@@ -7,13 +7,21 @@ has_script() {
   [ -f package.json ] && node -e 'const p=require("./package.json"); process.exit(p.scripts?.[process.argv[1]] ? 0 : 1)' "$1"
 }
 
+has_bun_native_coverage() {
+  [ -f package.json ] && node -e 'const p=require("./package.json"); process.exit(p.scripts?.["test:coverage"]?.includes("bun test") ? 0 : 1)'
+}
+
 has_javascript() {
   git ls-files -- '*.js' '*.jsx' '*.ts' '*.tsx' | grep -q .
 }
 
 has_python() {
   [ -f pyproject.toml ] || [ -f requirements.txt ] || [ -f requirements-dev.txt ] || \
-    git ls-files -- '*.py' | grep -q .
+    git ls-files -- '*.py' ':!.github/**' | grep -q .
+}
+
+has_graph_project() {
+  [ -f package.json ] && node -e 'const p=require("./package.json"); process.exit(p.devDependencies?.["@graphprotocol/graph-cli"] ? 0 : 1)'
 }
 
 package_manager() {
@@ -44,6 +52,45 @@ run_package_tool() {
   esac
 }
 
+run_bun_coverage() {
+  local log_file coverage_line functions lines minimum
+  log_file="$(mktemp)"
+  if ! run_script test:coverage 2>&1 | tee "$log_file"; then
+    rm -f "$log_file"
+    return 1
+  fi
+  coverage_line="$(grep -E '^All files[[:space:]]*\|' "$log_file" | tail -n 1 || true)"
+  if [ -z "$coverage_line" ]; then
+    echo "Coverage summary not found in test:coverage output" >&2
+    rm -f "$log_file"
+    return 1
+  fi
+  functions="$(printf '%s\n' "$coverage_line" | awk -F'|' '{gsub(/[[:space:]]/, "", $4); print $4}')"
+  lines="$(printf '%s\n' "$coverage_line" | awk -F'|' '{gsub(/[[:space:]]/, "", $5); print $5}')"
+  minimum="${BUN_COVERAGE_MIN:-80}"
+  if ! awk -v functions="$functions" -v lines="$lines" -v minimum="$minimum" \
+    'BEGIN { exit !(functions + 0 >= minimum && lines + 0 >= minimum) }'; then
+    echo "Coverage below ${minimum}%: functions=${functions}% lines=${lines}%" >&2
+    rm -f "$log_file"
+    return 1
+  fi
+  echo "Coverage threshold passed: functions=${functions}% lines=${lines}% (minimum ${minimum}%)"
+  rm -f "$log_file"
+}
+
+python_coverage_args() {
+  if [ -f pyproject.toml ]; then
+    python - <<'PY'
+import tomllib
+from pathlib import Path
+
+config = tomllib.loads(Path("pyproject.toml").read_text())
+for source in config.get("tool", {}).get("coverage", {}).get("run", {}).get("source", []):
+    print(f"--cov={source}")
+PY
+  fi
+}
+
 install() {
   if [ -f package.json ]; then
     case "$(package_manager)" in
@@ -67,6 +114,12 @@ rust_component() {
   fi
 }
 
+has_rust_target() {
+  local kind="$1"
+  cargo metadata --no-deps --format-version 1 |
+    jq -e --arg kind "$kind" 'any(.packages[].targets[]; (.kind | index($kind)) != null)' >/dev/null
+}
+
 format() {
   if has_script format:check; then run_script format:check
   elif has_javascript; then run_package_tool prettier --check .
@@ -84,7 +137,9 @@ lint() {
 }
 
 type_check() {
-  if has_script type-check; then run_script type-check
+  if has_graph_project; then
+    echo "Skipping TypeScript type-check (Graph AssemblyScript project uses graph build/codegen)"
+  elif has_script type-check; then run_script type-check
   elif has_script typecheck; then run_script typecheck
   else echo "Skipping type-check (script not defined)"; fi
   if [ -f Cargo.toml ]; then cargo check; fi
@@ -95,25 +150,47 @@ type_check() {
   fi
 }
 
