From fbf54e701b699d8acbfb2c9aeeb9bc6f3bd293cc Mon Sep 17 00:00:00 2001 From: tegwick Date: Thu, 8 Oct 2026 18:50:45 +0200 Subject: [PATCH] Record the forge visibility policy, points 1-2 decided Forge private without anonymous access; publication via a per-repo public/ folder of symlinks, projected outward by a shared, sanitizing publisher. Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 5457@bnt-lap001 Assistant-Session: 792bf84a-3783-4f5d-a811-cded61dd2012 --- decisions/forge-visibility-policy.md | 89 ++++++++++++++++++++++++++++ 1 file changed, 89 insertions(+) create mode 100644 decisions/forge-visibility-policy.md diff --git a/decisions/forge-visibility-policy.md b/decisions/forge-visibility-policy.md new file mode 100644 index 0000000..13334cc --- /dev/null +++ b/decisions/forge-visibility-policy.md @@ -0,0 +1,89 @@ +# Forge visibility policy (ORGREF-WP-0002-T01) + +Status: **partly decided** (founder, 2026-10-08). Points 1 and 2 are decided. +Points 3–6 and the plan's owner are open. + +## 1. The forge is private, with no anonymous access — decided + +Every org, repository and package on `forgejo.coulomb.social` is private, and +the final wave sets `REQUIRE_SIGNIN_VIEW=true`. The forge is internal +infrastructure. Public codebases, when there are any, are published to a +separate location with its own publicity, probably not one we build +(GitHub or similar). + +## 2. Publication is a per-repo `public/` convention, not a visibility setting — decided + +Licensing is experimental and is **not** an input to access decisions. + +What to publish, where and for whom is a series of decisions per repository. +They are made through a shared publication-flow mechanism, not reinvented per +repository. The baseline is the Unix home directory's public folder: + +- **`public/` holds only symlinks**, never original content. Each link points to + a file inside the same repository. +- **Everything reachable through `public/` may be made readable from outside**, + by a publisher that projects it to the public location. Nothing outside + `public/` is published. +- **Emergency removal:** renaming the folder (for example to `public.withdrawn/`) + withdraws everything at once. +- **Transparency:** `INTENT.md`, `README.md` and `LICENSE.md` are candidates to + link from `public/` where showing what a repository is about is wanted. +- **Sanitization:** published content passes a check before it leaves (secrets, + internal hostnames and addresses, personal data, links into private + repositories). +- **Hall of Helix** content is published: it is a PR edge. This connects to + coulomb.social, where a coulomb.social space corresponds to a repository and + its content is a projection of information in that repository. + +### Consequences to carry into the design + +- **Withdrawal must propagate.** Renaming `public/` stops new publication. It only + removes content from the outside if the projection mirrors absence: the + publisher deletes what is no longer in `public/` on its next run, and a + withdrawal can trigger that run immediately. What has already been fetched + outside stays fetched. +- **The publisher is the only reader that crosses the boundary.** It reads + private repositories with its own read identity, resolves the symlinks, + sanitizes, and writes to the public target. The forge itself never serves + `public/` anonymously, which is consistent with point 1. +- **The convention is checkable.** A repository check can enforce that `public/` + contains only relative symlinks resolving inside the repository, with no + absolute paths, no `..` escapes and no links to other symlinks. +- **This is ecosystem convention.** The `public/` rule belongs in canon (a + the-custodian standard, review-gated). The publisher and the coulomb.social + projection belong to their own owners (coulomb-social, plus a publishing + component). This plan only needs the forge to be closable without breaking + the Hall's PR edge. + +## 3. Packages follow their repository: private — open + +Proposed: one node-level registry login (k3s `registries.yaml`, read-only package +identity) for all 43 workloads; one ArgoCD credential template for the +`coulomb/` repositories; job tokens in CI; package-read tokens for PyPI and npm. + +## 4. Telegram post images — open + +Proposed: the fluid-telegram adapter fetches the image with a read identity and +uploads it to Telegram, so no image URL needs to be public. Under point 2 the +alternative is the publisher's public target (the Hall's coulomb.social space) +once it exists. + +## 5. Interim lockdown — open + +Proposed: close now the sensitive repositories with no anonymous reader +(inventory 2026-10-08): `disaster-control`, `railiance-hosts`, `secrets-engine`, +`rapp-secrets-engine`, `rapp-openbao`, `rapp-policy-nexus`, `fin-hub`, +`qonto-assistant`, `rapp-tenant-engine`, `executor-sandbox`, `ops-mason`, +`rein-aharness`, `rein-openweights`. + +Under point 2, `hall-of-helix` should stay readable until its publication +path exists, so it is not in the interim set. + +## 6. Exposed history — open + +Proposed: T03 scans public history and drives rotations in parallel; it does +not block the waves. + +## Owner — open + +Proposed: the founder holds T01 and T08; an agent drives the rest.