Prepare org reference inventory and stewardship assignment review

Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a0e782-9f45-7382-afff-77ad665b88ec
2026-09-28 12:42:22 +02:00 · 2026-09-28 12:42:22 +02:00 · 660c429838
commit 660c429838
parent 25dd4626e0
19 changed files with 54017 additions and 19 deletions
--- a/GOAL.md
+++ b/GOAL.md
@ -34,9 +34,13 @@ entry gate in `ORGREF-WP-0001` makes that condition checkable instead of a feeli

 Reviewed September 28: the family validator runs green locally; fresh deployable
 coverage, a stable full reference inventory and transfer rollback proof remain
-missing. T01/T02 can advance; T03 onward stays deferred. See the
+missing. Authorized preparation has now produced a partial repeatable inventory
+and stewardship matrix; T01/T02 wait on the documented evidence and decisions.
+Fresh platform coverage reports 52 unclaimed workload names. T03 onward stays deferred. See the
 [readiness review](history/2026-09-28-readiness-review.md), including the circular
-dependency between the rollback prerequisite and T04.
+dependency between the rollback prerequisite and T04. Preparation artifacts:
+[inventory](inventory/README.md), [taxonomy](taxonomy/README.md), and
+[preparation record](history/2026-09-28-preparation.md).

 ## Invariants

--- a/README.md
+++ b/README.md
@ -1,15 +1,21 @@
 # prj-forgejo-org-refactor

 A migration to establish `railiance`, `netkingdom`, `helixforge`, `binky` and
-`experimental` as Forgejo orgs next to `coulomb`, with the relevant repos
+potentially a steward-owned incubator as Forgejo orgs next to `coulomb`, with relevant repos
 changing their org to better structure discoverability and responsibility.

-**Status: seeded, deliberately deferred.** The finding and its blast radius are
-recorded; execution waits until the entry gate in `ORGREF-WP-0001` holds.
+**Status: preparation delivered for review; migration remains deferred.**
+See the [inventory and its gaps](inventory/README.md),
+[stewardship proposal and assignment matrix](taxonomy/README.md), and
+[preparation evidence](history/2026-09-28-preparation.md).
+T01/T02 wait on authenticated completeness and stewardship acceptance; T03 onward
+still requires all four entry conditions in `ORGREF-WP-0001`.

 ## Why this is a project and not a workplan

-All 112 repos with a Forgejo origin currently sit under `coulomb/`. Renaming
+The seed recorded 112 `coulomb` origins. September preparation identifies 141
+public server repos plus 12 additional local paths, with private completeness
+still unproven. Migration
 touches Git remotes, ArgoCD `repoURL` sources, `Chart.yaml` metadata — and,
 most dangerously, **container image paths**, because Forgejo's package registry
 is org-scoped. That last one fails *deferred*: not at rename time, but at the
--- a/SCOPE.md
+++ b/SCOPE.md
@ -89,10 +89,11 @@ project's workplans, never copied.

