# P&T access through Docusign GitHub Enterprise Server

P&T engineers who cannot access GitHub SaaS can use the internal mirror at
<https://github.docusignhq.com/Enterprise-Apps/reckon-graph>. `Enterprise-Apps`
is a legacy namespace; the repository is owned and maintained by DTS / Application
Engineering. The authoritative development repository remains
`DTS-Productivity-Engineering/reckon-graph` on GitHub SaaS. The GHES repository
is operationally designated as a downstream copy, but that direction is not yet
enforced: authenticated maintainers can push and `main` has no branch
protection. Product changes must not originate there.

## Quick install without GitHub SaaS

Node.js 24 or newer and an authenticated GHES CLI are required. Download the
versioned release asset from GHES, verify its observed SHA-256, install it
without dependency lifecycle scripts, and initialize the existing checkout:

```bash
mkdir reckon-install && cd reckon-install
GH_HOST=github.docusignhq.com gh release download v0.3.0 \
  --repo Enterprise-Apps/reckon-graph \
  --pattern 'reckon-graph-0.3.0.tgz'
printf '%s  %s\n' \
  373ca7540e745915f195e51f4ed6383374e4df4a2b8663872b2f279380e60989 \
  reckon-graph-0.3.0.tgz | shasum -a 256 --check
npm install --global --ignore-scripts ./reckon-graph-0.3.0.tgz
cd /path/to/existing/repository
reckon init
reckon doctor
reckon status --deep
```

Unverified Windows guidance: PowerShell provides
`Get-FileHash -Algorithm SHA256` instead of `shasum`, and the npm/CLI commands
are intended to be portable. A native Windows named-client run has not yet been
certified, so this is not a Windows support claim. The release page records the
versioned filename and observed digest; do not substitute a branch archive or a
mutable `latest` URL. GHES does not currently enforce immutable releases, which
is why digest verification and the separate signed-update trust remain
required.

The same 0.3.0 tarball was published to Docusign Artifactory at
`dts-productivity-engineering-npm-dev-local/reckon-graph-0.3.0.tgz`. That raw
artifact path requires normal corporate Artifactory authentication and is not
an npm registry endpoint. GHES release download is the supported P&T bootstrap
until an approved internal npm virtual repository exposes the package metadata.

## Mirror operating model

1. Source commits and reviewed release tags originate in the GitHub SaaS
   repository.
2. The GHES `main` branch and release tag are synchronized without rewriting
   history.
3. The exact retained release tarball is attached to the matching GHES release;
   it is not rebuilt on GHES.
4. A release is not certified merely because it appears on GHES. The final
   cross-channel attestation must prove that npm, Artifactory, GitHub SaaS,
   Homebrew, and GHES represent the same source and bytes.
5. Developers do not dual-push feature branches. Mirror synchronization is a
   release/operations responsibility and must eventually use a narrowly scoped
   workload identity rather than a personal SSH key.

The destination must eventually enforce repository visibility, branch
protection, required reviews/checks, security scans, commit/tag provenance, and
license notices. Today the repository is internal, but `main` is unprotected and
maintainers retain push access. Those are open governance controls, not
completed evidence. Future mirror automation must fail closed and must not
accept changes back into the authoritative repository.

## Required governance follow-up

Record or complete:

- repository-owner approval to disclose the source to P&T;
- enterprise GitHub/security approval for cross-organization private forks or
  mirrors;
- legal/compliance confirmation for source and license visibility;
- the exact destination GitHub organization and repository name;
- confirmation of destination visibility and membership controls;
- the required branch-protection, review, scan, and retention policy;
- approval of a narrowly scoped GitHub App/workload identity, its installation
  owners, secret store, rotation owner, and audit-log owner;
- an owner for incident response and mirror decommissioning.

The destination repository and current release asset are live. Branch
protection, enforced read-only direction, automated mirror synchronization,
production threshold-update trust, timed onboarding evidence, and a Windows
named-client release certification remain open gates; the existence of this
access path is not evidence that those separate controls are complete.