feat: label-governance - Add the locked-files guard and inventory token guard

.github/specs/008-label-audit-consolidation/contracts/dry-run-and-drift-report-schema.md

@@ -4,7 +4,7 @@ Defines the per-repository deletion dry run that @ashleyshaw approves before any
 
 ## Per-repository dry run
 
-Saved as `evidence/dry-run/{repo}.json` and summarised in a comment on the gate issue that replaces #95.
+Saved as `evidence/dry-run/{repo}.json` and summarised in a comment on the gate issue that replaces #95. For a private repository the file stays under `.private-evidence/dry-run/` and is neither committed nor summarised in the public gate issue (decision of 2026-10-04).
 
 ```json
 {

.github/specs/008-label-audit-consolidation/plan.md

@@ -256,7 +256,7 @@ Each stage starts only when the previous stage's exit check passes. Validation s
 | 0a. Issue types and colours (configuration done in #3534; T040c to do) | PR updating `issue-types.yml` (25 entries with descriptions, Decision replaces Question) and `type:*` label colours in `labels.yml` from `contracts/issue-types-org-settings.md`, together with the Decision template and `issue-fields.yml`; then a manual update of the organisation's issue types page in the order given in the contract | for #3534, which merged on 2026-09-25 before approval, T040n's dated sign-off on #3556 and #3557 (or a revert of any rejected part); for every later locked-file PR, approval before merge (FR-009); configuration validation and `npm test` pass; settings page matches the contract (Test 10b) | FR-009, FR-014, FR-019, FR-020 |
 | 0b. Labelling agent guard (done in #3564) | Separate fix PR (`fix/` branch): the agent stops removing labels for being outside `labels.yml`, honours `DRY_RUN`, and applies only `type:*` labels that exist in `labels.yml` | Test 16 passes; the agent's own tests pass | FR-017, FR-022 |
 | 0c. Label names on the audit branch (done in #3362) | On `audit/label-consolidation`: replace `ai-ops`/`type:ai-ops` label names with `aiops`/`type:aiops` and `openspec:` with `spec:` in the spec 008 artefacts, the audit's analysis reports and recommendation files, `docs/LABEL_INVENTORY.md` and `docs/LABELING_FAQ.md`; add `target_name` to the four snapshot files (`canonical-labels.json`, `label-families.json`, `label-inventory.json`, `label-inventory.csv`) and a note in `evidence/README.md`; leave `renamed-label-references.json` unchanged. No locked file, script, workflow or test changes | Test 17 passes; the evidence test still passes | FR-011 |
-| 0. Evidence | Paginated label inventory for every repository (after the T075 token guard); `evidence/linear-labels.json` with issue counts and proposed mappings (`contracts/label-mapping-schema.md`) | Mapping validation rules pass (Test 9); the inventory lists private repositories | FR-006, FR-010, FR-012, FR-018 |
+| 0. Evidence | Paginated label inventory for every repository (after the T075 token guard); `evidence/linear-labels.json` with issue counts and proposed mappings (`contracts/label-mapping-schema.md`) | Mapping validation rules pass (Test 9); the inventory counts every private repository (names withheld, 2026-10-04) | FR-006, FR-010, FR-012, FR-018 |
 | 1. Approve | Raise `[LABEL-UPDATE-REQUEST]` (mapping table, referencing #3554 for its five imports), `[ISSUE-TYPE-UPDATE-REQUEST]` and `[TEMPLATE-UPDATE-REQUEST]` (Question → Decision), a `[LABEL-UPDATE-REQUEST]` for the 16 FR-011 prefix renames and the `spec:NNN` → `spec-id:NNN` move, a `[TEMPLATE-UPDATE-REQUEST]` for the six PR templates (`type:ai-ops` → `type:aiops`, `type:documentation` → `type:docs`, `meta:needs-review` removed) that also covers the routing files `branch-labels.yml` (T074) and `PULL_REQUEST_TEMPLATE/config.yml` (T076), locked since constitution v1.4.0, a migration issue for OpenSpec paths, and a new gate issue replacing #95; each waiting request carries `meta:needs-approval` once the label exists | @ashleyshaw approves all requests | FR-009, FR-011, FR-013, FR-014, FR-016, FR-021 |
