[vitormattos]

Problem

GitHub governance Apply run #41853388139 failed to mint a token (HTTP 422), because the installed ruleset-management GitHub App grants Administration: write but not Contents: read. The missing shared protection on akaunting-field-studio remains unprovisioned.

Fix

• Pin the updated generic governance engine at signed SHA 76fcdc8ae250c81aeb055533c2741385ac9f0b7b (fix(governance): separate public content reads from ruleset administration github-governance#43).
• Request only permission-administration: write from the ruleset App, which is already granted to its installation.
• Pass the workflow's existing short-lived github.token as contents-token only for public content classification.
• Preserve ruleset-sync environment approval, repository-scoped Apply, and the safe onboard_only=true default.
• Update documentation and regression assertions.

Validation

• 92 Python tests passed locally; no whitespace errors.
• Signed, DCO-compliant commit 53b1791230e536967b3135e768ae5511ecdf4c61.
• No GitHub App permission grants or target repository rules were changed as part of this PR.

Rollout

1. Review and merge upstream engine PR chore: sync workflow catalog #43 after CI passes.
2. Review and merge this caller PR after CI passes.
3. Execute GitHub governance with repository=akaunting-field-studio, apply=true, onboard_only=true; approve the protected environment after confirming the plan.
4. Verify the ruleset and rerun the read-only governance plan. Do not skip protected environment approval.

Future work

Automatic onboarding of future repositories and privileged verification of currently hidden bypass actors remain separate from this immediate incident fix.