epic: harden .github meta-repo — private visibility, community health gaps, full Claude Code sync

[wcmchenry3-stack]

Overview

The org's .github repo is currently public, exposing internal workflow logic, Claude Code hook scripts, policy enforcement configs, and org-internal automation. This epic tracks all work required to harden the repo and safely flip it to private.

GitHub's auto-serving of community health files requires a public .github repo, but the current setup already bypasses this via sync-community-health.yml (explicit push to each repo). Going private is safe IF the sync is complete and a separate public profile repo exists for the org homepage.

Gap Analysis

• 3 missing community health files (CODE_OF_CONDUCT, CONTRIBUTING, SUPPORT)
• Claude Code tooling is only ~40% synced — target repos get lint-on-edit.sh and plan-issues.md but NOT the PR gates (lint-gate.sh, policy-gate.sh) or the lint-review/policy-compliance agents
• Root-level SECURITY.md, PULL_REQUEST_TEMPLATE.md, and ISSUE_TEMPLATE/ duplicate community-health/ (older, diverged versions) and should be deleted
• No CODEOWNERS or dependabot.yml in .github/
• README.md incorrectly claims files "auto-apply" to org repos

Child Issues

Phase 2 — Structural Cleanup (parallel, no dependencies)

• chore: remove redundant root-level community health files #78 — chore: remove redundant root-level community health files
• feat: add CODE_OF_CONDUCT.md to community-health and sync #79 — feat: add CODE_OF_CONDUCT.md to community-health and sync
• feat: add CONTRIBUTING.md to community-health and sync #80 — feat: add CONTRIBUTING.md to community-health and sync
• feat: add SUPPORT.md to community-health and sync #81 — feat: add SUPPORT.md to community-health and sync
• feat: add CODEOWNERS to .github/ #82 — feat: add CODEOWNERS to .github/
• feat: add dependabot.yml to .github/ #83 — feat: add dependabot.yml to .github/
• feat: expand sync FILE_MAP to include all Claude Code agents and hooks #84 — feat: expand sync FILE_MAP to include all Claude Code agents and hooks
• docs: update README.md to reflect sync architecture #85 — docs: update README.md to reflect sync architecture

Phase 3 — Org Profile (must complete before Phase 5)

• feat: create public wcmchenry3-stack/profile repo for org homepage #86 — feat: create public wcmchenry3-stack/profile repo for org homepage

Phase 4 — Audit (parallel)

• feat: add audit script to discover unsynced Claude Code content in org repos #87 — feat: add audit script to discover unsynced Claude Code content in org repos
• chore: consolidate org-common Claude Code content from audit #88 — chore: consolidate org-common Claude Code content from audit (blocked by feat: add audit script to discover unsynced Claude Code content in org repos #87)

Phase 5 — Privacy Change (final gate)

• chore: make .github private and verify all org integrations #89 — chore: make .github private and verify all org integrations (blocked by chore: remove redundant root-level community health files #78–feat: create public wcmchenry3-stack/profile repo for org homepage #86)

Dependency Graph

#78, #79, #80, #81, #82, #83, #84, #85  ←  all parallel, no dependencies
#86 (profile)                            ←  parallel, must finish before #89
#87 (audit)                              ←  parallel
#88                                      ←  blocked by #87
#89                                      ←  blocked by #78–#86 (all Phase 2 + profile)

Definition of Done

• All Phase 2 child issues (chore: remove redundant root-level community health files #78–docs: update README.md to reflect sync architecture #85) merged
• profile repo (feat: create public wcmchenry3-stack/profile repo for org homepage #86) live and visible on org homepage
• sync-community-health.yml FILE_MAP includes all Claude Code hooks and agents (feat: expand sync FILE_MAP to include all Claude Code agents and hooks #84)
• Audit completed (feat: add audit script to discover unsynced Claude Code content in org repos #87) and any org-common Claude Code content consolidated (chore: consolidate org-common Claude Code content from audit #88)
• .github repo flipped to private (chore: make .github private and verify all org integrations #89)
• Reusable workflows still callable from private repo (verified via test PR)
• Scheduled workflows still running in private repo

Plan Reference

Full plan: ~/.claude/plans/logical-beaming-hopper.md