 | 2. Configuration PR | One PR: `labels.yml` (renames, imports including the five #3554 labels with the FR-012 colour rule, the `area:*` → `aiops:*` AI merges), `label-governance-policy.yml` (new gate issue, `enabled: false`), `labeler.yml`, `branch-labels.yml` (one canonical `type:*` label per branch type, matching its routed template: T074), `PULL_REQUEST_TEMPLATE/config.yml` (mirrors `branch-types.yml`: T076), scripts, workflows (including `orchestrate-phase-progression.yml`), validators (`validate-labeling-configs.cjs` prefix list) and tests referencing `ai-ops:` or `openspec:` labels, `pr_aiops.md`, the `spec:NNN` → `spec-id:NNN` move (`prd-combined-agent` plan, `bulk-label-issues.sh` and its test), the six docs files, and the FR-021 policy in `docs/LABEL_STRATEGY.md`. The `type:question` removal, `issue-types.yml`, `06-decision.md` and `issue-fields.yml` belong to Stage 0a; the never-delete list clean-up shipped in #3362 (T055 stays open only for `gated_by_issue`, which waits for the new gate issue) | Merges only after #3564 (Stage 0b), and its label renames are applied in GitHub (Stage 3) in the same session, so no item loses an `ai-ops:*` or `openspec:*` label. CI green; Test 10 and Test 15 pass | FR-011, FR-012, FR-014, FR-021 |
 | 2b. Spec Kit rename PR | Separate PR for the OpenSpec → Spec Kit rename in live files and paths, with links updated | Test 11 passes | FR-013 |

.github/specs/008-label-audit-consolidation/spec.md

@@ -324,5 +324,9 @@ The audit itself makes no changes to the production label configuration. The app
 - Q: FR-018 requires the drift check to authenticate with an App holding only Issues (read/write) and Metadata (read). May the existing `BOT_PR_APP_*` App be reused unchanged? → A: Yes, by decision of Chris on 2026-10-02 (recorded in `evidence/change-requests.json` as `APP-CREDENTIAL-VARIANCE`). The App is shared by `documentation.yml`, `keep-pr-current.yml` and `branch-validation-metrics-aggregator.yml`, so narrowing it would break those; no new App and no new secret values were created. **This is a documented variance from FR-018 and T071a: the App's installed permission set is broader than "only Issues (read/write) and Metadata (read)", and the limit is applied per token instead.** **Amended 2026-10-02 after a failed live dry run:** `BOT_PR_APP_*` has no Issues permission and cannot serve the drift check; the check now uses the installed `lightspeed-project-automation` App (permissions verified and recorded) with downscoped tokens. `LINEAR_API_KEY` was confirmed by Chris and stays repository-level.
 - Q: What does the `label-drift-check` GitHub environment actually protect, given it holds no secrets? → A: Branch gating only. The environment exists (created 2026-10-02, admin bypass off, deployment branch policy `develop` only) and the drift job binds to it, so a `workflow_dispatch` from another branch cannot deploy that job. It provides **no secret isolation**: the environment stores no secrets, so every credential remains reachable at repository level by any workflow that runs in the repository. Secret isolation would require moving the three secrets into the environment, which has not been done. The job is therefore gated by branch, not by secret scope.
 
+### Session 2026-10-04
+
+- Q: This repository is public and the organisation has private repositories, some of which may identify clients. Should the label inventory and the drift report name them? → A: No. By decision of Chris on 2026-10-04, the clean-up and the drift check still cover private repositories, but nothing committed to or published in `lightspeedwp/.github` (evidence files, the drift issue, its artifact, Actions logs) names a private repository or lists its labels. The tracked inventory keeps each private repository as a numbered placeholder with its counts (`label_count`, `pages_read`), the drift issue counts them, and the full detail is kept outside this repository: a local `.private-evidence/` directory for the inventory and the per-repository dry runs, and a private report repository for the drift detail (`PRIVATE_REPORT_REPO`). This supersedes the earlier assumption that the inventory and per-repository dry runs are committed in full. Recorded in FR-006, T041, T065a and the dry-run contract.
+
 *This page brought to you by the 🦄 Magic Automation Unicorns of LightSpeedWP.*
 [Automation Docs](https://github.com/lightspeedwp/.github/tree/main/instructions)