tegwick
4a690f9e27
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a11beb-4eef-7fc1-94a7-597130a01ae9
140 lines
8.3 KiB
Markdown
140 lines
8.3 KiB
Markdown
# Preparation inventory
|
|
|
|
This is a reproducible **partial baseline**, not G1 acceptance or permission to
|
|
move repositories. No Secret objects were queried and no source/cluster state
|
|
was mutated. Reference records contain tokens and locations, not source lines.
|
|
|
|
## Reproduce
|
|
|
|
From this project checkout:
|
|
|
|
```bash
|
|
python3 tools/inventory.py --output /tmp/orgref-first.json
|
|
python3 tools/inventory.py --output /tmp/orgref-second.json --compare /tmp/orgref-first.json
|
|
python3 tools/runtime_inventory.py --output /tmp/orgref-runtime.json
|
|
python3 /home/worsch/railiance-platform/scripts/capture-reef-deployables.py -o /tmp/orgref-deployables.json
|
|
python3 /home/worsch/railiance-master/tools/validate-family-declarations.py --root /home/worsch --inventory /tmp/orgref-deployables.json
|
|
python3 -m unittest discover -s tests -v
|
|
```
|
|
|
|
The source collector paginates anonymous forge repository/package endpoints,
|
|
reads State Hub repository metadata, scans visible sibling and registered Git
|
|
working trees, and scans pinned default-branch archives for public repos without
|
|
local remotes. `snapshot.json` records revisions, working-content hashes, local
|
|
remotes, stable server/State Hub IDs, reference locations and exclusions. No
|
|
fetch, checkout or repo mutation is performed. Runtime collection refuses a
|
|
cluster whose node addresses do not include the verified railiance01 IP.
|
|
|
|
Source/metadata output omits capture timestamps so identical runs are directly
|
|
comparable. `comparison.json` records the paired hashes separately. Project-local
|
|
generated files are excluded to prevent self-referential output. Historical
|
|
matches remain findings until explicitly reviewed; they are not silently ignored.
|
|
|
|
The scan finds literal `coulomb/<component>` tokens, including unmatched/example
|
|
paths; these are candidates for review, not all confirmed broken URLs. A reference
|
|
may have several surface categories. It does not detect arbitrary computed or
|
|
encoded paths. File location categories are triage hints, not semantic parsing.
|
|
|
|
## Authenticated collector preparation — completed locally, 2026-10-09
|
|
|
|
`tools/inventory.py --forge-token-env ORGREF_FORGE_READ_TOKEN` enables scoped
|
|
read authentication only when that named environment variable has been supplied
|
|
by the authorized credential route. Omit the flag for the anonymous baseline.
|
|
A requested missing, empty or invalid variable fails before network collection;
|
|
there is no silent anonymous fallback. Never put a credential value on the
|
|
command line, in a file, or in a receipt.
|
|
|
|
The same token is used for forge repository/package metadata and default-branch
|
|
archives. Requests are GET-only and confined to the exact current HTTPS forge
|
|
origin; cross-origin and HTTP downgrade redirects are refused. State Hub reads
|
|
remain separate and receive no forge token. Transport errors emit fixed messages
|
|
or HTTP status only, never request headers or response bodies. The snapshot
|
|
records `authentication: authenticated-read`, not the token or environment.
|
|
|
|
This option finishes local preparation within existing WP-0001-T01 /
|
|
WP-0002-T06. It does not grant a credential, waive the previous access denial,
|
|
attest the principal's scope, or turn `g1_complete` true. Actual authorized
|
|
private repository/package reads and owner completeness evidence remain pending.
|
|
The authenticated census also still needs access/automation exports, exclusion
|
|
and consumer disposition, and a matching unchanged-fleet pair.
|
|
|
|
## Live evidence
|
|
|
|
- `runtime-2026-09-28.json`: names/images/owner links for 132 workload controllers
|
|
across all namespaces, six ArgoCD Applications and five AppProjects. Includes
|
|
CronJobs/Jobs and DaemonSets; completed Jobs may be historical consumers.
|
|
- `deployables-2026-09-28.json`: 68 workload units captured by the existing
|
|
platform collector; its namespace and Knative-revision exclusions are retained.
|
|
- `coverage-2026-09-28.txt`: existing framework validator reports 16 declarations,
|
|
**52 errors and 10 warnings** against that fresh platform snapshot. Errors are
|
|
unclaimed names, including name drift; they are not all necessarily new rapps.
|
|
|
|
The platform collector omits substrate/test namespaces, Jobs and DaemonSets.
