prj-forgejo-org-refactor/inventory/owner-evidence-contract.md

Owner evidence required to complete G1

Decision 5f3680fc-0cd5-4d27-ba39-59fbdd13313c remains open. The previous credential request was denied by the policy gate. This contract can be fulfilled by an authorized forge owner; it does not authorize this project to impersonate that owner, mint credentials, or use State Hub's workload credential.

Export contents

Provide a JSON export with the fields below. A successful HTTP response, an empty list, or a site-admin flag alone is not proof of coverage.

Section	Required evidence
provenance	Capture time, source instance URL, product/version, authenticated principal identifier (no token), export tool/revision, owner attestation and scope
repositories	Immutable ID, current owner/name, visibility, archive state, default branch and revision; include private and archived repositories
packages	Immutable package/version identity where supported, owner, type, name, tags/digests, repository association separately; include unlinked packages and retained rollback versions
access	Actual org/team membership and repository grants, direct collaborators, branch protections, machine-reader grants; distinguish inherited from direct grants
automation	Deploy-key IDs and read/write flags (no key bytes), webhook IDs and destination host/path without query credentials, runner associations and reusable workflow consumers
pagination	Endpoint/filter and observed counts for every page, termination evidence, API permission failures and omissions; no silent partial success
consumers	GitOps source allowlists and repository credential references, runtime/current and rollback image consumers, package index users, external clones/CI and frozen-cluster consumers
completeness	Owner-confirmed reconciliation with this project's public/local/registered census; every omission explicitly accepted or blocking

Do not export credential values, key bytes, Secret objects, webhook secrets, auth headers, token-bearing URLs or raw environment/configuration dumps. Names and grant IDs are sufficient for the access comparison. Record unavailable surfaces as blockers rather than replacing them with empty accepted lists.

Acceptance procedure

1. Validate identities and pagination; reconcile the 12 local paths absent from the anonymous census, remote-only private repos and archived repos.
2. Join repo/package identities to the assignment matrix. Do not derive package ownership from Git repository ownership.
3. Reconcile reference locations, runtime consumers and each excluded surface.
4. Record grant-preservation checks for every proposed transfer; no broad new org membership may silently widen access.
5. Capture two consecutive source/server/runtime snapshots in a declared unchanged-fleet window. Stop acceptance if revisions, content, grants or consumer sets change. Compare semantic inventory and record provenance.
6. Only after owner attestation and all coverage gaps are closed may G1 and condition 3 be accepted. Stable partial output is insufficient.

Existing owner records

• WARDEN-WP-0025 — 70c11222-d8e7-5936-99f7-7d626a4a5deb: admin PAT lane establishment. Historical success does not establish current caller access.
• WARDEN-WP-0031 — 739bad25-2345-5f4f-aaa3-cc4cd8c71f6c: caller identity on policy requests. Its documented 403 distinction concerns system binding; it supplies the right diagnostic owner, not permission to substitute an identity.
• MASON-WP-0003 — 4015b46d-02f1-56ac-853e-87e8542cf0dd: State Hub's narrow forge-read workload lane. This is a separate principal and use; it is not an alternative credential for this project following the denial.

These are context records, not newly accepted owner follow-ups. A new repair or export activity must retain its owner's own record and be linked here once it exists. No owner messages or task assignments have been sent.