DecodeMarketing/IcAt-Results-Viewer

1# GitHub Security Posture — `icat_results`2 3Per [decode-ai-standards](https://github.com/implicitdiagnosticsandsolutions/decode-ai-standards)4`C11` + `C36`, reapplied at standards ref `81c3f17`5("Document the slim-to-full branch model adoption path", 2026-05-14).6 7## Branch model in use: **slim**8 9This repo uses the **slim** branch model: only the current default branch10is protected. The default and only protected branch is `master`. There is11no `staging` or `dev` branch in this repository.12 13Slim is the standards-named valid steady state for repositories with a14single primary contributor, no separate deploy environment, and continuous15release. `icat_results` matches that shape: one primary contributor, one16production environment (Hugging Face Space `DecodeMarketing/IcAT-Results-Viewer`),17and every merge to `master` ships.18 19| Role | Branch name | Status | Notes |20|---|---|---|---|21| **Production / default** | `master` | Protected | Push restricted to code reviewers. Pushing triggers `.github/workflows/main.yml` (HF Spaces sync). |22| Staging | — | Not in use | Would only be created during a deliberate slim → full migration. |23| Development base | — | Not in use | Same as above. Feature branches PR directly into `master`. |24 25### Adoption signal26 27The standards (`81c3f17`) say the full three-branch model is worth28adopting when: multiple contributors merge in parallel, batched releases29are needed, a staging environment receives changes before prod, or30stakeholders need a pre-prod review env. None apply here today. If two of31those become true, follow the migration steps in32[`decode-ai-standards/docs/ai-centric-repository-guidelines.md`](https://github.com/implicitdiagnosticsandsolutions/decode-ai-standards/blob/main/docs/ai-centric-repository-guidelines.md)33section "Adopting the full three-branch model".34 35## Admins36 37| Role | User |38|---|---|39| Primary admin | `@FloWeinert` |40| Backup admin | `@matussekatdecode` |41| Additional admins | (none) |42 43Admins configure branch protection, secrets, and webhooks. **Admins are44NOT in the push-restriction list** and "Do not allow bypassing" is45enabled — admin merges go through the same PR + review flow as everyone46else. Emergency bypass requires deliberate rule-edit (audited org-wide).47 48## Code reviewers (listed in `.github/CODEOWNERS`)49 50For developer PRs into `master`: their approval is required51(`require_code_owner_reviews: true` + `required_approving_review_count: 1`).52For their own PRs: they bypass the approval requirement via53`bypass_pull_request_allowances` and self-merge (since GitHub blocks54self-approval). They're also the only ones who can click Merge on `master`55(push restriction).56 57- `@matussekatdecode`58 59Because the sole codeowner is also the sole primary contributor today,60the bypass-and-self-merge path is the normal path. This is documented61openly rather than hidden; the convention to **still open a PR** even62though bypass would allow a direct push preserves the audit trail.63 64## Outside collaborators65 66| Login | Permission | Notes |67|---|---|---|68| — | — | None on this repo |69 70## Branch protection rules summary (`master` only)71 72- ✓ Require pull request before merging (audit trail)73- ✓ Require 1 CODEOWNER approval74  (`required_approving_review_count: 1` + `require_code_owner_reviews: true`)75- ✓ Codeowners in `bypass_pull_request_allowances` — they can merge their76  own PRs without needing self-approval (which GitHub blocks)77- ✓ Do not allow bypassing the above settings (admins NOT in the bypass78  list — emergencies use the 4-step deliberate procedure)79- ✓ Restrict who can push: code reviewers only80- ✓ Block force-push81- ✓ Block branch deletion82- ✓ Require linear history83 84No protections are configured on any branch other than `master`.85 86## Repo-internal gate layer87 88In addition to GitHub branch protection, the repo enforces a DECODE89reviewer gate on every commit touching substantive files. See:90 91- `CLAUDE.md` — reviewer procedure (Claude Code dispatch + `.decode-reviewer-clean` marker)92- `.githooks/commit-msg` — gate that verifies the marker matches HEAD + diff hash93- `.github/workflows/gate.yml` `override-audit` job — reports any `[override-reviewer: <reason>]` usage on PRs and pushes94 95That gate runs locally and in CI and is independent of the GitHub branch96protection above. Both must pass.97 98## Change log99 100| Date | Change | By |101|---|---|---|102| 2026-05-13 | Initial posture created (full-model template absorbed) | matussekatdecode |103| 2026-05-20 | Rewrote posture to reflect actual slim-mode reality; cited standards ref `81c3f17` as authority for slim being a valid steady state; documented the repo-internal reviewer gate layer | matussekatdecode (Standards Baseline slice) |104 105---106 107*This file is checked into the repo so any change requires a PR — the108protection model is self-protecting via the `.github/CODEOWNERS` lockdown109rule on this file.*110