2026-09-28 12:42:22 +02:00
# Preparation inventory
This is a reproducible **partial baseline** , not G1 acceptance or permission to
move repositories. No Secret objects were queried and no source/cluster state
was mutated. Reference records contain tokens and locations, not source lines.
## Reproduce
From this project checkout:
```bash
python3 tools/inventory.py --output /tmp/orgref-first.json
python3 tools/inventory.py --output /tmp/orgref-second.json --compare /tmp/orgref-first.json
python3 tools/runtime_inventory.py --output /tmp/orgref-runtime.json
python3 /home/worsch/railiance-platform/scripts/capture-reef-deployables.py -o /tmp/orgref-deployables.json
python3 /home/worsch/railiance-master/tools/validate-family-declarations.py --root /home/worsch --inventory /tmp/orgref-deployables.json
python3 -m unittest discover -s tests -v
```
The source collector paginates anonymous forge repository/package endpoints,
reads State Hub repository metadata, scans visible sibling and registered Git
working trees, and scans pinned default-branch archives for public repos without
local remotes. `snapshot.json` records revisions, working-content hashes, local
remotes, stable server/State Hub IDs, reference locations and exclusions. No
fetch, checkout or repo mutation is performed. Runtime collection refuses a
cluster whose node addresses do not include the verified railiance01 IP.
Source/metadata output omits capture timestamps so identical runs are directly
comparable. `comparison.json` records the paired hashes separately. Project-local
generated files are excluded to prevent self-referential output. Historical
matches remain findings until explicitly reviewed; they are not silently ignored.
The scan finds literal `coulomb/<component>` tokens, including unmatched/example
paths; these are candidates for review, not all confirmed broken URLs. A reference
may have several surface categories. It does not detect arbitrary computed or
encoded paths. File location categories are triage hints, not semantic parsing.
## Live evidence
- `runtime-2026-09-28.json` : names/images/owner links for 132 workload controllers
across all namespaces, six ArgoCD Applications and five AppProjects. Includes
CronJobs/Jobs and DaemonSets; completed Jobs may be historical consumers.
- `deployables-2026-09-28.json` : 68 workload units captured by the existing
platform collector; its namespace and Knative-revision exclusions are retained.
- `coverage-2026-09-28.txt` : existing framework validator reports 16 declarations,
**52 errors and 10 warnings** against that fresh platform snapshot. Errors are
unclaimed names, including name drift; they are not all necessarily new rapps.
The platform collector omits substrate/test namespaces, Jobs and DaemonSets.
Its result alone cannot certify the universal managed-deployable coverage rule
in RMASTER-WP-0025. The wider runtime export exposes those additional controllers
for owner adjudication; the project does not redefine workload cardinality.
The frozen coulombcore cluster and consumers outside railiance01 are not captured.
## Known completion blockers
- Anonymous API sees 141 public repositories; 12 additional local `coulomb` paths
are not publicly listed. Private IDs/visibility and any remote-only private repos
need an authenticated owner census. State Hub has 143 registered repos, a
different population; registration is not forge existence or stewardship.
- Package enumeration failed. No package ownership/version completeness claim is
possible. Git repository transfer and package ownership must remain separate.
- Forge version endpoint reports `11.0.3+gitea-1.22.0` ; current public API works at
`forgejo.coulomb.social` . The checked `gitea.coulomb.social` API URLs failed.
This resolves the reachable endpoint/version, not transfer behavior or redirect
semantics, which remain behind T03.
- Existing credential route was checked through `warden route` and `warden plan` .
`warden access forgejo-admin-api-token --exec --field API_TOKEN` was denied by
flex-auth (HTTP 403: caller authentication or system binding rejected). No
credentials were retrieved and no alternative identity was used. The forge
owner must provide a sanctioned metadata export or restore the caller binding.
- Team grants, protected branches, deploy keys, webhooks, runners, repository
credential locations and org/package permissions need that owner export.
- Per-file exclusions include encrypted/sensitive files, symlinks, binaries,
large files and submodule directories. Ignored files, hidden sibling repos,
non-default remote branches and external consumers also need explicit owner
disposition. Do not decrypt files to satisfy a text scan.
- Current local changes are included, not assumed deployed. Heads and hashes in
the inventory bind the evidence; a changed fleet requires another paired scan.
## Completion handoffs (not duplicated owner tasks)
| Evidence needed | Existing owner / record |
| --- | --- |
| Authenticated full repo/package/access export | railiance-forge; credential lane owned by railiance-platform, routed by ops-warden |
| Universal current workload ownership and name drift | railiance-master RMASTER-WP-0021-T06 / RMASTER-WP-0025; platform and individual workload owners |
| Legacy/live image consumers and retained rollback digests | railiance-platform RPF-WP-0028 / RPF-WP-0048-T03; activity-core release owner |
| Source allowlists, credentials and frozen-cluster consumers | railiance-platform RPF-WP-0044 and application owners |
| Reusable workflow and runner references | railiance-enablement / railiance-forge |
## Migration cleanliness precheck
```bash
python3 tools/verify_inventory.py --inventory inventory/snapshot.json --assignments taxonomy/assignments.json
```
This intentionally exits nonzero now: coverage is incomplete, assignments are
unapproved, and old-path references remain. It is a conservative source/remotes
precheck, **not the whole G6 gate** . Before G6, extend it with reviewed per-location
historical dispositions and the accepted runtime/package inventory, then prove
GitOps recovery and fresh pulls/reschedules under the owner execution records.
Do not change `g1_complete` or `approved` merely to obtain a green check.
2026-09-28 13:06:18 +02:00
## Follow-up review
[Owner evidence contract ](owner-evidence-contract.md ) specifies the sanitized
export needed from an authorized forge owner. [Owner follow-ups ](owner-followups.md )
link stable work-record IDs, the 52-row workload review queue and all 326 excluded
source items. Four pinned submodules still reference the old forge endpoint;
wiki/issue-facade identity reconciliation remains open.
A further consecutive pair also failed stability: hub-core changed between runs.
`stability-retry.json` records hashes and the changed fields as a diagnostic
receipt; temporary full retry outputs were not retained as accepted evidence.
The original full snapshots and comparison remain unchanged. No credential retry
was made after the policy denial; the existing owner records explain where to
resolve caller binding without substituting another workload's identity.
