@homeflare/alchemy 0.25.1 → 0.27.0

package/src/github/repository-ruleset-constraints.ts

@@ -0,0 +1,136 @@
+/**
+ * Wire-form constraints for `GitHub.RepositoryRuleset`, read off GitHub's own schema rather
+ * than invented (vendor-schema's rule: never infer a bound the schema does not state).
+ *
+ * Provenance: `github/rest-api-description` commit `4377b4f4845b` on `main`
+ * (measured 2026-09-23; 12,964,430 bytes; sha256 `b8ca0376…` (prefix as given upstream by the
+ * planner — this file does not extend it), `info.version` `1.1.4`).
+ * That commit's `pull_request` rule gives `allowed_merge_methods` as the enum
+ * `{merge, squash, rebase}` and `required_approving_review_count` as `0–10` — both match
+ * what Octokit's own installed types carry (below), so the two agree.
+ *
+ * ⚠️ MEASURED 2026-09-23, CORRECTING THE PLAN'S OWN CITATION: `@octokit/rest@22.0.1` pulls
+ *   `@octokit/openapi-types@29.0.1` in directly, but the REST method PARAMETER TYPES Octokit
+ *   actually exposes — `Parameters<Octokit['rest']['repos']['createRepoRuleset']>[0]`, which
+ *   `RepositoryRuleType` below is derived from — resolve through a DIFFERENT chain:
+ *   `@octokit/plugin-rest-endpoint-methods@17.0.0` → `@octokit/types@16.0.0` →
+ *   `@octokit/openapi-types@27.0.0` (`bun install`'s own resolution in this checkout,
+ *   confirmed by reading each intermediate `package.json`). 27.0.0's `repository-rule` union
+ *   has 21 members, one fewer than 29.0.1's 22 — it has no `license_compliance_scanning`.
+ *   `RULE_TYPE_COVERAGE`'s `satisfies` below is written against the 27.0.0 union, because
+ *   that is the one `tsc` (and so `bun run check`) actually enforces; a bump that moves
+ *   `plugin-rest-endpoint-methods` onto a newer `@octokit/types` will fail this file to
+ *   compile on the very day the union changes (S1 test iv), which is the point.
+ *
+ * ⛔ `require_extra_approval_for_unattributed_changes` appears in NEITHER schema (0 occurrences
+ * in the commit above, 0 in either installed `@octokit/openapi-types`) — see
+ * repository-ruleset.ts for why it is still modeled (H15) and repository-ruleset-wire.test.ts
+ * for whether it survives Octokit's request builder.
+ */
+import type { Octokit } from '@octokit/rest';
+
+/** The exact vendor/toolchain versions this file's constraints were read against (S38). A
+ * re-walk that finds a different version updates this comment and the header above together. */
+export const RULESET_SCHEMA_PROVENANCE = {
+  alchemy: '2.0.0-beta.79',
+  octokitRest: '22.0.1',
+  /** The version `Octokit['rest']['repos']['createRepoRuleset']`'s own PARAMETER TYPES
+   * actually resolve through (`plugin-rest-endpoint-methods@17.0.0` → `@octokit/types@16.0.0`
+   * → this) — not the 29.0.1 `@octokit/rest@22.0.1` pulls in directly. See the file header. */
+  octokitOpenapiTypesForRestMethods: '27.0.0',
+  restApiDescriptionCommit: '4377b4f4845b',
+  restApiDescriptionSha256Prefix: 'b8ca0376',
+  restApiDescriptionInfoVersion: '1.1.4',
+} as const;
+
+type CreateRulesetParams = NonNullable<
+  Parameters<Octokit['rest']['repos']['createRepoRuleset']>[0]
+>;
+/** The request body Octokit's OWN types accept, minus the two URL-template params — the shape
+ * repository-ruleset-form.ts builds `rules`/`conditions`/`bypass_actors` against.
