protected_ref` rows are scoped to `namespace-001` and repo-01 carries an empty `namespace` column, so the document shapeBranchProtection publishes (render-protection.ts:37) has no `restrictions` object; GitHub's own answer for a protected branch with no push restrictions is 404. RULED by the founder 2026-09-12

refuse — no branch in this repository restricts who may push — canon's only two `protected_ref` rows are scoped to `namespace-001` and repo-01 carries an empty `namespace` column, so the document shapeBranchProtection publishes (render-protection.ts:37) has no `restrictions` object; GitHub's own answer for a protected branch with no push restrictions is 404. RULED by the founder 2026-09-12

neither `production` nor `staging` restricts which branches may deploy to it — all 22 `deployment` rows name a ref that already exists in `branch`, and canon carries no per-environment branch policy; GitHub's own answer for an environment with no policies is `{total_count: 0, branch_policies: []}` at 200 (this operation nests the same empty page under `custom_deployment_protection_rules`). RULED by the founder 2026-09-12

neither `production` nor `staging` restricts which branches may deploy to it — all 22 `deployment` rows name a ref that already exists in `branch`, and canon carries no per-environment branch policy; GitHub's own answer for an environment with no policies is `{total_count: 0, branch_policies: []}` at 200 (this operation nests the same empty page under `branch_policies`). RULED by the founder 2026-09-12

refuse — the by-id half of a list that is already an honest empty. No person in olympus-labs owns anything publishable - every repository belongs to the organization (the hello-16 ownership ruling) - so the /user and /users/{username} package collections are empty and no package name can resolve under them; the ruleset reads are addressed over four green/empty ruleset lists (founder, 2026-09-12: no ruleset exists at either scope); the two environment reads are addressed over three armed empties; and the personal projectsV2 reads are addressed over a personal project list nobody here keeps. RULED by the founder 2026-09-14 (seed §A-R batch F1)

no snippet and no gist exists in this organization - every shared file in olympus-labs lives in the parthenon repository and no persona has ever posted one, which is GitLab's own armed wording for the same fact. The collection's parent resolves, so the honest answer is GitHub's empty list at 200. RULED by the founder 2026-09-14 (seed §A-R batch F1)

no snippet and no gist exists in this organization - every shared file in olympus-labs lives in the parthenon repository and no persona has ever posted one, which is GitLab's own armed wording for the same fact. The collection's parent resolves, so the honest answer is GitHub's empty list at 200. RULED by the founder 2026-09-14 (seed §A-R batch F1)

refuse — no gist exists in this organization, so no gist id can resolve - every shared file in olympus-labs lives in the parthenon repository and no persona has ever posted one. GitHub's own answer for a gist that does not exist is 404, which is what this row mirrors; the three gist COLLECTIONS beside it answer the empty list at 200. RULED by the founder 2026-09-14 (seed §A-R batch F1)

refuse — no gist exists in this organization, so no gist id can resolve - every shared file in olympus-labs lives in the parthenon repository and no persona has ever posted one. GitHub's own answer for a gist that does not exist is 404, which is what this row mirrors; the three gist COLLECTIONS beside it answer the empty list at 200. RULED by the founder 2026-09-14 (seed §A-R batch F1)

refuse — no gist exists in this organization, so no gist id can resolve - every shared file in olympus-labs lives in the parthenon repository and no persona has ever posted one. GitHub's own answer for a gist that does not exist is 404, which is what this row mirrors; the three gist COLLECTIONS beside it answer the empty list at 200. RULED by the founder 2026-09-14 (seed §A-R batch F1)

refuse — no gist exists in this organization, so no gist id can resolve - every shared file in olympus-labs lives in the parthenon repository and no persona has ever posted one. GitHub's own answer for a gist that does not exist is 404, which is what this row mirrors; the three gist COLLECTIONS beside it answer the empty list at 200. RULED by the founder 2026-09-14 (seed §A-R batch F1)

refuse — a source import exists only because someone started one, and this universe has never run one — but GitHub removed the Source Import API on 2024-04-12, before the 2026-03-10 generation every gh pin emulates, so no pin serves it and every host answers GitHub's own deprecated 404 naming the GitHub Importer (meta.retired_meaning)

