GitHub integration: read-only branch-protection and ruleset evidence unavailable for independent review

Problem

In Codex Desktop, an independent review workflow needs to verify a repository protection policy without making any GitHub changes. The required read-only evidence is:

• branch-protection details and the full ruleset body;
• bypass actors;
• the selected ref, commit and tree identity in the same review session.

The repository administrator can read basic repository/ref/tree metadata, but the independent-review connection receives 403 Resource not accessible by integration for protection-detail endpoints. This prevents a reviewer from independently confirming the policy and therefore blocks a safety-sensitive, append-only materials-registry workflow.

Expected behavior

Expose documented, read-only access to the above protection/ruleset/bypass/ref/commit/tree evidence for an authorized repository reviewer, or document the supported Codex Desktop/GitHub App permission model and a supported alternative evidence path.

Actual behavior

Protection-detail readback returns 403 in the independent review connection. No repository mutation, upload, permission change, or protected-ref change was attempted.

Environment

• Codex Desktop on Windows native
• Private GitHub repository
• Read-only review workflow

No repository name, source files, credentials, or customer data are included in this report.

No source files, tests, or entry points are named. Start by reproducing the 403 from the protection-detail endpoints in the stated read-only environment, then inspect the GitHub App permission model and supported evidence alternatives. Done means an authorized reviewer can obtain the listed protection, bypass, ref, commit, and tree evidence without repository mutation, or the supported limitation and alternative are documented.