Declarative, secure, and consumer-neutral reconciliation for GitHub Projects.
Important
Yukh Projects is in foundation bootstrap. It is not yet ready for production use.
Yukh Projects turns reviewed configuration into predictable GitHub Projects state. The project is designed for teams that need repeatable automation without coupling the public implementation to any adopter, company, or private repository.
- Consumer-neutral: public code, documentation, tests, and examples never contain adopter-specific data or identifiers.
- Safe by default: plans and dry-runs precede mutations; destructive behavior requires explicit intent.
- Idempotent: applying the same desired state repeatedly converges without unintended changes.
- Least privilege: every integration uses the smallest practical permission set and short-lived credentials where available.
- Auditable: decisions, plans, and outcomes are explainable and machine-readable.
- Supply-chain aware: automation dependencies are reviewed and pinned to immutable revisions.
This repository currently contains the public project foundation. Functional code enters through a clean-room migration: each capability must pass neutrality, security, provenance, and continued-relevance gates before implementation.
- Threat model
- Repository hardening baseline
- Accepted issue contract v1
- Accepted repository policy and effective schema v1
- Accepted reconciliation plan and report v1
- Accepted GitHub read-only adapter v1
- Reviewed dry-run credential profile amendment
- Accepted REST-first Project snapshot v2
- Accepted GitHub issue-contract source v1
- Accepted controlled mutations v1
- Accepted controlled apply entrypoint v1 and reviewed single-token profile amendment
- Accepted GitHub mutation transport v1
- REST Issue Type mutation transport v3 candidate
- Accepted owner-aware work type provider routing v1
- Accepted Action, CLI, and protected release v1
- Proposed aggregate manifest migration planner v1
- Release operations
Do not report vulnerabilities in public issues. Follow SECURITY.md to use a private disclosure channel.
Run the closed, deterministic suite-orchestrator command:
npm --silent run demo:e2eThe command uses only invented policy, issue, Project, approval, and transport fixtures. It performs no network request or live mutation and proves dry-run, approval denial, one observable fake mutation, and a zero-effect second pass. See the validation note for the fixed output contract and safety boundary.
Licensed under the Apache License 2.0.