+ * ⚠️ `Pick` with explicit keys, NOT `Omit<CreateRulesetParams, 'owner' | 'repo'>` — measured:
+ *   `CreateRulesetParams` is an intersection with Octokit's own `RequestParameters`, which
+ *   carries a string index signature; `Omit`'s `keyof`-based exclusion collapses through that
+ *   signature and produces a type whose named properties no longer survive an object spread
+ *   (every spread of the `Omit`'d type type-checked as contributing only `{}`). `Pick` with
+ *   literal keys never computes `keyof` over the intersection, so it does not collapse. */
+export type CreateRulesetBody = Pick<
+  CreateRulesetParams,
+  'name' | 'target' | 'enforcement' | 'bypass_actors' | 'conditions' | 'rules'
+>;
+export type WireRule = NonNullable<CreateRulesetParams['rules']>[number];
+export type WirePullRequestRule = Extract<WireRule, { type: 'pull_request' }>;
+export type WireStatusChecksRule = Extract<WireRule, { type: 'required_status_checks' }>;
+
+/** Every rule `type` Octokit's OWN installed types know about — derived, not hand-listed, so a
+ * vendor upgrade that adds a rule type fails `RULE_TYPE_COVERAGE`'s `satisfies` below at
+ * compile time (S1 test iv) rather than silently reaching `reconcile` unrecognized. */
+export type RepositoryRuleType = WireRule['type'];
+
+/** `'modeled'` rules this resource can declare and diff; `'refused'` rules it recognizes on a
+ * live ruleset but will never send — a live rule of a refused type fails the plan by name
+ * (`UndeclaredLiveRule`) instead of being silently dropped by the wholesale `rules` PUT. */
+export const RULE_TYPE_COVERAGE = {
+  creation: 'modeled',
+  update: 'modeled',
+  deletion: 'modeled',
+  required_linear_history: 'modeled',
+  required_signatures: 'modeled',
+  pull_request: 'modeled',
+  required_status_checks: 'modeled',
+  non_fast_forward: 'modeled',
+  merge_queue: 'refused',
+  required_deployments: 'refused',
+  commit_message_pattern: 'refused',
+  commit_author_email_pattern: 'refused',
+  committer_email_pattern: 'refused',
+  branch_name_pattern: 'refused',
+  tag_name_pattern: 'refused',
+  workflows: 'refused',
+  code_scanning: 'refused',
+  copilot_code_review: 'refused',
+  file_path_restriction: 'refused',
+  max_file_path_length: 'refused',
+  file_extension_restriction: 'refused',
+  max_file_size: 'refused',
+} as const satisfies Record<RepositoryRuleType, 'modeled' | 'refused'>;
+
+export const MODELED_RULE_TYPES: readonly RepositoryRuleType[] = (
+  Object.keys(RULE_TYPE_COVERAGE) as RepositoryRuleType[]
+).filter((type) => RULE_TYPE_COVERAGE[type] === 'modeled');
+
+export const ALLOWED_MERGE_METHODS = ['merge', 'squash', 'rebase'] as const;
+export type AllowedMergeMethod = (typeof ALLOWED_MERGE_METHODS)[number];
+
+export const MIN_REQUIRED_APPROVALS = 0;
+export const MAX_REQUIRED_APPROVALS = 10;
+
+/** `undefined` when the value is within the schema's `0–10` bound for
+ * `required_approving_review_count`; otherwise the refusal reason. Plan-time, not wire-time —
+ * schema-codegen's rule: check the form, before the "no previous state" early return. */
+export function approvalCountRefusal(count: number): string | undefined {
+  if (
+    !Number.isInteger(count) ||
+    count < MIN_REQUIRED_APPROVALS ||
+    count > MAX_REQUIRED_APPROVALS
+  ) {
+    return (
+      `requiredApprovingReviewCount must be a whole number from ${String(MIN_REQUIRED_APPROVALS)} ` +
+      `to ${String(MAX_REQUIRED_APPROVALS)} (GitHub's own bound); got ${String(count)}.`
+    );
+  }
+  return undefined;
+}
+
+/** `undefined` when every entry is one of the schema's enum and the list is non-empty ("at
+ * least one option must be enabled" — the schema's own words); otherwise the refusal reason. */
+export function allowedMergeMethodsRefusal(methods: readonly string[]): string | undefined {
+  if (methods.length === 0) {
+    return 'allowedMergeMethods must name at least one method — GitHub refuses an empty list.';
+  }
+  const bad = methods.filter((m) => !(ALLOWED_MERGE_METHODS as readonly string[]).includes(m));
+  if (bad.length > 0) {
+    return `allowedMergeMethods has values GitHub does not accept: ${bad.join(', ')}.`;
+  }
+  return undefined;
+}

package/src/github/repository-ruleset-coverage.test.ts

@@ -0,0 +1,82 @@
+/**
+ * (iv) `RULE_TYPE_COVERAGE` is a compile-time exhaustiveness check by construction: it is typed
+ * `as const satisfies Record<RepositoryRuleType, 'modeled' | 'refused'>`, and `RepositoryRuleType`
+ * is derived from Octokit's OWN installed rule-type union (repository-ruleset-constraints.ts),
+ * not hand-listed. When a future `@octokit/rest`/`@octokit/types` upgrade adds a rule type,
+ * `bun run check`'s `tsc` step fails on repository-ruleset-constraints.ts — the object literal
+ * is missing a required key — before `reconcile` can ever see a rule it does not recognize.
