abcd site setup reports an existing environment on custom deployment policies as current, or adds the missing rules and reports it written, with no restriction step, even when it also holds a rule broader than the default branch and tags v* (a branch policy `*`, for example). setupEnvironments marks an environment unrestricted only when it is not on custom policies or admits protected branches; it reads the existing policies only to find the missing ones, never to find the extra ones, so an environment that admits every branch through a custom rule passes as restricted and the deploy environment's secrets can be reached from unreviewed workflow content.

abcd site setup reports an existing environment on custom deployment policies as current, or adds the missing rules and reports it written, with no restriction step, even when it also holds a rule broader than the default branch and tags v* (a branch policy *, for example). setupEnvironments marks an environment unrestricted only when it is not on custom policies or admits protected branches; it reads the existing policies only to find the missing ones, never to find the extra ones, so an environment that admits every branch through a custom rule passes as restricted and the deploy environment's secrets can be reached from unreviewed workflow content.

Grounds

• pursued: an environment holding any rule beyond branch <default> and tag v* is reported unrestricted with a restriction step and receives no forge write; a run against such an environment that reports it current or written, or writes a policy to it, would show it wrong