Record GitHub access by lane, the ruleset bypass and the remaining owner actions

docs/FORMAL_REQUIRED_CHECKS.md

@@ -47,6 +47,12 @@ authenticate independent semantic review, or promote mathematical status.
 The pre-change main ruleset23798639 requires verify/public-intake/public-shop;
 Math-24045351 requires math-downstream-gates. Both require zero GitHub approving
 reviews. Main has a pre-existing repository-role PR bypass; Math- has none.
+*Correction, 2026-10-07 (live read):* the sentence "Main has a pre-existing
+repository-role PR bypass" is the 27 September snapshot, superseded. The bypass
+actor on main ruleset 23798639 is the ChatGPT Codex Connector integration
+(1144995), bypass mode `always`, exempt from every rule of that ruleset; see
+[OP-ACCESS-20261007](../governance/OP-ACCESS-20261007.md), the access record; the
+bypass disposition (remove, or record as an accepted exception) is pending.
 This code uses the already-required contexts and does not claim to edit settings.
 The managed connector does not expose ruleset writes. Do not bypass a rule or
 claim an administrator change without a successful write and independent readback.

docs/PUBLIC_SHOP_SETUP.md

@@ -26,7 +26,7 @@ The first five bounded tasks are [#141](https://github.com/d6g8k5htny-coder/main
 
 **Math- verified active:** [Proof vault: reviewed changes](https://github.com/d6g8k5htny-coder/Math-/rules/24045351) protects its default `main` branch. It requires a pull request, resolved conversations, and an up-to-date **math-downstream-gates** check from GitHub Actions. Force pushes and deletion are blocked; the bypass list is empty.
 
-**Main verified active:** [Verified pull requests](https://github.com/d6g8k5htny-coder/main/rules/23798639) requires a pull request, resolved conversations, and up-to-date **verify**, **public-shop**, and **public-intake** checks from GitHub Actions. Force pushes and deletion are blocked. The existing repository-admin bypass is restricted to pull requests; it was not expanded. See the [installation receipt](https://github.com/d6g8k5htny-coder/main/pull/149#issuecomment-5848091891), recorded separately from the deployment PR. The external results guard is **public-intake**; its tests are a different check. A green replay is not mathematical acceptance. Do not grant outsiders direct write access.
+**Main verified active:** [Verified pull requests](https://github.com/d6g8k5htny-coder/main/rules/23798639) requires a pull request, resolved conversations, and up-to-date **verify**, **public-shop**, and **public-intake** checks from GitHub Actions. Force pushes and deletion are blocked. The existing repository-admin bypass is restricted to pull requests; it was not expanded. See the [installation receipt](https://github.com/d6g8k5htny-coder/main/pull/149#issuecomment-5848091891), recorded separately from the deployment PR. *Correction, 2026-10-07 (live read):* the two sentences "Force pushes and deletion are blocked. The existing repository-admin bypass is restricted to pull requests; it was not expanded." are the 26 September snapshot and are superseded. The bypass list of that ruleset holds the ChatGPT Codex Connector integration (1144995) with bypass mode `always`, which exempts that one actor from every rule of the ruleset on `main`: the pull-request requirement, the three checks, the non-fast-forward rule and the deletion rule. For every other actor those rules, including the force-push and deletion blocks, stay in force. The ruleset was last updated 2026-09-28T06:22Z, after the receipt. See [OP-ACCESS-20261007](../governance/OP-ACCESS-20261007.md), where the disposition (remove, or record as an accepted exception) is pending. The external results guard is **public-intake**; its tests are a different check. A green replay is not mathematical acceptance. Do not grant outsiders direct write access.
 
 **Single-account autonomous operation (owner-directed correction, 2026-09-26):** both rulesets require **zero GitHub approving reviews**, and approval of the latest reviewable push is disabled. This removes the second-account dependency: authorized agents may review and merge eligible PRs without requesting routine permission from Dylan. Do not reinstate account-count approval gates as a substitute for agent review. Preserve nonauthor technical reviews as exact-source comments or artifacts, disclose authorship and provider, and give same-provider reviews zero organizational-independence credit. Required theorem-specific review predicates and unresolved scientific holds remain separate from engineering merge eligibility. Dismissal of stale optional approvals remains enabled; the Copilot extra-approval option applies only when a nonzero approval count is required. Neither repository has classic branch protection configured. This supersedes the approval-count/latest-push settings in the historical installation receipt; all other protections described above remain.