 ## Current State

- Status: **draft, deliberately deferred**
+- Status: **preparation drafted; production execution deliberately deferred**
 - Seeded 2026-08-11 with the finding, blast radius, and entry gate
 - Reviewed 2026-09-28: local family validator green; fresh deployable coverage,
  stable full reference inventory and transfer rollback evidence still needed
- T01/T02 preparation can proceed now; execution requires the unchanged
+- T01/T02 preparation produced inventory/code and a 153-row taxonomy draft;
+  both tasks wait on explicit evidence and acceptance gaps. Execution requires the unchanged
  `ORGREF-WP-0001` entry gate and resolution of its circular rollback dependency
 - Evidence and next sequence: [readiness review](history/2026-09-28-readiness-review.md)
--- a/history/2026-09-28-preparation.md
+++ b/history/2026-09-28-preparation.md
@ -0,0 +1,87 @@
+# Authorized preparation — 2026-09-28
+
+The user requested execution of preparation after the readiness review. This
+session implemented the read-only T01 inventory and T02 review draft. T03–T05
+were not started, and the four-part entry gate and AGENTS.md were not changed.
+No repository/org/package transfer, credential grant or runtime change occurred.
+
+## Delivered
+
+- [Inventory collector and usage](../inventory/README.md): paginated public forge
+  metadata, State Hub reconciliation, local working-tree reference locations,
+  two pinned remote-only source archives, per-file exclusions and paired snapshots.
+- [Taxonomy](../taxonomy/README.md): CSV/JSON records for 153 known paths, stable
+  IDs where observable, purpose/evidence, candidate steward/org, visibility
+  preservation and per-repo unresolved access/ownership items.
+- Fresh platform-owned deployable capture and validator output; additional
+  project read-only export of runtime controller images and ArgoCD sources.
+- A conservative migration cleanliness precheck and focused tests for secret-safe
+  output, pagination, deterministic fixture scans and incomplete-input refusal.
+
+## Findings
+
+| Observation | Result |
+| --- | --- |
+| Public forge repos | 141, all anonymously visible; pagination exhausted |
+| Additional local paths not publicly listed | 12; existence/IDs/privacy need authenticated confirmation |
+| State Hub registered repos | 143; not the same population as forge repos |
+| Local non-coordinator Git checkouts scanned | 150 |
+| Public repos scanned via pinned archives | forgejo-actions-probe and inter-hub-haskell |
+| Literal source/archive references | 2,133 + 27 = 2,160, excluding remote records |
+| Proposed assignments | railiance 32; netkingdom 20; helixforge 59; binky 3; coulomb 4 |
+| Unresolved steward assignments | 35; grouped for review in taxonomy/README.md |
+| Fresh platform workload inventory | 68 units; validation: 16 declarations, 52 errors, 10 warnings |
+| Wider runtime inventory | 132 controllers, 35 distinct coulomb image references, 6 Applications, 5 AppProjects |
+| Paired normalized snapshots | Unequal; reference sets equal but five repositories changed revision/content |
+
+The source token inventory includes history, examples and planning records.
+Those occurrences are review candidates, not 2,160 asserted live breakages.
+The wider runtime export includes completed Jobs and control-plane controllers;
+its cardinality is not directly comparable with the filtered platform capture.
+
+## Evidence boundaries and blockers
+
+The scanner has no local read errors. It explicitly excludes sensitive/encrypted,
+large and binary files, symlinks and gitlink directories; ignored files, other
+branches and external consumers need owner disposition. The coordinator excludes
+itself from the content scan to avoid self-reference. It remains in the repo matrix.
+
+`inventory/comparison.json` records both retained snapshot hashes. Changes were
+observed in hall-of-helix, hub-core, net-kingdom, rapp-qonto and test-driver.
+Do not call that unchanged-fleet evidence, even though reference findings match.
+
+The existing forge credential route's plan verdict was autonomous, but its
+actual exec request was denied by flex-auth HTTP 403 for caller authentication or
+system binding. No credential was retrieved. No alternate identity or Secret
+read was used. Anonymous package enumeration also failed. The inventory therefore
+makes no claim of private repo, package or effective-access completeness.
+
+Decisions recorded:
+
+- `5f3680fc-0cd5-4d27-ba39-59fbdd13313c`: authenticated owner metadata export or
+  restoration of the sanctioned caller binding, plus completeness evidence.
+- `60c5767c-d510-4d13-9a24-d5d58485b7e5`: matrix, unresolved stewards, actual teams
+  and durable convention review.
+- Existing `e9aca79b-f167-4326-94cd-037dcea34cd2`: circular rollback prerequisite;
+  remains unresolved and is not waived by preparation authorization.
+
+No messages or owner task assignments were sent. Existing owner work is linked
+from the inventory handoff table rather than copied into this coordination repo.
+
+## Acceptance and next actions
+
+T01/T02 are waiting with substantive artifacts, not done. G1/G2 are not accepted.
+To close preparation: obtain authenticated metadata, adjudicate collector exclusions
+and cross-cluster/external consumers, repeat against an unchanged fleet, and settle
+stewards/targets/permissions with verified identities. The 35 unresolved rows are
+not permission to permanently retain those repos in coulomb.
+
+The current live workload errors strengthen the reason to defer implementation.
+Coverage owners must resolve name drift/unclaimed workloads and the collector's
+universal-coverage gap; then the unchanged entry gate still requires applicable
+Git/package transfer rollback proof. No T03 exception is implied.
+
+Validation: four focused unit tests passed; JSON/CSV consistency and whitespace
+checks passed. The cleanliness precheck exits 1 as expected with coverage,
+approval and assignment blockers, reporting 2,254 old-path candidates including
+remote records. That precheck is not full G6 runtime acceptance.
--- a/inventory/README.md
+++ b/inventory/README.md
@ -0,0 +1,102 @@
+# Preparation inventory
+
+This is a reproducible **partial baseline**, not G1 acceptance or permission to
+move repositories. No Secret objects were queried and no source/cluster state
+was mutated. Reference records contain tokens and locations, not source lines.
+
+## Reproduce
+
+From this project checkout:
+
+```bash
+python3 tools/inventory.py --output /tmp/orgref-first.json
+python3 tools/inventory.py --output /tmp/orgref-second.json --compare /tmp/orgref-first.json
+python3 tools/runtime_inventory.py --output /tmp/orgref-runtime.json
+python3 /home/worsch/railiance-platform/scripts/capture-reef-deployables.py -o /tmp/orgref-deployables.json
+python3 /home/worsch/railiance-master/tools/validate-family-declarations.py --root /home/worsch --inventory /tmp/orgref-deployables.json
+python3 -m unittest discover -s tests -v
+```
+
+The source collector paginates anonymous forge repository/package endpoints,
+reads State Hub repository metadata, scans visible sibling and registered Git
+working trees, and scans pinned default-branch archives for public repos without
+local remotes. `snapshot.json` records revisions, working-content hashes, local
+remotes, stable server/State Hub IDs, reference locations and exclusions. No
+fetch, checkout or repo mutation is performed. Runtime collection refuses a
+cluster whose node addresses do not include the verified railiance01 IP.
+
+Source/metadata output omits capture timestamps so identical runs are directly
+comparable. `comparison.json` records the paired hashes separately. Project-local
+generated files are excluded to prevent self-referential output. Historical
+matches remain findings until explicitly reviewed; they are not silently ignored.
+
+The scan finds literal `coulomb/<component>` tokens, including unmatched/example
+paths; these are candidates for review, not all confirmed broken URLs. A reference
+may have several surface categories. It does not detect arbitrary computed or
+encoded paths. File location categories are triage hints, not semantic parsing.
+
+## Live evidence
+
+- `runtime-2026-09-28.json`: names/images/owner links for 132 workload controllers
+  across all namespaces, six ArgoCD Applications and five AppProjects. Includes
+  CronJobs/Jobs and DaemonSets; completed Jobs may be historical consumers.
+- `deployables-2026-09-28.json`: 68 workload units captured by the existing
+  platform collector; its namespace and Knative-revision exclusions are retained.
+- `coverage-2026-09-28.txt`: existing framework validator reports 16 declarations,
+  **52 errors and 10 warnings** against that fresh platform snapshot. Errors are
+  unclaimed names, including name drift; they are not all necessarily new rapps.
+
+The platform collector omits substrate/test namespaces, Jobs and DaemonSets.
+Its result alone cannot certify the universal managed-deployable coverage rule
+in RMASTER-WP-0025. The wider runtime export exposes those additional controllers
+for owner adjudication; the project does not redefine workload cardinality.
+The frozen coulombcore cluster and consumers outside railiance01 are not captured.
+
+## Known completion blockers
+
+- Anonymous API sees 141 public repositories; 12 additional local `coulomb` paths
+  are not publicly listed. Private IDs/visibility and any remote-only private repos
+  need an authenticated owner census. State Hub has 143 registered repos, a
+  different population; registration is not forge existence or stewardship.
+- Package enumeration failed. No package ownership/version completeness claim is
+  possible. Git repository transfer and package ownership must remain separate.
+- Forge version endpoint reports `11.0.3+gitea-1.22.0`; current public API works at
+  `forgejo.coulomb.social`. The checked `gitea.coulomb.social` API URLs failed.
+  This resolves the reachable endpoint/version, not transfer behavior or redirect
+  semantics, which remain behind T03.
+- Existing credential route was checked through `warden route` and `warden plan`.
+  `warden access forgejo-admin-api-token --exec --field API_TOKEN` was denied by
+  flex-auth (HTTP 403: caller authentication or system binding rejected). No
+  credentials were retrieved and no alternative identity was used. The forge
+  owner must provide a sanctioned metadata export or restore the caller binding.
+- Team grants, protected branches, deploy keys, webhooks, runners, repository
+  credential locations and org/package permissions need that owner export.
+- Per-file exclusions include encrypted/sensitive files, symlinks, binaries,
+  large files and submodule directories. Ignored files, hidden sibling repos,
+  non-default remote branches and external consumers also need explicit owner
+  disposition. Do not decrypt files to satisfy a text scan.
+- Current local changes are included, not assumed deployed. Heads and hashes in
+  the inventory bind the evidence; a changed fleet requires another paired scan.
+
+## Completion handoffs (not duplicated owner tasks)
+
+| Evidence needed | Existing owner / record |
+| --- | --- |
+| Authenticated full repo/package/access export | railiance-forge; credential lane owned by railiance-platform, routed by ops-warden |
+| Universal current workload ownership and name drift | railiance-master RMASTER-WP-0021-T06 / RMASTER-WP-0025; platform and individual workload owners |
+| Legacy/live image consumers and retained rollback digests | railiance-platform RPF-WP-0028 / RPF-WP-0048-T03; activity-core release owner |
+| Source allowlists, credentials and frozen-cluster consumers | railiance-platform RPF-WP-0044 and application owners |
+| Reusable workflow and runner references | railiance-enablement / railiance-forge |
+
+## Migration cleanliness precheck
+
+```bash
+python3 tools/verify_inventory.py --inventory inventory/snapshot.json --assignments taxonomy/assignments.json
+```
+
+This intentionally exits nonzero now: coverage is incomplete, assignments are
+unapproved, and old-path references remain. It is a conservative source/remotes
+precheck, **not the whole G6 gate**. Before G6, extend it with reviewed per-location
+historical dispositions and the accepted runtime/package inventory, then prove
+GitOps recovery and fresh pulls/reschedules under the owner execution records.
+Do not change `g1_complete` or `approved` merely to obtain a green check.
--- a/inventory/comparison.json
+++ b/inventory/comparison.json
@ -0,0 +1,44 @@
+{
+  "date": "2026-09-28",
+  "first": "inventory/snapshot-before.json",
+  "second": "inventory/snapshot.json",
+  "first_sha256": "965d9707eb0eb73aea637252b1ed3e182d5e0a728a437abc291cf1003944cc02",
+  "second_sha256": "655ed9c445d76a561068c41883075a65ae5578056854eec25d8ba5a6b3ef6a4f",
+  "normalized_equal": false,
+  "reference_sets_equal": true,
+  "changed_repositories": [
+    {
+      "repo": "hall-of-helix",
+      "fields": [
+        "content_sha256"
+      ]
+    },
+    {
+      "repo": "hub-core",
+      "fields": [
+        "content_sha256"
+      ]
+    },
+    {
+      "repo": "net-kingdom",
+      "fields": [
+        "content_sha256",
+        "files_considered"
+      ]
+    },
+    {
+      "repo": "rapp-qonto",
+      "fields": [
+        "head"
+      ]
+    },
+    {
+      "repo": "test-driver",
+      "fields": [
+        "content_sha256",
+        "files_considered"
+      ]
+    }
+  ],
+  "acceptance": "FAIL: fleet changed between runs; identical reference findings do not satisfy the unchanged-fleet requirement."
+}
--- a/inventory/coverage-2026-09-28.txt
+++ b/inventory/coverage-2026-09-28.txt
@ -0,0 +1,63 @@
+reef-railiance/declarations/reef.yaml: warning: bound_rapps: omitted; derived projection is ['rapp-canned-prompts', 'rapp-core-hub', 'rapp-issue-core', 'rapp-openbao', 'rapp-policy-nexus', 'rapp-postgres', 'rapp-qonto', 'rapp-sbom-nexus', 'rapp-telemetry', 'rapp-user-engine']
+inventory/deployables-2026-09-28.json: error: deployables.actcore-api: live deployable is not claimed by any rapp (wave-2 worklist item)
+inventory/deployables-2026-09-28.json: error: deployables.actcore-app-db: live deployable is not claimed by any rapp (wave-2 worklist item)
+inventory/deployables-2026-09-28.json: error: deployables.actcore-event-router: live deployable is not claimed by any rapp (wave-2 worklist item)
+inventory/deployables-2026-09-28.json: error: deployables.actcore-nats: live deployable is not claimed by any rapp (wave-2 worklist item)
+inventory/deployables-2026-09-28.json: error: deployables.actcore-statehub-edge-relay: live deployable is not claimed by any rapp (wave-2 worklist item)
+inventory/deployables-2026-09-28.json: error: deployables.actcore-temporal: live deployable is not claimed by any rapp (wave-2 worklist item)
+inventory/deployables-2026-09-28.json: error: deployables.actcore-temporal-db: live deployable is not claimed by any rapp (wave-2 worklist item)
+inventory/deployables-2026-09-28.json: error: deployables.actcore-temporal-ui: live deployable is not claimed by any rapp (wave-2 worklist item)
+inventory/deployables-2026-09-28.json: error: deployables.actcore-worker: live deployable is not claimed by any rapp (wave-2 worklist item)
+inventory/deployables-2026-09-28.json: error: deployables.llm-connect: live deployable is not claimed by any rapp (wave-2 worklist item)
+inventory/deployables-2026-09-28.json: error: deployables.approval-engine: live deployable is not claimed by any rapp (wave-2 worklist item)
+inventory/deployables-2026-09-28.json: error: deployables.argocd-application-controller: live deployable is not claimed by any rapp (wave-2 worklist item)
+inventory/deployables-2026-09-28.json: error: deployables.argocd-applicationset-controller: live deployable is not claimed by any rapp (wave-2 worklist item)
+inventory/deployables-2026-09-28.json: error: deployables.argocd-redis: live deployable is not claimed by any rapp (wave-2 worklist item)
+inventory/deployables-2026-09-28.json: error: deployables.argocd-repo-server: live deployable is not claimed by any rapp (wave-2 worklist item)
+inventory/deployables-2026-09-28.json: error: deployables.audit-core: live deployable is not claimed by any rapp (wave-2 worklist item)
+inventory/deployables-2026-09-28.json: error: deployables.bao-notice: live deployable is not claimed by any rapp (wave-2 worklist item)
+inventory/deployables-2026-09-28.json: error: deployables.core-hub-api-candidate: live deployable is not claimed by any rapp (wave-2 worklist item)
+inventory/deployables-2026-09-28.json: error: deployables.core-hub-api-repository-publisher: live deployable is not claimed by any rapp (wave-2 worklist item)
+inventory/deployables-2026-09-28.json: error: deployables.ihp-railiance-probe: live deployable is not claimed by any rapp (wave-2 worklist item)
+inventory/deployables-2026-09-28.json: error: deployables.coulomb-social: live deployable is not claimed by any rapp (wave-2 worklist item)
+inventory/deployables-2026-09-28.json: error: deployables.apps-pg: live deployable is not claimed by any rapp (wave-2 worklist item)
+inventory/deployables-2026-09-28.json: error: deployables.forgejo-db: live deployable is not claimed by any rapp (wave-2 worklist item)
+inventory/deployables-2026-09-28.json: error: deployables.net-kingdom-pg: live deployable is not claimed by any rapp (wave-2 worklist item)
+inventory/deployables-2026-09-28.json: error: deployables.platform-pg-2: live deployable is not claimed by any rapp (wave-2 worklist item)
+inventory/deployables-2026-09-28.json: error: deployables.state-hub-db: live deployable is not claimed by any rapp (wave-2 worklist item)
+inventory/deployables-2026-09-28.json: error: deployables.email-connect: live deployable is not claimed by any rapp (wave-2 worklist item)
+inventory/deployables-2026-09-28.json: error: deployables.flex-auth-informed-decision-sitting: live deployable is not claimed by any rapp (wave-2 worklist item)
+inventory/deployables-2026-09-28.json: error: deployables.flex-auth-informed-decision-t03: live deployable is not claimed by any rapp (wave-2 worklist item)
+inventory/deployables-2026-09-28.json: error: deployables.flex-auth-ops-warden: live deployable is not claimed by any rapp (wave-2 worklist item)
+inventory/deployables-2026-09-28.json: error: deployables.flex-auth-secrets-engine: live deployable is not claimed by any rapp (wave-2 worklist item)
+inventory/deployables-2026-09-28.json: error: deployables.flex-auth-tenant-engine: live deployable is not claimed by any rapp (wave-2 worklist item)
+inventory/deployables-2026-09-28.json: error: deployables.flex-auth-user-engine: live deployable is not claimed by any rapp (wave-2 worklist item)
+inventory/deployables-2026-09-28.json: error: deployables.forgejo-gitea: live deployable is not claimed by any rapp (wave-2 worklist item)
+inventory/deployables-2026-09-28.json: error: deployables.forgejo-runner: live deployable is not claimed by any rapp (wave-2 worklist item)
+inventory/deployables-2026-09-28.json: error: deployables.informed-decision: live deployable is not claimed by any rapp (wave-2 worklist item)
+inventory/deployables-2026-09-28.json: error: deployables.inter-hub: live deployable is not claimed by any rapp (wave-2 worklist item)
+inventory/deployables-2026-09-28.json: error: deployables.privacyidea: live deployable is not claimed by any rapp (wave-2 worklist item)
+inventory/deployables-2026-09-28.json: error: deployables.policy-nexus: live deployable is not claimed by any rapp (wave-2 worklist item)