refuse — a source import exists only because someone started one, and this universe has never run one — but GitHub removed the Source Import API on 2024-04-12, before the 2026-03-10 generation every gh pin emulates, so no pin serves it and every host answers GitHub's own deprecated 404 naming the GitHub Importer (meta.retired_meaning)

refuse — a migration or a source import exists only because someone started one; this universe has never run either, so GitHub answers 404 for the job that was never created

refuse — a migration or a source import exists only because someone started one; this universe has never run either, so GitHub answers 404 for the job that was never created

refuse — a migration or a source import exists only because someone started one; this universe has never run either, so GitHub answers 404 for the job that was never created

refuse — a migration or a source import exists only because someone started one; this universe has never run either, so GitHub answers 404 for the job that was never created

SERVED 2026-09-14 (hello-20 wave W-github): features.billingPeriods mints billing_period/spend_limit/retention_policy - one UTC calendar month of one product's spend on one meter, clipped to the window (decisions/2026-09-14-0343). EVERY AMOUNT DIVIDES BACK: unit_price_micro_cents stores the rate the row was priced at, so a reader multiplies the quantity by it and gets the gross, and gross = discount + net holds BY CONSTRUCTION rather than by two roundings. Every quantity is a fold over rows this artifact already carries - minutes are the month's jobs with each duration rounded up, seats are the Copilot licences held at month end, premium requests are the sessions ai_usage_day recorded - and every rate was verified against the vendor's own published page on 2026-09-14

SERVED 2026-09-14 (hello-20 wave W-github): features.billingPeriods mints spend_limit, and a cap CARRIES NO AMOUNT in the artifact: it is a policy expressed as a MULTIPLE of the worst month, and this host resolves it against the price list it already publishes, so there is one number behind the budget and the usage report rather than two that could drift. alert_threshold_percent is floor(100 / multiple), derived from the multiple rather than chosen beside it

SERVED 2026-09-14 (hello-20 wave W-github): features.billingPeriods mints billing_period/spend_limit/retention_policy - one UTC calendar month of one product's spend on one meter, clipped to the window (decisions/2026-09-14-0343). EVERY AMOUNT DIVIDES BACK: unit_price_micro_cents stores the rate the row was priced at, so a reader multiplies the quantity by it and gets the gross, and gross = discount + net holds BY CONSTRUCTION rather than by two roundings. Every quantity is a fold over rows this artifact already carries - minutes are the month's jobs with each duration rounded up, seats are the Copilot licences held at month end, premium requests are the sessions ai_usage_day recorded - and every rate was verified against the vendor's own published page on 2026-09-14

nobody in olympus-labs owns anything billable of their own: every repository belongs to the organization (the hello-16 ownership ruling), every Copilot seat is granted by it, and every minute and byte on the bill is the organization's - so a personal account here runs up no usage at all. The person resolves and the report is a real one about them, so the honest answer is the empty usage report at 200 rather than a 404. Rides the founder's 2026-09-14 batch on the same fact as the /user(s)/packages group

nobody in olympus-labs owns anything billable of their own: every repository belongs to the organization (the hello-16 ownership ruling), every Copilot seat is granted by it, and every minute and byte on the bill is the organization's - so a personal account here runs up no usage at all. The person resolves and the report is a real one about them, so the honest answer is the empty usage report at 200 rather than a 404. Rides the founder's 2026-09-14 batch on the same fact as the /user(s)/packages group

no commit in this universe carries a comment: review conversation happens on the pull request, and canon has no commit-comment entity (DECISIONS 2026-08-20 [commit-detail] decision 2)

nobody in this organization has made a Copilot space - a space is a curated context bundle a person creates, and this universe records no such act (the migrations/import pattern: it exists only because somebody started one). The scope resolves, so the honest answer is the empty {spaces: []} envelope at 200. RULED by the founder 2026-09-14 (seed §A-R batch F1)

