[vitormattos]

Problem

The GitHub ruleset read API conceals bypass_actors when a token lacks write access to the ruleset. The automatic public Plan (GITHUB_TOKEN/read only) incorrectly treats this redaction as an empty bypass list, reporting false drift even after successful privileged reconciliation.

Changes

• Track hidden bypass actors explicitly rather than inventing an empty authoritative actor list.
• Distinguish UNVERIFIED when observable ruleset fields match but bypass cannot be inspected.
• Continue reporting real DRIFT for observable differences; do not hide authentication or API errors.
• Fail closed if Apply ever receives a ruleset with hidden bypass actors.
• Surface UNVERIFIED warnings in GitHub Actions plan summary.

Tests

• 58 Vitest tests, TypeScript typecheck, Node-native syntax check, and build passed locally.
• Added regression tests for redaction, visible policy drift, safe application, and CLI diagnostics.
• Earlier authenticated read-only org plans found 38 pending LibreSign repositories and 125 pending LibreCodeCoop repositories after targeted .github Apply; no metadata changes.

Rollout

Merge this before updating the caller workflows to this immutable commit SHA. Apply still requires an approved, write-scoped GitHub App token. The automatic Plan remains least privilege and may display UNVERIFIED; use an authenticated administrative dry-run to verify bypass changes before a full Apply.