+inventory/deployables-2026-09-28.json: error: deployables.qonto-egress-proxy: live deployable is not claimed by any rapp (wave-2 worklist item)
+inventory/deployables-2026-09-28.json: error: deployables.rein-aharness: live deployable is not claimed by any rapp (wave-2 worklist item)
+inventory/deployables-2026-09-28.json: error: deployables.reuse-surface: live deployable is not claimed by any rapp (wave-2 worklist item)
+inventory/deployables-2026-09-28.json: error: deployables.reuse-surface-landing: live deployable is not claimed by any rapp (wave-2 worklist item)
+inventory/deployables-2026-09-28.json: error: deployables.authelia: live deployable is not claimed by any rapp (wave-2 worklist item)
+inventory/deployables-2026-09-28.json: error: deployables.identity-provisioner: live deployable is not claimed by any rapp (wave-2 worklist item)
+inventory/deployables-2026-09-28.json: error: deployables.keycape: live deployable is not claimed by any rapp (wave-2 worklist item)
+inventory/deployables-2026-09-28.json: error: deployables.lldap: live deployable is not claimed by any rapp (wave-2 worklist item)
+inventory/deployables-2026-09-28.json: error: deployables.state-hub: live deployable is not claimed by any rapp (wave-2 worklist item)
+inventory/deployables-2026-09-28.json: error: deployables.state-hub-mcp: live deployable is not claimed by any rapp (wave-2 worklist item)
+inventory/deployables-2026-09-28.json: error: deployables.target-revenue: live deployable is not claimed by any rapp (wave-2 worklist item)
+inventory/deployables-2026-09-28.json: error: deployables.target-revenue-pg: live deployable is not claimed by any rapp (wave-2 worklist item)
+inventory/deployables-2026-09-28.json: error: deployables.vergabe-teilnahme: live deployable is not claimed by any rapp (wave-2 worklist item)
+rapp-core-hub/declarations/rapp.yaml: warning: composition.member_repos.deployables.core-hub-migrate: declared deployable is not in the live inventory
+rapp-core-hub/declarations/rapp.yaml: warning: composition.member_repos.deployables.hub-core-candidate: declared deployable is not in the live inventory
+rapp-core-hub/declarations/rapp.yaml: warning: composition.member_repos.deployables.hub-core-candidate-migrate: declared deployable is not in the live inventory
+rapp-core-hub/declarations/rapp.yaml: warning: composition.member_repos.deployables.repository-classification-publisher: declared deployable is not in the live inventory
+rapp-policy-nexus/declarations/rapp.yaml: warning: composition.member_repos.deployables.policy-nexus-static: declared deployable is not in the live inventory
+rapp-secrets-engine/declarations/rapp.yaml: warning: composition.member_repos.deployables.secrets-engine-cli: declared deployable is not in the live inventory
+rapp-telemetry/declarations/rapp.yaml: warning: composition.member_repos.deployables.telemetry-admission-create: declared deployable is not in the live inventory
+rapp-telemetry/declarations/rapp.yaml: warning: composition.member_repos.deployables.telemetry-admission-patch: declared deployable is not in the live inventory
+rapp-telemetry/declarations/rapp.yaml: warning: composition.member_repos.deployables.telemetry-ack: declared deployable is not in the live inventory
+16 declaration(s), 52 error(s), 10 warning(s)
--- a/inventory/deployables-2026-09-28.json
+++ b/inventory/deployables-2026-09-28.json
@ -0,0 +1,347 @@
+{
+  "source": "railiance-platform",
+  "captured_at": "2026-09-28T10:24:56Z",
+  "reef": "reef-railiance",
+  "deployables": [
+    {
+      "name": "actcore-api",
+      "namespace": "activity-core",
+      "kind": "Deployment"
+    },
+    {
+      "name": "actcore-app-db",
+      "namespace": "activity-core",
+      "kind": "StatefulSet"
+    },
+    {
+      "name": "actcore-event-router",
+      "namespace": "activity-core",
+      "kind": "Deployment"
+    },
+    {
+      "name": "actcore-nats",
+      "namespace": "activity-core",
+      "kind": "StatefulSet"
+    },
+    {
+      "name": "actcore-statehub-edge-relay",
+      "namespace": "activity-core",
+      "kind": "Deployment"
+    },
+    {
+      "name": "actcore-temporal",
+      "namespace": "activity-core",
+      "kind": "Deployment"
+    },
+    {
+      "name": "actcore-temporal-db",
+      "namespace": "activity-core",
+      "kind": "StatefulSet"
+    },
+    {
+      "name": "actcore-temporal-ui",
+      "namespace": "activity-core",
+      "kind": "Deployment"
+    },
+    {
+      "name": "actcore-worker",
+      "namespace": "activity-core",
+      "kind": "Deployment"
+    },
+    {
+      "name": "llm-connect",
+      "namespace": "activity-core",
+      "kind": "Deployment"
+    },
+    {
+      "name": "approval-engine",
+      "namespace": "approval-engine",
+      "kind": "StatefulSet"
+    },
+    {
+      "name": "argocd-application-controller",
+      "namespace": "argocd",
+      "kind": "StatefulSet"
+    },
+    {
+      "name": "argocd-applicationset-controller",
+      "namespace": "argocd",
+      "kind": "Deployment"
+    },
+    {
+      "name": "argocd-redis",
+      "namespace": "argocd",
+      "kind": "Deployment"
+    },
+    {
+      "name": "argocd-repo-server",
+      "namespace": "argocd",
+      "kind": "Deployment"
+    },
+    {
+      "name": "audit-core",
+      "namespace": "audit-core",
+      "kind": "Deployment"
+    },
+    {
+      "name": "bao-notice",
+      "namespace": "bao-notice",
+      "kind": "Deployment"
+    },
+    {
+      "name": "canned-prompts",
+      "namespace": "canned-prompts",
+      "kind": "Deployment"
+    },
+    {
+      "name": "core-hub-api",
+      "namespace": "core-hub",
+      "kind": "Deployment"
+    },
+    {
+      "name": "core-hub-api-candidate",
+      "namespace": "core-hub",
+      "kind": "Deployment"
+    },
+    {
+      "name": "core-hub-api-repository-publisher",
+      "namespace": "core-hub",
+      "kind": "Deployment"
+    },
+    {
+      "name": "ihp-railiance-probe",
+      "namespace": "coulomb",
+      "kind": "Deployment"
+    },
+    {
+      "name": "coulomb-social",
+      "namespace": "coulomb-social",
+      "kind": "Deployment"
+    },
+    {
+      "name": "apps-pg",
+      "namespace": "databases",
+      "kind": "Cluster"
+    },
+    {
+      "name": "forgejo-db",
+      "namespace": "databases",
+      "kind": "Cluster"
+    },
+    {
+      "name": "net-kingdom-pg",
+      "namespace": "databases",
+      "kind": "Cluster"
+    },
+    {
+      "name": "platform-pg",
+      "namespace": "databases",
+      "kind": "Cluster"
+    },
+    {
+      "name": "platform-pg-2",
+      "namespace": "databases",
+      "kind": "Cluster"
+    },
+    {
+      "name": "state-hub-db",
+      "namespace": "databases",
+      "kind": "Cluster"
+    },
+    {
+      "name": "email-connect",
+      "namespace": "email-connect",
+      "kind": "Deployment"
+    },
+    {
+      "name": "flex-auth-informed-decision-sitting",
+      "namespace": "flex-auth",
+      "kind": "Deployment"
+    },
+    {
+      "name": "flex-auth-informed-decision-t03",
+      "namespace": "flex-auth",
+      "kind": "Deployment"
+    },
+    {
+      "name": "flex-auth-ops-warden",
+      "namespace": "flex-auth",
+      "kind": "Deployment"
+    },
+    {
+      "name": "flex-auth-secrets-engine",
+      "namespace": "flex-auth",
+      "kind": "Deployment"
+    },
+    {
+      "name": "flex-auth-tenant-engine",
+      "namespace": "flex-auth",
+      "kind": "Deployment"
+    },
+    {
+      "name": "flex-auth-user-engine",
+      "namespace": "flex-auth",
+      "kind": "Deployment"
+    },
+    {
+      "name": "forgejo-gitea",
+      "namespace": "forgejo",
+      "kind": "Deployment"
+    },
+    {
+      "name": "forgejo-runner",
+      "namespace": "forgejo",
+      "kind": "Deployment"
+    },
+    {
+      "name": "informed-decision",
+      "namespace": "informed-decision",
+      "kind": "Deployment"
+    },
+    {
+      "name": "inter-hub",
+      "namespace": "inter-hub",
+      "kind": "Deployment"
+    },
+    {
+      "name": "issue-core",
+      "namespace": "issue-core",
+      "kind": "Deployment"
+    },
+    {
+      "name": "privacyidea",
+      "namespace": "mfa",
+      "kind": "Deployment"
+    },
+    {
+      "name": "openbao",
+      "namespace": "openbao",
+      "kind": "StatefulSet"
+    },
+    {
+      "name": "openbao-ui-gateway",
+      "namespace": "openbao",
+      "kind": "Deployment"
+    },
+    {
+      "name": "policy-nexus",
+      "namespace": "policy-nexus",
+      "kind": "Deployment"
+    },
+    {
+      "name": "rapp-qonto",
+      "namespace": "rapp-qonto",
+      "kind": "KnativeService"
+    },
+    {
+      "name": "qonto-egress-proxy",
+      "namespace": "rapp-qonto-egress",
+      "kind": "Deployment"
+    },
+    {
+      "name": "rein-aharness",
+      "namespace": "rein-aharness",
+      "kind": "Deployment"
+    },
+    {
+      "name": "reuse-surface",
+      "namespace": "reuse",
+      "kind": "Deployment"
+    },
+    {
+      "name": "reuse-surface-landing",
+      "namespace": "reuse",
+      "kind": "Deployment"
+    },
+    {
+      "name": "sbom-nexus",
+      "namespace": "sbom-nexus",
+      "kind": "Deployment"
+    },
+    {
+      "name": "authelia",
+      "namespace": "sso",
+      "kind": "Deployment"
+    },
+    {
+      "name": "identity-provisioner",
+      "namespace": "sso",
+      "kind": "Deployment"
+    },
+    {
+      "name": "keycape",
+      "namespace": "sso",
+      "kind": "Deployment"
+    },
+    {
+      "name": "lldap",
+      "namespace": "sso",
+      "kind": "Deployment"
+    },
+    {
+      "name": "state-hub",
+      "namespace": "state-hub",
+      "kind": "Deployment"
+    },
+    {
+      "name": "state-hub-mcp",
+      "namespace": "state-hub",
+      "kind": "Deployment"
+    },
+    {
+      "name": "target-revenue",
+      "namespace": "target-revenue",
+      "kind": "Deployment"
+    },
+    {
+      "name": "target-revenue-pg",
+      "namespace": "target-revenue",
+      "kind": "Cluster"
+    },
+    {
+      "name": "alertmanager-telemetry-alertmanager",
+      "namespace": "telemetry",
+      "kind": "StatefulSet"
+    },
+    {
+      "name": "prometheus-telemetry-prometheus",
+      "namespace": "telemetry",
+      "kind": "StatefulSet"
+    },
+    {
+      "name": "telemetry-grafana",
+      "namespace": "telemetry",
+      "kind": "Deployment"
+    },
+    {
+      "name": "telemetry-kube-state-metrics",
+      "namespace": "telemetry",
+      "kind": "Deployment"
+    },
+    {
+      "name": "telemetry-operator",
+      "namespace": "telemetry",
+      "kind": "Deployment"
+    },
+    {
+      "name": "tenant-engine",
+      "namespace": "tenant-engine",
+      "kind": "Deployment"
+    },
+    {
+      "name": "user-engine",
+      "namespace": "user-engine",
+      "kind": "Deployment"
+    },
+    {
+      "name": "user-engine-pg",
+      "namespace": "user-engine",
+      "kind": "Cluster"
+    },
+    {
+      "name": "vergabe-teilnahme",
+      "namespace": "vergabe-demo-company",
+      "kind": "Deployment"
+    }
+  ]
+}
--- a/inventory/runtime-2026-09-28.json
+++ b/inventory/runtime-2026-09-28.json
--- a/inventory/snapshot-before.json
+++ b/inventory/snapshot-before.json
--- a/inventory/snapshot.json
+++ b/inventory/snapshot.json
--- a/taxonomy/README.md
+++ b/taxonomy/README.md
@ -0,0 +1,94 @@
+# Stewardship proposal — 2026-09-28
+
+This is a review draft, not a transfer authorization. The matrix contains all
+141 anonymously visible server repositories plus 12 additional paths observed
+in local remotes. It is not a complete private-server census.
+
+- [assignments.csv](assignments.csv): sortable review table.
+- [assignments.json](assignments.json): stable IDs where available, purpose,
+  source evidence, target proposal, visibility and unresolved access decisions.
+
+## Assignment rule
+
+Choose the group accountable for maintaining the repository's own capability:
+who accepts changes, maintains its contracts and responds when it fails. A
+consumer, hosting platform, legal owner, State Hub domain, programming language,
+repository prefix or lifecycle stage alone does not establish stewardship.
+
+| Candidate org | Responsibility | Proposed repos |
+| --- | --- | ---: |
+| railiance | Infrastructure, delivery, platform operations and managed workload packaging | 32 |
+| netkingdom | Security, identity, authority, policy and security evidence | 20 |
+| helixforge | Software factory, development tooling, capability/knowledge/interface frameworks | 59 |
+| binky | Company-specific coordination and finance integration | 3 |
+| coulomb | Explicit Coulomb product/engagement and estate/personal continuity | 4 |
+| Unresolved | Insufficient evidence to choose a steward | 35 |
+
+The 118 assignments are recommendations derived from current descriptions and
+scope documents, not evidence that their proposed maintainers have accepted
+responsibility. JSON `open_items` flags cross-cutting cases requiring particular
+attention. Every row still needs named maintainers and access reconciliation.
+The 12 non-publicly-listed paths have no verified numeric forge ID or visibility;
+State Hub UUIDs are included where known, but do not substitute for forge IDs.
+
+Examples that preserve the independent dimensions:
+
+- `canned-prompts` → helixforge; `rapp-canned-prompts` → railiance. The latter's
+  SCOPE explicitly owns packaging/operations rather than the product.
+- `user-engine` → netkingdom; `rapp-user-engine` → railiance. Their code and
+  operational contracts have distinct responsibilities.
+- `qonto-assistant` → binky; `rapp-qonto` → railiance. The financial policy and
+  runtime binding remain separate.
+- `coulomb-social` stays coulomb despite consuming all three platform stacks.
+- `rapp-secrets-engine` provisionally remains with netkingdom: it is a CLI
+  declaration, so the `rapp-` prefix alone does not establish Railiance ownership.
+
+## Experimental and standalone products
+
+Recommend **no lifecycle-only `experimental` org**. Experiments live with their
+steward and carry maturity/visibility metadata. A real shared incubator could
+justify an org only after naming its accountable steward, access model and exit
+policy. No such organization is established by this preparation.
+
+Do not force standalone products into helixforge because they use its tooling,
+or into binky because of legal ownership. These review groups remain unassigned:
+
+| Review group | Repositories | Decision needed |
+| --- | --- | --- |
+| Document/evidence products | binect-chrome, binect-js, citation-engine, citation-evidence, citation-work, direkt-vermittlung-de, evidence-anchor, evidence-binder, evidence-source, vergabe-teilnahme | Product steward; keep each product/component family coherent where responsibility is shared |
+| Shared data/communication facilities | artifact-store, doc-store-pg, email-connect, plenty-gobble | Reusable framework steward versus infrastructure-service steward |
+| Commercial and company tooling | adaptive-pricing, fin-hub, human-resources, target-revenue | Generic product responsibility versus Binky-specific operational ownership |
+| Cross-estate canon/governance | commerce-canon, info-tech-canon, interface-canon, prj-canon-federation, disaster-control, guide-board, ops-hub | Cross-estate continuity versus HelixForge/NetKingdom responsibility |
+| Research, prototypes and independent products | clay-borg, freedom-intelligence, ground-game, inter-hub-haskell, polycode-sim, python-snake, soul-frame, timeline-svg, whynot-control, whynot-design | Accountable research/product steward; `whynot` is an existing responsibility candidate outside the seed taxonomy |
+
+Their current paths stay unchanged pending a decision; that is not permanent
+approval to retain them in coulomb. Do not infer public/private treatment from
+whether a project is experimental. Binky's evolving company branding also needs
+review before making its proposed org name durable.
+
+## Permissions and visibility proposal
+
+1. Preserve current visibility, direct collaborators, protected-branch behavior,
+   deploy keys, machine access and necessary package access during each transfer.
+   Current public visibility is observed, not a recommendation to publicize
+   anything currently private.
+2. Propose separate named org administrators and repository maintainer teams.
+   Maintainer membership grants write only for accepted repositories; ordinary
+   org membership must not silently grant fleet-wide write.
+3. Model cross-org CI, GitOps and registry readers explicitly. Owning a repository
+   does not imply ownership of its package namespace or a credential grant.
+4. Populate actual people/service identities, existing grants, proposed team
+   membership and before/after effective access from an authorized forge export.
+   The anonymous API cannot supply this; no grants are invented in the matrix.
+5. Accept G2 only after every row has an agreed target and accountable steward,
+   resolved access/visibility review, and verified immutable server identity.
+
+## Durable home
+
+Propose `the-custodian` as the permanent convention owner because this rule spans
+all stewardship groups. `railiance-master` keeps authority over family schemas
+and can link to the convention. This is an owner-acceptance proposal, not a
+cross-repo edit or a new assignment of authority.
+
+The convention should include a new-repo checklist: accountable steward, org,
+visibility, team grants, package publication owner and cross-org consumers.
--- a/taxonomy/assignments.csv
+++ b/taxonomy/assignments.csv
@ -0,0 +1,154 @@
+repository,forge_id,state_hub_id,proposed_org,status,visibility,rationale,evidence
+activity-core,15,4296e38c-4eb4-4710-8e35-fb37009add0b,helixforge,draft,public,"Software factory, development tooling, knowledge/interface framework or capability lifecycle responsibility.","{""head"": ""ce9a8f8edf4ec162bae3aa087803bd57a1b33a66"", ""path"": ""SCOPE.md"", ""repo"": ""activity-core"", ""sha256"": ""820aafbff2f7d1c314c0c270d745468172a0500d106ab276216e0eeb702ca7bd""}"
+adaptive-pricing,24,d7c12587-e70c-4d06-8843-e582c0d683c3,UNRESOLVED,unresolved,public,No sufficiently clear steward among the proposed organizations. Retain current path pending an explicit stewardship choice; experimental maturity is not ownership.,"{""head"": ""80de1fad4fb9f561b572a08d3b6a20c7ee4d7616"", ""path"": ""SCOPE.md"", ""repo"": ""adaptive-pricing"", ""sha256"": ""274bb582587049a2a242a0fbf03ebe2d3328b6992f216e12e4a3533fdd6c960f""}"
+agentic-resources,25,dc9e7e92-2c8c-4cec-9021-9182c46ab097,helixforge,draft,public,"Software factory, development tooling, knowledge/interface framework or capability lifecycle responsibility.","{""head"": ""65b3a5cb6bf3eb214b492b95a38f2eb729f89709"", ""path"": ""SCOPE.md"", ""repo"": ""agentic-resources"", ""sha256"": ""ba38e80cf2a374063eb6b6b60211a02e32bca5d3b260aea5f8a70978f67a5627""}"
+approval-engine,138,ec60633d-b055-43b7-a83e-7e0e9734ede1,netkingdom,draft,public,"Security, identity, authority, policy or security-evidence responsibility; runtime placement does not determine this assignment.","{""head"": ""b81b651ff4da9679b9ccd3911dc90e177f9525ac"", ""path"": ""SCOPE.md"", ""repo"": ""approval-engine"", ""sha256"": ""a5159d06efba8de9c2da76c49cc8606bff74b5b757c184b6fb1f9d973cc91fef""}"
+arc-nexus,130,,helixforge,draft,public,"Software factory, development tooling, knowledge/interface framework or capability lifecycle responsibility.","{""head"": ""ff21e8a001fc71fe8ee1d0cb5e31e62b165b79ba"", ""path"": ""README.md"", ""repo"": ""arc-nexus"", ""sha256"": ""0adb52b4af8002c145b2f8769a7f9f3658f89b348cf731487b4d0cd32d3d3a7a""}"