+ *
+ * ⚠️ THIS FILE CANNOT DEMONSTRATE THAT FAILURE AT RUNTIME. `bun:test` does not type-check; a
+ *   `// @ts-expect-error` fixture proving the object literal rejects an incomplete map would
+ *   need its own file kept permanently out of `tsc`'s project (or it would break the build it
+ *   is trying to test), which is more machinery than the guarantee is worth. What this file
+ *   DOES check at runtime: the count and shape of the union `tsc` is enforcing right now, as a
+ *   change detector — a value this test did not expect means the installed Octokit version
+ *   moved and `RULE_TYPE_COVERAGE`'s completeness (already enforced separately, by `tsc`) has a
+ *   new member to classify as `'modeled'` or `'refused'` on purpose, not by accident.
+ */
+import { describe, expect, test } from 'bun:test';
+import {
+  MODELED_RULE_TYPES,
+  RULESET_SCHEMA_PROVENANCE,
+  RULE_TYPE_COVERAGE,
+} from './repository-ruleset-constraints.ts';
+
+const EXPECTED_TYPES = [
+  'creation',
+  'update',
+  'deletion',
+  'required_linear_history',
+  'required_signatures',
+  'pull_request',
+  'required_status_checks',
+  'non_fast_forward',
+  'merge_queue',
+  'required_deployments',
+  'commit_message_pattern',
+  'commit_author_email_pattern',
+  'committer_email_pattern',
+  'branch_name_pattern',
+  'tag_name_pattern',
+  'workflows',
+  'code_scanning',
+  'copilot_code_review',
+  'file_path_restriction',
+  'max_file_path_length',
+  'file_extension_restriction',
+  'max_file_size',
+] as const;
+
+describe('RULE_TYPE_COVERAGE tracks Octokit-installed rule types exactly', () => {
+  test("classifies every one of the 21 rule types this checkout's Octokit knows", () => {
+    expect(Object.keys(RULE_TYPE_COVERAGE).sort()).toEqual([...EXPECTED_TYPES].sort());
+  });
+
+  test('exactly the 8 upstream `GitHub.Ruleset` models are "modeled", the rest "refused"', () => {
+    const modeled = new Set(MODELED_RULE_TYPES);
+    expect(modeled).toEqual(
+      new Set([
+        'creation',
+        'update',
+        'deletion',
+        'required_linear_history',
+        'required_signatures',
+        'pull_request',
+        'required_status_checks',
+        'non_fast_forward',
+      ]),
+    );
+    for (const type of EXPECTED_TYPES) {
+      if (!modeled.has(type)) expect(RULE_TYPE_COVERAGE[type]).toBe('refused');
+    }
+  });
+
+  test('the provenance record names the version tcs actually checked this file against', () => {
+    // The 27.0.0 vs 29.0.1 split is the point (see repository-ruleset-constraints.ts's header):
+    // `@octokit/rest` pulls 29.0.1 directly, but the REST method parameter types this family
+    // derives `RepositoryRuleType` from resolve through a different, older chain.
+    expect(RULESET_SCHEMA_PROVENANCE.octokitOpenapiTypesForRestMethods).toBe('27.0.0');
+    expect(RULESET_SCHEMA_PROVENANCE.octokitRest).toBe('22.0.1');
+    expect(RULESET_SCHEMA_PROVENANCE.alchemy).toBe('2.0.0-beta.79');
+  });
+});

package/src/github/repository-ruleset-errors.ts

@@ -0,0 +1,136 @@
+/**
+ * `GitHub.RepositoryRuleset`'s failures as typed tags (S21). None of these sniffs a status
+ * code or matches a message from Octokit — every one is raised from a fact this family's own
+ * code already checked (a paginated list, a live GET, a declared prop), so `catchTag` covers
+ * every refusal without a driver-string coincidence hiding a different failure underneath it.