-build() { run_script build; }
+build() {
+  # Some frameworks validate session secrets while statically collecting pages.
+  # Keep CI builds deterministic without weakening runtime/deployment validation.
+  if [ "${CI:-}" = true ] && [ -z "${NEXTAUTH_SECRET:-}" ]; then
+    export NEXTAUTH_SECRET="ci-only-build-secret-not-for-runtime-0123456789"
+  fi
+  run_script build
+  if [ -f Cargo.toml ]; then cargo build --all-targets --all-features; fi
+}
 
 unit() {
   # Bun repositories should expose test scripts backed by Bun's native runner.
   # Specialized repositories may keep their native runner (for example Matchstick or Hardhat).
   if has_script test:unit; then
     run_script test:unit
   elif has_script test:coverage; then
-    run_script test:coverage
+    if [ "$(package_manager)" = bun ] && has_bun_native_coverage; then
+      run_bun_coverage
+    else
+      run_script test:coverage
+    fi
   elif has_script test && ! has_script test:integration; then
     run_script test
   else
     echo "Skipping JavaScript/TypeScript unit tests (script not defined)"
   fi
-  if [ -f Cargo.toml ]; then cargo test --lib --all-features; fi
+  if [ -f Cargo.toml ]; then
+    if has_rust_target lib; then cargo test --lib --all-features
+    elif has_rust_target bin; then cargo test --bins --all-features
+    else echo "Skipping Rust unit tests (no library or binary target)"; fi
+  fi
   if [ -d tests/unit ] && python -c 'import importlib.util; raise SystemExit(importlib.util.find_spec("pytest") is None)' 2>/dev/null; then
-    python -m pytest -q tests/unit --cov --cov-report=term-missing
+    coverage_args=()
+    while IFS= read -r arg; do [ -n "$arg" ] && coverage_args+=("$arg"); done < <(python_coverage_args)
+    [ "${#coverage_args[@]}" -gt 0 ] || coverage_args=(--cov)
+    env -u MISE_GITHUB_TOKEN -u MISE_TRUSTED_CONFIG_PATHS -u MISE_YES -u MISE_LOG_LEVEL -u PYTHONHOME PYTHONPATH="$PWD/.github/scripts" python -m pytest -q tests/unit "${coverage_args[@]}" --cov-report=term-missing --cov-fail-under="${PYTHON_COVERAGE_MIN:-80}"
   elif [ -d tests ] && [ ! -d tests/integration ] && python -c 'import importlib.util; raise SystemExit(importlib.util.find_spec("pytest") is None)' 2>/dev/null; then
-    python -m pytest -q tests --cov --cov-report=term-missing
+    coverage_args=()
+    while IFS= read -r arg; do [ -n "$arg" ] && coverage_args+=("$arg"); done < <(python_coverage_args)
+    [ "${#coverage_args[@]}" -gt 0 ] || coverage_args=(--cov)
+    env -u MISE_GITHUB_TOKEN -u MISE_TRUSTED_CONFIG_PATHS -u MISE_YES -u MISE_LOG_LEVEL -u PYTHONHOME PYTHONPATH="$PWD/.github/scripts" python -m pytest -q tests "${coverage_args[@]}" --cov-report=term-missing --cov-fail-under="${PYTHON_COVERAGE_MIN:-80}"
   else
     echo "Skipping Python unit tests (no unit suite detected)"
   fi
 