+artifact-store,22,e1575e7c-e1b0-4b46-98be-78bd49e06318,UNRESOLVED,unresolved,public,No sufficiently clear steward among the proposed organizations. Retain current path pending an explicit stewardship choice; experimental maturity is not ownership.,"{""head"": ""94541a29e2758ea5da86a41f4d2016c6ef98d026"", ""path"": ""SCOPE.md"", ""repo"": ""artifact-store"", ""sha256"": ""d6ac3f14448977a4315767d45a53eeb6d01b8307d2a2c8e6de4cfae5b10d1d56""}"
+audit-core,26,ffb264e4-5c5b-4c18-9c6f-df6dd5f1bb05,netkingdom,draft,public,"Security, identity, authority, policy or security-evidence responsibility; runtime placement does not determine this assignment.","{""head"": ""3e42ca8ffb2ead14fd52f9a6f9f42800f1dc2771"", ""path"": ""SCOPE.md"", ""repo"": ""audit-core"", ""sha256"": ""5d08b0de4576db63f7e7b24f52a890d8196c543d0461edf54b5cfa69e237b206""}"
+binect-chrome,27,a9916da2-b4dd-4e12-8a30-47e47f6ed298,UNRESOLVED,unresolved,public,No sufficiently clear steward among the proposed organizations. Retain current path pending an explicit stewardship choice; experimental maturity is not ownership.,"{""head"": ""bf7395342997bf3b35432bbc38e18190a3e6ddc6"", ""path"": ""SCOPE.md"", ""repo"": ""binect-chrome"", ""sha256"": ""27d960f981badc6c3eb13831827add700fa7573d85dae070f54bbadfec822b9b""}"
+binect-js,28,423794e3-a8a4-49f3-9f07-f743e10d5f67,UNRESOLVED,unresolved,public,No sufficiently clear steward among the proposed organizations. Retain current path pending an explicit stewardship choice; experimental maturity is not ownership.,"{""head"": ""d128f03a700bd9a5f6e6a6e3b3f68fa07d597243"", ""path"": ""SCOPE.md"", ""repo"": ""binect-js"", ""sha256"": ""f9832b57cc67122d9f83805c829fd5186c44c6a303dfe7c17b508940dbde4a24""}"
+binky-control,88,2ad0ed58-4324-47e2-b695-d7128bc623bf,binky,draft,public,Company-specific coordination or finance integration responsibility; this is not assignment by legal copyright ownership.,"{""head"": ""e6f8370eba2afefb2e4f6fce1276a72fe0d50d4d"", ""path"": ""SCOPE.md"", ""repo"": ""binky-control"", ""sha256"": ""ead6634c78eab8eca16f921daa7ae28709c8416c1a80fca91f05886f39c7d4bd""}"
+can-you-assist,29,32549b0d-b065-4294-b577-fad643fa38de,helixforge,draft,public,"Software factory, development tooling, knowledge/interface framework or capability lifecycle responsibility.","{""head"": ""0ada8d66ce67574ce5b9fd6880975a3a2def302e"", ""path"": ""SCOPE.md"", ""repo"": ""can-you-assist"", ""sha256"": ""6e1a92edd52be1b740fbde263faedf1005ed4523a9b99928a488e98398e1beaa""}"
+canned-prompts,147,3377ddca-bae7-477f-bb1a-556d326727cf,helixforge,draft,public,"Software factory, development tooling, knowledge/interface framework or capability lifecycle responsibility.","{""head"": ""d1631e4eb4ec3ed77e76c93575ad34dee9d65a09"", ""path"": ""SCOPE.md"", ""repo"": ""canned-prompts"", ""sha256"": ""9f56c9c49d7f33866fb49a41e77a0dd1729fc07051f6724c44b1489e5f21ae72""}"
+citation-engine,30,b96c952c-9993-4941-b75a-fe76eb7b2a57,UNRESOLVED,unresolved,public,No sufficiently clear steward among the proposed organizations. Retain current path pending an explicit stewardship choice; experimental maturity is not ownership.,"{""head"": ""a2de792fb6e905ef6a9454798de0c143f72a2947"", ""path"": ""SCOPE.md"", ""repo"": ""citation-engine"", ""sha256"": ""c4300fbccafcecefee893c5696c84cc8f6b93fcb9e105e8ec55019ff54fab499""}"
+citation-evidence,31,a677c189-b4e2-4f2a-9e48-faa482c277e6,UNRESOLVED,unresolved,public,No sufficiently clear steward among the proposed organizations. Retain current path pending an explicit stewardship choice; experimental maturity is not ownership.,"{""head"": ""c58d096cbd6fbaeb2b43362b50bdbf8258de4309"", ""path"": ""SCOPE.md"", ""repo"": ""citation-evidence"", ""sha256"": ""70758f7027b670389ccd2d806807a770dc55561085becfcbf9d1122813165b86""}"
+citation-work,32,8142c713-7a09-4703-9771-0b9d4238fe33,UNRESOLVED,unresolved,public,No sufficiently clear steward among the proposed organizations. Retain current path pending an explicit stewardship choice; experimental maturity is not ownership.,"{""head"": ""c38759046570d2ac7809aa1ab020760583293653"", ""path"": ""SCOPE.md"", ""repo"": ""citation-work"", ""sha256"": ""8c09bd71347545b96ea4e1ac55c399d5fc734cf147cbdb3ccf7b992b3dfeb550""}"
+clay-borg,104,f5d1db1e-e6f7-4299-a496-12dbc5e73b18,UNRESOLVED,unresolved,public,No sufficiently clear steward among the proposed organizations. Retain current path pending an explicit stewardship choice; experimental maturity is not ownership.,"{""head"": ""90207cc0413590809a5d19326169695508afb9e3"", ""path"": ""INTENT.md"", ""repo"": ""clay-borg"", ""sha256"": ""f41047572ef14d498231cb5193ff26b12d6d98f71f8ad278a6b310de3340fed2""}"
+commerce-canon,46,8c82baea-bb40-435d-ac42-ec7a7c20dbb8,UNRESOLVED,unresolved,public,No sufficiently clear steward among the proposed organizations. Retain current path pending an explicit stewardship choice; experimental maturity is not ownership.,"{""head"": ""2e230e7d3e163d925f040d49143426a7e622aca6"", ""path"": ""SCOPE.md"", ""repo"": ""commerce-canon"", ""sha256"": ""945add324cdb8958eabdabefcb876263fa5058a708039695df54e5c65b0b4c51""}"
+config-atlas,33,10f1c902-576d-4782-b1b2-643a6083ee36,helixforge,draft,public,"Software factory, development tooling, knowledge/interface framework or capability lifecycle responsibility.","{""head"": ""8c312714a98c694e6734ab40a8eab56e79800b80"", ""path"": ""SCOPE.md"", ""repo"": ""config-atlas"", ""sha256"": ""3957dfd3e622f90ce2ee21c7df4fefe9356a1872d64a3bce5805052b3fe6f438""}"
+coordination-engine,34,90fc8c09-30e7-439d-a873-779bd2cd5ac5,helixforge,draft,public,"Software factory, development tooling, knowledge/interface framework or capability lifecycle responsibility.","{""head"": ""2c3cedaa373652937e3eefdd866fca0d589fd74e"", ""path"": ""SCOPE.md"", ""repo"": ""coordination-engine"", ""sha256"": ""e207efd8bf40ede4ad6c2705121cefc809467dab72746054850c62f2e2e3a12e""}"
+core-hub,14,f4038d32-948d-49e2-9b84-4fd48109100f,helixforge,draft,public,"Software factory, development tooling, knowledge/interface framework or capability lifecycle responsibility.","{""head"": ""a59c9677794ea94526ff462a5ef634e3cf0f5e74"", ""path"": ""SCOPE.md"", ""repo"": ""core-hub"", ""sha256"": ""2cb2486fc8f8bdb702b32dd64951999b3fd3e68a92306aea5023270464613d5d""}"
+coulomb-loop,35,9d7b100b-1538-483e-a873-cf70980c59e3,coulomb,draft,public,Explicit Coulomb engagement/product or estate/personal continuity responsibility; not a default for all shared dependencies.,"{""head"": ""d07455fbacd3e125e1ba6d991041c811b5c353d2"", ""path"": ""SCOPE.md"", ""repo"": ""coulomb-loop"", ""sha256"": ""38197986c12453c3cc8e2b66f5ccc38184ade127386ff8e71b64b6e22440f8c3""}"
+coulomb-social,106,fc3296df-e3e0-49a4-b022-4701f3c71f9b,coulomb,draft,public,Explicit Coulomb engagement/product or estate/personal continuity responsibility; not a default for all shared dependencies.,"{""head"": ""aee6dfdc7651bf19f3459fa1685af997a70f1dd1"", ""path"": ""SCOPE.md"", ""repo"": ""coulomb-social"", ""sha256"": ""a8ef224b64b551f649e50f7b8b2f491a9d5a31aefc981134271cf4d193d03f65""}"
+direkt-vermittlung-de,81,d166babe-c3f0-4e46-8091-a2c44ab557fb,UNRESOLVED,unresolved,public,No sufficiently clear steward among the proposed organizations. Retain current path pending an explicit stewardship choice; experimental maturity is not ownership.,"{""head"": ""bba68d1948cbe6525c55b53f9311f092afa21e5d"", ""path"": ""SCOPE.md"", ""repo"": ""direkt-vermittlung-de"", ""sha256"": ""49b4f81c87210c1f81f5137ee8575c642eff4cca2ceb181b275e78931a4483f3""}"
+disaster-control,17,439a69fc-084a-4074-88fe-c99de627deeb,UNRESOLVED,unresolved,public,No sufficiently clear steward among the proposed organizations. Retain current path pending an explicit stewardship choice; experimental maturity is not ownership.,"{""head"": ""9f437a5a069279941ea8b982870725b36d0ca7ac"", ""path"": ""SCOPE.md"", ""repo"": ""disaster-control"", ""sha256"": ""6ada8f0085abda948faebcad056e3e587721c938ca829804dc5bb1023ced527e""}"
+doc-store-pg,116,,UNRESOLVED,unresolved,public,No sufficiently clear steward among the proposed organizations. Retain current path pending an explicit stewardship choice; experimental maturity is not ownership.,"{""head"": ""e1ddb12198b05531156ee831b2d214fd90a72ff0"", ""path"": ""INTENT.md"", ""repo"": ""doc-store-pg"", ""sha256"": ""8dee3e5484e459765d0df87bcb981caff9c094865802dc2ad119b481b0265abf""}"
+domain-tree,36,146bcec9-59e8-481e-9996-f0b30ab28abb,helixforge,draft,public,"Software factory, development tooling, knowledge/interface framework or capability lifecycle responsibility.","{""head"": ""2f2dd5ed57c1d22322b7be5ae0de134ced9bbc60"", ""path"": ""SCOPE.md"", ""repo"": ""domain-tree"", ""sha256"": ""137a989c5319d855a85cc49ff54c76e0d24d804051b12dfb03b7a7ff81e43f80""}"
+email-connect,37,3ce9ef37-9672-4096-9d28-5ef77e450c07,UNRESOLVED,unresolved,public,No sufficiently clear steward among the proposed organizations. Retain current path pending an explicit stewardship choice; experimental maturity is not ownership.,"{""head"": ""bedb99193e05941133f3519bc928b284e9e540cd"", ""path"": ""SCOPE.md"", ""repo"": ""email-connect"", ""sha256"": ""2a09339750f8edee3b775d026878b9b94bda825f796a7d492d6f63cf9fc66b51""}"
+evidence-anchor,38,a4cac053-048b-453b-93aa-942260bd4e09,UNRESOLVED,unresolved,public,No sufficiently clear steward among the proposed organizations. Retain current path pending an explicit stewardship choice; experimental maturity is not ownership.,"{""head"": ""adbcae29e813e676afe0ad8149c440284e1729e7"", ""path"": ""SCOPE.md"", ""repo"": ""evidence-anchor"", ""sha256"": ""eeb29b8d69182282dc867779baf1c62c6bdd03e6ac617be56b2652bd57373045""}"
+evidence-binder,39,f14be058-a339-4357-a3ff-c8326f7748a7,UNRESOLVED,unresolved,public,No sufficiently clear steward among the proposed organizations. Retain current path pending an explicit stewardship choice; experimental maturity is not ownership.,"{""head"": ""4f115e38b84960038df92b5755cc33387fdec574"", ""path"": ""SCOPE.md"", ""repo"": ""evidence-binder"", ""sha256"": ""55b90d2b6dd16486042418a6446383e52bc1ae2e9e2fb11ba3b56aad8e44fe88""}"
+evidence-source,40,03e6fe9f-ca84-4be5-ad5d-03c037bf6107,UNRESOLVED,unresolved,public,No sufficiently clear steward among the proposed organizations. Retain current path pending an explicit stewardship choice; experimental maturity is not ownership.,"{""head"": ""24aad6ec6a6b0b5ac28efd2638f0c66d52f459f3"", ""path"": ""SCOPE.md"", ""repo"": ""evidence-source"", ""sha256"": ""d419a6312762a820766df3f17e096a888c1618422e5900d68d7a692e59325322""}"
+executor-sandbox,90,,helixforge,draft,public,"Software factory, development tooling, knowledge/interface framework or capability lifecycle responsibility.","{""head"": ""6df1596c6097556a39ce16e4614de551cb3d44e4"", ""path"": ""README.md"", ""repo"": ""executor-sandbox"", ""sha256"": ""c46febb3c0229f893193a14e170f0e8d5b0d305ea2bfbc6e5568484342ad3f42""}"
+facetted-interfaces,153,92b98d54-fb03-44b6-998a-f4afff77038f,helixforge,draft,public,"Software factory, development tooling, knowledge/interface framework or capability lifecycle responsibility.","{""head"": ""a1f8d4d58d441d9eb4f870c575012a6c6305a8ca"", ""path"": ""SCOPE.md"", ""repo"": ""facetted-interfaces"", ""sha256"": ""ac1bdb7bb0e3456fabdff0f3e7543e0568a1a447160e9a60dfdb8c3652e349db""}"
+feature-control,41,4fb4a5f3-08f9-49ba-958b-414adc565168,helixforge,draft,public,"Software factory, development tooling, knowledge/interface framework or capability lifecycle responsibility.","{""head"": ""a555aaaf35c4fbb7a67703ae05c8795bcbc449d9"", ""path"": ""SCOPE.md"", ""repo"": ""feature-control"", ""sha256"": ""d60606710cf0bd005bb3b256f8f42be28282d14d4039f206f12b30fb99f94354""}"
+fin-hub,79,fbf4e172-966a-4ec8-b135-2bff8951c550,UNRESOLVED,unresolved,public,No sufficiently clear steward among the proposed organizations. Retain current path pending an explicit stewardship choice; experimental maturity is not ownership.,"{""head"": ""48951df3773881ac6be03b3303324a693abf4946"", ""path"": ""SCOPE.md"", ""repo"": ""fin-hub"", ""sha256"": ""2ef38e5d1a36dedfa7785f128a35b0058ae7e123bba834efa41dcc809d18a631""}"
+flex-auth,42,fda8ad85-a7d7-4055-8f21-902a533e59df,netkingdom,draft,public,"Security, identity, authority, policy or security-evidence responsibility; runtime placement does not determine this assignment.","{""head"": ""2dfee5782ec9010758af9ba5a6f72d9fa0fe6234"", ""path"": ""SCOPE.md"", ""repo"": ""flex-auth"", ""sha256"": ""7efc96ec3ab3ee4a48f47119f6db0fa2059e8eb7f80cea6c994d1a76d9fd0f12""}"
+fluid-core,143,0f681685-7bc0-41b9-97fb-50073ebf6cf4,helixforge,draft,public,"Software factory, development tooling, knowledge/interface framework or capability lifecycle responsibility.","{""head"": ""3c4eb1125d7e88a5e6eaa03e2dd5d452509cecf6"", ""path"": ""SCOPE.md"", ""repo"": ""fluid-core"", ""sha256"": ""0f30ccf19ba266961f96fa4a686ef88ddbbfb7aff268d85cf50253d96ad20ae5""}"
+fluid-substack,142,,helixforge,draft,public,"Software factory, development tooling, knowledge/interface framework or capability lifecycle responsibility.","{""head"": ""bf9d65d716c6dffe4296b1aad0e0f5f523c7f40b"", ""path"": ""README.md"", ""repo"": ""fluid-substack"", ""sha256"": ""faa7ec468a2fbea89051b9962343e7cb307d545a6ff1daaf0b153361e201ec9e""}"
+fluid-telegram,140,76830af5-cfeb-48bd-8f2a-c33f42d9c5db,helixforge,draft,public,"Software factory, development tooling, knowledge/interface framework or capability lifecycle responsibility.","{""head"": ""bfebca3aee6926c1fcaf943bcb62d35cd38435ab"", ""path"": ""SCOPE.md"", ""repo"": ""fluid-telegram"", ""sha256"": ""07832baa1f10d05af82c943a3ae5eb7ea6072e1159ca7dfeb3ca911ce5e1540c""}"
+fluid-x,141,,helixforge,draft,public,"Software factory, development tooling, knowledge/interface framework or capability lifecycle responsibility.","{""head"": ""3e1cf6b5ad3eb272dfaf01f9717adf5bc62694d4"", ""path"": ""README.md"", ""repo"": ""fluid-x"", ""sha256"": ""83899c4dd14202aaff789e8ba75dd8d9ef2c62eadb9267871f53648dad9e1ab0""}"
+forgejo-actions-probe,1,,railiance,draft,public,Runtime/framework delivery and operations responsibility; managed application packaging is distinct from product ownership.,"{""field"": ""description"", ""forge_repository_id"": 1, ""value"": ""Probe repository for validating Forgejo Actions runners, workflows, and migration readiness.""}"
+freedom-intelligence,94,d3581e63-4002-4c83-8c03-93547823c8c7,UNRESOLVED,unresolved,public,No sufficiently clear steward among the proposed organizations. Retain current path pending an explicit stewardship choice; experimental maturity is not ownership.,"{""head"": ""e8e79db6321c05f2c68153acb5166e2832edd0ba"", ""path"": ""SCOPE.md"", ""repo"": ""freedom-intelligence"", ""sha256"": ""8dc8ab1b4a90f922b03345a09ae452790c2d4cc186b13c62bbc497f392a2ed6a""}"
+frontend-patterns,158,34db923e-97aa-4c4f-b3d2-2eb83ff200b5,helixforge,draft,public,"Software factory, development tooling, knowledge/interface framework or capability lifecycle responsibility.","{""head"": ""80dc3e5d8581124281ee8b8f3915dfe6c7abba1e"", ""path"": ""SCOPE.md"", ""repo"": ""frontend-patterns"", ""sha256"": ""952e073b931a2efe726c6beed90740257a6c38ad207499fa35671d8cee2c65cd""}"
+gate-house,137,ea797759-b691-4b5a-910e-3d77f19df0da,netkingdom,draft,public,"Security, identity, authority, policy or security-evidence responsibility; runtime placement does not determine this assignment.","{""head"": ""1f94774849f8871c289816f16fd247d83b69149f"", ""path"": ""SCOPE.md"", ""repo"": ""gate-house"", ""sha256"": ""bd761e4f1ff867eeb6fab06a55bbe894fb729d6e34f1e6f2f9e46c11a9e18023""}"
+glas-harness,2,5bac09ed-a1c9-42fb-bd16-75c8f9e01a1a,helixforge,draft,public,"Software factory, development tooling, knowledge/interface framework or capability lifecycle responsibility.","{""head"": ""d4fd3ee3b8e4567f1dfffcfe0bb29b0dc54da2f7"", ""path"": ""SCOPE.md"", ""repo"": ""glas-harness"", ""sha256"": ""5a2b96f8a3aa7218ad43dbd72abc89319a44c329298e973589f49c4ec354b0c6""}"
+ground-game,105,39b9170f-25d2-4728-bb68-bdd4791534ea,UNRESOLVED,unresolved,public,No sufficiently clear steward among the proposed organizations. Retain current path pending an explicit stewardship choice; experimental maturity is not ownership.,"{""head"": ""4965a4edb00d20b8340c906786a261cb807cf98e"", ""path"": ""SCOPE.md"", ""repo"": ""ground-game"", ""sha256"": ""af6717e1eda52f9e09c9625229f272666f1d3b6f52a87c12c498fc319065c5d9""}"
+guide-board,43,90918b55-6347-4e57-8086-db7b0454f73d,UNRESOLVED,unresolved,public,No sufficiently clear steward among the proposed organizations. Retain current path pending an explicit stewardship choice; experimental maturity is not ownership.,"{""head"": ""7e28f4ee557049a5d331098bc656e1aff83a70a0"", ""path"": ""SCOPE.md"", ""repo"": ""guide-board"", ""sha256"": ""c4300fbccafcecefee893c5696c84cc8f6b93fcb9e105e8ec55019ff54fab499""}"
+hall-of-helix,109,c98cc221-af43-4f77-af92-55695694ae59,helixforge,draft,public,"Software factory, development tooling, knowledge/interface framework or capability lifecycle responsibility.","{""head"": ""d76c6eee25a426695f43b6e4df7d9deb38a8680a"", ""path"": ""SCOPE.md"", ""repo"": ""hall-of-helix"", ""sha256"": ""fb4917b23fe6d2e47862983d35b8ccfd82f39396e08ba73f0ee9309b186abc83""}"
+helix-forge,44,c7a3dc03-d837-4577-a107-a190d6b00705,helixforge,draft,public,"Software factory, development tooling, knowledge/interface framework or capability lifecycle responsibility.","{""head"": ""fdf5af121ca906df6c657aac6b89c5b07b5818f2"", ""path"": ""SCOPE.md"", ""repo"": ""helix-forge"", ""sha256"": ""0858a7cdc9a08f9bc7beb859e241ae53890c1fc040c396dde06359de0781808e""}"
+hub-core,11,80a9b0c4-f654-47fe-9721-33fc0558687e,helixforge,draft,public,"Software factory, development tooling, knowledge/interface framework or capability lifecycle responsibility.","{""head"": ""1ece969f59287b3592081aa245e881b49e13ab06"", ""path"": ""SCOPE.md"", ""repo"": ""hub-core"", ""sha256"": ""00c6c85c93e47f0fc9aa02f63c8cf44710af78f13e06d0b9d249ce30518f4c62""}"
+human-resources,45,4a887c44-e301-4c1e-a4fe-1b4a842d8777,UNRESOLVED,unresolved,public,No sufficiently clear steward among the proposed organizations. Retain current path pending an explicit stewardship choice; experimental maturity is not ownership.,"{""head"": ""1363719ff1bb50b47dc7f2f459a726aeb9505461"", ""path"": ""SCOPE.md"", ""repo"": ""human-resources"", ""sha256"": ""0d7f9859341795872d7cabd6c3bbc1cf830c72335a0c8e2a8a906a8b61864a6c""}"
+ihp-railiance-probe,19,69b69830-af7f-496f-9af2-cbc23a83cd42,railiance,draft,public,Runtime/framework delivery and operations responsibility; managed application packaging is distinct from product ownership.,"{""head"": ""bafecfb4bed8d19aa625daa066beb3a0f1998772"", ""path"": ""SCOPE.md"", ""repo"": ""ihp-railiance-probe"", ""sha256"": ""c06a1e21bddad9210dac3d7da18fc3bc23553cfd513d5b22350c758a4fc682b1""}"
+info-tech-canon,47,487f321e-2e53-43d4-90a6-af421e438313,UNRESOLVED,unresolved,public,No sufficiently clear steward among the proposed organizations. Retain current path pending an explicit stewardship choice; experimental maturity is not ownership.,"{""head"": ""dea47183c06fc2bd355aef0c438ca20cbec21ae4"", ""path"": ""SCOPE.md"", ""repo"": ""info-tech-canon"", ""sha256"": ""342ee894c1d6d64da76ff521eeb3c21279c55c6e7b7f0892b34f54c2d89e91b3""}"
+informed-decision,151,cf4c7da8-f05f-4b71-ba0c-95f84803c783,helixforge,draft,public,"Software factory, development tooling, knowledge/interface framework or capability lifecycle responsibility.","{""head"": ""8429e41fcb19f302d54947e3e2b84cd29de070ed"", ""path"": ""SCOPE.md"", ""repo"": ""informed-decision"", ""sha256"": ""17570e13c96bf68d84714930c9b5d5500a4f50d314c26f27dea7a27d8d412fb3""}"