+ */
+import * as Data from 'effect/Data';
+
+/**
+ * More than one ruleset shares a name (and target) on the same repository. `probeByName`
+ * fails BEFORE reading either one — see repository-ruleset-probe.ts — because there is no
+ * way to know which one is "ours" and guessing risks converging the wrong ruleset.
+ */
+export class DuplicateRuleset extends Data.TaggedError('DuplicateRuleset')<{
+  readonly owner: string;
+  readonly repository: string;
+  readonly name: string;
+  readonly ids: readonly number[];
+}> {
+  override get message(): string {
+    return (
+      `GitHub.RepositoryRuleset: ${this.owner}/${this.repository} has ${String(this.ids.length)} ` +
+      `rulesets named "${this.name}" (ids ${this.ids.join(', ')}). Delete the extra one or rename ` +
+      'it by hand before this resource can adopt or manage it — nothing was read or written.'
+    );
+  }
+}
+
+/** A declared `bypassActors` entry names an actor the live ruleset does not have. Widening
+ * bypass is a handoff, never a deploy — see repository-ruleset-guards.ts. */
+export class BypassActorWidened extends Data.TaggedError('BypassActorWidened')<{
+  readonly owner: string;
+  readonly repository: string;
+  readonly name: string;
+  readonly widened: readonly string[];
+}> {
+  override get message(): string {
+    return (
+      `GitHub.RepositoryRuleset "${this.name}" on ${this.owner}/${this.repository}: the ` +
+      `declaration adds a bypass actor the live ruleset does not have (${this.widened.join(', ')}). ` +
+      'Widening bypass is refused here; grant it by hand and adopt the change, or use handoff.'
+    );
+  }
+}
+
+/** A live rule's `type` is neither modeled nor explicitly refused by RULE_TYPE_COVERAGE, or is
+ * refused and present live anyway. The PUT replaces `rules` wholesale, so silently omitting a
+ * live rule type would drop it — this fails the plan by name instead. */
+export class UndeclaredLiveRule extends Data.TaggedError('UndeclaredLiveRule')<{
+  readonly owner: string;
+  readonly repository: string;
+  readonly name: string;
+  readonly ruleType: string;
+}> {
+  override get message(): string {
+    return (
+      `GitHub.RepositoryRuleset "${this.name}" on ${this.owner}/${this.repository}: the live ` +
+      `ruleset has a "${this.ruleType}" rule this resource does not model. Declare it (if it is ` +
+      'now modeled) or an explicit `false` to remove it — the PUT replaces `rules` wholesale, so ' +
+      'nothing may be dropped silently.'
+    );
+  }
+}
+
+/** The declaration omits `requiredStatusChecks` while adopting or updating a live ruleset that
+ * HAS one. Declare the contexts, or declare `requiredStatusChecks: false` to remove them. */
+export class RequiredChecksOmitted extends Data.TaggedError('RequiredChecksOmitted')<{
+  readonly owner: string;
+  readonly repository: string;
+  readonly name: string;
+  readonly liveContexts: readonly string[];
+}> {
+  override get message(): string {
+    return (
+      `GitHub.RepositoryRuleset "${this.name}" on ${this.owner}/${this.repository}: the live ` +
+      `ruleset requires ${this.liveContexts.join(', ')}, and the declaration says nothing about ` +
+      'requiredStatusChecks. Declare the same contexts, or `rules.requiredStatusChecks: false` to ' +
+      'remove them on purpose.'
+    );
+  }
+}
+
+/** A context being ADDED to `requiredStatusChecks` has never reported success on the default
+ * branch. Requiring it would leave every future pull request pending forever. */
+export class NeverReportedContext extends Data.TaggedError('NeverReportedContext')<{
+  readonly owner: string;
+  readonly repository: string;
+  readonly context: string;
+}> {
+  override get message(): string {
+    return (
+      `GitHub.RepositoryRuleset: "${this.context}" has never reported success on ` +
+      `${this.owner}/${this.repository}'s default branch. Requiring it now would leave every ` +
+      'pull request waiting on a check that has never once reported — refused before any write.'
