From 9b754f054b9ad0ac83f133bfac8ba42ce9491fa2 Mon Sep 17 00:00:00 2001
From: Alexey Zhokhov <alexey@zhokhov.com>
Date: Sun, 11 Oct 2026 20:42:53 +0700
Subject: [PATCH 1/7] refactor: drop dead 1Password secrets path

The last org secret was removed 2026-10-01, leaving org_secrets empty, but
the onepassword provider stayed declared and referenced with no provider
block, failing every plan with 'Invalid provider configuration'. Remove the
provider, the onepassword_item/secret_selected data sources, the
github_actions_organization_secret resource, the secret_visibility variable,
and the managed_secrets output, and regenerate the lockfile.

Signed-off-by: Alexey Zhokhov <alexey@zhokhov.com>
---
 .terraform.lock.hcl | 24 +-----------------------
 data-sources.tf     | 14 --------------
 locals.tf           | 18 ------------------
 main.tf             | 12 ------------
 outputs.tf          | 11 -----------
 variables.tf        | 11 -----------
 versions.tf         |  5 -----
 7 files changed, 1 insertion(+), 94 deletions(-)
 delete mode 100644 data-sources.tf
 delete mode 100644 main.tf

diff --git a/.terraform.lock.hcl b/.terraform.lock.hcl
index 3edc040..491bec9 100644
--- a/.terraform.lock.hcl
+++ b/.terraform.lock.hcl
@@ -1,31 +1,9 @@
 # This file is maintained automatically by "tofu init".
 # Manual edits may be lost in future updates.
 
-provider "registry.opentofu.org/1password/onepassword" {
-  version     = "3.3.1"
-  constraints = "~> 3.3"
-  hashes = [
-    "h1:35PCpSNLVubReT1imwfC+FpIP5gQWx+rvG4njkXkZKM=",
-    "h1:GqvBYImDNYNPMi9o3kJTSIJDeEnNO7om46RWA0wjeso=",
-    "h1:Tg8bJ+ATy5pla6ZTn87lb3nIyiTJTgQHJdxOWQjFF9k=",
-    "h1:a8DHdeyXt8YaEngXGEWZC75W27OG742wtw5BmRnhrpI=",
-    "h1:bPFt8A+PWGwEj3wQ3D0GxyrTMmr1piNrwEuPJu7AZTo=",
-    "h1:nThx/0XctUKlAa6aAsSEHZvx/mD1tSxCE6pacSnotxU=",
-    "h1:syh+iS5VPBQTLszL503BOi5rLpL1wGl1IjyYqgpKYIg=",
-    "zh:02d93a7f520ec69ad8944a68dcbf512e2f9920a6696628b8d05e6ad408309f35",
-    "zh:0f91a902da84470af95f0da4dc21127b84e23c856a431ff9ecfe45d9c6775ef0",
-    "zh:161bc55c466214a5d425ba85753d74ed5078212db965f726e6650d2e1524d633",
-    "zh:3de4a9f212e1046016a3ace8816e2cb15cfb7b9579161e468a08b9034d6a5f51",
-    "zh:730105346065ea3d2bd6acc6f5fe36f7b8a2b54c513d20a46bcd51d656e82bb4",
-    "zh:890df766e9b839623b1f0437355032a3c006226a6c200cd911e15ee1a9014e9f",
-    "zh:c29f6025d099bc8f1f96e7bb4cd66c5d07209b4141d2fd7720228cf20c9c8efd",
-    "zh:d8ea431d396986ca6baf033fa9aaccb73d6a9f9b7d42bea7af8dc73b9ef20297",
-  ]
-}
-
 provider "registry.opentofu.org/integrations/github" {
   version     = "6.13.0"
-  constraints = "~> 6.0, ~> 6.13"
+  constraints = "~> 6.13"
   hashes = [
     "h1:2kD+4leuV8tBBXv+EPeehmfW6cDhIzVki61OXsGCtRI=",
     "h1:99s0C+KmzXIsUJY0tKlgfcFUIuuXjCK0TAeeZ8HaOZQ=",
diff --git a/data-sources.tf b/data-sources.tf
deleted file mode 100644
index 530a945..0000000
--- a/data-sources.tf
+++ /dev/null
@@ -1,14 +0,0 @@
-# SPDX-FileCopyrightText: 2026 Alexey Zhokhov
-# SPDX-License-Identifier: Apache-2.0
-
-data "onepassword_item" "org_secret" {
-  for_each = local.org_secrets
-
-  vault = each.value.vault_uuid
-  title = each.value.item
-}
-
-data "github_repository" "secret_selected" {
-  for_each  = toset(flatten([for s in local.org_secrets : lookup(s, "repositories", [])]))
-  full_name = "${var.github_organization}/${each.key}"
-}
diff --git a/locals.tf b/locals.tf
index 0cecdf2..092c525 100644
--- a/locals.tf
+++ b/locals.tf
@@ -2,24 +2,6 @@
 # SPDX-License-Identifier: Apache-2.0
 
 locals {
-  # Fill this map with final secret names and metadata.
