fix(applier): never PUT an org-inherited ruleset at the repo endpoint

[hyperpolymath]

The defect

repos/{r}/rulesets returns the organisation's rulesets alongside the repository's own. An inherited one reads back in full at repos/{r}/rulesets/{id} — so every GET succeeds and nothing warns you — while the PUT to that same path 404s.

scripts/apply-branch-gates.sh:333 selected:

.[]|select(.target=="branch" and .enforcement=="active")|.id

with no ownership filter. On every metadatastician repo that picks up the org-level EstateBranching (18225024) and then PUTs it to the repo path. That is the failure already measured 67 times on this estate, once per reached repo.

The discriminator

.source_type. Verified against the live API that the list endpoint does return it on every entry:

$ gh api repos/metadatastician/paint-type/rulesets --jq '[.[]|keys]'
[["_links","created_at","enforcement","id","name","node_id","source","source_type","target","updated_at"], …]

The population is now fetched and classified locally — a server-side select whose empty result is also its success result cannot fail closed.

Three outcomes, none a guess

Situation	State	Why
Only inherited rulesets active	ORG-INHERITED	Names the ids and the /orgs/{org}/rulesets/{id} endpoint. The cure is at the org, applied once; 67 doomed per-repo writes are not a smaller version of it.
Inherited beside a repo-level one	repo-level selected, inherited reported	Rulesets are additive — the inherited one goes on enforcing. Counting both as candidates would turn an ordinary repo into AMBIGUOUS and leave it permanently ungated.
.source_type absent	UNKNOWN	Writability is exactly what that field decides; defaulting a missing one to the writable arm is a silent 404.

Verified against the live estate, report-only

metadatastician/paint-type — all three active rulesets are source_type: Organization, zero repo-level:

metadatastician/paint-type	ORG-INHERITED	branch=main gate_files=5 contexts=19 … — the only
active branch ruleset(s) here are org-level (18225024); writable ONLY at
/orgs/{org}/rulesets/{id}, cured once at the org, never per repo

Before this change it would have selected 18225024 and issued the 404.

Tests — 46/46, and a mutant that died

• CASE 12 org-inherited only → ORG-INHERITED, no PUT even with --apply.
• CASE 13 inherited beside repo-level → WOULD-GATE on ruleset=9, inherited still reported.
• CASE 14 .source_type absent → UNKNOWN, no PUT.
• MUTANT F restores the original selection and dies by PUTting to repos/{r}/rulesets/18225024 — the 404 reproduced, not merely asserted.

Cases 12 and 13 deliberately ship no fixture for the inherited ruleset's own path: the shim exits 1 on a missing fixture, so that absence asserts the fixed applier never reads it.

The 14 existing rulesets-list fixtures omitted source_type, which the live API always sends; they are now faithful to it.

Scope

Read-only except for the two files above. No ruleset was written — every live run in this PR was report-only.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Ji1bq3TypfycfUPAR7hSxR

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 0acaa735-1d81-4623-a065-bb6b0ae3e925

📥 Commits

Reviewing files that changed from the base of the PR and between 392e84d and 9d15a77.

📒 Files selected for processing (2)

• scripts/apply-branch-gates.sh
• scripts/tests/branch-gates-apply-test.sh

 ___________________________________________________________________________________________________________
< A CodeRabbit review a day keeps the merge cop away: https://x.com/ThePrimeagen/status/1986151686839116209 >
 -----------------------------------------------------------------------------------------------------------
  \
   \   \
        \ /\
        ( )
      .( o ).

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• 🔴 Error committing to branch - (🔄 Check to retry)
• Create a new PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate passed

Issues
5 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[coderabbitai]

❌ Failed to create Coding Agent finishing-touch task. Please try again.