refuse — nobody in this organization has made a Copilot space, so no space number can resolve and neither can a collaborator or a resource under one - the two space COLLECTIONS beside this row answer the empty envelope at 200. RULED by the founder 2026-09-14 (seed §A-R batch F1)

refuse — nobody in this organization has made a Copilot space, so no space number can resolve and neither can a collaborator or a resource under one - the two space COLLECTIONS beside this row answer the empty envelope at 200. RULED by the founder 2026-09-14 (seed §A-R batch F1)

refuse — nobody in this organization has made a Copilot space, so no space number can resolve and neither can a collaborator or a resource under one - the two space COLLECTIONS beside this row answer the empty envelope at 200. RULED by the founder 2026-09-14 (seed §A-R batch F1)

refuse — nobody in this organization has made a Copilot space, so no space number can resolve and neither can a collaborator or a resource under one - the two space COLLECTIONS beside this row answer the empty envelope at 200. RULED by the founder 2026-09-14 (seed §A-R batch F1)

the community profile is which of README/LICENSE/CONTRIBUTING/CODE_OF_CONDUCT the tree actually holds

every statistic is an aggregation over commits (authors, weeks, additions/deletions)

every statistic is an aggregation over commits (authors, weeks, additions/deletions)

this replica records no request of its own, and nobody has viewed or cloned these repositories from outside - an API-insight or a traffic count would be a number with no fact behind it, which is the held-vs-invent line SPEC:220 draws. The scope resolves, so the honest answer is the report with an empty series (and, where the report carries them, the two zero counts that say the same thing) at 200. RULED by the founder 2026-09-14 (seed §A-R batch F1)

this replica records no request of its own, and nobody has viewed or cloned these repositories from outside - an API-insight or a traffic count would be a number with no fact behind it, which is the held-vs-invent line SPEC:220 draws. The scope resolves, so the honest answer is the report with an empty series (and, where the report carries them, the two zero counts that say the same thing) at 200. RULED by the founder 2026-09-14 (seed §A-R batch F1)

no security product is enabled on olympus-labs and no vulnerability exists, so there is no alert, no analysis, no configuration and no custom pattern to list - and it cannot be built either: render-sbom.ts parses the repository's REAL manifests, so this replica publishes express@4.18.2, github.com/google/uuid v1.3.0 and httpx==0.24.1, and a generated finding over one of them would be a false claim about a real upstream project. The collection's parent resolves, so the truthful answer is GitHub's empty list at 200 rather than a 404 that would deny the operation exists. RULED by the founder 2026-09-14 (seed §A-R batch F1)

refuse — olympus-labs is a standalone organization, not an enterprise account, so no enterprise slug in this universe resolves — GitHub's own 404 for an unknown enterprise is the whole answer

refuse — olympus-labs is a standalone organization, not an enterprise account, so no enterprise slug in this universe resolves — GitHub's own 404 for an unknown enterprise is the whole answer

refuse — no security product is enabled on olympus-labs and no vulnerability exists, so nothing is addressable here: this row reads an alert, an analysis, a database, a configuration or an upload by an id no collection on this host can hand out. GitHub's own answer for a thing that does not exist is 404, which is what this row mirrors; the 403 several of these operations declare for a product that is not enabled was deliberately not taken, because a 403 is a claim about the CALLER and this ruling is a claim about what nobody here ever created. RULED by the founder 2026-09-14 (seed §A-R batch F1)

refuse — no security product is enabled on olympus-labs and no vulnerability exists, so nothing is addressable here: this row reads an alert, an analysis, a database, a configuration or an upload by an id no collection on this host can hand out. GitHub's own answer for a thing that does not exist is 404, which is what this row mirrors; the 403 several of these operations declare for a product that is not enabled was deliberately not taken, because a 403 is a claim about the CALLER and this ruling is a claim about what nobody here ever created. RULED by the founder 2026-09-14 (seed §A-R batch F1)

