Security: see references/scanner-notes.md and upstream SECURITY.md for expected scanner signals and trust model.

Verasic GitHub Governance — Factory + Soft Enforcement

Workflows

New repo factory path — bootstrap a repo once:

1. Read references/governance-protocol.md (model, plan matrix, mutation routing) and references/factory-protocol.md (ordered checklist).
2. Create a private repo (default). Do not apply GitHub branch protection on Free private plans.
3. Prefer init orchestrator: bash .cursor/skills/verasic-github-governance-init/scripts/factory.sh --yes
4. Or manually: bootstrap-repo.sh → wire-hooks.sh → lefthook install → doctor.sh
5. Open first PR to prove CI merge + Actions. Required status check name: ci.
6. Verify: bash .cursor/skills/verasic-github-governance/scripts/doctor.sh

Existing repo with CI: bootstrap stops on foreign workflows (exit 2). Read references/existing-repo-conflicts.md and pass --ci-strategy=skip|merge|replace.

Turborepo: when turbo.json exists at repo root, bootstrap uses ci-turborepo.yml (bun + turbo + gate job ci).