+    );
+  }
+}
+
+/** A prop value the wire form or GitHub's own schema refuses — an approval count outside 0–10,
+ * an empty `allowedMergeMethods`, or an unmodeled rule `type` in the declaration itself. */
+export class RulesetConstraintRefused extends Data.TaggedError('RulesetConstraintRefused')<{
+  readonly field: string;
+  readonly reason: string;
+}> {
+  override get message(): string {
+    return `GitHub.RepositoryRuleset: ${this.field} — ${this.reason}`;
+  }
+}
+
+/** The independent readback GET after a write does not match what was sent, for one of the
+ * fields this family refuses to leave unverified (S10: the write's own report is never proof). */
+export class ReadbackMismatch extends Data.TaggedError('ReadbackMismatch')<{
+  readonly owner: string;
+  readonly repository: string;
+  readonly name: string;
+  readonly field: string;
+  readonly sent: unknown;
+  readonly read: unknown;
+}> {
+  override get message(): string {
+    return (
+      `GitHub.RepositoryRuleset "${this.name}" on ${this.owner}/${this.repository}: after the ` +
+      `write, an independent GET of ${this.field} read back ${JSON.stringify(this.read)}, not the ` +
+      `${JSON.stringify(this.sent)} that was sent. The write did not persist as declared.`
+    );
+  }
+}
+
+export type RepositoryRulesetError =
+  | DuplicateRuleset
+  | BypassActorWidened
+  | UndeclaredLiveRule
+  | RequiredChecksOmitted
+  | NeverReportedContext
+  | RulesetConstraintRefused
+  | ReadbackMismatch;

package/src/github/repository-ruleset-fake-octokit.ts

@@ -0,0 +1,131 @@
+/**
+ * Two `RulesetOctokit` fakes for the test files — no HTTP, no Octokit instance, exactly the
+ * seam repository-ruleset-probe.ts documents. Mirrors `postgres/fake-sql.ts`'s split: a
+ * GET-only fake that refuses to be written to (proves a plan touches nothing when it should
+ * not), and a write-recording fake that behaves like a tiny in-memory GitHub, so the SAME
+ * `reconcileRuleset` code under test runs against both.
+ */
+import * as Effect from 'effect/Effect';
+import type { CreateRulesetBody } from './repository-ruleset-constraints.ts';
+import type { RulesetOctokit, RulesetRecord, RulesetSummary } from './repository-ruleset-probe.ts';
+
+const refuseWrite = (op: string) => () =>
+  Effect.fail(new Error(`GET-only fake: ${op} must never be called`));
+
+/** Serves a fixed `{repo: RulesetRecord}` map and fails any write — for tests that must prove
+ * a plan is a pure read (a noop, or a refusal caught before any write). */
+export function makeGetOnlyFake(byRepo: Readonly<Record<string, RulesetRecord>>): RulesetOctokit {
+  return {
+    list: ({ repo }) =>
+      Effect.succeed(
+        byRepo[repo] === undefined
+          ? []
+          : ([
+              {
+                id: byRepo[repo].id,
+                name: byRepo[repo].name,
+                target: byRepo[repo].target,
+                source_type: byRepo[repo].source_type,
+              },
+            ] satisfies RulesetSummary[]),
+      ),
+    get: ({ repo, rulesetId }) =>
+      Effect.succeed(byRepo[repo]?.id === rulesetId ? byRepo[repo] : undefined),
+    create: refuseWrite('create'),
+    update: refuseWrite('update'),
+    delete: refuseWrite('delete'),
+    hasContextReportedSuccess: () => Effect.succeed(true),
+  };
+}
+
+export interface RecordedWrite {
+  readonly op: 'create' | 'update' | 'delete';
+  readonly repo: string;
+  readonly body?: CreateRulesetBody;
+}
+
+export interface RecordingFake {
+  readonly octokit: RulesetOctokit;
+  readonly writes: RecordedWrite[];
+  /** Whether `hasContextReportedSuccess` answers `true` — defaults to `true` (every context
+   * has reported); set per-context to test `NeverReportedContext`. */
+  readonly reportedContexts: Set<string>;
+}
+
+let nextId = 90000;
+
+/** An in-memory GitHub: `create` assigns an id and stores the record verbatim (merging the