no security product is enabled on olympus-labs and no vulnerability exists, so there is no alert, no analysis, no configuration and no custom pattern to list - and it cannot be built either: render-sbom.ts parses the repository's REAL manifests, so this replica publishes express@4.18.2, github.com/google/uuid v1.3.0 and httpx==0.24.1, and a generated finding over one of them would be a false claim about a real upstream project. The collection's parent resolves, so the truthful answer is GitHub's empty list at 200 rather than a 404 that would deny the operation exists. RULED by the founder 2026-09-14 (seed §A-R batch F1)

no security product is enabled on olympus-labs and no vulnerability exists, so there is no alert, no analysis, no configuration and no custom pattern to list - and it cannot be built either: render-sbom.ts parses the repository's REAL manifests, so this replica publishes express@4.18.2, github.com/google/uuid v1.3.0 and httpx==0.24.1, and a generated finding over one of them would be a false claim about a real upstream project. The collection's parent resolves, so the truthful answer is GitHub's empty list at 200 rather than a 404 that would deny the operation exists. RULED by the founder 2026-09-14 (seed §A-R batch F1)

no security product is enabled on olympus-labs and no vulnerability exists, so there is no alert, no analysis, no configuration and no custom pattern to list - and it cannot be built either: render-sbom.ts parses the repository's REAL manifests, so this replica publishes express@4.18.2, github.com/google/uuid v1.3.0 and httpx==0.24.1, and a generated finding over one of them would be a false claim about a real upstream project. The collection's parent resolves, so the truthful answer is GitHub's empty list at 200 rather than a 404 that would deny the operation exists. RULED by the founder 2026-09-14 (seed §A-R batch F1)

refuse — no security product is enabled on olympus-labs and no vulnerability exists, so nothing is addressable here: this row reads an alert, an analysis, a database, a configuration or an upload by an id no collection on this host can hand out. GitHub's own answer for a thing that does not exist is 404, which is what this row mirrors; the 403 several of these operations declare for a product that is not enabled was deliberately not taken, because a 403 is a claim about the CALLER and this ruling is a claim about what nobody here ever created. RULED by the founder 2026-09-14 (seed §A-R batch F1)

the caller's automations are a bare array, and it is empty because no Copilot automation exists in this data set: an automation exists only because a write created one (POST /agents/repos/{owner}/{repo}/automations), this data set has issued none, and the repository's own cloud-agent configuration on this host reports is_automations_enabled false, so no agent task here was started by one. RULED 2026-10-23 (fleet reserve, from the 2026-10-20 re-pin proposals)

refuse — the by-id half of an honestly empty list, so no id resolves and GitHub's own answer is its 404: no Copilot automation exists in this data set: an automation exists only because a write created one (POST /agents/repos/{owner}/{repo}/automations), this data set has issued none, and the repository's own cloud-agent configuration on this host reports is_automations_enabled false, so no agent task here was started by one. RULED 2026-10-23 (fleet reserve, from the 2026-10-20 re-pin proposals)

generateheld · data-licensing — the tools an automation can select are GitHub's own catalogue, not a fact about this data set: the operation's schema calls the catalogue authoritative and open-ended and says clients must accept identifiers they have not seen, so every id, title and description would be copied from the vendor, which this project holds no grant to redistribute, and a renderer constant would be the request-time vendor catalogue the /vendors ruling forbids. Answers the coverage 404 until an independently licensed source exists (decisions/2026-10-27-2137-github-unclassified-eight.md)

refuse — the by-id half of the repository's honestly empty automation list, so no id resolves and GitHub's own answer is its 404: no Copilot automation exists in this data set: an automation exists only because a write created one (POST /agents/repos/{owner}/{repo}/automations), this data set has issued none, and the repository's own cloud-agent configuration on this host reports is_automations_enabled false, so no agent task here was started by one. RULED 2026-10-23 (fleet reserve, from the 2026-10-20 re-pin proposals)

search over the artifact rows the other search endpoints already query

refuse — GitHub Classroom is a separate product with its own teacher accounts; this universe has no classroom, and every classroom object exists only because a teacher created it — and GitHub sunset Classroom itself on 2026-08-28, so live hosts answer its own 410 while the gh pins, which all emulate the pre-sunset 2026-03-10 generation, keep this refusal (meta.retired_meaning)