|
|
Its result alone cannot certify the universal managed-deployable coverage rule
|
|
in RMASTER-WP-0025. The wider runtime export exposes those additional controllers
|
|
for owner adjudication; the project does not redefine workload cardinality.
|
|
The frozen coulombcore cluster and consumers outside railiance01 are not captured.
|
|
|
|
## Known completion blockers
|
|
|
|
- Anonymous API sees 141 public repositories; 12 additional local `coulomb` paths
|
|
are not publicly listed. Private IDs/visibility and any remote-only private repos
|
|
need an authenticated owner census. State Hub has 143 registered repos, a
|
|
different population; registration is not forge existence or stewardship.
|
|
- Package enumeration failed. No package ownership/version completeness claim is
|
|
possible. Git repository transfer and package ownership must remain separate.
|
|
- Forge version endpoint reports `11.0.3+gitea-1.22.0`; current public API works at
|
|
`forgejo.coulomb.social`. The checked `gitea.coulomb.social` API URLs failed.
|
|
This resolves the reachable endpoint/version, not transfer behavior or redirect
|
|
semantics, which remain behind T03.
|
|
- Existing credential route was checked through `warden route` and `warden plan`.
|
|
`warden access forgejo-admin-api-token --exec --field API_TOKEN` was denied by
|
|
flex-auth (HTTP 403: caller authentication or system binding rejected). No
|
|
credentials were retrieved and no alternative identity was used. The forge
|
|
owner must provide a sanctioned metadata export or restore the caller binding.
|
|
- Team grants, protected branches, deploy keys, webhooks, runners, repository
|
|
credential locations and org/package permissions need that owner export.
|
|
- Per-file exclusions include encrypted/sensitive files, symlinks, binaries,
|
|
large files and submodule directories. Ignored files, hidden sibling repos,
|
|
non-default remote branches and external consumers also need explicit owner
|
|
disposition. Do not decrypt files to satisfy a text scan.
|
|
- Current local changes are included, not assumed deployed. Heads and hashes in
|
|
the inventory bind the evidence; a changed fleet requires another paired scan.
|
|
|
|
## Completion handoffs (not duplicated owner tasks)
|
|
|
|
| Evidence needed | Existing owner / record |
|
|
| --- | --- |
|
|
| Authenticated full repo/package/access export | railiance-forge; credential lane owned by railiance-platform, routed by ops-warden |
|
|
| Universal current workload ownership and name drift | railiance-master RMASTER-WP-0021-T06 / RMASTER-WP-0025; platform and individual workload owners |
|
|
| Legacy/live image consumers and retained rollback digests | railiance-platform RPF-WP-0028 / RPF-WP-0048-T03; activity-core release owner |
|
|
| Source allowlists, credentials and frozen-cluster consumers | railiance-platform RPF-WP-0044 and application owners |
|
|
| Reusable workflow and runner references | railiance-enablement / railiance-forge |
|
|
|
|
## Migration cleanliness precheck
|
|
|
|
```bash
|
|
python3 tools/verify_inventory.py --inventory inventory/snapshot.json --assignments taxonomy/assignments.json
|
|
```
|
|
|
|
This intentionally exits nonzero now: coverage is incomplete, assignments are
|
|
unapproved, and old-path references remain. It is a conservative source/remotes
|
|
precheck, **not the whole G6 gate**. Before G6, extend it with reviewed per-location
|
|
historical dispositions and the accepted runtime/package inventory, then prove
|
|
GitOps recovery and fresh pulls/reschedules under the owner execution records.
|
|
Do not change `g1_complete` or `approved` merely to obtain a green check.
|
|
|
|
## Follow-up review
|
|
|
|
[Owner evidence contract](owner-evidence-contract.md) specifies the sanitized
|
|
export needed from an authorized forge owner. [Owner follow-ups](owner-followups.md)
|
|
link stable work-record IDs, the 52-row workload review queue and all 326 excluded
|
|
source items. Four pinned submodules still reference the old forge endpoint;
|
|
wiki/issue-facade identity reconciliation remains open.
|
|
|
|
A further consecutive pair also failed stability: hub-core changed between runs.
|
|
`stability-retry.json` records hashes and the changed fields as a diagnostic
|
|
receipt; temporary full retry outputs were not retained as accepted evidence.
|
|
The original full snapshots and comparison remain unchanged. No credential retry
|
|
was made after the policy denial; the existing owner records explain where to
|
|
resolve caller binding without substituting another workload's identity.
|