Priority 9/10 | 1 source issues | Impact 3/5 | Confidence 3/5 | Effort 3/5

One assignment, one coherent fix

The shared github.com parent rule also permits package registry hosts, so selecting an engine or github bundle grants unintended registry access.

Implementation scope

Centralize the shared transport policy, narrow the parent rule to required GitHub hosts, and add tests asserting registry hosts need an explicit ecosystem opt-in.

Done when

• Selecting only the github ecosystem does not allow package registry hostnames.
• Tests assert the documented ecosystem opt-in boundary.

Why now

The report lists affected sets with file locations and affects the default security posture, but depends on documented firewall suffix semantics.

Unchanged AW sources close only after this summary is completed. Newer source activity and not-planned retirement do not trigger source closure. Assigned summaries are frozen; unassign to allow reclustering.

Generated by AW Essential Issue Clustering · copilot · auto · 28.1 AIC · ⌖ 0.614 AIC · ⊞ 8.9K · ◷