refuse — GitHub Classroom is a separate product with its own teacher accounts; this universe has no classroom, and every classroom object exists only because a teacher created it — and GitHub sunset Classroom itself on 2026-08-28, so live hosts answer its own 410 while the gh pins, which all emulate the pre-sunset 2026-03-10 generation, keep this refusal (meta.retired_meaning)

refuse — GitHub Classroom is a separate product with its own teacher accounts; this universe has no classroom, and every classroom object exists only because a teacher created it — and GitHub sunset Classroom itself on 2026-08-28, so live hosts answer its own 410 while the gh pins, which all emulate the pre-sunset 2026-03-10 generation, keep this refusal (meta.retired_meaning)

refs resolve against the branch/commit tables the git transport already serves

no interaction limit is active anywhere in this universe — olympus-labs is a private organization whose one repository is private (repo.visibility='private'), so there is no drive-by traffic to limit and nobody has set one; GitHub's own answer for a scope with no active limit is `{}` at 200 (the spec's 200 has no required member). RULED by the founder 2026-09-12

no interaction limit is active anywhere in this universe — olympus-labs is a private organization whose one repository is private (repo.visibility='private'), so there is no drive-by traffic to limit and nobody has set one; this operation's own 200 is an ARRAY of the users who may bypass the cap, so its empty answer is `[]` rather than the `{}` the three limit reads carry. RULED by the founder 2026-09-12

refuse — the organization twin of the repository row the founder ruled on 2026-09-14 (seed batch F1): no interaction limit was ever created in this organization, which /orgs/{org}/interaction-limits already answers with {}, so there is no creation-cap configuration to read and GitHub's own answer is its 404. RULED 2026-10-23 (fleet reserve, from the 2026-10-20 re-pin proposals)

refuse — olympus-labs publishes no Pages site - GitLab's armed wording, applied to GitHub - so the whole family refuses, the builds LIST included: a build list is a collection under a SITE, and the site is what does not exist, so there is no resolving parent for it to be empty under. GitHub's own answer for a repository with no Pages site is 404. RULED by the founder 2026-09-14 (seed §A-R batch F1)

refuse — olympus-labs publishes no Pages site - GitLab's armed wording, applied to GitHub - so the whole family refuses, the builds LIST included: a build list is a collection under a SITE, and the site is what does not exist, so there is no resolving parent for it to be empty under. GitHub's own answer for a repository with no Pages site is 404. RULED by the founder 2026-09-14 (seed §A-R batch F1)

refuse — olympus-labs publishes no Pages site - GitLab's armed wording, applied to GitHub - so the whole family refuses, the builds LIST included: a build list is a collection under a SITE, and the site is what does not exist, so there is no resolving parent for it to be empty under. GitHub's own answer for a repository with no Pages site is 404. RULED by the founder 2026-09-14 (seed §A-R batch F1)

release assets over the release the tag already resolves to (14-hit demand cluster, telemetry 2026-09-01)

repo collaborators are the teams with access plus the outside contributors canon already marks (Person.member = false)

repo collaborators are the teams with access plus the outside contributors canon already marks (Person.member = false)

no pending repository invitations in this universe: reader.membershipsForPerson(athena) (reader.ts:2969) carries no pending repository row, because nobody here has been offered a repository. It is the caller's side of /repos/{owner}/{repo}/invitations and answers the same fact, so conformance asserts the two agree. SERVED 2026-09-10 as GitHub's empty array, behind the hello-16 generation gate — RULED EMPTY by the founder 2026-09-10

reader.refCatalog("github.api-versions") in the artifact's own ord order (newest first), and the version this host stamps into x-github-api-version is asserted to be one of them. licence: FACTUAL — the response is a list of API version DATES (gh api /versions returns ["2026-03-10","2022-11-28"]), which carries no authorship, and this host already declares the version each pin emulates. Older pins answer the refCatalogs generation-gap 404 rather than an empty catalogue, which on these rows would be a false claim about the HOST. SERVED 2026-09-09 (hello-16)

generateheld · data-licensing — static provider catalog, and NOT `derive`: `derive` is defined in this file as computed from artifact rows that already exist, and a vendor catalog is not an artifact row. LICENCE: NO GRANT — the response is one of GitHub's design aphorisms, creative prose GitHub publishes under no licence. The per-item licence finding is coverage/reviews/2026-09-09-hello-15-stale-reasons-git-hosts.md §5.3, and §5.4 records why the label waited for a shard arm