@@ -4,7 +4,7 @@ set -euo pipefail
 languages=()
 if find .github/workflows -type f \( -name '*.yml' -o -name '*.yaml' \) -print -quit | grep -q .; then languages+=(actions); fi
 if git ls-files -- '*.ts' '*.tsx' '*.js' '*.jsx' 'package.json' 'tsconfig*.json' | grep -q .; then languages+=(javascript-typescript); fi
-if git ls-files -- '*.py' 'pyproject.toml' 'requirements*.txt' 'setup.py' | grep -q .; then languages+=(python); fi
+if git ls-files -- '*.py' 'pyproject.toml' 'requirements*.txt' 'setup.py' ':!.github/**' | grep -q .; then languages+=(python); fi
 if git ls-files -- '*.rs' 'Cargo.toml' 'Cargo.lock' | grep -q .; then languages+=(rust); fi
 
 json=$(printf '%s\n' "${languages[@]}" | jq -Rsc 'split("\n") | map(select(length > 0) | {language: ., name: (if . == "javascript-typescript" then "TypeScript" elif . == "actions" then "Actions" else (. | ascii_upcase[0:1] + .[1:]) end), "build-mode": "none"})')
 
@@ -45,6 +45,15 @@ if [ -f package.json ]; then
       warn "JavaScript/TypeScript sources found but no test or test:unit/test:integration script is defined"
     fi
   fi
+  if [ -f bunfig.toml ] && node -e 'const p=require("./package.json"); process.exit(p.scripts?.["test:coverage"] ? 0 : 1)' 2>/dev/null; then
+    if ! grep -q 'coverageThreshold' bunfig.toml; then
+      if [ -x .github/scripts/ci.sh ]; then
+        printf '%s\n' "INFO: shared CI enforces the Bun aggregate coverage threshold"
+      else
+        error "Bun coverage is enabled by test:coverage but no coverage policy is configured"
+      fi
+    fi
+  fi
 fi
 
 if [ -f Cargo.toml ]; then
@@ -53,14 +62,16 @@ if [ -f Cargo.toml ]; then
 fi
 
 if [ -f pyproject.toml ] || [ -f requirements.txt ] || [ -f requirements-dev.txt ]; then
-  command -v python >/dev/null 2>&1 || error "Python is required for this repository"
+  if ! command -v python >/dev/null 2>&1 && [ ! -x .venv/bin/python ]; then
+    error "Python is required for this repository"
+  fi
 fi
 
 for workflow in ci.yml codeql.yml security.yml test.yml draft-pr.yml release-pr.yml release.yml; do
   [ -f ".github/workflows/$workflow" ] || error "missing standard workflow: $workflow"
 done
 
-for script in ci.sh codeql-languages.sh security.sh doctor.sh bootstrap.sh sync-template.sh init-repo.sh; do
+for script in ci.sh codeql-languages.sh security.sh doctor.sh bootstrap.sh sync-template.sh init-repo.sh sync-protection.sh; do
   [ -x ".github/scripts/$script" ] || error "missing executable script: .github/scripts/$script"
 done
 
 
@@ -3,13 +3,15 @@ set -euo pipefail
 
 source="https://github.com/0xPlayerOne/template-repo.git"
 ref="main"
+protection=false
 
 while [ "$#" -gt 0 ]; do
   case "$1" in
     --source) source="${2:?missing source path or URL}"; shift 2 ;;
     --ref) ref="${2:?missing ref}"; shift 2 ;;
+    --protection) protection=true; shift ;;
     -h|--help)
-      printf '%s\n' 'Usage: init-repo.sh [--source PATH_OR_URL] [--ref REF]'
+      printf '%s\n' 'Usage: init-repo.sh [--source PATH_OR_URL] [--ref REF] [--protection]'
       exit 0
       ;;
     *)
@@ -21,3 +23,10 @@ done
 
 bash .github/scripts/sync-template.sh --source "$source" --ref "$ref" --apply
 bash .github/scripts/bootstrap.sh
+
+if [ "$protection" = true ]; then
+  remote="$(git remote get-url origin 2>/dev/null || true)"
+  repo="$(printf '%s\n' "$remote" | sed -E 's#.*github.com[:/]([^/]+/[^/.]+)(\.git)?$#\1#')"
+  [ -n "$repo" ] || { echo 'Could not determine GitHub repository from origin' >&2; exit 1; }
+  bash .github/scripts/sync-protection.sh --repo "$repo" --apply
+fi
@@ -13,8 +13,15 @@ package_manager() {
 }
 