+ * REQUEST body, not re-deriving it, so a test can inspect exactly what reconcile sent);
+ * `update` replaces the stored rules/enforcement/etc from the body; every write is also
+ * appended to `writes` for direct assertions ("N changed values give N non-noop results" is
+ * checked by counting entries here, not by re-reading state). */
+export function makeRecordingFake(initial: Readonly<Record<string, RulesetRecord>>): RecordingFake {
+  const state = new Map<string, RulesetRecord>(Object.entries(initial));
+  const writes: RecordedWrite[] = [];
+  const reportedContexts = new Set<string>();
+
+  const octokit: RulesetOctokit = {
+    list: ({ repo }) => {
+      const record = state.get(repo);
+      return Effect.succeed(
+        record === undefined
+          ? []
+          : ([
+              {
+                id: record.id,
+                name: record.name,
+                target: record.target,
+                source_type: record.source_type,
+              },
+            ] satisfies RulesetSummary[]),
+      );
+    },
+    get: ({ repo, rulesetId }) => {
+      const record = state.get(repo);
+      return Effect.succeed(record?.id === rulesetId ? record : undefined);
+    },
+    create: ({ repo, body }) =>
+      Effect.sync(() => {
+        const id = nextId++;
+        const record: RulesetRecord = {
+          id,
+          name: body.name,
+          target: body.target ?? 'branch',
+          source_type: 'Repository',
+          enforcement: body.enforcement,
+          bypass_actors: body.bypass_actors,
+          conditions: body.conditions,
+          rules: body.rules as unknown as Record<string, unknown>[],
+        };
+        state.set(repo, record);
+        writes.push({ op: 'create', repo, body });
+        return record;
+      }),
+    update: ({ repo, rulesetId, body }) =>
+      Effect.sync(() => {
+        const existing = state.get(repo);
+        const record: RulesetRecord = {
+          id: rulesetId,
+          name: body.name,
+          target: body.target ?? 'branch',
+          source_type: 'Repository',
+          enforcement: body.enforcement,
+          bypass_actors: body.bypass_actors,
+          conditions: body.conditions,
+          rules: body.rules as unknown as Record<string, unknown>[],
+          created_at: existing?.created_at,
+        };
+        state.set(repo, record);
+        writes.push({ op: 'update', repo, body });
+        return record;
+      }),
+    delete: ({ repo, rulesetId }) =>
+      Effect.sync(() => {
+        if (state.get(repo)?.id === rulesetId) state.delete(repo);
+        writes.push({ op: 'delete', repo });
+      }),
+    hasContextReportedSuccess: ({ context }) => Effect.succeed(reportedContexts.has(context)),
+  };
+
+  return { octokit, writes, reportedContexts };
+}

package/src/github/repository-ruleset-fixtures.ts

@@ -0,0 +1,183 @@
+/**
+ * The 16 live GitHub rulesets this family was walked against — captured 2026-09-23 by the
+ * planner's read-only `gh api` survey (owner `taslabs-net`; no secrets in any of these rows,
+ * only ruleset configuration GitHub already shows to any collaborator). Used by
+ * repository-ruleset-lifecycle.test.ts as a GET-only loopback fake, so a real baseline diff is
+ * checked against real shapes rather than a hand-picked "easy" fixture.
+ *
+ * Two simplifications from the raw survey, both noted here rather than silently taken:
+ * - `aimto`'s `secret scan (any app)` context is recorded as plain `secret scan` — the survey
+ *   did not say the wire context string differs, only that the workflow's check-suite scope
+ *   does; nothing in this family reads that scope, so it would not change any comparison.
+ * - `updated_at` is a placeholder ISO date derived from the survey's two-digit day, not the
+ *   real timestamp (which the survey did not capture to the second).