-  # value format: vault UUID, item title, section label, field label.
-  # Vault UUID: op vault get NAME --format json | jq -r .id
-  # Example:
-  # org_secrets = {
-  #   GITHUB_WEBHOOK_SECRET = {
-  #     vault_uuid = "xlm7pn5y6d3nfya5xy2os3vtoq"
-  #     item       = "org-credentials"
-  #     section    = "tokens"
-  #     field      = "webhook_secret"
-  #   }
-  # }
-  org_secrets = {
-    # CARGO_REGISTRY_TOKEN removed 2026-10-01: termpane 0.1.0 published;
-    # crates.io Trusted Publisher (tailrocks/termpane, release.yml, release)
-    # replaces the bootstrap token path. No org secrets remain.
-  }
-
   # Check templates for new inventory entries. Variable defaults must be
   # literals, so variables.tf keeps literal lists — copy from here when
   # adding a repo, and keep both in sync. Bespoke check lists stay allowed
diff --git a/main.tf b/main.tf
deleted file mode 100644
index 0fc3522..0000000
--- a/main.tf
+++ /dev/null
@@ -1,12 +0,0 @@
-# SPDX-FileCopyrightText: 2026 Alexey Zhokhov
-# SPDX-License-Identifier: Apache-2.0
-
-resource "github_actions_organization_secret" "org_secret" {
-  for_each = local.org_secrets
-
-  secret_name = each.key
-  visibility  = lookup(each.value, "visibility", var.secret_visibility)
-  value       = data.onepassword_item.org_secret[each.key].section_map[each.value.section].field_map[each.value.field].value
-
-  selected_repository_ids = lookup(each.value, "visibility", var.secret_visibility) == "selected" ? [for r in lookup(each.value, "repositories", []) : data.github_repository.secret_selected[r].repo_id] : null
-}
diff --git a/outputs.tf b/outputs.tf
index 683448f..3bd0604 100644
--- a/outputs.tf
+++ b/outputs.tf
@@ -1,17 +1,6 @@
 # SPDX-FileCopyrightText: 2026 Alexey Zhokhov
 # SPDX-License-Identifier: Apache-2.0
 
-output "managed_secrets" {
-  value = {
-    for name, secret in github_actions_organization_secret.org_secret :
-    name => {
-      visibility = secret.visibility
-    }
-  }
-
-  description = "Managed org secret names and visibility. Values are intentionally omitted."
-}
-
 output "organization" {
   value = var.github_organization
 }
diff --git a/variables.tf b/variables.tf
index 74f17e8..1802093 100644
--- a/variables.tf
+++ b/variables.tf
@@ -14,17 +14,6 @@ variable "github_token" {
   default     = null
 }
 
-variable "secret_visibility" {
-  type        = string
-  description = "Fallback org secret visibility when an entry omits it: all, private, or selected. All managed repos are public, so private hides a secret from everywhere; prefer explicit per-entry visibility."
-  default     = "selected"
-
-  validation {
-    condition     = contains(["all", "private", "selected"], var.secret_visibility)
-    error_message = "secret_visibility must be one of: all, private, selected."