+infospace-bench,48,b7b3e7cc-cdde-4430-be43-e82343fdf1b0,helixforge,draft,public,"Software factory, development tooling, knowledge/interface framework or capability lifecycle responsibility.","{""head"": ""be872bf4e0af3a54b24f90ac4971fa281227da63"", ""path"": ""SCOPE.md"", ""repo"": ""infospace-bench"", ""sha256"": ""f8089f1ba93913d647b66cdc05435ea457e22efbb569db5f0cf74d1e0786de4f""}"
+intelligence-radar,155,3130bd49-a43f-4682-a25d-68b4d4de9b1f,helixforge,draft,public,"Software factory, development tooling, knowledge/interface framework or capability lifecycle responsibility.","{""head"": ""710b2ebbb52ebc07c0badff42324c877c0fd35dd"", ""path"": ""SCOPE.md"", ""repo"": ""intelligence-radar"", ""sha256"": ""d14d18eaddd91d886be0ab5d57c0ccc9c893fc13920884aad0c6afb42bafceb2""}"
+inter-hub-haskell,49,,UNRESOLVED,unresolved,public,No sufficiently clear steward among the proposed organizations. Retain current path pending an explicit stewardship choice; experimental maturity is not ownership.,"{""field"": ""description"", ""forge_repository_id"": 49, ""value"": ""Integrated Haskell Plattform based AI factory core framework""}"
+interface-canon,152,ad525bb5-70e7-4eb6-8b51-cccc547d42fe,UNRESOLVED,unresolved,public,No sufficiently clear steward among the proposed organizations. Retain current path pending an explicit stewardship choice; experimental maturity is not ownership.,"{""head"": ""20d7bfc2c3687fd15f00de10916d9ef976bf90ec"", ""path"": ""SCOPE.md"", ""repo"": ""interface-canon"", ""sha256"": ""5de740b56582b7f464a83aa3aa66ab1d41d7a7128995f09bb1cf94f1e17e12e1""}"
+issue-core,13,e51fd6df-525e-457c-9ec0-924832b491bc,helixforge,draft,public,"Software factory, development tooling, knowledge/interface framework or capability lifecycle responsibility.","{""head"": ""de368271f6ffc06353ec409998a0d6d0ec0bf25e"", ""path"": ""SCOPE.md"", ""repo"": ""issue-core"", ""sha256"": ""c43d8c15cf0b85dd8558bc0031a0662d668de9c0394eb2045a7735d044d7ed0e""}"
+kaizen-agentic,50,c29eab12-d8b8-46b3-851b-0e23f78f91f3,helixforge,draft,public,"Software factory, development tooling, knowledge/interface framework or capability lifecycle responsibility.","{""head"": ""894d34c466eb7f949e136fbeca4fcf201cdb1086"", ""path"": ""SCOPE.md"", ""repo"": ""kaizen-agentic"", ""sha256"": ""bbcdaa34b1a01422a62bdade839cbbd16ebac5f9fdc7de968bfac5e2cdac87d9""}"
+key-cape,3,8a99bb74-1ec0-4478-ac70-35a7cddb0e3c,netkingdom,draft,public,"Security, identity, authority, policy or security-evidence responsibility; runtime placement does not determine this assignment.","{""head"": ""1164f65d89623713aa2f9950914ceb731f43b175"", ""path"": ""SCOPE.md"", ""repo"": ""key-cape"", ""sha256"": ""993359c5ca4f4c56e81c88f2b05ba66475f81cb53c21a946411dae1042e33c03""}"
+kings-guard,93,6b6e91cd-160f-4e62-9478-80d7588a35dd,netkingdom,draft,public,"Security, identity, authority, policy or security-evidence responsibility; runtime placement does not determine this assignment.","{""head"": ""164f2aecd522c6870db245be4622422eded222fd"", ""path"": ""SCOPE.md"", ""repo"": ""kings-guard"", ""sha256"": ""8e77e587c67aa419df35d4f642468bb57bc30df65e1ea6a922fdca282ea9ed63""}"
+kontextual-engine,51,a7cea934-e38c-467c-b2ea-64fd3424a845,helixforge,draft,public,"Software factory, development tooling, knowledge/interface framework or capability lifecycle responsibility.","{""head"": ""90fc86e3efd87292c6688d7cab7a95107335daf5"", ""path"": ""SCOPE.md"", ""repo"": ""kontextual-engine"", ""sha256"": ""ef90850d905541b4d73af1e45a8e89cbf9939e5d99227bda230e4e5a47833884""}"
+llm-connect,52,13094d7a-b978-4aa3-8a1d-0d05b824698d,helixforge,draft,public,"Software factory, development tooling, knowledge/interface framework or capability lifecycle responsibility.","{""head"": ""7cd633986e75ced673ce0789f8aee2a195a99d9f"", ""path"": ""SCOPE.md"", ""repo"": ""llm-connect"", ""sha256"": ""4e805a0ac9969f1e0ca8175b870acd3f4feef9ce9db0a4b292265f61b48d8cdb""}"
+marki-docx,53,75d31180-acf5-4d47-aea8-2a5b1e71e6a9,helixforge,draft,public,"Software factory, development tooling, knowledge/interface framework or capability lifecycle responsibility.","{""head"": ""b9cefe4e3daf88771abaf7ae2ce0698839becab6"", ""path"": ""SCOPE.md"", ""repo"": ""marki-docx"", ""sha256"": ""21d993567fa6374b167847c30a8beee04f5f4cdbdbfe63702bb728cb46f81e5e""}"
+markitect-filter,54,87f43c8e-01bd-465a-96ce-c0eee2ae7bcf,helixforge,draft,public,"Software factory, development tooling, knowledge/interface framework or capability lifecycle responsibility.","{""head"": ""ac0d9055d8aa5bb3f92ea95ef6a5cbf0753c8bda"", ""path"": ""SCOPE.md"", ""repo"": ""markitect-filter"", ""sha256"": ""92307d10707d6e8713e9c1a5504490f81a55d8e626765dd223e30a090f60c83e""}"
+markitect-main,55,a4c297f2-b38a-42d3-b1a5-ae4b29640276,helixforge,draft,public,"Software factory, development tooling, knowledge/interface framework or capability lifecycle responsibility.","{""head"": ""1e4c46414e8db89c05f07a450f90fc1cfd45440d"", ""path"": ""SCOPE.md"", ""repo"": ""markitect-main"", ""sha256"": ""96920a51e735c5dd673ad28b0cd47d52cc0a6ceadabf5593e16ae3a54dbcaea6""}"
+markitect-quarkdown,56,2c72f2ad-d940-4a21-a71e-d490bd51cff2,helixforge,draft,public,"Software factory, development tooling, knowledge/interface framework or capability lifecycle responsibility.","{""head"": ""f3c5fdc048d145d2f07794f30cea6ba0c0133022"", ""path"": ""SCOPE.md"", ""repo"": ""markitect-quarkdown"", ""sha256"": ""5fb1e0119134fceb6469e2f25bb155e757104a1aa80d71b6c2a555abdc240572""}"
+markitect-tool,66,ba599cd4-e8aa-430b-bbbe-e49f88536d70,helixforge,draft,public,"Software factory, development tooling, knowledge/interface framework or capability lifecycle responsibility.","{""head"": ""c8c3e2b70935a5a390431f96dd51ead61d54fc4f"", ""path"": ""SCOPE.md"", ""repo"": ""markitect-tool"", ""sha256"": ""ad8d6c0e0918c08d915ff4f7a16554c25b76726d1a64f58e057fbdd03ab96831""}"
+maturity-engine,139,a3e46250-9594-4f3d-ab88-723af034c867,helixforge,draft,public,"Software factory, development tooling, knowledge/interface framework or capability lifecycle responsibility.","{""head"": ""2ef97c87a0f818a906aa42942c32d6c69f9ec899"", ""path"": ""SCOPE.md"", ""repo"": ""maturity-engine"", ""sha256"": ""653f47b0d370dfdb45c723b361f6fee53be7e384732c201443d7238c04d155bc""}"
+net-kingdom,67,4589488d-625b-4ffe-b8f0-48744d7b1498,netkingdom,draft,public,"Security, identity, authority, policy or security-evidence responsibility; runtime placement does not determine this assignment.","{""head"": ""019e8f21a744664e8a00614f1f63a5c558f0c4bf"", ""path"": ""SCOPE.md"", ""repo"": ""net-kingdom"", ""sha256"": ""efaf8ab45f68b78ac04f393abdd677cc0cba4b10bd858007446fa94e3c096f39""}"
+open-cmis-tck,57,b6b8dacd-4100-475a-8390-c326e1cebdec,helixforge,draft,public,"Software factory, development tooling, knowledge/interface framework or capability lifecycle responsibility.","{""head"": ""d8d63f824456808c2d08f501a6e1f1535dbd54a6"", ""path"": ""SCOPE.md"", ""repo"": ""open-cmis-tck"", ""sha256"": ""c4300fbccafcecefee893c5696c84cc8f6b93fcb9e105e8ec55019ff54fab499""}"
+open-reuse,21,d416fd6f-3c9d-4ba7-a5ca-f7543940ee6a,helixforge,draft,public,"Software factory, development tooling, knowledge/interface framework or capability lifecycle responsibility.","{""head"": ""f0456ac33131e8ebc5328169cb0244858288a3bc"", ""path"": ""SCOPE.md"", ""repo"": ""open-reuse"", ""sha256"": ""45b24c2a506f3ad295cd489b7b26fe8854f2959898e760218b6135449b297783""}"
+ops-bridge,20,1bf99f56-6e94-4379-a9ea-295a4c181889,netkingdom,draft,public,"Security, identity, authority, policy or security-evidence responsibility; runtime placement does not determine this assignment.","{""head"": ""190ef1e188e12c606f1359325fd9fdd1dbef29e2"", ""path"": ""SCOPE.md"", ""repo"": ""ops-bridge"", ""sha256"": ""63cd52d1cdf38e72af0285c25aa2292f959080c6befe565a1d2690747a813975""}"
+ops-hub,58,c96dd8b3-3d15-4c50-8daf-0ec6a2c56ddf,UNRESOLVED,unresolved,public,No sufficiently clear steward among the proposed organizations. Retain current path pending an explicit stewardship choice; experimental maturity is not ownership.,"{""head"": ""75f4944144b000119a68d3ed6eb8d938b05f73a1"", ""path"": ""SCOPE.md"", ""repo"": ""ops-hub"", ""sha256"": ""56feb5acd3ad98061070353c91f473bd45f30912829f17ed4e835f932ebd6fb9""}"
+ops-mason,102,b9066ab1-c6fe-409b-9145-64ba374654db,netkingdom,draft,public,"Security, identity, authority, policy or security-evidence responsibility; runtime placement does not determine this assignment.","{""head"": ""13a633760791bb2c30edb475a4bed36af1cd3461"", ""path"": ""SCOPE.md"", ""repo"": ""ops-mason"", ""sha256"": ""7da4c8c660b1c8d15675768a5f6040303fe3ca3b4f05b1bba4633be3cc6e0c77""}"
+ops-warden,16,74df727e-a756-42de-b776-11928b03bd1f,netkingdom,draft,public,"Security, identity, authority, policy or security-evidence responsibility; runtime placement does not determine this assignment.","{""head"": ""4d5595ba8b4963a728a597ba16ebcec2badbd59f"", ""path"": ""SCOPE.md"", ""repo"": ""ops-warden"", ""sha256"": ""47b47468746617c84f8411ac671bb488ab740b4c3133401f5d7b55d3d024345f""}"
+phase-memory,23,d56e0504-044d-4021-ae43-e9d706dbd087,helixforge,draft,public,"Software factory, development tooling, knowledge/interface framework or capability lifecycle responsibility.","{""head"": ""755fd2c3e2a5414cd89ee59df1814196d872b768"", ""path"": ""SCOPE.md"", ""repo"": ""phase-memory"", ""sha256"": ""2856b8dcc36e58f9c242079988df9bcd864ee96445d6109bf6db3fa13f41f694""}"
+plenty-gobble,154,,UNRESOLVED,unresolved,public,No sufficiently clear steward among the proposed organizations. Retain current path pending an explicit stewardship choice; experimental maturity is not ownership.,"{""head"": ""a430115fa831cc9906932df24757ee89e2369b7f"", ""path"": ""INTENT.md"", ""repo"": ""plenty-gobble"", ""sha256"": ""0ba62aa4e7321637058adeb2ac6ab79b950d3d2da414f4ae1165db9452404d80""}"
+policy-nexus,124,29593df6-89a6-4058-9e0b-863e986b86f8,netkingdom,draft,public,"Security, identity, authority, policy or security-evidence responsibility; runtime placement does not determine this assignment.","{""head"": ""c1b60f322e3bcddff3cece618ece2bd3686169e1"", ""path"": ""INTENT.md"", ""repo"": ""policy-nexus"", ""sha256"": ""58b95e4e158da6b978b9bd3a2ecbaf7f279553098906a8e8ed404afd3d582494""}"
+polycode-sim,82,9b69c35b-f3e7-490c-bb9e-d78f96992513,UNRESOLVED,unresolved,public,No sufficiently clear steward among the proposed organizations. Retain current path pending an explicit stewardship choice; experimental maturity is not ownership.,"{""head"": ""5c6d974f11daf3ba7bc82ac8183004e9ef5f39b3"", ""path"": ""SCOPE.md"", ""repo"": ""polycode-sim"", ""sha256"": ""d61ed0b356339f3a9d06f13fcf2ca79c5e6b94543663d5949104a0ef96c0dccb""}"
+pqrst-practice,146,0e6b7382-f870-4e12-ab5b-e0c64e57953e,helixforge,draft,public,"Software factory, development tooling, knowledge/interface framework or capability lifecycle responsibility.","{""head"": ""25d2ce38c4ccd12d9cacaaa69769bdfe4bcc4639"", ""path"": ""SCOPE.md"", ""repo"": ""pqrst-practice"", ""sha256"": ""811a771308b303252465cee151b7250a9b93a57af55785186662502849fc9c6d""}"
+pr-hall-of-helix,145,957ea7be-3dab-4a26-a098-32b9bb780fdc,helixforge,draft,public,"Software factory, development tooling, knowledge/interface framework or capability lifecycle responsibility.","{""head"": ""ac4c2babf2c9323715ce096e1b627c24bbbc6f1f"", ""path"": ""SCOPE.md"", ""repo"": ""pr-hall-of-helix"", ""sha256"": ""b69bd6366a04e727835723a000fa1c3f5810b6559cbce683d363f561fdb23041""}"
+prj-canon-federation,123,ec840a06-4e33-4fdc-9762-da7a5beec254,UNRESOLVED,unresolved,public,No sufficiently clear steward among the proposed organizations. Retain current path pending an explicit stewardship choice; experimental maturity is not ownership.,"{""head"": ""85abef3bc8eb38d1a641bfe4b6a9e8be6b6cd213"", ""path"": ""SCOPE.md"", ""repo"": ""prj-canon-federation"", ""sha256"": ""9583f530a625b0488b958f678e8f96274e54ea783fba7f4692e08e48fce5f522""}"
+prj-forgejo-org-refactor,117,01631c7a-f612-4799-892e-a96970d06063,railiance,draft,public,Runtime/framework delivery and operations responsibility; managed application packaging is distinct from product ownership.,"{""head"": null, ""path"": ""SCOPE.md"", ""repo"": ""prj-forgejo-org-refactor"", ""sha256"": ""4b8819f3fce4666f58538b84555f5d63b79a9eb741c7cd6c9803a4f207ae422a""}"
+prj-helixforge-factory,,99cc4689-9f73-42a2-9cca-d2e235393014,helixforge,draft,unknown,"Software factory, development tooling, knowledge/interface framework or capability lifecycle responsibility.","{""head"": ""988285dadc8d0522c9f14c9abb5960b899ed6073"", ""path"": ""SCOPE.md"", ""repo"": ""prj-helixforge-factory"", ""sha256"": ""78684afaca02a70cb145612373e24c83127fec7b72e674d6b6b103cbe154d3be""}"
+prj-state-hub-retirement,107,5dd1708d-96e3-4737-96be-05485548ab04,helixforge,draft,public,"Software factory, development tooling, knowledge/interface framework or capability lifecycle responsibility.","{""head"": ""f8389a810ec61361f98bf73a45b5d48921845512"", ""path"": ""SCOPE.md"", ""repo"": ""prj-state-hub-retirement"", ""sha256"": ""66c1977bc6808e968bd97d81d6f921a48f64de23797878fbf25d3475647a2aab""}"
+prj-unattended-progress-company,87,ea264d14-723b-48d9-b330-1e3c929934ec,binky,draft,public,Company-specific coordination or finance integration responsibility; this is not assignment by legal copyright ownership.,"{""head"": ""20e8191f3b9b75e315e7f4fec5d656f4f2721828"", ""path"": ""SCOPE.md"", ""repo"": ""prj-unattended-progress-company"", ""sha256"": ""df12b2cb306e9470df5bbac9cd4597ad67ff3b39adc3824946ab3cb15bcb4e85""}"
+python-snake,86,47f50756-aaf6-4897-9bc7-097fcd9daf46,UNRESOLVED,unresolved,public,No sufficiently clear steward among the proposed organizations. Retain current path pending an explicit stewardship choice; experimental maturity is not ownership.,"{""head"": ""704657e67ac536ee2bd3f88546a619895ec8e0f8"", ""path"": ""SCOPE.md"", ""repo"": ""python-snake"", ""sha256"": ""c4300fbccafcecefee893c5696c84cc8f6b93fcb9e105e8ec55019ff54fab499""}"
+qonto-assistant,91,7945cc60-f228-4baa-879d-5aa515d004e3,binky,draft,public,Company-specific coordination or finance integration responsibility; this is not assignment by legal copyright ownership.,"{""head"": ""fbe1945e158f66d33491205f036d4cf0d3a286a9"", ""path"": ""SCOPE.md"", ""repo"": ""qonto-assistant"", ""sha256"": ""62181fc31d4106d74f6a28a14f15b9553001414c24293a24b0a66112c162193d""}"
+rail-knative,99,95d05a4d-e276-4eea-a767-c78d3ac4b320,railiance,draft,public,Runtime/framework delivery and operations responsibility; managed application packaging is distinct from product ownership.,"{""head"": ""cd38dba3653e7fc85d3b2d3a074811b9a7216f25"", ""path"": ""SCOPE.md"", ""repo"": ""rail-knative"", ""sha256"": ""d5c9f0433a25825ce2b77f6caef8bc20dba303b07596233904975226e33e3d87""}"
+rail-kubernetes,96,dc1866c7-08af-4117-8684-057331be20b5,railiance,draft,public,Runtime/framework delivery and operations responsibility; managed application packaging is distinct from product ownership.,"{""head"": ""35159e49c1340b7a0e30c49188975c8839d346f6"", ""path"": ""SCOPE.md"", ""repo"": ""rail-kubernetes"", ""sha256"": ""00fce3ee7cb4bbbd7eff210adb2a03c533f2b43870f7327cfc35f28354bb549a""}"
+railiance-apps,8,cb06310e-4381-428b-b8f3-d3ea8ac2f70d,railiance,draft,public,Runtime/framework delivery and operations responsibility; managed application packaging is distinct from product ownership.,"{""head"": ""cfbc95e11d3e9b86db1cef219745acdc01285ab6"", ""path"": ""SCOPE.md"", ""repo"": ""railiance-apps"", ""sha256"": ""8243098d979d4258c9e7f9e39b5de24ce78b521cd82a7e199028df30bc130b14""}"
+railiance-bootstrap,78,42f80fe5-e5bb-4765-8e4b-e369517fb36a,railiance,draft,public,Runtime/framework delivery and operations responsibility; managed application packaging is distinct from product ownership.,"{""head"": ""d88c52a7d4604379db0ebed130a7ef791775fc46"", ""path"": ""SCOPE.md"", ""repo"": ""railiance-bootstrap"", ""sha256"": ""4efdd7f7817e39c01d6024e2f8bcbd70c2b10b90baf9f92855bb3967cd629831""}"
+railiance-clock,156,4a6a7947-b419-428d-bf09-ed91de18095c,railiance,draft,public,Runtime/framework delivery and operations responsibility; managed application packaging is distinct from product ownership.,"{""head"": ""3e537d117f0d443f8fe47fa7c88268a3eb747bea"", ""path"": ""SCOPE.md"", ""repo"": ""railiance-clock"", ""sha256"": ""1cfd5894ea2712eb771836819618ccd5f6c6bf9c1b6e9020b8980d7a69746e11""}"
+railiance-cluster,10,c3fd0dd2-a0de-415c-8e3a-e37406f4b8f8,railiance,draft,public,Runtime/framework delivery and operations responsibility; managed application packaging is distinct from product ownership.,"{""head"": ""550b50aa94ad0c10f68bbf7eac18d7c89f992c77"", ""path"": ""SCOPE.md"", ""repo"": ""railiance-cluster"", ""sha256"": ""e4f6a8dd3d72a1f04f0d94721d57ca2a4c7e98790a8373876a5005b87ec5d8a6""}"
+railiance-enablement,6,bc978be9-ca72-42bb-a451-d4737b779c5b,railiance,draft,public,Runtime/framework delivery and operations responsibility; managed application packaging is distinct from product ownership.,"{""head"": ""28baf36ad6399543315288a9dd5038882899a3a5"", ""path"": ""SCOPE.md"", ""repo"": ""railiance-enablement"", ""sha256"": ""2a554aef6d6803f1a176ea3bdb3bcc0f077f03d131b0a897a5ec56bd6df85f88""}"
+railiance-fabric,59,2c0de614-e468-4eb6-8157-470649ac8c05,railiance,draft,public,Runtime/framework delivery and operations responsibility; managed application packaging is distinct from product ownership.,"{""head"": ""b47dd43b0491a5f72f75d3edf6bd0349117063b7"", ""path"": ""SCOPE.md"", ""repo"": ""railiance-fabric"", ""sha256"": ""b80d4a8b39c2920818ba4069318f888e56736a0f0e8d40f3a72568b0472fb36d""}"
+railiance-forge,60,edffc8b6-0360-471e-a6b1-df56bde1a27e,railiance,draft,public,Runtime/framework delivery and operations responsibility; managed application packaging is distinct from product ownership.,"{""head"": ""e395e5e9c196fe7cea9cd2be513554e493e675ee"", ""path"": ""SCOPE.md"", ""repo"": ""railiance-forge"", ""sha256"": ""dc4c179e33898e32fae7b2e8e30e88a66d9efc3ad2f488651ccedf600274c1b8""}"
+railiance-hosts,80,2db668cf-6c52-4965-951f-0d5e617de9e3,railiance,draft,public,Runtime/framework delivery and operations responsibility; managed application packaging is distinct from product ownership.,"{""head"": ""53344177f3de1d0a417504e798b80c1d89798867"", ""path"": ""SCOPE.md"", ""repo"": ""railiance-hosts"", ""sha256"": ""4163a86630d4b7f1395d84099aac0c82399ccbbbcd8824f4900fa1170af077ff""}"
+railiance-infra,7,485187c0-4fad-42f7-984c-5e317a66c5de,railiance,draft,public,Runtime/framework delivery and operations responsibility; managed application packaging is distinct from product ownership.,"{""head"": ""8f027bde8a64fcb1cde85e371f7259987e43ae16"", ""path"": ""SCOPE.md"", ""repo"": ""railiance-infra"", ""sha256"": ""18cdf933d658eeddcb68528bb9c222ceb0866d8c5f0ec4bb3ea955de762c3c33""}"
+railiance-master,95,aa497d2f-d88d-4065-9ab2-e251df07ead4,railiance,draft,public,Runtime/framework delivery and operations responsibility; managed application packaging is distinct from product ownership.,"{""head"": ""6729627d174afaff4501ccb798c6788aa3314bbf"", ""path"": ""SCOPE.md"", ""repo"": ""railiance-master"", ""sha256"": ""63ebaef0397795257650521e6f3be6b46cca1142f53b1865d9df9ed0c0530fc8""}"
+railiance-platform,9,5115e0c5-009f-4168-b155-9943fe2ab9a7,railiance,draft,public,Runtime/framework delivery and operations responsibility; managed application packaging is distinct from product ownership.,"{""head"": ""7a12760160be6817ae9c6958afab67bfb843b1f0"", ""path"": ""SCOPE.md"", ""repo"": ""railiance-platform"", ""sha256"": ""bb18dc91f3be50337d7ebc81d269f1234f65919f7014eef990b09c3df54a5347""}"
+railiance-telemetry,121,c186e743-9ebb-425a-aecc-7e3ea7cdc2a5,railiance,draft,public,Runtime/framework delivery and operations responsibility; managed application packaging is distinct from product ownership.,"{""head"": ""3166da1d2e68d7d05e022bce8f207692053482c4"", ""path"": ""SCOPE.md"", ""repo"": ""railiance-telemetry"", ""sha256"": ""206279dabc14fe1a44ba6df8ad2b664cc91d3460379b732951d3e29bb6a814da""}"
