prj-forgejo-org-refactor/inventory

Preparation inventory

This is a reproducible partial baseline, not G1 acceptance or permission to move repositories. No Secret objects were queried and no source/cluster state was mutated. Reference records contain tokens and locations, not source lines.

Reproduce

From this project checkout:

python3 tools/inventory.py --output /tmp/orgref-first.json
python3 tools/inventory.py --output /tmp/orgref-second.json --compare /tmp/orgref-first.json
python3 tools/runtime_inventory.py --output /tmp/orgref-runtime.json
python3 /home/worsch/railiance-platform/scripts/capture-reef-deployables.py -o /tmp/orgref-deployables.json
python3 /home/worsch/railiance-master/tools/validate-family-declarations.py --root /home/worsch --inventory /tmp/orgref-deployables.json
python3 -m unittest discover -s tests -v

The source collector paginates anonymous forge repository/package endpoints, reads State Hub repository metadata, scans visible sibling and registered Git working trees, and scans pinned default-branch archives for public repos without local remotes. snapshot.json records revisions, working-content hashes, local remotes, stable server/State Hub IDs, reference locations and exclusions. No fetch, checkout or repo mutation is performed. Runtime collection refuses a cluster whose node addresses do not include the verified railiance01 IP.

Source/metadata output omits capture timestamps so identical runs are directly comparable. comparison.json records the paired hashes separately. Project-local generated files are excluded to prevent self-referential output. Historical matches remain findings until explicitly reviewed; they are not silently ignored.

The scan finds literal coulomb/<component> tokens, including unmatched/example paths; these are candidates for review, not all confirmed broken URLs. A reference may have several surface categories. It does not detect arbitrary computed or encoded paths. File location categories are triage hints, not semantic parsing.

Authenticated collector preparation — completed locally, 2026-10-09

tools/inventory.py --forge-token-env ORGREF_FORGE_READ_TOKEN enables scoped read authentication only when that named environment variable has been supplied by the authorized credential route. Omit the flag for the anonymous baseline. A requested missing, empty or invalid variable fails before network collection; there is no silent anonymous fallback. Never put a credential value on the command line, in a file, or in a receipt.

The same token is used for forge repository/package metadata and default-branch archives. Requests are GET-only and confined to the exact current HTTPS forge origin; cross-origin and HTTP downgrade redirects are refused. State Hub reads remain separate and receive no forge token. Transport errors emit fixed messages or HTTP status only, never request headers or response bodies. The snapshot records authentication: authenticated-read, not the token or environment.

This option finishes local preparation within existing WP-0001-T01 / WP-0002-T06. It does not grant a credential, waive the previous access denial, attest the principal's scope, or turn g1_complete true. Actual authorized private repository/package reads and owner completeness evidence remain pending. The authenticated census also still needs access/automation exports, exclusion and consumer disposition, and a matching unchanged-fleet pair.

Live evidence

• runtime-2026-09-28.json: names/images/owner links for 132 workload controllers across all namespaces, six ArgoCD Applications and five AppProjects. Includes CronJobs/Jobs and DaemonSets; completed Jobs may be historical consumers.
• deployables-2026-09-28.json: 68 workload units captured by the existing platform collector; its namespace and Knative-revision exclusions are retained.
• coverage-2026-09-28.txt: existing framework validator reports 16 declarations, 52 errors and 10 warnings against that fresh platform snapshot. Errors are unclaimed names, including name drift; they are not all necessarily new rapps.

The platform collector omits substrate/test namespaces, Jobs and DaemonSets. Its result alone cannot certify the universal managed-deployable coverage rule in RMASTER-WP-0025. The wider runtime export exposes those additional controllers for owner adjudication; the project does not redefine workload cardinality. The frozen coulombcore cluster and consumers outside railiance01 are not captured.

Known completion blockers

• Anonymous API sees 141 public repositories; 12 additional local coulomb paths are not publicly listed. Private IDs/visibility and any remote-only private repos need an authenticated owner census. State Hub has 143 registered repos, a different population; registration is not forge existence or stewardship.
• Package enumeration failed. No package ownership/version completeness claim is possible. Git repository transfer and package ownership must remain separate.
• Forge version endpoint reports 11.0.3+gitea-1.22.0; current public API works at forgejo.coulomb.social. The checked gitea.coulomb.social API URLs failed. This resolves the reachable endpoint/version, not transfer behavior or redirect semantics, which remain behind T03.
• Existing credential route was checked through warden route and warden plan. warden access forgejo-admin-api-token --exec --field API_TOKEN was denied by flex-auth (HTTP 403: caller authentication or system binding rejected). No credentials were retrieved and no alternative identity was used. The forge owner must provide a sanctioned metadata export or restore the caller binding.
• Team grants, protected branches, deploy keys, webhooks, runners, repository credential locations and org/package permissions need that owner export.
• Per-file exclusions include encrypted/sensitive files, symlinks, binaries, large files and submodule directories. Ignored files, hidden sibling repos, non-default remote branches and external consumers also need explicit owner disposition. Do not decrypt files to satisfy a text scan.
• Current local changes are included, not assumed deployed. Heads and hashes in the inventory bind the evidence; a changed fleet requires another paired scan.

Completion handoffs (not duplicated owner tasks)

Evidence needed	Existing owner / record
Authenticated full repo/package/access export	railiance-forge; credential lane owned by railiance-platform, routed by ops-warden
Universal current workload ownership and name drift	railiance-master RMASTER-WP-0021-T06 / RMASTER-WP-0025; platform and individual workload owners
Legacy/live image consumers and retained rollback digests	railiance-platform RPF-WP-0028 / RPF-WP-0048-T03; activity-core release owner
Source allowlists, credentials and frozen-cluster consumers	railiance-platform RPF-WP-0044 and application owners
Reusable workflow and runner references	railiance-enablement / railiance-forge

Migration cleanliness precheck

python3 tools/verify_inventory.py --inventory inventory/snapshot.json --assignments taxonomy/assignments.json

This intentionally exits nonzero now: coverage is incomplete, assignments are unapproved, and old-path references remain. It is a conservative source/remotes precheck, not the whole G6 gate. Before G6, extend it with reviewed per-location historical dispositions and the accepted runtime/package inventory, then prove GitOps recovery and fresh pulls/reschedules under the owner execution records. Do not change g1_complete or approved merely to obtain a green check.

Follow-up review

Owner evidence contract specifies the sanitized export needed from an authorized forge owner. Owner follow-ups link stable work-record IDs, the 52-row workload review queue and all 326 excluded source items. Four pinned submodules still reference the old forge endpoint; wiki/issue-facade identity reconciliation remains open.

A further consecutive pair also failed stability: hub-core changed between runs. stability-retry.json records hashes and the changed fields as a diagnostic receipt; temporary full retry outputs were not retained as accepted evidence. The original full snapshots and comparison remain unchanged. No credential retry was made after the policy denial; the existing owner records explain where to resolve caller binding without substituting another workload's identity.