[DESIGN] Subscribe to an org, so channels are discovered rather than pointed at

Filed 2026-07-30. The org-listing answer to the enumeration question #51 left open.

This is not a new feature. It is the missing producer for two finished ones.

Channels shipped (#66). CitizenRecord.channel exists and is populated from the event payload's repository.full_name (review.py:100). A record now knows which show it belongs to.

The leaderboard shipped. leaderboard.py implements the LEADERBOARD.md partition rule and the opt-in display rules, and is well covered.

Neither is reachable across repositories:

• load_all_citizens(root) globs *.json over one local directory (leaderboard.py:61). It cannot see a second channel.
• generate_leaderboard's only caller is src/shodann/cli.py:144, which prints to stdout. No workflow invokes it.

So every citizen record accumulates correctly in its own repository and is never assembled. PRD.md US-3.2 is an MVP acceptance criterion phrased as "WHEN an instructor views METRICS.md", and nothing writes that file. This is S1-12 in design_docs/sprints/2026-07-28/01-candidates.md, and the survey's completeness critic found it precisely because it is a file absent from a directory — no scope was positioned to notice.

Why an org settles it

#51 closed naming an unresolved prerequisite: how does the course repo enumerate student repos — org listing, a roster file, or per-repo push? None of the three is specified anywhere.

An org is the org-listing answer. Subscribing to algocratic means SHODANN discovers channels rather than being pointed at them one at a time, and the enumeration question closes by being chosen rather than argued.

The metaphor holds and is load-bearing: SHODANN watches GitHub as humans watch YouTube. An org is a subscription feed. A repository is a channel. A citizen has one velocity per channel because it is a different show.

What needs deciding

1. Scope of the subscription. Every repo in the org, or an opt-in marker — a .shodann/ directory present, or a topic? algocratic currently holds four repos, one private, and at least two are tools rather than coursework. Not every repo in an org is a channel, and defaulting to "all" makes the leaderboard include things nobody submitted.
2. Who reads across repositories, and with what token. A scheduled job in the course repo needs read access to each channel. That is a cross-repo credential the current two-job split has never needed, and it lands next to the security property the split exists to protect.
3. Private channels. tool-vita-lite is private. A mirror that reads it publishes derived data about a private repo into a public METRICS.md. Decide before, not after.
4. The mirror stays derived. CLAUDE.md Landmines 4: the citizen's own file wins if the two disagree. An aggregator must never write back.

Consent, which is not optional here

display.visibility still defaults to named (S1-14). Today that is contained, because nothing aggregates. Org-wide aggregation is exactly what makes it live — the first cohort's usernames would land on a public ranking without anyone having chosen it, against PRD.md:448 and state.py's own docstring saying "opt-in by name, never by default."

S1-14 is a blocker for this issue, not a companion to it.

Relevant documentation

Not in scope

Moving this repository into the org, and the skill-selector work in #68. Both are adjacent; neither blocks this.

Read design_docs/LEADERBOARD.md, CLAUDE.md, PRD.md §8, src/shodann/state.py, and src/shodann/review.py:100 first. Then inspect leaderboard.py:61 and src/shodann/cli.py:144 to understand the current single-repository flow. Done means the subscription scope, credentials, private-repository handling, consent behavior, and derived-mirror contract are decided and documented before implementation.