+ralph-workplan,83,33b4936f-aadd-42e2-a320-33c524a07e1d,helixforge,draft,public,"Software factory, development tooling, knowledge/interface framework or capability lifecycle responsibility.","{""head"": ""059cf05f199af9f3aec6d231417b6f0aae7f9a61"", ""path"": ""SCOPE.md"", ""repo"": ""ralph-workplan"", ""sha256"": ""e7f418526fcad06c68918e9f9f32d891bd9c05508ffdbd19ee06f44b75a15ade""}"
+rapp-canned-prompts,149,a2051964-8295-4e4c-aad6-9c4638fc32a8,railiance,draft,public,Runtime/framework delivery and operations responsibility; managed application packaging is distinct from product ownership.,"{""head"": ""60e8c49e6d940606492414344aacb07625eb5cda"", ""path"": ""SCOPE.md"", ""repo"": ""rapp-canned-prompts"", ""sha256"": ""872ac601070496760d660017179945dbe083b2cac453d554fcac73a4983db599""}"
+rapp-core-hub,,155fab93-6a76-415e-a57a-7e39b4428985,railiance,draft,unknown,Runtime/framework delivery and operations responsibility; managed application packaging is distinct from product ownership.,"{""head"": ""83ea9bf15e0ef2dd87f6574f48e1ee9297ca8729"", ""path"": ""SCOPE.md"", ""repo"": ""rapp-core-hub"", ""sha256"": ""665ca191fd1611d196e87640b0ee6b5490525e98c51d0cdbb19020d6597ce549""}"
+rapp-issue-core,,719f49a6-63a0-47d4-9a9c-ea515be17d5a,railiance,draft,unknown,Runtime/framework delivery and operations responsibility; managed application packaging is distinct from product ownership.,"{""head"": ""a78f38cfd8afb29ed23d150a4ea3e3dcd1f35381"", ""path"": ""SCOPE.md"", ""repo"": ""rapp-issue-core"", ""sha256"": ""252d60ffd5a7e07e395c200e1f24d2448f09dae478fd26753c0a6314201799fa""}"
+rapp-openbao,,3d070446-80e0-4d51-a802-d037b8ac273a,railiance,draft,unknown,Runtime/framework delivery and operations responsibility; managed application packaging is distinct from product ownership.,"{""head"": ""360dff2aad1c7e571544fd2eac8215872486d62a"", ""path"": ""SCOPE.md"", ""repo"": ""rapp-openbao"", ""sha256"": ""cdcf80122c8c55dfe697312d6cd67b76861f322cae9816b85123aefe2345c674""}"
+rapp-policy-nexus,,d5c398ad-93a6-479c-bd5e-6078e717c819,railiance,draft,unknown,Runtime/framework delivery and operations responsibility; managed application packaging is distinct from product ownership.,"{""head"": ""37e129ea8e20900af7a3b617249b4b5003b6ec68"", ""path"": ""SCOPE.md"", ""repo"": ""rapp-policy-nexus"", ""sha256"": ""dfb85b48d6ff68a9945178a5fc1b85f1d342f765d046a58285e7edc52f517438""}"
+rapp-postgres,,e4614b15-7526-4787-bd6f-74aa3cf24c3d,railiance,draft,unknown,Runtime/framework delivery and operations responsibility; managed application packaging is distinct from product ownership.,"{""head"": ""3af806d0d0ff3f1e7f0e3c0139f6d58f55d0fcfb"", ""path"": ""SCOPE.md"", ""repo"": ""rapp-postgres"", ""sha256"": ""5c8318668c49ba405d0c0b455fb5345a284745dc1390059b8e0c80e5c2893356""}"
+rapp-qonto,,46e9c85b-057d-41e0-9382-851bebcf2cc1,railiance,draft,unknown,Runtime/framework delivery and operations responsibility; managed application packaging is distinct from product ownership.,"{""head"": ""1d829a51961b69b564e62a71236c47335220680a"", ""path"": ""SCOPE.md"", ""repo"": ""rapp-qonto"", ""sha256"": ""c7f8256e5c241bee6251849bbc6d47f93ca4a5a0e692f109eed16854615aaa1c""}"
+rapp-sbom-nexus,,8df9b401-f2e4-4d12-b5ba-7fc191d4e606,railiance,draft,unknown,Runtime/framework delivery and operations responsibility; managed application packaging is distinct from product ownership.,"{""head"": ""1566bcf69fc0757db5efc67f78b14af10d944c1b"", ""path"": ""SCOPE.md"", ""repo"": ""rapp-sbom-nexus"", ""sha256"": ""a20b2c4492a6ff54986e79d40836e7633a4b6ae578330fb87c06eb41aaf81f4d""}"
+rapp-secrets-engine,,,netkingdom,draft,unknown,CLI package responsibility appears coupled to secrets-engine rather than a platform runtime package; NetKingdom proposal needs confirmation.,"{""head"": ""f71131e76b70aad02d32ab46f2d0983f030304a9"", ""path"": ""README.md"", ""repo"": ""rapp-secrets-engine"", ""sha256"": ""0b9192132b361528fc669a583659b3c6386c5952f4c3bb4c7d2d179152590c8e""}"
+rapp-telemetry,,c3c19d82-e39c-4342-8e93-4d8f0656f17d,railiance,draft,unknown,Runtime/framework delivery and operations responsibility; managed application packaging is distinct from product ownership.,"{""head"": ""6696a8c2335f151c083be739db9f04a97b28a188"", ""path"": ""SCOPE.md"", ""repo"": ""rapp-telemetry"", ""sha256"": ""3776b5924bd90f8114e77f7bbbcacc7f3713cd56ca26440a3e4bce792ce8b142""}"
+rapp-tenant-engine,,215c052f-88e7-4b8d-af84-01008cd606d3,railiance,draft,unknown,Runtime/framework delivery and operations responsibility; managed application packaging is distinct from product ownership.,"{""head"": ""5c86aa3020ffcda1ee10bbb92056d3b3c0500166"", ""path"": ""SCOPE.md"", ""repo"": ""rapp-tenant-engine"", ""sha256"": ""fc0c5a80f37c410c10eb29a7541ca37088668e5f76d64ece4e889c7f0145a13d""}"
+rapp-user-engine,,9cfdd641-0c27-436f-ad3b-5d41a1353fcf,railiance,draft,unknown,Runtime/framework delivery and operations responsibility; managed application packaging is distinct from product ownership.,"{""head"": ""43471b7a9256b377669cb16446a9b7d256db41b3"", ""path"": ""SCOPE.md"", ""repo"": ""rapp-user-engine"", ""sha256"": ""732fd68b194d034e81faf170d5a69e1d61cfab5385457b93a5f5689a63a2f184""}"
+reef-railiance,98,1f5876f3-bc96-4f64-a9c8-f2e4578b8416,railiance,draft,public,Runtime/framework delivery and operations responsibility; managed application packaging is distinct from product ownership.,"{""head"": ""e3c5ca2b74f6ae4f3b79f918708f3b573157a0c2"", ""path"": ""SCOPE.md"", ""repo"": ""reef-railiance"", ""sha256"": ""a273078d5dc7ceb72bbdf5473b5146cd624411b08bdc6b1e7d78113c4e675cc8""}"
+reef-storage,122,b1321f79-ccc7-4b0a-84bf-c7b9825ca427,railiance,draft,public,Runtime/framework delivery and operations responsibility; managed application packaging is distinct from product ownership.,"{""head"": ""91b4c2e1453be8c5d99b5da4d893563401ff03b8"", ""path"": ""SCOPE.md"", ""repo"": ""reef-storage"", ""sha256"": ""0522a48cd79628b0a578444dd344180aa026eae96e8f1c424bab530b6527493c""}"
+rein-aharness,89,73be5a8e-8503-447f-87cb-de8c2c8c0b9e,helixforge,draft,public,"Software factory, development tooling, knowledge/interface framework or capability lifecycle responsibility.","{""head"": ""43e621439a2902062405bb3c351411bb9e8c7d33"", ""path"": ""SCOPE.md"", ""repo"": ""rein-aharness"", ""sha256"": ""d9979b35ec0909f76e6c34a0f40de2e5cbc700d1bb5c7b5f73c6e2b20e3cbc48""}"
+rein-openweights,101,317300f6-a09b-4464-8a0e-798aad5627d0,helixforge,draft,public,"Software factory, development tooling, knowledge/interface framework or capability lifecycle responsibility.","{""head"": ""e1fccb39b738a5381a9de6e1d799f124797798ce"", ""path"": ""SCOPE.md"", ""repo"": ""rein-openweights"", ""sha256"": ""f7791a1f858cd7225e217b9b53213066e44ddd7ac4a1e748383a2c8756d3aa3c""}"
+repo-manager,108,a9d105c6-10fa-4cf9-8bc1-e248476698d3,helixforge,draft,public,"Software factory, development tooling, knowledge/interface framework or capability lifecycle responsibility.","{""head"": ""40b0cff72b2b0c62872e9a310ef7d632df78977a"", ""path"": ""SCOPE.md"", ""repo"": ""repo-manager"", ""sha256"": ""bca5806e11f04e4550ce5c147d4d98e6c0014fed1f17fa3f134e5b193adec43c""}"
+repo-scoping,68,de749ff1-a4a4-42f5-8ed4-6b8c05b18bd9,helixforge,draft,public,"Software factory, development tooling, knowledge/interface framework or capability lifecycle responsibility.","{""head"": ""4a05eabc6d93d587e95709771e0c7a6746eb8977"", ""path"": ""SCOPE.md"", ""repo"": ""repo-scoping"", ""sha256"": ""e1d609e978fb6012039c15efc83b05ea8db78a2e47d01e99a55d95e251ada4fc""}"
+repo-seed,69,b7add1b9-b90f-4baf-acac-2f5ce3037b5f,helixforge,draft,public,"Software factory, development tooling, knowledge/interface framework or capability lifecycle responsibility.","{""head"": ""33a741fa2999ff0298706233f69bdcf840f1b146"", ""path"": ""SCOPE.md"", ""repo"": ""repo-seed"", ""sha256"": ""936c0fa75c712b9b97a39be9a5e948fe17a9601383b613260fcd09867c38c0dc""}"
+resource-control,115,195e2991-79c3-4c61-981d-5de78f6fe5b8,railiance,draft,public,Runtime/framework delivery and operations responsibility; managed application packaging is distinct from product ownership.,"{""head"": ""3604d468f86ede7d320f4d22dd4aea775306b53f"", ""path"": ""SCOPE.md"", ""repo"": ""resource-control"", ""sha256"": ""2daf0899d730bb6da30bd471f364061b86428cb5e38573df9d5551aff9dd5e29""}"
+reuse-surface,18,7007e599-6f2a-4fc6-b6c7-a86b6e9ccfaf,helixforge,draft,public,"Software factory, development tooling, knowledge/interface framework or capability lifecycle responsibility.","{""head"": ""5594cfd6bd789c1a87a7165c082addbe53783410"", ""path"": ""SCOPE.md"", ""repo"": ""reuse-surface"", ""sha256"": ""2c30972ceb2a643147ce61c04c6919b16797b6754c2a407df998c81ce76c9c30""}"
+risk-nexus,125,2cb4c14d-6f90-40a7-a9ee-14a663306cb5,netkingdom,draft,public,"Security, identity, authority, policy or security-evidence responsibility; runtime placement does not determine this assignment.","{""head"": ""0b3cfb81c65221477f17c05d0916902f690d4427"", ""path"": ""SCOPE.md"", ""repo"": ""risk-nexus"", ""sha256"": ""5f2b0ef864e28ac37855f0c8e04edfc966c938365bd90d32c1b3699513918b2e""}"
+role-engine,113,,helixforge,draft,public,"Software factory, development tooling, knowledge/interface framework or capability lifecycle responsibility.","{""head"": ""d231241dbfeeb541b34243f4022883aa6417a1eb"", ""path"": ""INTENT.md"", ""repo"": ""role-engine"", ""sha256"": ""06678fc42521c91514ef9684674479c70ae47ee829e7a1e5e6c5d7ae54c0d7a2""}"
+sand-boxer,70,11c1ff2e-ad0d-4a1a-b649-7da7b98a07da,helixforge,draft,public,"Software factory, development tooling, knowledge/interface framework or capability lifecycle responsibility.","{""head"": ""22c95a9c3bb5bf423f46d827b2af0f1de67bb3e8"", ""path"": ""SCOPE.md"", ""repo"": ""sand-boxer"", ""sha256"": ""6e4b44b9e3e607836cf234b0561f42d0b97c104e5c96fa8314b06915a5b6b0b8""}"
+sbom-nexus,128,7b46d0dd-b261-4b8f-82c6-fa26f24e42a0,netkingdom,draft,public,"Security, identity, authority, policy or security-evidence responsibility; runtime placement does not determine this assignment.","{""head"": ""503bebcb0bd7be60d3f15e11e8dd974dbc5af1eb"", ""path"": ""SCOPE.md"", ""repo"": ""sbom-nexus"", ""sha256"": ""32f6e853b366c5097b3ab1a3d05413a0091ec48585de4def7adcbacd57da02ba""}"
+secrets-engine,71,ce3d5e76-ee5c-40dc-acc8-c04e63a0e406,netkingdom,draft,public,"Security, identity, authority, policy or security-evidence responsibility; runtime placement does not determine this assignment.","{""head"": ""560da4d67866a43f8675be7c63db76af90b63b01"", ""path"": ""SCOPE.md"", ""repo"": ""secrets-engine"", ""sha256"": ""49bb8d5954e55a5fb10cce5a6236d46d6f3cfd23b01fd2e796b9f533692652a4""}"
+security-canon,157,294a2e5d-888f-4084-92a4-d3b248970482,netkingdom,draft,public,"Security, identity, authority, policy or security-evidence responsibility; runtime placement does not determine this assignment.","{""head"": ""bbd44332543e1cc40b2ebed10ec06123b9c798ea"", ""path"": ""SCOPE.md"", ""repo"": ""security-canon"", ""sha256"": ""894252721637e29189ae7ab9d226c8a00d8f3bdb82c301eb7b7e81fc92f9bbbc""}"
+shard-wiki,72,b51b2b12-dc53-4423-8d3c-78c96eee0362,helixforge,draft,public,"Software factory, development tooling, knowledge/interface framework or capability lifecycle responsibility.","{""head"": ""d4cacd7a35a8eb4def06f6954bef576d21fb8ed5"", ""path"": ""SCOPE.md"", ""repo"": ""shard-wiki"", ""sha256"": ""2b874da18cde3547da21add2cf03ea335614bd93b35b2c9fefdff602430fca0a""}"
+snuggles-inventor,73,,helixforge,draft,public,"Software factory, development tooling, knowledge/interface framework or capability lifecycle responsibility.","{""head"": ""f4c8bfde1b326afbb705b6837fafb86aa48f2e66"", ""path"": ""INTENT.md"", ""repo"": ""snuggles-inventor"", ""sha256"": ""d0515fb2eb5fd854c3bacdc249b65a2d4e5327f9937f2d246dc2b65b18bba4b8""}"
+soul-frame,112,da8ecb37-e1bf-4260-b853-beb40ac9235b,UNRESOLVED,unresolved,public,No sufficiently clear steward among the proposed organizations. Retain current path pending an explicit stewardship choice; experimental maturity is not ownership.,"{""head"": ""cc8d3cf3b453d0c95e347aa81731c07df950c7ae"", ""path"": ""SCOPE.md"", ""repo"": ""soul-frame"", ""sha256"": ""67f456d177e391693a3a9f3ad5e44019c9dae0f812bc856cadbdc418da26ad2d""}"
+state-hub,12,8e9ffb56-7abc-47b5-84b2-5ad392b37dcd,helixforge,draft,public,"Software factory, development tooling, knowledge/interface framework or capability lifecycle responsibility.","{""head"": ""e92471df3b415f9692a25eef9470f667c377b468"", ""path"": ""SCOPE.md"", ""repo"": ""state-hub"", ""sha256"": ""cfdd20b8718d92db1413c9bfcccdb1ae1e7fdee638aadcedf6508cee9f7c713f""}"
+target-revenue,103,d63ab9fa-9bf2-4014-a5e8-d186c417552e,UNRESOLVED,unresolved,public,No sufficiently clear steward among the proposed organizations. Retain current path pending an explicit stewardship choice; experimental maturity is not ownership.,"{""head"": ""f1109d54eeda9f187daa215cf1c7163610d35d0a"", ""path"": ""SCOPE.md"", ""repo"": ""target-revenue"", ""sha256"": ""3ed8d4de5767b8e8175bc9171625d59f7719fe25dbe9e1bc3bf3152d749e1376""}"
+tegwick-control,74,1174ca73-c53d-4bb8-bfc3-fdeda13ef706,coulomb,draft,public,Explicit Coulomb engagement/product or estate/personal continuity responsibility; not a default for all shared dependencies.,"{""head"": ""70dba933a7b6820433209d4ee9e146c218391753"", ""path"": ""SCOPE.md"", ""repo"": ""tegwick-control"", ""sha256"": ""62c30b2fa6dc975a6508c1e2dd3f43d9c0ad07b77966634a1f888177e151607a""}"
+tele-mcp,75,60f2d8b6-f3fa-4bb0-b316-89de9b2a7d79,railiance,draft,public,Runtime/framework delivery and operations responsibility; managed application packaging is distinct from product ownership.,"{""head"": ""da0da8b4e4d6db4477a6fa203e241cd9c399f312"", ""path"": ""SCOPE.md"", ""repo"": ""tele-mcp"", ""sha256"": ""e6edf1c794ac0f4d4f0ab4db22f6057b08496fb45fa10d2c632d57daecd23799""}"
+telegram-edge,110,,helixforge,draft,public,"Software factory, development tooling, knowledge/interface framework or capability lifecycle responsibility.","{""head"": ""c94598687b25a1e10d3d45ebd09d349c3c329e1e"", ""path"": ""INTENT.md"", ""repo"": ""telegram-edge"", ""sha256"": ""3313148ca27ace2ea67b9ece936ecdc7f47247e0e72e19c07b543a5232659660""}"
+tenant-engine,92,d70d228e-841d-42d9-a7e9-5d978b4008d8,netkingdom,draft,public,"Security, identity, authority, policy or security-evidence responsibility; runtime placement does not determine this assignment.","{""head"": ""4ce89969c0cc0ab4ba111f1b4009aa137c94a68b"", ""path"": ""SCOPE.md"", ""repo"": ""tenant-engine"", ""sha256"": ""63f86c1bc39110db862fe60e273703463415e6e0365e4c058ab6c65be399d62e""}"
+test-driver,135,217fe904-2e15-44a8-bdda-e8c6683f46c9,helixforge,draft,public,"Software factory, development tooling, knowledge/interface framework or capability lifecycle responsibility.","{""head"": ""a8bb787d123b19e1a8cc4408e5f731c7122d0b6b"", ""path"": ""SCOPE.md"", ""repo"": ""test-driver"", ""sha256"": ""c54721c8a8a443fbc0779003aa2e250dd72758e2c0e4f44db804faff46ae6415""}"
+testdrive-jsui,84,3786363f-94a5-43a0-889d-8e85993b2783,helixforge,draft,public,"Software factory, development tooling, knowledge/interface framework or capability lifecycle responsibility.","{""head"": ""701341d7fa520f860245e28eb16d44b767fd116b"", ""path"": ""SCOPE.md"", ""repo"": ""testdrive-jsui"", ""sha256"": ""8f27d741a19501d0a403baaa827d6d3f9323e77e691fee9f219fa1647d40589e""}"
+the-custodian,76,56ae522c-b47e-4748-8239-f61b332fe69d,coulomb,draft,public,Explicit Coulomb engagement/product or estate/personal continuity responsibility; not a default for all shared dependencies.,"{""head"": ""2258c7eefc31dd9d15a27a5c131cb50fdd17275c"", ""path"": ""SCOPE.md"", ""repo"": ""the-custodian"", ""sha256"": ""f0161681a55c1cb80ac31ec87106a47dee76990e0b4926280262ff42b0c42f76""}"
+timeline-svg,85,077cf296-3879-4da5-ac97-46cb248c889d,UNRESOLVED,unresolved,public,No sufficiently clear steward among the proposed organizations. Retain current path pending an explicit stewardship choice; experimental maturity is not ownership.,"{""head"": ""9dfb14326455fccf2e3194ee194a11388cb1308b"", ""path"": ""SCOPE.md"", ""repo"": ""timeline-svg"", ""sha256"": ""8108d7400e95fe6a0f7a10e0c73c6c51155eac1b730ef8aab205c34848e5e47f""}"
+tmux-amq,136,040b00d5-9c61-4a48-b21e-59c3f6ff4f18,helixforge,draft,public,"Software factory, development tooling, knowledge/interface framework or capability lifecycle responsibility.","{""head"": ""04de219061c576ee77eb0d5f2178ad9f98fe9b12"", ""path"": ""SCOPE.md"", ""repo"": ""tmux-amq"", ""sha256"": ""7b97c20b580ac7aa6d7ca3df97478f781beee192fd90cd3f66ba07d33f1bc510""}"
+user-engine,77,761e6ac3-6483-4b7f-ac7a-5e5741a01118,netkingdom,draft,public,"Security, identity, authority, policy or security-evidence responsibility; runtime placement does not determine this assignment.","{""head"": ""b4cef6446bc10555b598ea74de1743bc9b03e7ba"", ""path"": ""SCOPE.md"", ""repo"": ""user-engine"", ""sha256"": ""0e863e1cc93e2aac373f566db4a4445348a930029a1c0968cf8e30c456b003e8""}"
+vantage-point,61,14a5657e-f875-4cd4-8801-3c7dcecb11f2,helixforge,draft,public,"Software factory, development tooling, knowledge/interface framework or capability lifecycle responsibility.","{""head"": ""d760b74e6cb9dc94265fa94482136911bdfe6440"", ""path"": ""SCOPE.md"", ""repo"": ""vantage-point"", ""sha256"": ""f03fe2ddaf1994b407c5babd1b3d4ede7d280e9470940beb92e4e6e56bd1f473""}"
+vergabe-teilnahme,62,ff7b0754-9d54-4abf-a752-d342870f5993,UNRESOLVED,unresolved,public,No sufficiently clear steward among the proposed organizations. Retain current path pending an explicit stewardship choice; experimental maturity is not ownership.,"{""head"": ""5fddf5f8f0626c9b4567b59a2486880694084396"", ""path"": ""SCOPE.md"", ""repo"": ""vergabe-teilnahme"", ""sha256"": ""bc58ebef916e20f0edf486df9f51e2c822e42a538dd9b42b2ab88feac367fe0f""}"
+whitehat-security,126,14487b12-9a94-4d98-83e5-dcc0b58b650a,netkingdom,draft,public,"Security, identity, authority, policy or security-evidence responsibility; runtime placement does not determine this assignment.","{""head"": ""b5cc6706b95a7e639a89429aee1a4f4a4ead405f"", ""path"": ""SCOPE.md"", ""repo"": ""whitehat-security"", ""sha256"": ""8af1dcd511ae0c39c529bf5a3a7d7d7f18800729c0bb5ef5ec1cc358526bc9ed""}"
+whynot-control,63,76af2d82-9a4b-4797-b542-3f4f5545b6cc,UNRESOLVED,unresolved,public,No sufficiently clear steward among the proposed organizations. Retain current path pending an explicit stewardship choice; experimental maturity is not ownership.,"{""head"": ""cadbe22d9e806d53fc96ab0934555f4720c6dc84"", ""path"": ""SCOPE.md"", ""repo"": ""whynot-control"", ""sha256"": ""f4af21e5525c39c4a4b268d64117443e6b06db1caefafb16cc2c33636df19a66""}"
+whynot-design,64,a53a75fb-e9fa-41d9-8a96-12a4b924dc63,UNRESOLVED,unresolved,public,No sufficiently clear steward among the proposed organizations. Retain current path pending an explicit stewardship choice; experimental maturity is not ownership.,"{""head"": ""a79a4d803e9aed13f66d072bf409b6f86000f01f"", ""path"": ""SCOPE.md"", ""repo"": ""whynot-design"", ""sha256"": ""ec1eecdac57b7e82108760f699b9f08503130e556d4e41764728fea57251a88a""}"
+wise-validator,65,,helixforge,draft,public,"Software factory, development tooling, knowledge/interface framework or capability lifecycle responsibility.","{""head"": ""7c83e388d88c43aae720e1e435758ee357cbe5d9"", ""path"": ""INTENT.md"", ""repo"": ""wise-validator"", ""sha256"": ""8e73ffd7d972135a5b56d13473519eeaaffdf0e6b17b2c1c3779bcc5b6ffe87d""}"