ContentReaction is canon as of hello-15 (features.contentReactions); reactionsFor() answers it and shapeReaction renders GitHub's closed eight-value content enum over the SAME rows GitLab serves as award emoji. The parent resources now carry the reaction-rollup GitHub embeds

ContentReaction is canon as of hello-15 (features.contentReactions); reactionsFor() answers it and shapeReaction renders GitHub's closed eight-value content enum over the SAME rows GitLab serves as award emoji. The parent resources now carry the reaction-rollup GitHub embeds

refuse — no commit in this universe carries a comment (DECISIONS 2026-08-20 [commit-detail] decision 2; `/repos/{owner}/{repo}/comments` is already an armed honest empty in honest-empties.ts), so no `comment_id` can ever resolve and GitHub's own answer for a commit comment that does not exist is 404 — the row waits on a CommitComment, not on ContentReaction, whose 80 rows already answer GitHub's other four reaction operations. RULED by the founder 2026-09-12

no security product is enabled on olympus-labs and no vulnerability exists, so there is no alert, no analysis, no configuration and no custom pattern to list - and it cannot be built either: render-sbom.ts parses the repository's REAL manifests, so this replica publishes express@4.18.2, github.com/google/uuid v1.3.0 and httpx==0.24.1, and a generated finding over one of them would be a false claim about a real upstream project. The collection's parent resolves, so the truthful answer is GitHub's empty list at 200 rather than a 404 that would deny the operation exists. RULED by the founder 2026-09-14 (seed §A-R batch F1)

generate — GitHub's GLOBAL security-advisory database, which is a catalogue of REAL upstream vulnerabilities rather than anything about olympus-labs - an empty list here would claim no vulnerability is known anywhere, and a generated one would be a false claim about a real project (the constraint render-sbom.ts's real manifests impose, seed trap 29). It is the vendor-reference class /emojis and /codes_of_conduct already sit in, and THE ASK IS A LICENCE ANSWER for redistributing advisory data plus a catalogue to hold it - not renderer work, and deliberately outside the founder's 2026-09-14 batch, which is about what nobody in this organization did. Re-worded by the 2026-09-14 GitHub serving wave

refuse — no security product is enabled on olympus-labs and no vulnerability exists, so nothing is addressable here: this row reads an alert, an analysis, a database, a configuration or an upload by an id no collection on this host can hand out. GitHub's own answer for a thing that does not exist is 404, which is what this row mirrors; the 403 several of these operations declare for a product that is not enabled was deliberately not taken, because a 403 is a claim about the CALLER and this ruling is a claim about what nobody here ever created. RULED by the founder 2026-09-14 (seed §A-R batch F1)

THE MANIFESTS NEVER CHANGE BETWEEN COMMITS. hello-9's scaffold writes package.json, pnpm-lock.yaml, go.mod/go.sum and requirements.txt from constants, so every commit in a repository carries byte-identical dependency declarations and the diff between any two refs is genuinely empty — GitHub returns the same `[]` for a comparison that adds and removes nothing. This is not the SBOM being unavailable: `/dependency-graph/sbom` serves the real package list (#418), and this row says only that the list did not MOVE. Falsifiable: the day the generator varies a manifest across commits, a comparison spanning that change stops being empty and the row goes red. RULED by the founder 2026-09-09

generate — needs a gateway download route (service-own endpoint) — later. The DATA is already served: `/dependency-graph/sbom` returns the real SPDX document (#418). This pair is the request-then-download flow, and its second half is a 302 to bytes on the SERVICE host, so it needs a route in packages/gateway rather than more renderer. Minting an `sbom_url` that 404s would be a placeholder link (invariant #4). RULED by the founder 2026-09-09

