Record the forge visibility policy, points 1-2 decided

Forge private without anonymous access; publication via a per-repo public/
folder of symlinks, projected outward by a shared, sanitizing publisher.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5457@bnt-lap001
Assistant-Session: 792bf84a-3783-4f5d-a811-cded61dd2012

decisions/forge-visibility-policy.md

@@ -0,0 +1,89 @@
+# Forge visibility policy (ORGREF-WP-0002-T01)
+
+Status: **partly decided** (founder, 2026-10-08). Points 1 and 2 are decided.
+Points 3–6 and the plan's owner are open.
+
+## 1. The forge is private, with no anonymous access — decided
+
+Every org, repository and package on `forgejo.coulomb.social` is private, and
+the final wave sets `REQUIRE_SIGNIN_VIEW=true`. The forge is internal
+infrastructure. Public codebases, when there are any, are published to a
+separate location with its own publicity, probably not one we build
+(GitHub or similar).
+
+## 2. Publication is a per-repo `public/` convention, not a visibility setting — decided
+
+Licensing is experimental and is **not** an input to access decisions.
+
+What to publish, where and for whom is a series of decisions per repository.
+They are made through a shared publication-flow mechanism, not reinvented per
+repository. The baseline is the Unix home directory's public folder:
+
+- **`public/` holds only symlinks**, never original content. Each link points to
+  a file inside the same repository.
+- **Everything reachable through `public/` may be made readable from outside**,
+  by a publisher that projects it to the public location. Nothing outside
+  `public/` is published.
+- **Emergency removal:** renaming the folder (for example to `public.withdrawn/`)
+  withdraws everything at once.
+- **Transparency:** `INTENT.md`, `README.md` and `LICENSE.md` are candidates to
+  link from `public/` where showing what a repository is about is wanted.
+- **Sanitization:** published content passes a check before it leaves (secrets,
+  internal hostnames and addresses, personal data, links into private
+  repositories).
+- **Hall of Helix** content is published: it is a PR edge. This connects to
+  coulomb.social, where a coulomb.social space corresponds to a repository and
+  its content is a projection of information in that repository.
+
+### Consequences to carry into the design
+
+- **Withdrawal must propagate.** Renaming `public/` stops new publication. It only
+  removes content from the outside if the projection mirrors absence: the
+  publisher deletes what is no longer in `public/` on its next run, and a
+  withdrawal can trigger that run immediately. What has already been fetched
+  outside stays fetched.
+- **The publisher is the only reader that crosses the boundary.** It reads
+  private repositories with its own read identity, resolves the symlinks,
+  sanitizes, and writes to the public target. The forge itself never serves
+  `public/` anonymously, which is consistent with point 1.
+- **The convention is checkable.** A repository check can enforce that `public/`
+  contains only relative symlinks resolving inside the repository, with no
+  absolute paths, no `..` escapes and no links to other symlinks.
+- **This is ecosystem convention.** The `public/` rule belongs in canon (a
+  the-custodian standard, review-gated). The publisher and the coulomb.social
+  projection belong to their own owners (coulomb-social, plus a publishing
+  component). This plan only needs the forge to be closable without breaking
+  the Hall's PR edge.
+
+## 3. Packages follow their repository: private — open
+
+Proposed: one node-level registry login (k3s `registries.yaml`, read-only package
+identity) for all 43 workloads; one ArgoCD credential template for the
+`coulomb/` repositories; job tokens in CI; package-read tokens for PyPI and npm.
+
+## 4. Telegram post images — open
+
+Proposed: the fluid-telegram adapter fetches the image with a read identity and
+uploads it to Telegram, so no image URL needs to be public. Under point 2 the
+alternative is the publisher's public target (the Hall's coulomb.social space)
+once it exists.
+
+## 5. Interim lockdown — open
+
+Proposed: close now the sensitive repositories with no anonymous reader
+(inventory 2026-10-08): `disaster-control`, `railiance-hosts`, `secrets-engine`,
+`rapp-secrets-engine`, `rapp-openbao`, `rapp-policy-nexus`, `fin-hub`,
+`qonto-assistant`, `rapp-tenant-engine`, `executor-sandbox`, `ops-mason`,
+`rein-aharness`, `rein-openweights`.
+
+Under point 2, `hall-of-helix` should stay readable until its publication
+path exists, so it is not in the interim set.
+
+## 6. Exposed history — open
+
+Proposed: T03 scans public history and drives rotations in parallel; it does
+not block the waves.
+
+## Owner — open
+
+Proposed: the founder holds T01 and T08; an agent drives the rest.