+zone-engine,131,ff057178-b3ca-48f4-b7b5-2cda570ed12f,netkingdom,draft,public,"Security, identity, authority, policy or security-evidence responsibility; runtime placement does not determine this assignment.","{""head"": ""9fd05d09fe17aaeee1347b9cc35a2d6618f37304"", ""path"": ""SCOPE.md"", ""repo"": ""zone-engine"", ""sha256"": ""953dbf718481adae00fa53258ede0632df65bdc7f6a1cb3e1dd3344357dba80d""}"
--- a/taxonomy/assignments.json
+++ b/taxonomy/assignments.json
--- a/tests/test_inventory.py
+++ b/tests/test_inventory.py
@ -0,0 +1,51 @@
+import importlib.util
+from pathlib import Path
+import subprocess
+import tempfile
+import unittest
+
+
+def module(name):
+    spec=importlib.util.spec_from_file_location(name,Path(__file__).parents[1]/'tools'/f'{name}.py')
+    m=importlib.util.module_from_spec(spec);spec.loader.exec_module(m);return m
+
+inv=module('inventory');verify=module('verify_inventory')
+
+class InventoryTests(unittest.TestCase):
+    def test_scan_emits_reference_only_and_skips_sensitive_files(self):
+        with tempfile.TemporaryDirectory() as d:
+            p=Path(d)
+            subprocess.run(['git','init','-q',d],check=True)
+            (p/'values.yaml').write_text('image: https://user:do-not-emit@forgejo.example/coulomb/example:tag?token=also-private\n')
+            (p/'.env').write_text('SECRET=coulomb/private-secret\n')
+            (p/'link').symlink_to(p/'values.yaml')
+            subprocess.run(['git','-C',d,'add','.'],check=True)
+            subprocess.run(['git','-C',d,'-c','user.name=Test','-c','user.email=test@example.invalid','commit','-qm','fixture'],check=True)
+            result=inv.scan(p)
+            self.assertEqual([r['reference'] for r in result['references']],['coulomb/example'])
+            self.assertNotIn('do-not-emit',str(result));self.assertNotIn('also-private',str(result))
+            self.assertNotIn('private-secret',str(result))
+            self.assertEqual({e['reason'] for e in result['exclusions']},{'sensitive-or-encrypted','symlink-not-followed'})
+            self.assertEqual(result,inv.scan(p))
+
+    def test_paginated_server_read_does_not_stop_at_first_page(self):
+        original=inv.get
+        try:
+            inv.get=lambda url: [{'id':1}] if 'page=1' in url else [{'id':2}] if 'page=2' in url else []
+            self.assertEqual(inv.pages('/repos'),[{'id':1},{'id':2}])
+            inv.get=lambda url:[{'id':1}]
+            with self.assertRaises(RuntimeError):inv.pages('/repos')
+        finally:inv.get=original
+
+    def test_empty_partial_inventory_cannot_pass(self):
+        result=verify.check({'g1_complete':False,'local_repositories':[]},{'approved':False,'assignments':[]})
+        self.assertFalse(result['clean'])
+
+    def test_retained_org_and_stale_moved_path(self):
+        i={'g1_complete':True,'local_repositories':[{'name':'consumer','references':[{'reference':'coulomb/example','categories':['historical-or-planning']}]}]}
+        m={'approved':True,'assignments':[{'repository':'example','proposed_org':'coulomb'}]}
+        self.assertTrue(verify.check(i,m)['clean'])
+        m['assignments'][0]['proposed_org']='railiance'
+        self.assertFalse(verify.check(i,m)['clean'])
+
+if __name__=='__main__':unittest.main()
--- a/tools/inventory.py
+++ b/tools/inventory.py
@ -0,0 +1,206 @@
+#!/usr/bin/env python3
+"""Read-only org-reference inventory. Emits reference tokens, never source lines."""
+import argparse
+import concurrent.futures
+import hashlib
+import io
+import zipfile
+import json
+import re
+import subprocess
+import urllib.error
+import urllib.request
+from pathlib import Path
+
+BASE = 'https://forgejo.coulomb.social'
+# Capture only the owner and first path component; never URL credentials/query.
+REF = re.compile(r'(?<![A-Za-z0-9_-])coulomb/([A-Za-z0-9_.-]+)')
+SENSITIVE = re.compile(r'(^|/)(\.env($|\.)|id_rsa|id_ed25519)|\.(pem|key|p12|pfx|age)$|sops\.|\.sops\.', re.I)
+BINARY = {'.png','.jpg','.jpeg','.gif','.pdf','.zip','.gz','.woff','.woff2','.ico','.mp4','.sqlite','.db'}
+SELF = Path(__file__).resolve().parents[1]
+
+
+def run(repo, *args):
+    r = subprocess.run(['git', '-C', str(repo), *args], capture_output=True)
+    if r.returncode:
+        raise RuntimeError('git ' + args[0] + ' failed')
+    return r.stdout
+
+
+def get(url):
+    try:
+        with urllib.request.urlopen(url, timeout=30) as r:
+            return json.load(r)
+    except urllib.error.HTTPError as e:
+        raise RuntimeError('HTTP ' + str(e.code)) from None
+
+
+def pages(path):
+    rows = []
+    seen = set()
+    for page in range(1, 1001):
+        batch = get(BASE + path + f'?limit=50&page={page}')
+        if not isinstance(batch, list):
+            raise RuntimeError('expected paginated list')
+        if not batch:
+            return rows
+        digest = hashlib.sha256(json.dumps(batch, sort_keys=True).encode()).hexdigest()
+        if digest in seen:
+            raise RuntimeError('pagination repeated a page')
+        seen.add(digest)
+        rows.extend(batch)
+    raise RuntimeError('pagination limit exceeded')
+
+
+def categories(path):
+    p = path.lower()
+    kinds = []
+    for flag, name in [
+        ('argocd' in p, 'gitops'),
+        (p.endswith('chart.yaml'), 'chart-metadata'),
+        ('chart' in p or 'values' in p, 'chart-values'),
+        (p.endswith('.gitmodules'), 'submodule'),
+        (any(x in p for x in ['.gitea/','.forgejo/','.github/','workflow','jenkins','ci/']), 'ci'),
+        (any(x in p for x in ['retention','prune','live-image','release','rollback']), 'release-retention'),
+        (any(x in p for x in ['credential','policy','routing','access']), 'access-policy'),
+        (any(x in p for x in ['lock','requirements','pyproject','package.json','npmrc']), 'package-consumer'),
+        (any(x in p.split('/') for x in ['history','archived','evidence','workplans']), 'historical-or-planning'),
+    ]:
+        if flag:
+            kinds.append(name)
+    return kinds or ['other']
+
+
+def scan(path):
+    errors, exclusions, refs = [], [], []
+    start = run(path, 'rev-parse', 'HEAD').decode().strip()
+    remotes = []
+    raw = run(path, 'config', '--get-regexp', r'^remote\..*\.url$') if run(path,'remote').strip() else b''
+    for line in raw.decode(errors='replace').splitlines():
+        key, value = line.split(' ', 1)
+        match = REF.search(value)
+        remotes.append({'remote':key.split('.')[1], 'owner_path':match.group(0).removesuffix('.git') if match else None,
+                        'transport':'https' if value.startswith('https:') else 'ssh-or-other'})
+    files = sorted(set(run(path, 'ls-files', '-z', '--cached', '--others', '--exclude-standard').split(b'\0')) - {b''})
+    h = hashlib.sha256()
+    for encoded in files:
+        name = encoded.decode(errors='replace')
+        file = path / name
+        if file.is_dir():
+            exclusions.append({'path':name,'reason':'gitlink-or-directory-not-scanned'}); continue
+        if file.is_symlink():
+            exclusions.append({'path':name,'reason':'symlink-not-followed'}); continue
+        if SENSITIVE.search(name):
+            exclusions.append({'path':name,'reason':'sensitive-or-encrypted'}); continue
+        if file.suffix.lower() in BINARY:
+            exclusions.append({'path':name,'reason':'binary-extension'}); continue
+        try:
+            if file.stat().st_size > 4_000_000:
+                exclusions.append({'path':name,'reason':'over-4MB'}); continue
+            data = file.read_bytes()
+        except OSError:
+            errors.append({'path':name,'reason':'unreadable-or-missing'}); continue
+        h.update(encoded + b'\0' + hashlib.sha256(data).digest())
+        if b'\0' in data:
+            exclusions.append({'path':name,'reason':'binary-content'}); continue
+        for number, line in enumerate(data.decode(errors='replace').splitlines(), 1):
+            for match in REF.finditer(line):
+                refs.append({'path':name,'line':number,'reference':match.group(0), 'categories':categories(name)})
+    end = run(path, 'rev-parse', 'HEAD').decode().strip()
+    if start != end:
+        errors.append({'reason':'HEAD-changed-during-scan'})
+    return {'name':path.name, 'path':str(path), 'head':start,
+            'content_sha256':h.hexdigest(), 'remotes':remotes, 'files_considered':len(files),
+            'references':refs,'exclusions':exclusions,'errors':errors}
+
+
+
+def scan_archive(repo):
+    """Read a public default-branch archive in memory, never extract to disk."""
+    name=repo['name']
+    branch=repo['default_branch']
+    from urllib.parse import quote
+    branch_info=get(BASE+'/api/v1/repos/coulomb/'+name+'/branches/'+quote(branch,safe=''))
+    commit=branch_info['commit']['id']
+    url=BASE+'/api/v1/repos/coulomb/'+name+'/archive/'+commit+'.zip'
+    with urllib.request.urlopen(url,timeout=30) as response:
+        raw=response.read(50_000_001)
+    if len(raw)>50_000_000:
+        raise RuntimeError('archive exceeds 50MB')
+    refs=[];exclusions=[]
+    with zipfile.ZipFile(io.BytesIO(raw)) as archive:
+        for item in sorted(archive.infolist(),key=lambda i:i.filename):
+            if item.is_dir(): continue
+            path=item.filename.split('/',1)[-1]
+            if SENSITIVE.search(path) or Path(path).suffix.lower() in BINARY or item.file_size>4_000_000:
+                exclusions.append({'path':path,'reason':'sensitive-binary-or-large'});continue
+            data=archive.read(item)
+            if b'\0' in data:continue
+            for number,line in enumerate(data.decode(errors='replace').splitlines(),1):
+                for match in REF.finditer(line):
+                    refs.append({'path':path,'line':number,'reference':match.group(0),'categories':categories(path)})
+    return {'name':name,'commit':commit,'references':refs,'exclusions':exclusions}
+
+
+def collect(root):
+    gaps = [
+        'Anonymous forge enumeration cannot attest private repository/package completeness.',
+        'Team membership, deploy keys, webhooks, runners, protected branches and server-side access policies require an authorized owner export.',
+        'Local working trees and public remote-only default-branch archives are scanned; other branches and inaccessible repos are not content-scanned.',
+        'Hidden sibling directories, ignored files, submodule contents outside discovered repos, binary/large/encrypted files and symlinks are not scanned; exclusions are recorded.',
+        'Runtime image/source inventory is collected separately; source scan cannot attest all runtime or external consumers.',
+        'Dynamic/computed org or repository names require owner review; token scan finds literal coulomb/ references only.',
+    ]
+    hub = get('http://127.0.0.1:8000/repos/')
+    repos = pages('/api/v1/orgs/coulomb/repos')
+    try:
+        packages = pages('/api/v1/packages/coulomb')
+    except (RuntimeError, OSError):
+        packages = []; gaps.append('Package API unavailable.')
+    paths = {p.resolve() for p in root.iterdir() if p.is_dir() and not p.name.startswith('.') and (p/'.git').exists()}
+    paths.update(Path(r['local_path']).resolve() for r in hub if r.get('local_path') and (Path(r['local_path'])/'.git').exists())
+    paths.discard(SELF)
+    with concurrent.futures.ThreadPoolExecutor(max_workers=6) as pool:
+        scans = list(pool.map(scan, sorted(paths)))
+    server = [{k:r.get(k) for k in ['id','name','full_name','private','archived','default_branch','description']} for r in repos]
+    registered = [{k:r.get(k) for k in ['id','slug','local_path','status','description']} for r in hub]
+    local_names = {m['owner_path'] for s in scans for m in s['remotes'] if m['owner_path']}
+    public_names = {r['full_name'] for r in server}
+    remote_scans=[]
+    for repo in server:
+        if repo['full_name'] not in local_names and repo['name']!=SELF.name:
+            try: remote_scans.append(scan_archive(repo))
+            except (OSError,RuntimeError,ValueError): gaps.append('Remote archive unavailable: '+repo['full_name'])
+    return {'schema_version':1,'forge':{'base_url':BASE,'version':get(BASE+'/api/v1/version'),'authentication':'anonymous'},
+            'g1_complete':False, 'coverage_gaps':gaps,
+            'server_repositories':sorted(server,key=lambda r:r['id']),
+            'registered_repositories':sorted(registered,key=lambda r:r['slug']),
+            'packages': sorted([{'id':p.get('id'),'name':p.get('name'),'type':p.get('type'),'version':p.get('version'),
+                                'owner':(p.get('owner') or {}).get('login'),
+                                'linked_repository_id':(p.get('repository') or {}).get('id')} for p in packages],key=lambda p:(str(p['id']),str(p['version']))),
+            'reconciliation':{'server_without_local_origin':sorted(public_names-local_names-{f'coulomb/{SELF.name}'}),
+                              'local_origin_not_publicly_listed':sorted(local_names-public_names),
+                              'coordinator_excluded':str(SELF)},
+            'local_repositories':scans,'remote_archives':remote_scans}
+
+
+def main():
+    ap = argparse.ArgumentParser(description=__doc__)
+    ap.add_argument('--root',type=Path,default=Path('/home/worsch'))
+    ap.add_argument('--output',type=Path,required=True)
+    ap.add_argument('--compare',type=Path)
+    args=ap.parse_args()
+    result=collect(args.root)
+    encoded=json.dumps(result,sort_keys=True,indent=2)+'\n'
+    args.output.write_text(encoded)
+    print(json.dumps({'repos':len(result['server_repositories']), 'local_repos':len(result['local_repositories']),
+                      'references':sum(len(r['references']) for r in result['local_repositories']),
+                      'sha256':hashlib.sha256(encoded.encode()).hexdigest(),'g1_complete':False}))
+    if args.compare:
+        same=json.loads(args.compare.read_text())==result
+        print('normalized_equal='+str(same).lower())
+        return 0 if same else 2
+    return 0
+
+if __name__=='__main__':
+    raise SystemExit(main())
--- a/tools/runtime_inventory.py
+++ b/tools/runtime_inventory.py
@ -0,0 +1,52 @@
+#!/usr/bin/env python3
+"""Project only names, image paths and GitOps source fields; never query Secrets."""
+import argparse
+import json
+import subprocess
+from urllib.parse import urlsplit, urlunsplit
+
+
+def get(resource):
+    r=subprocess.run(['kubectl','get',resource,'-A','-o','json'],capture_output=True,text=True)
+    if r.returncode:
+        raise RuntimeError('Read failed for '+resource)
+    return json.loads(r.stdout)['items']
+
+
+def safe_url(value):
+    p=urlsplit(value)
+    return urlunsplit((p.scheme,p.hostname or '',p.path,'','')) if p.scheme else value.split('?')[0]
+
+
+def main():
+    ap=argparse.ArgumentParser(description=__doc__)
+    ap.add_argument('--output',required=True)
+    args=ap.parse_args()
+    nodes=get('nodes')
+    addresses={a['address'] for n in nodes for a in n.get('status',{}).get('addresses',[])}
+    if '92.205.62.239' not in addresses:
+        raise RuntimeError('Expected railiance01 node IP not found; refusing wrong-cluster capture')
+    rows=[]
+    for resource in ['deployments','statefulsets','daemonsets','jobs','cronjobs','services.serving.knative.dev','clusters.postgresql.cnpg.io']:
+        for item in get(resource):
+            spec=item.get('spec',{})
+            pod=spec.get('jobTemplate',{}).get('spec',{}).get('template',{}).get('spec',{}) if item['kind']=='CronJob' else spec.get('template',{}).get('spec',{})
+            images=sorted({c['image'] for key in ['containers','initContainers'] for c in pod.get(key,[]) if c.get('image')})
+            if spec.get('imageName'): images.append(spec['imageName'])
+            rows.append({'kind':item['kind'],'namespace':item['metadata'].get('namespace'),'name':item['metadata']['name'],
+                         'images':images,'image_pull_secret_names':sorted(x['name'] for x in pod.get('imagePullSecrets',[])),
+                         'owners':[{'kind':o['kind'],'name':o['name']} for o in item['metadata'].get('ownerReferences',[])]})
+    apps=[]
+    for i in get('applications.argoproj.io'):
+        s=i['spec']; sources=s.get('sources',[])+([s['source']] if s.get('source') else [])
+        apps.append({'name':i['metadata']['name'],'namespace':i['metadata']['namespace'],'project':s.get('project'),
+                     'sources':[{k:safe_url(v) if k=='repoURL' else v for k,v in src.items() if k in ['repoURL','path','chart','targetRevision']} for src in sources]})
+    projects=[{'name':i['metadata']['name'],'namespace':i['metadata']['namespace'],
+               'sourceRepos':[safe_url(x) for x in i['spec'].get('sourceRepos',[])]} for i in get('appprojects.argoproj.io')]
+    result={'cluster':'railiance01','node_ip_verified':'92.205.62.239','coverage':'All namespaces; workload controller units, not pod/replicaset duplicates. Jobs may be historical; owners retained. Secrets never queried.',
+            'workloads':sorted(rows,key=lambda r:(r['namespace'] or '',r['kind'],r['name'])),
+            'applications':sorted(apps,key=lambda r:r['name']),'projects':sorted(projects,key=lambda r:r['name'])}
+    with open(args.output,'w') as f: json.dump(result,f,indent=2,sort_keys=True);f.write('\n')
+    print('Captured',len(rows),'controllers;',len(apps),'Applications;',len(projects),'AppProjects')
+
+if __name__=='__main__': main()
--- a/tools/verify_inventory.py
+++ b/tools/verify_inventory.py
@ -0,0 +1,37 @@
+#!/usr/bin/env python3
+"""Fail-closed G6 check of literal old paths against an accepted assignment matrix."""
+import argparse
+import json
+
+
+def check(inventory, matrix):
+    blockers=[]
+    if not inventory.get('g1_complete'):blockers.append('Inventory coverage has not been accepted as complete')
+    if not matrix.get('approved'):blockers.append('Assignment matrix is not approved')
+    assignments={r['repository']:r for r in matrix['assignments']}
+    stale=[]
+    sources=inventory['local_repositories']+inventory.get('remote_archives',[])
+    for repo in sources:
+        for ref in repo['references']:
+            name=ref['reference'].split('/',1)[1].removesuffix('.git')
+            row=assignments.get(name)
+            # Historical matches need explicit disposition, never automatic exemption.
+            if not row or row.get('proposed_org')!='coulomb':
+                stale.append({'repo':repo['name'],**ref})
+        for remote in repo.get('remotes',[]):
+            path=remote.get('owner_path')
+            if path and assignments.get(path.split('/',1)[1],{}).get('proposed_org')!='coulomb':
+                stale.append({'repo':repo['name'],'remote':remote['remote'],'reference':path})
+    if any(not r.get('proposed_org') for r in matrix['assignments']):blockers.append('Unresolved organization assignments')
+    return {'clean':not blockers and not stale,'blockers':blockers,'old_path_findings':len(stale)}
+
+
+def main():
+    p=argparse.ArgumentParser(description=__doc__)
+    p.add_argument('--inventory',required=True);p.add_argument('--assignments',required=True)
+    a=p.parse_args()
+    result=check(json.load(open(a.inventory)),json.load(open(a.assignments)))
+    print(json.dumps(result,indent=2))
+    return 0 if result['clean'] else 1
+
+if __name__=='__main__':raise SystemExit(main())
--- a/workplans/ORGREF-WP-0001-foundation-and-entry-gate.md
+++ b/workplans/ORGREF-WP-0001-foundation-and-entry-gate.md
@ -4,7 +4,7 @@ type: workplan
 title: "Foundation, blast-radius inventory, and execution entry gate"
 domain: infotech
 repo: prj-forgejo-org-refactor
-status: backlog
+status: blocked
 flavor: implementation
 owner: codex
 topic_slug: railiance
@ -22,17 +22,18 @@ state_hub_workstream_id: "c1dcd349-1a7a-51ae-8827-4ce96cfe0008"

