Quanta · born wired (P4) · mechanism decision · evidence attached

Born wired, done right

Your directive: for future repos, don’t guess — find out how the field really does it and do it right. Three research lenses, every claim cited, the famous answers weighed and two of them declined for documented reasons. One recommendation stands: one door at birth, a standing daily reconciler that plants the seed wherever it’s missing, and an optional enforcement floor. Your word ends it.

Awaiting Robert’s mechanism ruling · P4 of the approved Seed spec · evidence spot-checked
01

What the field does — in one breath

Three schools. GitHub-native: template repositories seed a repo perfectly on day 0 but never push updates afterward — GitHub’s own staff confirm no sync exists; org-level rulesets are the one piece that truly enforces, and since June 16, 2025 they work on our Team plan (verified against GitHub’s announcement), with filter targeting that automatically covers repos created in the future. Golden-path portals (Spotify’s Backstage): built for orgs with hundreds of services and a platform team — multi-quarter setup, ~10% adoption outside Spotify. Wrong size for us — but the insight transfers: our site factory already IS our golden path. Automation: big shops pair declarative repo management (Terraform — documented drift and rate-limit pain at scale) with a reactive loop — GitHub’s own safe-settings app reacting to new repos and applying the standard. The reactive loop is the piece that fits us.

02

The recommendation — three small parts, no new products

Day 0
One door at birth
Site repos are born wired by the factory template (already moving). The rare hand-made repo starts from a wired template repo — or just gets the paste line, sixty seconds.
Forever
The standing reconciler
A small daily job: read the org’s repos, compare with the fleet view, run the seed on anything unwired — new, drifted, or missed alike. PR opens; owner merges; PROVEN appears. “Future repos” stops being a category.
Optional floor
Org ruleset, where wanted
Require the banking check to pass on PRs, filter-targeted so future repos are auto-covered. On our plan since June 2025. Off by default — its own later one-worder.
Why the reconciler is the answer: it reuses everything the Seed build already ships — the idempotent planter, fail-closed refusals with named reasons, the receipts column as its eyes. It is the planting round on a timer. And we poll on a schedule rather than listen for events: the scan documented a real race where event-driven apps never see repos they weren’t granted — a daily poll structurally can’t miss.
03

Why not the famous answers

Template repos alone
Seed once, drift forever — GitHub confirms no update propagation exists; the community maintains third-party sync bots precisely because of this. Templates are our day-0 door, never our guarantee.
Backstage / developer portals
The field’s own numbers — ~10% adoption outside Spotify, multi-quarter setup, a dedicated team to run it — describe a product for a different scale of company.
Terraform-managed repos
Documented declared-vs-actual drift and API-limit pain at scale, a coverage gap on the newest ruleset targeting — and our repo-creation event source is the factory, not infrastructure code.
04

What could go wrong (honest)

The reconciler nags a deliberately-unwired repo
An explicit exclusions list, named reasons only, rendered in the fleet view — never silent.
Ruleset bypass actors defeat the floor
If the floor is ever turned on, the bypass list is part of that ruling.
Factory bursts outpace a daily cadence
Factory repos are born wired anyway — the reconciler is the net, not the door.
05

On your word

★
“Recommendation approved”
→ the reconciler joins the Seed build (mostly reuse), the wired template repo gets created, and the ruleset floor waits as its own later one-worder. Any variant → say it; the page adjusts.
06

Evidence — spot-checked where load-bearing

Org rulesets on Team plan: github.blog changelog, published 2025-06-16, verified by direct fetch 2026-07-16 (“GitHub Team plans can now configure and enforce organization-level rulesets!”). No template propagation: GitHub community discussion #23528 (staff answer) · a DevRev engineering account of manual propagation (“tedious and error-prone”) · the existence of third-party actions-template-sync. Required-workflow limits: PR-events only, path filters ignored, direct-push branches bypass (GitHub docs) — why the floor is optional, never the whole guarantee. Golden-path scale data: Spotify engineering; Backstage docs + issue #30494 (propagation unsolved even there); practitioner adoption/TCO accounts. Reactive-loop precedent: github/safe-settings (GitHub’s own) · the webhook install-race in community discussion #72593 — the reason we poll. Full 3-lens cited scan: workflow wf_a40fc350-545, each lens instructed to hunt its own class’s failure modes disconfirmingly.