-  }
-}
-
 variable "repository_policies" {
   description = "Authoritative inventory of managed repositories and their visibility and check policy."
   type = map(object({
diff --git a/versions.tf b/versions.tf
index 906825b..4cce781 100644
--- a/versions.tf
+++ b/versions.tf
@@ -9,10 +9,5 @@ terraform {
       source  = "integrations/github"
       version = "~> 6.13"
     }
-
-    onepassword = {
-      source  = "1password/onepassword"
-      version = "~> 3.3"
-    }
   }
 }

From d716c8f8a1a9a29bc6e1df2c493d4e1f57b8ebc0 Mon Sep 17 00:00:00 2001
From: Alexey Zhokhov <alexey@zhokhov.com>
Date: Sun, 11 Oct 2026 20:42:53 +0700
Subject: [PATCH 2/7] refactor: use ambient GITHUB_TOKEN like the other
 github-terraform repos

Remove the tofu:plan/tofu:apply mise tasks that injected a 1Password token,
so bare tofu plan/apply behaves exactly as in chainargo-github-terraform and
jackin-github-terraform: the GitHub provider reads GITHUB_TOKEN from the
environment. Document the required token permissions in the README.

Signed-off-by: Alexey Zhokhov <alexey@zhokhov.com>
---
 README.md | 15 +++++----------
 mise.toml | 26 --------------------------
 2 files changed, 5 insertions(+), 36 deletions(-)

diff --git a/README.md b/README.md
index 0680d83..923d91a 100644
--- a/README.md
+++ b/README.md
@@ -11,8 +11,6 @@ settings plus `protect-main` and `protect-tags` rulesets.
 - `repositories.tf` — `module.repository_policy` wiring.
 - `organization.tf` — organization settings, Actions/workflow permissions,
   and the `velnor-trusted` runner group.
-- `main.tf` — organization Actions secrets wiring (1Password-sourced).
-- `data-sources.tf` — 1Password items and `secret_selected` repo lookups.
 - `modules/repository-policy/` — shared policy module (identical across orgs).
 - `checks.tf` — invariant guards (no scripts).
 - `imports.tf` — bootstrap import triples (one per repo: settings + 2 rulesets).
@@ -41,13 +39,10 @@ settings plus `protect-main` and `protect-tags` rulesets.
   `velnor-trusted` runner group restricted to
   `var.velnor_runner_group_repositories` (must be a subset of
   `repository_policies`).
-- Secrets wiring (`main.tf` + `data-sources.tf`): org Actions secrets come
-  from 1Password via the `external` provider + `op` CLI; run tofu through the
-  mise tasks so the GitHub token is injected from 1Password (never exported
-  by hand): `mise run tofu:plan -- <plan args>`,
-  `mise run tofu:apply -- <apply args>`. A secret with
-  `visibility = "selected"` lists its repos, resolved through
-  `data.github_repository.secret_selected`.
+- Run tofu with `GITHUB_TOKEN` exported in the shell (same as the other
+  github-terraform repos). The token needs org admin on `tailrocks` (org
+  settings, Actions policies, runner group) plus Administration: write on
+  every managed repository.
 - GitHub does not expose organization package-creation visibility through the
   REST API or the Terraform GitHub provider; manage those settings in
   **Organization settings → Packages**. Making a package public is
@@ -62,6 +57,6 @@ tofu init -backend=false -input=false -lockfile=readonly
 tofu validate -no-color
 ```
 
-OpenTofu is pinned via `mise.toml` (opentofu 1.12.5); existing repos are
+OpenTofu is pinned via `mise.toml` (opentofu 1.13.1); existing repos are
 imported via `imports.tf` on first apply. Related reference:
 `jackin-project/github-terraform`.