no security product is enabled on olympus-labs and no vulnerability exists, so there is no alert, no analysis, no configuration and no custom pattern to list - and it cannot be built either: render-sbom.ts parses the repository's REAL manifests, so this replica publishes express@4.18.2, github.com/google/uuid v1.3.0 and httpx==0.24.1, and a generated finding over one of them would be a false claim about a real upstream project. The collection's parent resolves, so the truthful answer is GitHub's empty list at 200 rather than a 404 that would deny the operation exists. RULED by the founder 2026-09-14 (seed §A-R batch F1)

refuse — no security product is enabled on olympus-labs and no vulnerability exists, so nothing is addressable here: this row reads an alert, an analysis, a database, a configuration or an upload by an id no collection on this host can hand out. GitHub's own answer for a thing that does not exist is 404, which is what this row mirrors; the 403 several of these operations declare for a product that is not enabled was deliberately not taken, because a 403 is a claim about the CALLER and this ruling is a claim about what nobody here ever created. RULED by the founder 2026-09-14 (seed §A-R batch F1)

fetch negotiation; non-delta packfile v2, side-band-64k, shallow/deepen/unshallow. No partial clone (filter), no protocol v2

read-only — NOT A READ, and in the manifest for the one reason this mode exists - clients demonstrably probe it, because `git push` is what a developer types next after a clone that worked. The read-only 403 IS its final response (invariant #3) rather than a gap waiting on anything: renderer-github/src/git/routes.ts:120 answers the advertisement `?service=git-receive-pack` with readOnly(c, "push to this repository (git-receive-pack)") and the POST is deliberately given NO route at all (routes.ts:134), so both halves of a push refuse identically. The row is `excluded` and never joins the badge denominator, which is what this mode has meant since A0.1 - the zendesk /api/v2/users/me/session/renew precedent (founder ruling 2026-09-06), applied to the fleet's only other excluded row that is a WRITE rather than a scope decision. CLASSIFIED 2026-09-13 (the unjudged-47 pass) and NOT re-ruled: the row's own curated note in git-transport.ts has said exactly this since the transport shipped (DECISIONS 2026-08-23); the mode word was simply never written down beside it. NO NUMBER MOVES - an excluded row is counted in the generation report's (excluded) column either way, and the report's `read-only` column reads 0 whenever the mode is used correctly

reader.listLicenses() reads license_catalog (a compile-time table, never a renderer constant) and render-catalogs.ts shapes license-simple over it; node_id is minted with artifact's own nodeId("License", key) except mit, whose api.github.com value the repository object has published since Wave A. licence: FREE — the thirteen bodies GitHub serves (gh api /licenses: agpl-3.0, apache-2.0, bsd-2-clause, bsd-3-clause, bsl-1.0, cc0-1.0, epl-2.0, gpl-2.0, gpl-3.0, lgpl-2.1, mit, mpl-2.0, unlicense) are meant for verbatim redistribution and several say so in their own header — the GPL family carries "Everyone is permitted to copy and distribute verbatim copies of this license document", CC0-1.0 and Unlicense are public-domain dedications, Apache-2.0 ships an APPENDIX instructing reproduction; the key/spdx_id/permissions metadata comes from github/choosealicense.com, which is MIT (gh api repos/github/choosealicense.com/license). Older pins answer the refCatalogs generation-gap 404 rather than an empty catalogue, which on these rows would be a false claim about the HOST. SERVED 2026-09-09 (hello-16)

SERVED 2026-09-09 (hello-16): the LICENSE blob `features.repoLicense` put in every tree, read through the same fileAt/shapeContentFile path /repos/{owner}/{repo}/contents/LICENSE uses, so the two cannot describe different bytes. The `license` object is the one `shapeRepo` has published since Wave A (MIT_LICENSE in packages/renderer-github/src/render.ts), which closes the inconsistency the 2026-09-01 reason named: the repository object and this row can no longer name different licences, and conformance asserts they are byte-identical AND that both match the artifact's own /licenses catalogue row for `mit`. The served body carries no upstream `[year]`/`[fullname]` placeholder. `_links.self`, `_links.git` and `download_url` all resolve on this host — the last over the `/{owner}/{repo}/raw/{ref}/{path}` path this renderer has advertised on every content-file since SPEC rev 7 and now answers. `license.url` still points at the /licenses catalogue, which is the CATALOGUE wave's coverage and answers the honest coverage 404 until it lands. An older artifact answers the hello-16 generation gap rather than GitHub's no-licence 404, which would contradict the `license: MIT` the repository object serves on the same host

