Align Every Code skills with Launchplane authorization authority

[shiny-code-bot]

Objective

Align Every Code skills and repository guardrails with the Launchplane authorization freeze and DB-native access-administration direction in #2058.

Current Status

State: Implementation is open as draft codex-skills PR #555 on August 17, 2026. All six GitHub checks pass, the PR is mergeable, and no review comments are pending. Full skill validation and the authorization-denial exec-harness scenario pass. The remaining merge blocker is the required JetBrains Python lane, which reports 11 findings in changed files; reconcile those findings before marking the PR ready. No production authorization or secret change is included.

Scope

• Update the Launchplane skill and relevant GitHub, repo-readiness, security-review, docs-lookup, infra-ops, and planning guidance where authorization work is routed.
• Add an explicit rule: while Audit and redesign Launchplane authentication and authorization #2058 remains unresolved, agents must not propose or apply new GitHub-secret/workflow-managed authorization grants as routine remediation.
• Require agents to distinguish live DB authority, desired-set input, transport, bootstrap, break-glass, and generated projection.
• Require issue-history and parent-architecture checks before authorization changes, including Audit and redesign Launchplane authentication and authorization #2058 and its active successors.
• Add behavior tests or exec-harness scenarios covering an authorization_denied recovery case where the correct outcome is architectural escalation rather than another managed-set workflow.
• Keep existing emergency/bootstrap helpers available only where their narrow retained role remains documented and reviewed.

Acceptance Criteria

• The Launchplane skill cannot reasonably be read as endorsing workflow-managed grants for routine new permissions while Audit and redesign Launchplane authentication and authorization #2058 is open.
• Relevant skills agree on the same authority hierarchy and escalation path.
• Behavioral validation catches the failure mode reproduced in Add existing-only generic-web deploy recovery #2167.
• Public guidance contains no private policy values, topology, or credentials.
• Changes pass focused skill validation, repository-wide behavior checks, and independent review.

Finish Line

Agents consistently stop and route new Launchplane authorization gaps into the DB-native redesign instead of repeating protected-workflow permission setup.