diff --git a/mise.toml b/mise.toml
index c93b4c3..3d6434f 100644
--- a/mise.toml
+++ b/mise.toml
@@ -6,29 +6,3 @@ opentofu = "1.13.1"
 
 [settings]
 lockfile = true
-
-[tasks."tofu:plan"]
-description = "Run tofu plan"
-run = """
-set -eu
-export OP_ACCOUNT='zhokhov.1password.com'
-OP_SESSION_zhokhov="$(op signin --raw)" || { echo "op signin failed, refusing to run" >&2; exit 1; }
-export OP_SESSION_zhokhov
-GITHUB_TOKEN="$(op read 'op://tailrocks/GitHub/tokens/tofu')" || { echo "op read failed, refusing to run" >&2; exit 1; }
-export GITHUB_TOKEN
-[ -n "${GITHUB_TOKEN:-}" ] || { echo "GITHUB_TOKEN is empty, refusing to run" >&2; exit 1; }
-exec tofu plan "$@"
-"""
-
-[tasks."tofu:apply"]
-description = "Run tofu apply"
-run = """
-set -eu
-export OP_ACCOUNT='zhokhov.1password.com'
-OP_SESSION_zhokhov="$(op signin --raw)" || { echo "op signin failed, refusing to run" >&2; exit 1; }
-export OP_SESSION_zhokhov
-GITHUB_TOKEN="$(op read 'op://tailrocks/GitHub/tokens/tofu')" || { echo "op read failed, refusing to run" >&2; exit 1; }
-export GITHUB_TOKEN
-[ -n "${GITHUB_TOKEN:-}" ] || { echo "GITHUB_TOKEN is empty, refusing to run" >&2; exit 1; }
-exec tofu apply "$@"
-"""

From 2934ee7a6f538bad0ded68596557304851ae7b9e Mon Sep 17 00:00:00 2001
From: Alexey Zhokhov <alexey@zhokhov.com>
Date: Sun, 11 Oct 2026 20:45:01 +0700
Subject: [PATCH 3/7] docs: add pull request template

Signed-off-by: Alexey Zhokhov <alexey@zhokhov.com>
---
 .github/PULL_REQUEST_TEMPLATE.md | 81 ++++++++++++++++++++++++++++++++
 1 file changed, 81 insertions(+)
 create mode 100644 .github/PULL_REQUEST_TEMPLATE.md

diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md
new file mode 100644
index 0000000..aaaf821
--- /dev/null
+++ b/.github/PULL_REQUEST_TEMPLATE.md
@@ -0,0 +1,81 @@
+<!--
+PR body rules:
+- One paragraph per section, no hard-wrap (GitHub flows the text).
+- Explain the shipped feature shape, not every implementation detail.
+- No design rationale narration here — link out to a contributor doc instead.
+- No file-by-file changelog (use the diff). No full check list (use CI output).
+- Every Verify-locally command is copy-pasteable and states its expected
+  outcome when a bare exit code does not disambiguate pass from fail.
+- Drop the headings you do not need. "Related pull requests" is only when the
+  PR spans multiple repos (for example coordinated parity changes across the
+  github-terraform repos). "Behavior changes" is only when it adds signal
+  beyond "What ships". "Not included" is only when scope boundaries or
+  deferred work are useful to call out.
+-->
+
+## Related pull requests
+
+<When this PR is part of a coordinated set spanning multiple repositories, list every PR here — just the link, no description. Drop this section entirely when the PR stands alone.>
+
+- <https://github.com/org/repo/pull/N>
+
+## Summary
+
+<One paragraph answering: what is this pull request for? Name the shipped change to organization or repository management, who runs it, and how it changes their flow. Keep this short.>
+
+## What ships
+
+<Feature-level bullets grouped by operator-visible outcome: repositories onboarded, policy enforced, provider or wiring changes, documentation changes. Avoid resource names and file lists — the diff already shows those.>
+
+- <Capability or policy that now exists>
+- <Configuration, documentation, or workflow change operators can rely on>
+
+## Behavior changes
+
+<Operator-visible deltas: changed required checks, changed merge settings, changed token or permission requirements, changed runbook steps. Drop this section when it would only repeat "What ships".>
+
+- <Existing behavior that changes>
+
+## What this addresses
+
+<Bullets naming the practical problem, drift, or operational pain now resolved. Name the issue when one exists.>
+
+- <Problem or gap addressed>
+
+## Not included
+
+<Scope boundaries and deferred work: repositories not yet onboarded, follow-up PRs, policy left unchanged deliberately. Drop this section entirely when nothing meaningful is excluded.>
+
+- <Out-of-scope behavior or deferred follow-up>
+
+## Verify locally
+
+### Checkout
+
+```sh
+gh pr checkout <PR_NUMBER>
+```
+
+### Static checks
+
+<The format and validate gates, exactly as CI runs them in the tofu-workspace job. Expected: `tofu validate` prints "Success! The configuration is valid.">
+
+```sh
+tofu fmt -check -recursive
+tofu init -backend=false -input=false -lockfile=readonly
+tofu validate -no-color
+```
+
+### Smoke
+
+<Include when the PR changes plan-visible behavior: repositories, rulesets, org settings, providers. Drop when the PR only touches docs or comments. Requires GITHUB_TOKEN exported with org admin on tailrocks and Administration: write on every managed repository.>
+
+```sh
+tofu plan -no-color
+```
+
+Expected: <the plan renders with no provider or permission errors; name the key actions the reviewer should see, or "No changes" when the PR is already applied>.
