Keep repository audits read-only

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Author: MariusStorhaug

.github/plugin/README.md

@@ -31,8 +31,8 @@ It also provides
 [`psmodule-zensical-migration`](./psmodule/skills/psmodule-zensical-migration/SKILL.md)
 for migrating legacy MkDocs sites to the standard Zensical design, and
 [`psmodule-repository-audit`](./psmodule/skills/psmodule-repository-audit/SKILL.md)
-for auditing or aligning module repositories with the current
-Template-PSModule baseline.
+for auditing module repositories against the current Template-PSModule
+baseline.
 Verify the installation with:
 
 ```console

.github/plugin/psmodule/skills/psmodule-repository-audit/SKILL.md

@@ -1,16 +1,16 @@
 ---
 name: psmodule-repository-audit
-description: Audit a PSModule repository against the current Template-PSModule baseline and align the consumer when requested while preserving repository-owned code, tests, settings, and content.
+description: Audit a PSModule repository against the current Template-PSModule baseline while distinguishing template drift from repository-owned code, tests, settings, and content.
 ---
 
 # Audit a PSModule repository against Template-PSModule
 
-Use this skill when checking an established PowerShell module repository
-against the standard files in
+Use this read-only skill when checking an established PowerShell module
+repository against the standard files in
 [`PSModule/Template-PSModule`](https://github.com/PSModule/Template-PSModule).
-Apply confirmed consumer updates only when the requested scope includes them.
 Use the same procedure for one repository or as the repository-level audit
-inside a fleet campaign.
+inside a fleet campaign. Report changes for a separate migration or delivery
+task; do not edit either repository while running this audit.
 
 This skill does not maintain or reconcile `Template-PSModule`. Changes to
 Process-PSModule include an impact evaluation that determines whether the
@@ -19,12 +19,12 @@ validated in the template repository before consumer alignment begins.
 
 ## Authority and precedence
 
-Apply sources in this order:
+Use these sources together:
 
 1. The [MSX Repository Standard](https://msx.no/docs/Ways-of-Working/Repository-Standard/)
-   owns enterprise policy.
+   owns inherited enterprise policy.
 2. The [PSModule Repository Standard](https://psmodule.io/docs/reference/repository-standard/)
-   adds or overrides requirements for PowerShell module repositories.
+   owns PSModule additions and explicit initiative overrides.
 3. The default branch of `PSModule/Template-PSModule` owns the executable
    implementation of those requirements.
 4. The target repository owns its module code, tests, documentation content,
@@ -34,20 +34,20 @@ Resolve and record the template default-branch commit before comparing files.
 Use that one commit throughout the run. Do not embed a snapshot of template
 file contents in this skill.
 
-When a higher-precedence standard and the template disagree, do not propagate
-the discrepancy and do not repair the template from this skill. Report the
-upstream gap and block consumer alignment until the template is corrected.
-When prose and template implementation merely express the same requirement
-differently, use the template as the byte-level source.
+When either governing standard and the template disagree, do not propagate the
+discrepancy and do not repair the template from this skill. Report the upstream
+gap and block consumer alignment until the policy owner and template agree.
+When prose and template implementation express the same requirement
+differently, use the template as the byte-level source. For shared Zensical
+presentation settings, the MSXOrg documentation design takes precedence over
+the Process-PSModule documentation-site implementation.
 
-## Modes
+## Audit boundary
 
-- **Audit** reports drift without changing the target.
-- **Align** applies confirmed template-owned changes to one consumer repository.
-
-State the selected mode before editing. A fleet run invokes Audit or Align
-once per repository; it does not combine many repositories into one branch or
-pull request.
+The audit records aligned paths, drift, accepted differences, and blocked
+comparisons. It does not edit the template or consumer. A fleet run invokes the
+audit once per repository and creates a separate delivery task for each
+consumer that needs alignment.
 
 ## Inventory
 
@@ -71,7 +71,7 @@ overwrite an established repository.
 
 | Class | Treatment |
 | --- | --- |
