feat(scripts): fix-actions-policy.sh — repair the estate Actions-policy outage (#362)

[hyperpolymath]

Implements the "fastest shippable" item of #362.

The fault

An onboarding stamp set allowed_actions=selected + sha_pinning_required=true but never
populated patterns_allowed, leaving it []. An empty selected-list rejects every
non-github-owned uses: at workflow-parse time, so runs die as startup_failure with
zero jobs. It presents as "CI is broken" but no workflow edit can fix it — it is a settings
fault.

Measured 2026-07-21: 80 of 306 scanned hyperpolymath repos are in this state,
independently corroborating #362's estimate of 91. hyperpolymath is a User account so
there is no org lever; metadatastician is an Organization where one org-level PUT
covers every repo (needs admin:org).

Why this fixer is shaped unlike every other fix-*.sh

The others take a REPO_PATH and edit files — blast radius is a reviewable diff. This one
writes repository settings through the API: no diff, no branch, no PR. #362 calls this
out explicitly, so it is gated:

Guard	Behaviour
Default mode	--list — read-only, never writes
Writes	require explicit --apply
Kill switch	HYPATIA_AUTOMATION={off,disabled,0} → exit 4
Exclusion registry	consulted fail-closed; unreadable → refuse to write, exit 5
Post-write check	every PUT is GET-verified; a silent sha_pinning reset aborts (exit 3)

sha_pinning_required is never disabled. Under --mode all the remaining control is
mandatory SHA-pinning — which is the point: a pinned SHA cannot be moved under you, whereas
an empty allowlist protects nothing and blocks everything. --mode selected remains for a
high-sensitivity tier, seeding patterns_allowed from standards.

Dual invocation contract (integration bug caught before it shipped)

dispatch-runner.sh calls fixers as <script> <repo_path> <finding.json>, but a standalone
sweep is <script> <owner> --apply. Registering the script without handling that would have
made the fleet pass a filesystem path where an owner was expected. The script now detects
a directory in $1 and derives owner/repo from the git origin, so one tool serves both.

In the dispatcher path it stays report-only unless FIX_ACTIONS_POLICY_APPLY=1 — a
credentialed, diff-less write must not auto-fire merely because a finding routed to it.

Registered under by_category: ActionsPolicyTooRestrictive and
by_recipe: recipe-actions-allow-all.

Verification

shellcheck clean · bash -n clean · registry re-parsed with jq.

Guard rails (exit codes measured directly, not through a masking pipeline):

Invocation	Exit	Expected
no owner / bad --mode / unknown flag	2	✅
HYPATIA_AUTOMATION=off + --apply	4	✅
HYPATIA_AUTOMATION=off + --list	0	✅ read-only unaffected

Classification vs an independently collected 306-repo ground truth — 5/5 agreement:

Repo	Tool	Truth
typefix-zero, stateful-artefacts, trope-checker	BROKEN-M1	BROKEN-M1 ✅
svalinn, thejeffparadox	ok	ok ✅

Dispatcher path, invoked exactly as dispatch-runner.sh does:

$ fix-actions-policy.sh /…/hyper-repos/trope-checker /tmp/dispatch-finding-X.json
fix-actions-policy: dispatcher mode — hyperpolymath/trope-checker (action=list)
trope-checker    selected  true  0  BROKEN-M1
scanned=1 broken=1 fixed=0 excluded=0 mode=list/all      # exit 0

⚠️ Not applied anywhere

--apply has not been run. Widening allowed_actions across ~80 repos is a
security-posture change and needs explicit owner sign-off. This PR ships the tool and the
evidence; the sweep is a separate, deliberate decision.

Suggested rollout once signed off: --apply --repo <one> → confirm its workflows actually
start → 3-repo pilot → full sweep → re-run --list to confirm broken=0.

🤖 Generated with Claude Code