+
+## Migration notes
+
+<One paragraph naming what operators must do — token permission changes, state moves, re-imports. "None." is fine. Drop the section when it would only say that.>

From 0c6895ecdb7d7141b1ccb2ad90cc36be569776f2 Mon Sep 17 00:00:00 2001
From: Alexey Zhokhov <alexey@zhokhov.com>
Date: Sun, 11 Oct 2026 20:56:39 +0700
Subject: [PATCH 4/7] docs: unify README with the shared github-terraform
 skeleton

Same section order and wording as chainargo-github-terraform and
jackin-github-terraform: Layout, Authentication, Adding a repository,
Verification. Fixes the stale repository count (41 -> 47) and drops the
user-specific cd path from the verification block.

Signed-off-by: Alexey Zhokhov <alexey@zhokhov.com>
---
 README.md | 20 +++++++++++---------
 1 file changed, 11 insertions(+), 9 deletions(-)

diff --git a/README.md b/README.md
index 923d91a..e322d9a 100644
--- a/README.md
+++ b/README.md
@@ -1,7 +1,7 @@
 # github-terraform
 
 Manages GitHub repository settings and branch/tag protection for the
-`tailrocks` organization: 41 repositories, each with repository merge
+`tailrocks` organization: 47 repositories, each with repository merge
 settings plus `protect-main` and `protect-tags` rulesets.
 
 ## Layout
@@ -16,6 +16,14 @@ settings plus `protect-main` and `protect-tags` rulesets.
 - `imports.tf` — bootstrap import triples (one per repo: settings + 2 rulesets).
 - `providers.tf`, `versions.tf`, `outputs.tf` — provider, pins, outputs.
 
+## Authentication
+
+Run tofu with `GITHUB_TOKEN` exported in the shell; the GitHub provider
+reads it from the environment. The token needs Administration: write on
+every managed repository. It also needs org admin on `tailrocks` for the
+organization settings, Actions policies, and runner group in
+`organization.tf`.
+
 ## Adding a repository
 
 1. Add one entry to `repository_policies` in `variables.tf`, copying a check
@@ -23,7 +31,7 @@ settings plus `protect-main` and `protect-tags` rulesets.
    `control` = `["Control / Required"]`, `required_only` = `["Required"]`,
    `dco_only` = `["DCO"]`, `policy` = `["Policy"]`); bespoke checks inline
    with a comment citing the producing workflow. Repos with no CI use
-   `required_checks = []` plus a non-empty `no_ci_reason` and extend the
+   `required_checks = []` plus a non-empty `no_ci_reason`, extend the
    allowlist check in `checks.tf`, and add the name to the mandatory list in
    `mandatory_target_repositories_present` in `checks.tf` (updating its count
    and message).
@@ -39,10 +47,6 @@ settings plus `protect-main` and `protect-tags` rulesets.
   `velnor-trusted` runner group restricted to
   `var.velnor_runner_group_repositories` (must be a subset of
   `repository_policies`).
-- Run tofu with `GITHUB_TOKEN` exported in the shell (same as the other
-  github-terraform repos). The token needs org admin on `tailrocks` (org
-  settings, Actions policies, runner group) plus Administration: write on
-  every managed repository.
 - GitHub does not expose organization package-creation visibility through the
   REST API or the Terraform GitHub provider; manage those settings in
   **Organization settings → Packages**. Making a package public is
@@ -51,12 +55,10 @@ settings plus `protect-main` and `protect-tags` rulesets.