 if [ -f package.json ]; then
+  audit_args=(--audit-level=high)
+  if [ -f .github/security-audit-allowlist.txt ]; then
+    while IFS= read -r advisory; do
+      [[ -z "$advisory" || "$advisory" == \#* ]] && continue
+      audit_args+=(--ignore "$advisory")
+    done < .github/security-audit-allowlist.txt
+  fi
   case "$(package_manager)" in
-    bun) audits=$((audits + 1)); bun audit --audit-level=high ;;
+    bun) audits=$((audits + 1)); bun audit "${audit_args[@]}" ;;
     pnpm) audits=$((audits + 1)); corepack pnpm audit --audit-level high ;;
     yarn) audits=$((audits + 1)); corepack yarn npm audit --all --recursive ;;
     npm) audits=$((audits + 1)); npm audit --audit-level=high ;;
 
@@ -0,0 +1,17 @@
+"""Keep coverage.py usable with runners that ship malformed sysconfig schemes."""
+
+import sysconfig
+
+_get_paths = sysconfig.get_paths
+
+
+def get_paths(scheme=None, vars=None, expand=True):
+    try:
+        return _get_paths(scheme, vars, expand)
+    except ValueError as error:
+        if "Single '}' encountered in format string" not in str(error):
+            raise
+        return {}
+
+
+sysconfig.get_paths = get_paths
@@ -0,0 +1,95 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+branch="main"
+repo=""
+mode="check"
+
+usage() {
+  printf '%s\n' 'Usage: sync-protection.sh --repo OWNER/REPO [--branch main] [--check] [--apply]'
+}
+
+while [ "$#" -gt 0 ]; do
+  case "$1" in
+    --repo) repo="${2:?missing OWNER/REPO}"; shift 2 ;;
+    --branch) branch="${2:?missing branch}"; shift 2 ;;
+    --check) mode="check"; shift ;;
+    --apply) mode="apply"; shift ;;
+    -h|--help) usage; exit 0 ;;
+    *) usage >&2; exit 2 ;;
+  esac
+done
+
+[ -n "$repo" ] || { usage >&2; exit 2; }
+command -v gh >/dev/null 2>&1 || { echo "gh is required" >&2; exit 1; }
+
+is_private="$(gh repo view "$repo" --json isPrivate --jq '.isPrivate')"
+contexts=(Format Lint Type-Check Build Unit Integration E2E Smoke 'Dependency Audit' Detect)
+
+if [ "$is_private" != true ]; then
+  contexts+=("Analyze (Actions)")
+  if git ls-files -- '*.ts' '*.tsx' '*.js' '*.jsx' package.json tsconfig\*.json | grep -q .; then contexts+=("Analyze (TypeScript)"); fi
+  if git ls-files -- '*.py' pyproject.toml requirements\*.txt setup.py ':!.github/**' | grep -q .; then contexts+=("Analyze (Python)"); fi
+  if git ls-files -- '*.rs' Cargo.toml Cargo.lock | grep -q .; then contexts+=("Analyze (Rust)"); fi
+fi
+
+protection="$(gh api "repos/$repo/branches/$branch/protection" 2>/dev/null || true)"
+if ! jq -e 'type == "object" and (.required_status_checks | type == "object")' >/dev/null 2>&1 <<< "$protection"; then
+  if [ "$mode" = apply ]; then
+    echo "Cannot read branch protection for $repo:$branch (repository plan or permissions may not allow it)." >&2
+    exit 1
+  fi
+  existing=""
+else
+  existing="$(jq -r '.required_status_checks.contexts[]?' <<< "$protection")"
+fi
+preserved=()
+while IFS= read -r context; do
+  [ -n "$context" ] || continue
+  case "$context" in
+    'Slither / Analyze') continue ;; # removed from the standard workflow set
+    'CI / '*|'Test / '*|'Security / '*|'CodeQL / '*) ;;
+    *) preserved+=("$context") ;;
+  esac
+done <<< "$existing"
+
+payload="$(printf '%s\n' "${preserved[@]-}" "${contexts[@]}" | jq -Rsc 'split("\n") | map(select(length > 0)) | unique | {strict: true, contexts: .}')"
+
+if [ "$mode" = check ]; then
+  printf '%s\n' "$payload" | jq .
+  exit 0
+fi
+
+current="$protection"
+full_payload="$(jq --argjson checks "$payload" '
+  {
+    required_status_checks: $checks,
+    enforce_admins: .enforce_admins.enabled,
+    required_pull_request_reviews: (
+      if .required_pull_request_reviews == null then null else {
+        dismiss_stale_reviews: .required_pull_request_reviews.dismiss_stale_reviews,
+        require_code_owner_reviews: .required_pull_request_reviews.require_code_owner_reviews,
+        required_approving_review_count: .required_pull_request_reviews.required_approving_review_count,
+        require_last_push_approval: .required_pull_request_reviews.require_last_push_approval
+      } end
+    ),
+    restrictions: (
+      if .restrictions == null then null else {
+        users: [.restrictions.users[].login],
+        teams: [.restrictions.teams[].slug],
+        apps: [.restrictions.apps[].slug]
+      } end
+    ),
+    required_linear_history: .required_linear_history.enabled,
+    allow_force_pushes: .allow_force_pushes.enabled,
+    allow_deletions: .allow_deletions.enabled,
+    block_creations: .block_creations.enabled,
+    required_conversation_resolution: .required_conversation_resolution.enabled,
+    lock_branch: .lock_branch.enabled,
+    allow_fork_syncing: .allow_fork_syncing.enabled
+  }
+' <<< "$current")"
+
+gh api --method PUT "repos/$repo/branches/$branch/protection" \
+  --input - <<< "$full_payload" >/dev/null
+printf 'Updated required checks for %s:%s\n' "$repo" "$branch"
@@ -67,8 +67,10 @@ files=(
   .github/scripts/codeql-languages.sh
   .github/scripts/doctor.sh
   .github/scripts/security.sh
+  .github/scripts/sitecustomize.py
   .github/scripts/sync-template.sh
   .github/scripts/init-repo.sh
+  .github/scripts/sync-protection.sh
   .github/workflows/ci.yml
   .github/workflows/codeql.yml
   .github/workflows/draft-pr.yml
@@ -78,6 +80,27 @@ files=(
   .github/workflows/test.yml
 )
 