-| Template-owned standard | Compare with the template and replace drift unless a documented target exception applies. |
+| Template-owned standard | Compare with the template and report drift unless a documented target exception applies. |
 | Parameterized standard | Compare after applying only the substitutions declared by the template or framework. |
 | Configurable standard | Keep supported repository-specific values; compare the remaining structure and defaults. |
 | Creation scaffold | Use for new repositories. Do not overwrite established module source, tests, examples, or content. |
@@ -116,14 +116,11 @@ the target still uses MkDocs or requires a documentation layout migration.
 
 Template comparison does not prove that an established test suite is compatible
 with the template's Pester version. If the target does not already meet the
-template's Pester baseline, invoke
-[`psmodule-pester-migration`](../psmodule-pester-migration/SKILL.md) and migrate
-every test set before declaring alignment complete.
-
-When the Process-PSModule caller requires a major-version migration, invoke
-[`psmodule-v8-upgrade`](../psmodule-v8-upgrade/SKILL.md). Preserve supported
-`TestData` and repository-owned automation instead of replacing them with
-template examples.
+template's Pester baseline, report
+[`psmodule-pester-migration`](../psmodule-pester-migration/SKILL.md) as required
+follow-up. If the Process-PSModule caller needs a major-version migration,
+report [`psmodule-v8-upgrade`](../psmodule-v8-upgrade/SKILL.md) as required
+follow-up. Do not invoke either migration from this read-only audit.
 
 ## Audit output
 
@@ -159,7 +156,7 @@ Follow the MSX Fleet Orchestration standard:
 ## Validation
 
 1. Repeat the comparison against the same recorded template commit.
-2. Confirm no repository-owned content or secrets changed unintentionally.
+2. Confirm the audit did not change either repository.
 3. Run the target's smallest repository-native checks for every changed
    surface.
 4. Run Pester with the declared version when tests changed.

docs/content/reference/repository-standard.md

@@ -199,11 +199,12 @@ concerns:
 | Exact standard-file implementation | The default branch of [`PSModule/Template-PSModule`](https://github.com/PSModule/Template-PSModule) |
 | Repository-specific code and content | The consumer repository |
 
-MSX requirements take precedence when these sources differ. Correct the
-PSModule standard when its policy differs from MSX, then correct the template
-before updating consumer repositories. Once the policy sources agree, the
-template is the byte-level source for standard files. This keeps exact file
-content in one place instead of duplicating templates in documentation or
+The PSModule standard inherits MSX defaults and may explicitly adjust them for
+PowerShell module repositories. For the shared Zensical presentation profile,
+the MSXOrg documentation design takes precedence when it differs from the
+Process-PSModule documentation site. Once the governing policy is clear, the
+template is the byte-level source for standard module files. This keeps exact
+file content in one place instead of duplicating templates in documentation or
 skills.
 
 Every standard file for a new module repository must exist in
@@ -220,17 +221,17 @@ established repository:
 
 Use the
 [`psmodule-repository-audit`](https://github.com/PSModule/Process-PSModule/blob/main/.github/plugin/psmodule/skills/psmodule-repository-audit/SKILL.md)
-skill to audit a consumer repository and align it when requested. The skill
-never changes the template. Each run records the resolved template commit so
-its result remains reproducible after the template changes.
+skill to audit a consumer repository. The skill never changes the template or
+consumer; alignment is a separate delivery task. Each run records the resolved
+template commit so its result remains reproducible after the template changes.
 
 Automated managed-file distribution is not operating across the PSModule fleet.
 Setting `SubscribeTo` does not currently synchronize files. Until a distribution
 runtime is implemented, maintainers apply template changes through
 repository-specific pull requests and use the repository audit skill to detect
 drift. A future runtime must consume `Template-PSModule` rather than maintain a
 second copy of standard files. Process-PSModule maintainers own detecting when
-template reconciliation or distribution stops operating.
+repository audits or distribution stop operating.
 
 ## Supply-chain defaults