 ## Verification
 
 ```sh
-cd /Users/donbeave/Projects/one/tailrocks-github-terraform
 tofu fmt -check -recursive
 tofu init -backend=false -input=false -lockfile=readonly
 tofu validate -no-color
 ```
 
 OpenTofu is pinned via `mise.toml` (opentofu 1.13.1); existing repos are
-imported via `imports.tf` on first apply. Related reference:
-`jackin-project/github-terraform`.
+imported via `imports.tf` on first apply.

From 50fb5114db523fdb29ffeb67b2048b33e6328c1d Mon Sep 17 00:00:00 2001
From: Alexey Zhokhov <alexey@zhokhov.com>
Date: Mon, 12 Oct 2026 00:58:59 +0700
Subject: [PATCH 5/7] feat: add mise tofu tasks with 1Password token injection

Add tofu:plan/tofu:apply mise tasks that inject the org token from
1Password (op://tailrocks/GitHub/tailrocks-opentofu) and refuse to run
on an empty read, and document both authentication flows in the README.

Also reconcile the inventory with live GitHub state so the pending
rollout can converge:

- Drop the stale tailrocks-open-source-skills and tui-snap entries:
  both repos were renamed (to tailrocks-contribution-skills and
  tuiscotti, already in the inventory), so the old keys double-managed
  the same repositories and their ruleset creates failed with
  422 Name must be unique.
- Re-import the live protect-main/protect-tags rulesets for repo-scan,
  tailrocks-repository-skills, and rust-repository-policy using their
  current numeric ruleset IDs (previous import IDs went stale).
- Update the mandatory-repository check and README count to 45.

Signed-off-by: Alexey Zhokhov <alexey@zhokhov.com>
---
 README.md    | 12 ++++++------
 checks.tf    |  6 +++---
 imports.tf   | 40 ++++++++++++++++++++++++++++++----------
 mise.toml    | 22 ++++++++++++++++++++++
 variables.tf |  8 --------
 5 files changed, 61 insertions(+), 27 deletions(-)

diff --git a/README.md b/README.md
index e322d9a..dc84a6e 100644
--- a/README.md
+++ b/README.md
@@ -1,7 +1,7 @@
 # github-terraform
 
 Manages GitHub repository settings and branch/tag protection for the
-`tailrocks` organization: 47 repositories, each with repository merge
+`tailrocks` organization: 45 repositories, each with repository merge
 settings plus `protect-main` and `protect-tags` rulesets.
 
 ## Layout
@@ -18,11 +18,11 @@ settings plus `protect-main` and `protect-tags` rulesets.
 
 ## Authentication
 
-Run tofu with `GITHUB_TOKEN` exported in the shell; the GitHub provider
-reads it from the environment. The token needs Administration: write on
-every managed repository. It also needs org admin on `tailrocks` for the
-organization settings, Actions policies, and runner group in
-`organization.tf`.
+Run tofu with `GITHUB_TOKEN` exported in the shell, or via the mise tasks
+`mise run tofu:plan` / `mise run tofu:apply`, which inject the organization
+token from 1Password. The token needs Administration: write on every managed
+repository. It also needs org admin on `tailrocks` for the organization
+settings, Actions policies, and runner group in `organization.tf`.
 
 ## Adding a repository
 
diff --git a/checks.tf b/checks.tf
index 1ceefa8..5179754 100644
--- a/checks.tf
+++ b/checks.tf
@@ -14,16 +14,16 @@ check "mandatory_target_repositories_present" {
       "schemalane", "tablerock", "tailrocks-asd-ste100-skills",
       "tailrocks-code-quality-skills", "tailrocks-contribution-skills",
       "tailrocks-gradle-conventions", "tailrocks-logo",
-      "tailrocks-macos-skills", "tailrocks-open-source-skills",
+      "tailrocks-macos-skills",
       "tailrocks-pull-request-skills", "tailrocks-repository-skills",
       "tailrocks-roadmap-skills", "tailrocks-rust-skills",
       "tailrocks-skill-authoring-skills", "tailrocks-skills",
       "tailrocks-sqldiff", "tailrocks-typescript-skills",
       "terminal-components-claude", "termpane", "termrock",
-      "tracing-request-level", "tui-snap", "tuiscotti", "velnor",
+      "tracing-request-level", "tuiscotti", "velnor",
       "velnor-actions-fixture", "velnor-apt", "velnor-new", "vision",
     ])
-    error_message = "repository_policies must contain exactly the 47 managed tailrocks repositories."