+# Workflows outside the standard baseline are repository-owned extensions.
+# The sync operation never deletes or replaces them; surface them explicitly
+# so maintainers can verify custom deployment, indexing, or security flows.
+standard_workflow() {
+  case "$1" in
+    ci.yml|codeql.yml|draft-pr.yml|release-pr.yml|release.yml|security.yml|test.yml) return 0 ;;
+    *) return 1 ;;
+  esac
+}
+
+custom_workflows=()
+if [ -d .github/workflows ]; then
+  while IFS= read -r workflow; do
+    workflow="${workflow#./.github/workflows/}"
+    standard_workflow "$workflow" || custom_workflows+=("$workflow")
+  done < <(find .github/workflows -maxdepth 1 -type f -print | sort)
+fi
+if [ "${#custom_workflows[@]}" -gt 0 ]; then
+  printf 'Preserving custom workflows: %s\n' "${custom_workflows[*]}"
+fi
+
 changed=0
 for file in "${files[@]}"; do
   if [ ! -f "$template_root/$file" ]; then
 
@@ -10,7 +10,7 @@ They complement `CONTRIBUTING.md`. More specific instructions in nested `AGENTS.
 - Prefer the versions pinned in `.mise.toml`.
 - Do not commit secrets, generated credentials, local environment files, or machine-specific paths.
 - Add tests for behavior changes and keep coverage thresholds explicit in the project configuration.
-  Make the smallest complete, well-tested change that solves the requested problem without disturbing unrelated work.
+- Make the smallest complete, well-tested change that solves the requested problem without disturbing unrelated work.
 
 This repository may contain TypeScript, Rust, Python, or any combination of them. Detect the active stack from the files present; do not assume every check applies.