nobody launched a codespace, configured hosted-compute networking or registered a private registry - the last is hello-19's founder ruling F3 verbatim (olympus-labs runs no private package registry), which three already-terminal Dependabot rows rest on. The organization resolves, so the honest answer is the vendor's empty envelope at 200. RULED by the founder 2026-09-14 (seed §A-R batch F1)

refuse — nobody launched a codespace, configured hosted-compute networking or registered a private registry, so nothing here is addressable: this row reads a registry by name, a network configuration by id, or a codespace default for a repository nobody has ever started one in. RULED by the founder 2026-09-14 (seed §A-R batch F1)

no security product is enabled on olympus-labs and no vulnerability exists, so there is no alert, no analysis, no configuration and no custom pattern to list - and it cannot be built either: render-sbom.ts parses the repository's REAL manifests, so this replica publishes express@4.18.2, github.com/google/uuid v1.3.0 and httpx==0.24.1, and a generated finding over one of them would be a false claim about a real upstream project. The collection's parent resolves, so the truthful answer is GitHub's empty list at 200 rather than a 404 that would deny the operation exists. RULED by the founder 2026-09-14 (seed §A-R batch F1)

generateheld · data-licensing — static provider catalog, and NOT `derive`: `derive` is defined in this file as computed from artifact rows that already exist, and a vendor catalog is not an artifact row. LICENCE: NO USABLE GRANT, and the CC BY 4.0 premise is out of date — EthicalSource/contributor_covenant's only LICENSE.md is the Hippocratic License 3.0, and the other body GitHub serves is the Django Code of Conduct, CC BY-SA 4.0, whose ShareAlike reciprocity cannot travel into a compiled artifact this service publishes. The per-item licence finding is coverage/reviews/2026-09-09-hello-15-stale-reasons-git-hosts.md §5.3, and §5.4 records why the label waited for a shard arm

SERVED 2026-09-09: reader.listCheckoutKeys(repo) (packages/artifact/src/reader.ts:2351), validated against the vendored `deploy-key` component. packages/canon/src/ci-config.ts:236 names THIS endpoint as the reason a checkout key's public half is publishable at all; `key` is the ssh-ed25519 material and `title` its OpenSSH comment, and the conformance entry re-hashes the decoded blob to the artifact's own fingerprint_sha256. `read_only` is true because a CI checkout key clones, and `last_used` is null because canon records no use. Paginated with GitHub's Link header, walked to the last page in conformance; answers the hello-15 generation gap on an older artifact rather than an empty array

reader.listGitignoreTemplates() reads gitignore_template; every one of the 163 names it lists resolves at {name}, which conformance follows one by one. licence: CC0-1.0 — github/gitignore publishes its templates under the Creative Commons Zero v1.0 Universal public-domain dedication (its own LICENSE file; gh api repos/github/gitignore/license returns spdx_id CC0-1.0). Older pins answer the refCatalogs generation-gap 404 rather than an empty catalogue, which on these rows would be a false claim about the HOST. SERVED 2026-09-09 (hello-16)

generateheld · data-licensing — static provider catalog, and NOT `derive`: `derive` is defined in this file as computed from artifact rows that already exist, and a vendor catalog is not an artifact row. LICENCE: NO GRANT — the response is a map of roughly 1,870 shortcodes whose VALUES are github.githubassets.com URLs for GitHub's own image assets, which this project holds no grant to redistribute and which would also hand a caller live github.com URLs from a sandbox host. The per-item licence finding is coverage/reviews/2026-09-09-hello-15-stale-reasons-git-hosts.md §5.3, and §5.4 records why the label waited for a shard arm