+ */
+import type { RulesetRecord } from './repository-ruleset-probe.ts';
+
+const conditions = { ref_name: { include: ['~DEFAULT_BRANCH'], exclude: [] } };
+
+const pullRequestRule = (extraApprovalUnattributed: boolean) => ({
+  type: 'pull_request',
+  parameters: {
+    required_approving_review_count: 0,
+    dismiss_stale_reviews_on_push: true,
+    require_code_owner_review: false,
+    require_last_push_approval: false,
+    required_review_thread_resolution: false,
+    required_reviewers: [],
+    allowed_merge_methods: ['merge', 'squash', 'rebase'],
+    require_extra_approval_for_unattributed_changes: extraApprovalUnattributed,
+  },
+});
+
+const statusChecksRule = (checks: readonly string[]) => ({
+  type: 'required_status_checks',
+  parameters: {
+    required_status_checks: checks.map((context) => ({ context, integration_id: null })),
+    strict_required_status_checks_policy: false,
+    do_not_enforce_on_create: false,
+  },
+});
+
+const STANDARD_CHECKS = ['ci', 'secret scan'] as const;
+
+interface FixtureInput {
+  readonly repo: string;
+  readonly id: number;
+  readonly day: string;
+  readonly enforcement?: 'active' | 'disabled';
+  readonly checks?: readonly string[];
+  readonly extraApprovalUnattributed: boolean;
+}
+
+function fixture(input: FixtureInput): RulesetRecord {
+  return {
+    id: input.id,
+    name: 'main',
+    target: 'branch',
+    source_type: 'Repository',
+    enforcement: input.enforcement ?? 'active',
+    bypass_actors: [],
+    conditions,
+    rules: [
+      { type: 'deletion' },
+      { type: 'non_fast_forward' },
+      pullRequestRule(input.extraApprovalUnattributed),
+      ...(input.checks === undefined ? [] : [statusChecksRule(input.checks)]),
+    ],
+    created_at: `2026-09-${input.day}T00:00:00Z`,
+    updated_at: `2026-09-${input.day}T00:00:00Z`,
+  };
+}
+
+/** Keyed by repo name — every row from the LIVE SURVEY's per-repo ruleset table. */
+export const LIVE_RULESET_FIXTURES: Readonly<Record<string, RulesetRecord>> = {
+  homeflare: fixture({
+    repo: 'homeflare',
+    id: 23613456,
+    day: '17',
+    extraApprovalUnattributed: true,
+  }),
+  aimto: fixture({
+    repo: 'aimto',
+    id: 23616354,
+    day: '17',
+    checks: STANDARD_CHECKS,
+    extraApprovalUnattributed: false,
+  }),
+  alerts: fixture({
+    repo: 'alerts',
+    id: 23552096,
+    day: '17',
+    checks: STANDARD_CHECKS,
+    extraApprovalUnattributed: false,
+  }),
+  anyauth: fixture({
+    repo: 'anyauth',
+    id: 23478011,
+    day: '15',
+    enforcement: 'disabled',
+    extraApprovalUnattributed: true,
+  }),
+  blog: fixture({
+    repo: 'blog',
+    id: 23598797,
+    day: '17',
+    checks: STANDARD_CHECKS,
+    extraApprovalUnattributed: false,
+  }),
+  desktop: fixture({ repo: 'desktop', id: 23601674, day: '17', extraApprovalUnattributed: true }),
+  kit: fixture({
+    repo: 'kit',
+    id: 23471358,
+    day: '15',
+    checks: STANDARD_CHECKS,
+    extraApprovalUnattributed: false,
+  }),
+  landscape: fixture({
+    repo: 'landscape',
+    id: 23555162,
+    day: '17',
+    checks: STANDARD_CHECKS,
+    extraApprovalUnattributed: false,
+  }),
+  memory: fixture({
+    repo: 'memory',
+    id: 23616353,
+    day: '17',
+    checks: STANDARD_CHECKS,
+    extraApprovalUnattributed: false,
+  }),
+  mini: fixture({
+    repo: 'mini',
+    id: 23837649,
+    day: '22',
+    checks: STANDARD_CHECKS,
+    extraApprovalUnattributed: false,
+  }),
+  'openbao-plugins': fixture({
+    repo: 'openbao-plugins',
+    id: 23657714,
+    day: '18',
+    checks: STANDARD_CHECKS,
+    extraApprovalUnattributed: false,
+  }),
+  openbao: fixture({
+    repo: 'openbao',
+    id: 23580452,
+    day: '17',
+    checks: STANDARD_CHECKS,
+    extraApprovalUnattributed: false,
+  }),
+  proxmox: fixture({
+    repo: 'proxmox',
+    id: 23837620,
+    day: '22',
+    checks: STANDARD_CHECKS,
+    extraApprovalUnattributed: false,
+  }),
+  secrets: fixture({
+    repo: 'secrets',
+    id: 23616342,
+    day: '17',
+    checks: STANDARD_CHECKS,
+    extraApprovalUnattributed: false,
+  }),
+  'subnet-calc': fixture({
+    repo: 'subnet-calc',
+    id: 23580453,
+    day: '17',
+    checks: STANDARD_CHECKS,
+    extraApprovalUnattributed: false,
+  }),
+  wiki: fixture({
+    repo: 'wiki',
+    id: 23580451,
+    day: '17',
+    checks: STANDARD_CHECKS,
+    extraApprovalUnattributed: false,
+  }),
+};
+
+/** repos with NO live ruleset at all (measured: 0 rulesets), per the survey's RULESETS section. */
+export const REPOS_WITH_NO_RULESET: readonly string[] = ['builds', 'memos'];