prj-forgejo-org-refactor/inventory

Preparation inventory

This is a reproducible partial baseline, not G1 acceptance or permission to move repositories. No Secret objects were queried and no source/cluster state was mutated. Reference records contain tokens and locations, not source lines.

Reproduce

From this project checkout:

python3 tools/inventory.py --output /tmp/orgref-first.json
python3 tools/inventory.py --output /tmp/orgref-second.json --compare /tmp/orgref-first.json
python3 tools/runtime_inventory.py --output /tmp/orgref-runtime.json
python3 /home/worsch/railiance-platform/scripts/capture-reef-deployables.py -o /tmp/orgref-deployables.json
python3 /home/worsch/railiance-master/tools/validate-family-declarations.py --root /home/worsch --inventory /tmp/orgref-deployables.json
python3 -m unittest discover -s tests -v

The source collector paginates anonymous forge repository/package endpoints, reads State Hub repository metadata, scans visible sibling and registered Git working trees, and scans pinned default-branch archives for public repos without local remotes. snapshot.json records revisions, working-content hashes, local remotes, stable server/State Hub IDs, reference locations and exclusions. No fetch, checkout or repo mutation is performed. Runtime collection refuses a cluster whose node addresses do not include the verified railiance01 IP.

Source/metadata output omits capture timestamps so identical runs are directly comparable. comparison.json records the paired hashes separately. Project-local generated files are excluded to prevent self-referential output. Historical matches remain findings until explicitly reviewed; they are not silently ignored.

The scan finds literal coulomb/<component> tokens, including unmatched/example paths; these are candidates for review, not all confirmed broken URLs. A reference may have several surface categories. It does not detect arbitrary computed or encoded paths. File location categories are triage hints, not semantic parsing.

Live evidence

• runtime-2026-09-28.json: names/images/owner links for 132 workload controllers across all namespaces, six ArgoCD Applications and five AppProjects. Includes CronJobs/Jobs and DaemonSets; completed Jobs may be historical consumers.
• deployables-2026-09-28.json: 68 workload units captured by the existing platform collector; its namespace and Knative-revision exclusions are retained.
• coverage-2026-09-28.txt: existing framework validator reports 16 declarations, 52 errors and 10 warnings against that fresh platform snapshot. Errors are unclaimed names, including name drift; they are not all necessarily new rapps.

The platform collector omits substrate/test namespaces, Jobs and DaemonSets. Its result alone cannot certify the universal managed-deployable coverage rule in RMASTER-WP-0025. The wider runtime export exposes those additional controllers for owner adjudication; the project does not redefine workload cardinality. The frozen coulombcore cluster and consumers outside railiance01 are not captured.

Known completion blockers

• Anonymous API sees 141 public repositories; 12 additional local coulomb paths are not publicly listed. Private IDs/visibility and any remote-only private repos need an authenticated owner census. State Hub has 143 registered repos, a different population; registration is not forge existence or stewardship.
• Package enumeration failed. No package ownership/version completeness claim is possible. Git repository transfer and package ownership must remain separate.
• Forge version endpoint reports 11.0.3+gitea-1.22.0; current public API works at forgejo.coulomb.social. The checked gitea.coulomb.social API URLs failed. This resolves the reachable endpoint/version, not transfer behavior or redirect semantics, which remain behind T03.
• Existing credential route was checked through warden route and warden plan. warden access forgejo-admin-api-token --exec --field API_TOKEN was denied by flex-auth (HTTP 403: caller authentication or system binding rejected). No credentials were retrieved and no alternative identity was used. The forge owner must provide a sanctioned metadata export or restore the caller binding.
• Team grants, protected branches, deploy keys, webhooks, runners, repository credential locations and org/package permissions need that owner export.
• Per-file exclusions include encrypted/sensitive files, symlinks, binaries, large files and submodule directories. Ignored files, hidden sibling repos, non-default remote branches and external consumers also need explicit owner disposition. Do not decrypt files to satisfy a text scan.
• Current local changes are included, not assumed deployed. Heads and hashes in the inventory bind the evidence; a changed fleet requires another paired scan.

Completion handoffs (not duplicated owner tasks)

Evidence needed	Existing owner / record
Authenticated full repo/package/access export	railiance-forge; credential lane owned by railiance-platform, routed by ops-warden
Universal current workload ownership and name drift	railiance-master RMASTER-WP-0021-T06 / RMASTER-WP-0025; platform and individual workload owners
Legacy/live image consumers and retained rollback digests	railiance-platform RPF-WP-0028 / RPF-WP-0048-T03; activity-core release owner
Source allowlists, credentials and frozen-cluster consumers	railiance-platform RPF-WP-0044 and application owners
Reusable workflow and runner references	railiance-enablement / railiance-forge

Migration cleanliness precheck

python3 tools/verify_inventory.py --inventory inventory/snapshot.json --assignments taxonomy/assignments.json

This intentionally exits nonzero now: coverage is incomplete, assignments are unapproved, and old-path references remain. It is a conservative source/remotes precheck, not the whole G6 gate. Before G6, extend it with reviewed per-location historical dispositions and the accepted runtime/package inventory, then prove GitOps recovery and fresh pulls/reschedules under the owner execution records. Do not change g1_complete or approved merely to obtain a green check.

Follow-up review

Owner evidence contract specifies the sanitized export needed from an authorized forge owner. Owner follow-ups link stable work-record IDs, the 52-row workload review queue and all 326 excluded source items. Four pinned submodules still reference the old forge endpoint; wiki/issue-facade identity reconciliation remains open.

A further consecutive pair also failed stability: hub-core changed between runs. stability-retry.json records hashes and the changed fields as a diagnostic receipt; temporary full retry outputs were not retained as accepted evidence. The original full snapshots and comparison remain unchanged. No credential retry was made after the policy denial; the existing owner records explain where to resolve caller binding without substituting another workload's identity.