# Prepare repositories and preserve history

Read the latest report, source revision and coverage before choosing fixes. A
scanner result is evidence within its stated limits; it does not run your tests
or certify the entire repository/history. Preserve dirty work, branch/tag history,
licenses, authorship and timestamps. Use existing project commands and formatter
configuration; do not reformat an entire repository simply to change a score.
Build/test the baseline, apply focused fixes and verify the changed behavior.

Current-tree findings can be handled by the owner's coding agent through local
Git and GitHub tools. Prepare a reviewable branch/PR using the owner's existing
write authorization. Alternatively, the owner can start the website's remediation
PR flow in the dashboard; its separate GitHub OAuth approval uses the browser.
The intake token does not grant GitHub write access or merge approval. Do not
mistake starting OAuth for a created PR, or a PR for a completed cleanup.

For historical findings, fetch `/agent/history.md` from the CodeMerchant origin.
It is the canonical history-cleanup procedure used by remediation. Plan and
review a rewrite in a separate private mirror; do not run it on the working clone.
Before any force push, give the owner the affected refs and before/after SHAs,
backup location, validation results and collaborator consequences; require their
explicit authorization for those exact refs. Never automatically force-push as
part of “upload all repos”. Credential rotation and review may need owner action.
Do not strip provenance or collapse commits to conceal a project's history.

If exporting rewritten Git with PR metadata, use CodeMerchant's existing
`scripts/export-redacted-prs.mjs` from its source repository and
`docs/redacted-pr-export.md`. Preserve the complete commit map and regenerate
patches; stale original PR diffs can reintroduce removed content. The tool is an
operator export utility, not an upload endpoint or PII certificate. Final vendor
package delivery is not implemented by the website. CodeMerchant submission
currently references connected GitHub repositories and completed analyses.

After owner-approved publication, verify GitHub refs and rerun CodeMerchant scans
with the intended context IDs. Explicitly track source fixes, historical cleanup,
GitHub cached refs, LFS/releases/forks and external context review separately.

## Copying to another repository

Use the [collaboration-history copying skill](../../copy-github-collaboration-history/SKILL.md)
to reproduce native issues, pull requests, comments and closing links alongside
Git history. Follow its inventory and verification steps for every repository.