+    error_message = "repository_policies must contain exactly the 45 managed tailrocks repositories."
   }
 }
 
diff --git a/imports.tf b/imports.tf
index dc459d9..5fd2349 100644
--- a/imports.tf
+++ b/imports.tf
@@ -158,11 +158,6 @@ import {
   id = "tailrocks-macos-skills"
 }
 
-import {
-  to = module.repository_policy.github_repository.managed_settings["tailrocks-open-source-skills"]
-  id = "tailrocks-open-source-skills"
-}
-
 import {
   to = module.repository_policy.github_repository.managed_settings["tailrocks-pull-request-skills"]
   id = "tailrocks-pull-request-skills"
@@ -222,11 +217,6 @@ import {
   id = "tracing-request-level"
 }
 
-import {
-  to = module.repository_policy.github_repository.managed_settings["tui-snap"]
-  id = "tui-snap"
-}
-
 import {
   to = module.repository_policy.github_repository.managed_settings["tuiscotti"]
   id = "tuiscotti"
@@ -337,6 +327,16 @@ import {
   id = "renovate-rust:20575222"
 }
 
+import {
+  to = module.repository_policy.github_repository_ruleset.protect_main["repo-scan"]
+  id = "repo-scan:24877074"
+}
+
+import {
+  to = module.repository_policy.github_repository_ruleset.protect_main["rust-repository-policy"]
+  id = "rust-repository-policy:24877097"
+}
+
 import {
   to = module.repository_policy.github_repository_ruleset.protect_main["ruxel"]
   id = "ruxel:19573057"
@@ -376,6 +376,11 @@ import {
   id = "tailrocks-pull-request-skills:23746082"
 }
 
+import {
+  to = module.repository_policy.github_repository_ruleset.protect_main["tailrocks-repository-skills"]
+  id = "tailrocks-repository-skills:24877099"
+}
+
 import {
   to = module.repository_policy.github_repository_ruleset.protect_main["tailrocks-roadmap-skills"]
   id = "tailrocks-roadmap-skills:23746088"
@@ -532,6 +537,16 @@ import {
   id = "renovate-rust:20575267"
 }
 
+import {
+  to = module.repository_policy.github_repository_ruleset.protect_tags["repo-scan"]
+  id = "repo-scan:24877093"
+}
+
+import {
+  to = module.repository_policy.github_repository_ruleset.protect_tags["rust-repository-policy"]
+  id = "rust-repository-policy:24877092"
+}
+
 import {
   to = module.repository_policy.github_repository_ruleset.protect_tags["ruxel"]
   id = "ruxel:19572976"
@@ -571,6 +586,11 @@ import {
   id = "tailrocks-pull-request-skills:23746069"
 }
 
+import {
+  to = module.repository_policy.github_repository_ruleset.protect_tags["tailrocks-repository-skills"]
+  id = "tailrocks-repository-skills:24877095"
+}
+
 import {
   to = module.repository_policy.github_repository_ruleset.protect_tags["tailrocks-roadmap-skills"]
   id = "tailrocks-roadmap-skills:23746077"
diff --git a/mise.toml b/mise.toml
index 3d6434f..4d1a32b 100644
--- a/mise.toml
+++ b/mise.toml
@@ -6,3 +6,25 @@ opentofu = "1.13.1"
 
 [settings]
 lockfile = true
+
+[tasks."tofu:plan"]
+description = "Run tofu plan"
+run = """
+set -eu
+export OP_ACCOUNT='zhokhov.1password.com'
+GITHUB_TOKEN="$(op read 'op://tailrocks/GitHub/tailrocks-opentofu')" || { echo "op read failed, refusing to run" >&2; exit 1; }
+export GITHUB_TOKEN
+[ -n "${GITHUB_TOKEN:-}" ] || { echo "GITHUB_TOKEN is empty, refusing to run" >&2; exit 1; }
+exec tofu plan "$@"
+"""
+
+[tasks."tofu:apply"]
+description = "Run tofu apply"
+run = """
+set -eu
+export OP_ACCOUNT='zhokhov.1password.com'
+GITHUB_TOKEN="$(op read 'op://tailrocks/GitHub/tailrocks-opentofu')" || { echo "op read failed, refusing to run" >&2; exit 1; }
