prj-forgejo-org-refactor/decisions/forge-visibility-policy.md

# Forge visibility policy (ORGREF-WP-0002-T01)

Status: **decided** (founder, 2026-10-08). All six points and the plan's owner.

## 1. The forge is private, with no anonymous access — decided

Every org, repository and package on `forgejo.coulomb.social` is private, and
the final wave sets `REQUIRE_SIGNIN_VIEW=true`. The forge is internal
infrastructure. Public codebases, when there are any, are published to a
separate location with its own publicity, probably not one we build
(GitHub or similar).

## 2. Publication is a per-repo `public/` convention, not a visibility setting — decided

Licensing is experimental and is **not** an input to access decisions.

What to publish, where and for whom is a series of decisions per repository.
They are made through a shared publication-flow mechanism, not reinvented per
repository. The baseline is the Unix home directory's public folder:

- **`public/` holds only symlinks**, never original content. Each link points to
  a file inside the same repository.
- **Everything reachable through `public/` may be made readable from outside**,
  by a publisher that projects it to the public location. Nothing outside
  `public/` is published.
- **Emergency removal:** renaming the folder (for example to `public.withdrawn/`)
  withdraws everything at once.
- **Transparency:** `INTENT.md`, `README.md` and `LICENSE.md` are candidates to
  link from `public/` where showing what a repository is about is wanted.
- **Sanitization:** published content passes a check before it leaves (secrets,
  internal hostnames and addresses, personal data, links into private
  repositories).
- **Hall of Helix** content is published: it is a PR edge. This connects to
  coulomb.social, where a coulomb.social space corresponds to a repository and
  its content is a projection of information in that repository.

### Consequences to carry into the design

- **Withdrawal must propagate.** Renaming `public/` stops new publication. It only
  removes content from the outside if the projection mirrors absence: the
  publisher deletes what is no longer in `public/` on its next run, and a
  withdrawal can trigger that run immediately. What has already been fetched
  outside stays fetched.
- **The publisher is the only reader that crosses the boundary.** It reads
  private repositories with its own read identity, resolves the symlinks,
  sanitizes, and writes to the public target. The forge itself never serves
  `public/` anonymously, which is consistent with point 1.
- **The convention is checkable.** A repository check can enforce that `public/`
  contains only relative symlinks resolving inside the repository, with no
  absolute paths, no `..` escapes and no links to other symlinks.
- **This is ecosystem convention.** The `public/` rule belongs in canon (a
  the-custodian standard, review-gated). The publisher and the coulomb.social
  projection belong to their own owners (coulomb-social, plus a publishing
  component). This plan only needs the forge to be closable without breaking
  the Hall's PR edge.

## 3. Packages follow their repository: private — decided

One node-level registry login (k3s `registries.yaml`, read-only package
identity) for all 43 workloads; one ArgoCD credential template for the
`coulomb/` repositories; job tokens in CI; package-read tokens for PyPI and npm.

## 4. Telegram post images — decided

The fluid-telegram adapter fetches each image with a read identity and uploads
it to Telegram, so no image URL needs to be public (fluid-telegram
FT-WP-0001-T14).

A public assets location will come later, deliberately: a specific asset
repository and store with creator and trust management. It is **not** improvised
now, and Telegram images do not wait for it.

## 5. Interim lockdown — decided, with guardrails

The interim set is approved: the sensitive repositories with no anonymous reader
(inventory 2026-10-08): `disaster-control`, `railiance-hosts`, `secrets-engine`,
`rapp-secrets-engine`, `rapp-openbao`, `rapp-policy-nexus`, `fin-hub`,
`qonto-assistant`, `rapp-tenant-engine`, `executor-sandbox`, `ops-mason`,
`rein-aharness`, `rein-openweights`. `hall-of-helix` stays readable until its
publication path exists.

Founder guardrail, and the rule for every later wave as well: **tighten
gradually. Never lock ourselves out, never risk losing assets, never end up in a
state that is hard to repair.** Concretely:

1. **Before anything closes:** confirm that a current local clone of each
   repository exists (SSH, `forgejo-remote`) and is up to date with the server.
   Confirm that the founder account and the local administrator can sign in, and
   that administrator recovery is documented. Visibility changes delete nothing,
   but the clone is the recovery path if anything goes wrong.
2. **One repository first,** the least connected one. Close it, then verify:
   founder web view, SSH fetch and push, agent clone over SSH, and that an
   anonymous request gets 404. Reopen it once to prove the rollback, then close
   it again.
3. **Then the rest in small batches,** with the same checks after each batch.
   Stop at the first surprise and reopen what that batch changed.
4. **Only visibility changes.** No deletion, archiving, transfer, renaming, team
   or permission edits, and no instance settings (`REQUIRE_SIGNIN_VIEW` stays for
   the final wave).
5. **Record every change** (repository, time, before and after, check results)
   under `inventory/`, so that any step can be undone exactly.

### Step 1 pre-check, 2026-10-08

Local clones exist for all 13 and were fetched. 11 are clean and level with
`origin/main`. Two need their owners first and stay out of the first batch:

- **`executor-sandbox`:** local `master` and server `main` have diverged: 3 local
  commits were never pushed, and the server has 5 that the local branch lacks.
  Both histories are now held locally (`origin/main` fetched), so closing loses
  nothing. The unpushed work belongs to the owner to reconcile; it is not changed
  here.
- **`ops-mason`:** 3 uncommitted local changes. Server state is fetched; the
  changes are the owner's.

Suggested first repository for step 2: `rapp-openbao` or `railiance-hosts`
(single branch, clean, no anonymous reader).

## 6. Exposed history — decided

T03 scans public history and drives rotations in parallel. It does not block
the waves.

## Owner — decided

The founder holds T01 (this policy) and T08 (approval of each production wave).
An agent drives the rest of ORGREF-WP-0002.