 ## Status note

-`backlog`, deliberately. Operator decision of 2026-08-11: seed the project now,
-execute later, once the surrounding structure is stable enough that side-effect
-complications can be tested for rather than discovered in production.
+`blocked` after authorized read-only preparation on 2026-09-28. The founder's
+August 11 production deferral remains in force. T01/T02 now have review artifacts
+and are waiting on evidence/access and stewardship decisions; T03–T05 have not
+started.

 This workplan exists so the finding and its evidence are not lost, and so the
 condition for starting is written down and checkable rather than a judgement
 call made from memory months later.

-All tasks remain `todo`: this review updates the plan, not task acceptance.
-An operator may move T01/T02 to `progress` before the full execution gate
-because they are read-only; T03 onward still requires all four gate conditions.
+The user authorized preparation on September 28. T01/T02 are `wait` after the
+bounded preparation below; their acceptance criteria are not yet met. T03 onward
+still requires all four gate conditions.

 ## Entry gate — do not start T03 onward until all four hold

@ -59,8 +60,8 @@ See [evidence, owner records and next sequence](../history/2026-09-28-readiness-
 | Condition | Current evidence | Disposition |
 | --- | --- | --- |
 | 1 | Validator implemented in `RMASTER-WP-0021-T05`; current local scan: 16 declarations, zero errors, one warning | Green for inspected fleet; rerun before execution |
-| 2 | Coverage check exists (`RMASTER-WP-0021-T06`); universal scope clarified by `RMASTER-WP-0025`. August 13 snapshot yields 36 errors/19 warnings today | Not met; fresh complete coverage required |
-| 3 | No complete G1 command or stable paired output; bounded local count now 151 `coulomb` origins | Not met; T01 remains open |
+| 2 | Fresh September 28 platform capture: 68 units; validator reports 52 errors/10 warnings. Wider runtime capture covers 132 controllers | Not met; owner mapping/name drift and collector coverage still need resolution |
+| 3 | Collector implemented; 141 public repos + 12 additional local paths, 2,160 source/archive references. Paired reference sets match but fleet revisions/content changed; private/package/access evidence missing | Not met; partial inventory is not G1 acceptance |
 | 4 | No applicable Git/package transfer rollback receipt found | Not met; T03 onward remains gated |

 **Circular prerequisite:** T04 cannot produce the first condition-4 proof while
@ -94,7 +95,7 @@ It must not:

 ```task
 id: ORGREF-WP-0001-T01
-status: todo
+status: wait
 priority: high
 state_hub_task_id: "4964bf8f-96eb-59f0-8a50-5ecb5c7dbc8f"
 ```
@ -118,6 +119,22 @@ moved paths against an approved disposition list, preserving legitimate retained
 `coulomb` paths and historical records. This read-only collector/evidence belongs
 here; production fixes belong to the owning repos.

+Preparation delivered September 28:
+
+- `tools/inventory.py`, paired snapshots and `inventory/comparison.json`;
+  150 non-coordinator local checkouts plus two pinned public remote-only archives,
+  2,133 local + 27 archive reference occurrences, no scan errors.
+- Fresh workload and GitOps exports, source revision/content hashes, exclusions,
+  machine-readable repo/State Hub reconciliation and safe reference-only records.
+- Four focused tests pass; the migration cleanliness precheck correctly refuses
+  incomplete coverage and an unapproved matrix.
+- Waiting on authenticated metadata decision
+  `5f3680fc-0cd5-4d27-ba39-59fbdd13313c`, exclusion/consumer coverage review and an
+  unchanged-fleet pair. The existing credential lane was denied by flex-auth;
+  package ownership and private completeness are not known.
+
+See [inventory instructions and gaps](../inventory/README.md). T01 is not done.
+
 Known starting evidence, verified 2026-08-11: 112 repos with a `coulomb/`
 origin; `repoURL: https://forgejo.coulomb.social/coulomb/railiance-platform.git`
 in `railiance-platform/argocd/applications/`; `repository:
@ -126,7 +143,7 @@ forgejo.coulomb.social/coulomb/core-hub` in `railiance-apps/charts/core-hub/valu

 ```task
 id: ORGREF-WP-0001-T02
-status: todo
+status: wait
 priority: high
 state_hub_task_id: "00d150ed-81dd-51ac-af7b-197900373cbe"
 ```
@ -151,6 +168,14 @@ Acceptance requires every server repo's stable ID, target, steward, rationale,
 visibility/team permissions and unresolved assignment (if any); approve the
 matrix and select the permanent convention owner before declaring G2 complete.

+Preparation delivered September 28: [taxonomy proposal](../taxonomy/README.md)
+and CSV/JSON matrix cover 153 known paths: 118 proposed org assignments and 35
+explicitly unresolved stewards. Visibility is preserved by proposal; named teams,
+actual grants and missing private IDs still need owner evidence. Recommend no
+lifecycle-only `experimental` org and `the-custodian` as the durable convention
+home, both pending acceptance. Decision
+`60c5767c-d510-4d13-9a24-d5d58485b7e5` tracks the concrete review. G2 is not accepted.
+
 ```task
 id: ORGREF-WP-0001-T03
 status: todo
@ -202,6 +227,9 @@ an org split with an unplanned host or forge-product migration.

 ## Residuals

+- T01 metadata access/completeness: `5f3680fc-0cd5-4d27-ba39-59fbdd13313c`.
+- T02 matrix/maintainer/convention acceptance: `60c5767c-d510-4d13-9a24-d5d58485b7e5`.
+
 - Resolve pending gate decision `e9aca79b-f167-4326-94cd-037dcea34cd2`.
 - Fresh deployable coverage and gap closure remain with platform/framework and
  workload owners; link their work by stable ID rather than importing tasks.