GitHub integration: read-only branch-protection and ruleset evidence unavailable for independent review

Problem

In Codex Desktop, an independent review workflow needs to verify a repository protection policy without making any GitHub changes. The required read-only evidence is:

• branch-protection details and the full ruleset body;
• bypass actors;
• the selected ref, commit and tree identity in the same review session.

The repository administrator can read basic repository/ref/tree metadata, but the independent-review connection receives 403 Resource not accessible by integration for protection-detail endpoints. This prevents a reviewer from independently confirming the policy and therefore blocks a safety-sensitive, append-only materials-registry workflow.

Expected behavior

Expose documented, read-only access to the above protection/ruleset/bypass/ref/commit/tree evidence for an authorized repository reviewer, or document the supported Codex Desktop/GitHub App permission model and a supported alternative evidence path.

Actual behavior

Protection-detail readback returns 403 in the independent review connection. No repository mutation, upload, permission change, or protected-ref change was attempted.

Environment

• Codex Desktop on Windows native
• Private GitHub repository
• Read-only review workflow

No repository name, source files, credentials, or customer data are included in this report.