From 8fe5db8567ad13da304e2b7637123f0352a951c4 Mon Sep 17 00:00:00 2001 From: tegwick Date: Thu, 8 Oct 2026 18:56:40 +0200 Subject: [PATCH] Forge visibility policy: points 4-6 decided, lockdown guardrails and pre-check Interim lockdown approved under the founder's guardrail: gradual, no lockout, no asset loss. Pre-check found executor-sandbox diverged and ops-mason dirty; both wait for their owners. Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 5457@bnt-lap001 Assistant-Session: 792bf84a-3783-4f5d-a811-cded61dd2012 --- decisions/forge-visibility-policy.md | 55 +++++++++++++++---- ...WP-0002-forge-closure-netkingdom-access.md | 9 ++- 2 files changed, 52 insertions(+), 12 deletions(-) diff --git a/decisions/forge-visibility-policy.md b/decisions/forge-visibility-policy.md index cd5a170..80395e0 100644 --- a/decisions/forge-visibility-policy.md +++ b/decisions/forge-visibility-policy.md @@ -1,7 +1,7 @@ # Forge visibility policy (ORGREF-WP-0002-T01) -Status: **partly decided** (founder, 2026-10-08). Points 1, 2 and 4 are decided. -Points 3, 5 and 6 and the plan's owner are open. +Status: **partly decided** (founder, 2026-10-08). Points 1, 2, 4, 5 and 6 are +decided. Point 3 and the plan's owner are open. ## 1. The forge is private, with no anonymous access — decided @@ -71,21 +71,56 @@ A public assets location will come later, deliberately: a specific asset repository and store with creator and trust management. It is **not** improvised now, and Telegram images do not wait for it. -## 5. Interim lockdown — open +## 5. Interim lockdown — decided, with guardrails -Proposed: close now the sensitive repositories with no anonymous reader +The interim set is approved: the sensitive repositories with no anonymous reader (inventory 2026-10-08): `disaster-control`, `railiance-hosts`, `secrets-engine`, `rapp-secrets-engine`, `rapp-openbao`, `rapp-policy-nexus`, `fin-hub`, `qonto-assistant`, `rapp-tenant-engine`, `executor-sandbox`, `ops-mason`, -`rein-aharness`, `rein-openweights`. +`rein-aharness`, `rein-openweights`. `hall-of-helix` stays readable until its +publication path exists. -Under point 2, `hall-of-helix` should stay readable until its publication -path exists, so it is not in the interim set. +Founder guardrail, and the rule for every later wave as well: **tighten +gradually. Never lock ourselves out, never risk losing assets, never end up in a +state that is hard to repair.** Concretely: -## 6. Exposed history — open +1. **Before anything closes:** confirm that a current local clone of each + repository exists (SSH, `forgejo-remote`) and is up to date with the server. + Confirm that the founder account and the local administrator can sign in, and + that administrator recovery is documented. Visibility changes delete nothing, + but the clone is the recovery path if anything goes wrong. +2. **One repository first,** the least connected one. Close it, then verify: + founder web view, SSH fetch and push, agent clone over SSH, and that an + anonymous request gets 404. Reopen it once to prove the rollback, then close + it again. +3. **Then the rest in small batches,** with the same checks after each batch. + Stop at the first surprise and reopen what that batch changed. +4. **Only visibility changes.** No deletion, archiving, transfer, renaming, team + or permission edits, and no instance settings (`REQUIRE_SIGNIN_VIEW` stays for + the final wave). +5. **Record every change** (repository, time, before and after, check results) + under `inventory/`, so that any step can be undone exactly. -Proposed: T03 scans public history and drives rotations in parallel; it does -not block the waves. +### Step 1 pre-check, 2026-10-08 + +Local clones exist for all 13 and were fetched. 11 are clean and level with +`origin/main`. Two need their owners first and stay out of the first batch: + +- **`executor-sandbox`:** local `master` and server `main` have diverged: 3 local + commits were never pushed, and the server has 5 that the local branch lacks. + Both histories are now held locally (`origin/main` fetched), so closing loses + nothing. The unpushed work belongs to the owner to reconcile; it is not changed + here. +- **`ops-mason`:** 3 uncommitted local changes. Server state is fetched; the + changes are the owner's. + +Suggested first repository for step 2: `rapp-openbao` or `railiance-hosts` +(single branch, clean, no anonymous reader). + +## 6. Exposed history — decided + +T03 scans public history and drives rotations in parallel. It does not block +the waves. ## Owner — open diff --git a/workplans/ORGREF-WP-0002-forge-closure-netkingdom-access.md b/workplans/ORGREF-WP-0002-forge-closure-netkingdom-access.md index d819dab..e5e5e67 100644 --- a/workplans/ORGREF-WP-0002-forge-closure-netkingdom-access.md +++ b/workplans/ORGREF-WP-0002-forge-closure-netkingdom-access.md @@ -128,8 +128,13 @@ publisher with sanitization, withdrawn by renaming the folder. Hall of Helix stays a published PR edge, tied to coulomb.social spaces as projections of repos. Point 4 decided: the adapter uploads Telegram images itself (fluid-telegram FT-WP-0001-T14); a dedicated public asset store with creator and -trust management comes later, not now. Points 3, 5 and 6 and the owner are -still open. +trust management comes later, not now. Points 5 and 6 decided: interim +lockdown of 13 repositories under the founder's guardrail (tighten gradually, +no lockout, no asset loss, nothing hard to repair: clones first, one repository, +verify and roll back once, then small batches, visibility only). T03 runs in +parallel. Pre-check: executor-sandbox (diverged, unpushed local commits) and +ops-mason (uncommitted changes) wait for their owners. Open: point 3 (packages) +and the owner. ```task id: ORGREF-WP-0002-T02