coulomb/prj-forgejo-org-refactor
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Forge visibility policy: points 4-6 decided, lockdown guardrails and pre-check

Browse source 
Interim lockdown approved under the founder's guardrail: gradual, no lockout,
no asset loss. Pre-check found executor-sandbox diverged and ops-mason dirty;
both wait for their owners.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5457@bnt-lap001
Assistant-Session: 792bf84a-3783-4f5d-a811-cded61dd2012
This commit is contained in:
tegwick 2026-10-08 18:56:40 +02:00
parent bc474c1cd6
commit 8fe5db8567
2 changed files with 52 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

55
decisions/forge-visibility-policy.md
View file

@ -1,7 +1,7 @@
# Forge visibility policy (ORGREF-WP-0002-T01)
Status: **partly decided** (founder, 2026-10-08). Points 1, 2 and 4 are decided.
Points 3, 5 and 6 and the plan's owner are open.
Status: **partly decided** (founder, 2026-10-08). Points 1, 2, 4, 5 and 6 are
decided. Point 3 and the plan's owner are open.
## 1. The forge is private, with no anonymous access — decided
@ -71,21 +71,56 @@ A public assets location will come later, deliberately: a specific asset
repository and store with creator and trust management. It is **not** improvised
now, and Telegram images do not wait for it.
## 5. Interim lockdown — open
## 5. Interim lockdown — decided, with guardrails
Proposed: close now the sensitive repositories with no anonymous reader
The interim set is approved: the sensitive repositories with no anonymous reader
(inventory 2026-10-08): `disaster-control`, `railiance-hosts`, `secrets-engine`,
`rapp-secrets-engine`, `rapp-openbao`, `rapp-policy-nexus`, `fin-hub`,
`qonto-assistant`, `rapp-tenant-engine`, `executor-sandbox`, `ops-mason`,
`rein-aharness`, `rein-openweights`.
`rein-aharness`, `rein-openweights`. `hall-of-helix` stays readable until its
publication path exists.
Under point 2, `hall-of-helix` should stay readable until its publication
path exists, so it is not in the interim set.
Founder guardrail, and the rule for every later wave as well: **tighten
gradually. Never lock ourselves out, never risk losing assets, never end up in a
state that is hard to repair.** Concretely:
## 6. Exposed history — open
1. **Before anything closes:** confirm that a current local clone of each
repository exists (SSH, `forgejo-remote`) and is up to date with the server.
Confirm that the founder account and the local administrator can sign in, and
that administrator recovery is documented. Visibility changes delete nothing,
but the clone is the recovery path if anything goes wrong.
2. **One repository first,** the least connected one. Close it, then verify:
founder web view, SSH fetch and push, agent clone over SSH, and that an
anonymous request gets 404. Reopen it once to prove the rollback, then close
it again.
3. **Then the rest in small batches,** with the same checks after each batch.
Stop at the first surprise and reopen what that batch changed.
4. **Only visibility changes.** No deletion, archiving, transfer, renaming, team
or permission edits, and no instance settings (`REQUIRE_SIGNIN_VIEW` stays for
the final wave).
5. **Record every change** (repository, time, before and after, check results)
under `inventory/`, so that any step can be undone exactly.
Proposed: T03 scans public history and drives rotations in parallel; it does
not block the waves.
### Step 1 pre-check, 2026-10-08
Local clones exist for all 13 and were fetched. 11 are clean and level with
`origin/main`. Two need their owners first and stay out of the first batch:
- **`executor-sandbox`:** local `master` and server `main` have diverged: 3 local
commits were never pushed, and the server has 5 that the local branch lacks.
Both histories are now held locally (`origin/main` fetched), so closing loses
nothing. The unpushed work belongs to the owner to reconcile; it is not changed
here.
- **`ops-mason`:** 3 uncommitted local changes. Server state is fetched; the
changes are the owner's.
Suggested first repository for step 2: `rapp-openbao` or `railiance-hosts`
(single branch, clean, no anonymous reader).
## 6. Exposed history — decided
T03 scans public history and drives rotations in parallel. It does not block
the waves.
## Owner — open

9
workplans/ORGREF-WP-0002-forge-closure-netkingdom-access.md
View file

@ -128,8 +128,13 @@ publisher with sanitization, withdrawn by renaming the folder. Hall of Helix
stays a published PR edge, tied to coulomb.social spaces as projections of
repos. Point 4 decided: the adapter uploads Telegram images itself
(fluid-telegram FT-WP-0001-T14); a dedicated public asset store with creator and
trust management comes later, not now. Points 3, 5 and 6 and the owner are
still open.
trust management comes later, not now. Points 5 and 6 decided: interim
lockdown of 13 repositories under the founder's guardrail (tighten gradually,
no lockout, no asset loss, nothing hard to repair: clones first, one repository,
verify and roll back once, then small batches, visibility only). T03 runs in
parallel. Pre-check: executor-sandbox (diverged, unpushed local commits) and
ops-mason (uncommitted changes) wait for their owners. Open: point 3 (packages)
and the owner.
```task
id: ORGREF-WP-0002-T02