+export GITHUB_TOKEN
+[ -n "${GITHUB_TOKEN:-}" ] || { echo "GITHUB_TOKEN is empty, refusing to run" >&2; exit 1; }
+exec tofu apply "$@"
+"""
diff --git a/variables.tf b/variables.tf
index 1802093..4f363a9 100644
--- a/variables.tf
+++ b/variables.tf
@@ -161,10 +161,6 @@ variable "repository_policies" {
       visibility      = "public"
       required_checks = ["Required"]
     }
-    "tailrocks-open-source-skills" = {
-      visibility      = "public"
-      required_checks = ["Required"]
-    }
     "tailrocks-pull-request-skills" = {
       visibility      = "public"
       required_checks = ["Required"]
@@ -215,10 +211,6 @@ variable "repository_policies" {
       visibility      = "public"
       required_checks = ["DCO", "Policy", "ci-required"]
     }
-    "tui-snap" = {
-      visibility      = "public"
-      required_checks = ["DCO", "Required"]
-    }
     "tuiscotti" = {
       # Bespoke: matches live protect-main ruleset 23746094 required contexts (DCO + Required).
       visibility      = "public"

From c72488487a44aa4c18d514008f9db88d66a6ad00 Mon Sep 17 00:00:00 2001
From: Alexey Zhokhov <alexey@zhokhov.com>
Date: Mon, 12 Oct 2026 16:44:11 +0700
Subject: [PATCH 6/7] fix: drop advanced_security new-repo default on free-plan
 org

The API silently ignores advanced_security_enabled_for_new_repositories
for orgs without GitHub Advanced Security, producing a perpetual diff.
Matches the jackin-project handling; ChainArgos keeps the field because
its org accepts it.

Signed-off-by: Alexey Zhokhov <alexey@zhokhov.com>
---
 organization.tf | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/organization.tf b/organization.tf
index 96d37c0..67c7c71 100644
--- a/organization.tf
+++ b/organization.tf
@@ -27,7 +27,8 @@ resource "github_organization_settings" "tailrocks" {
   members_can_fork_private_repositories = false
   web_commit_signoff_required           = false
 
-  advanced_security_enabled_for_new_repositories               = true
+  # advanced_security_enabled_for_new_repositories omitted: the org is on the
+  # free plan and the API silently ignores it (perpetual diff otherwise).
   dependabot_alerts_enabled_for_new_repositories               = true
   dependabot_security_updates_enabled_for_new_repositories     = true
   dependency_graph_enabled_for_new_repositories                = true

From e924b48419050e94a34bef3702013d994302de45 Mon Sep 17 00:00:00 2001
From: Alexey Zhokhov <alexey@zhokhov.com>
Date: Mon, 12 Oct 2026 16:57:53 +0700
Subject: [PATCH 7/7] docs: drop removed variables from tfvars example

secret_visibility and OP_SERVICE_ACCOUNT_TOKEN described the removed
1Password secrets path; op_vault referenced a variable that no longer
exists. The example now lists only the surviving override and the
GITHUB_TOKEN env flow.

Signed-off-by: Alexey Zhokhov <alexey@zhokhov.com>
---
 terraform.tfvars.example | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/terraform.tfvars.example b/terraform.tfvars.example
index c560a4c..7f0ae5b 100644
--- a/terraform.tfvars.example
+++ b/terraform.tfvars.example
@@ -1,8 +1,5 @@
 # Optional overrides. Defaults live in variables.tf.
 # github_organization = "tailrocks"
-# op_vault            = "TailRocks"
-# secret_visibility   = "selected"
 
 # Prefer env auth (never commit real tokens):
 #   export GITHUB_TOKEN=...
-#   export OP_SERVICE_ACCOUNT_TOKEN=...