prj-forgejo-org-refactor/decisions/forge-visibility-policy.md

Forge visibility policy (ORGREF-WP-0002-T01)

Status: partly decided (founder, 2026-10-08). Points 1 and 2 are decided. Points 3–6 and the plan's owner are open.

1. The forge is private, with no anonymous access — decided

Every org, repository and package on forgejo.coulomb.social is private, and the final wave sets REQUIRE_SIGNIN_VIEW=true. The forge is internal infrastructure. Public codebases, when there are any, are published to a separate location with its own publicity, probably not one we build (GitHub or similar).

2. Publication is a per-repo public/ convention, not a visibility setting — decided

Licensing is experimental and is not an input to access decisions.

What to publish, where and for whom is a series of decisions per repository. They are made through a shared publication-flow mechanism, not reinvented per repository. The baseline is the Unix home directory's public folder:

• public/ holds only symlinks, never original content. Each link points to a file inside the same repository.
• Everything reachable through public/ may be made readable from outside, by a publisher that projects it to the public location. Nothing outside public/ is published.
• Emergency removal: renaming the folder (for example to public.withdrawn/) withdraws everything at once.
• Transparency: INTENT.md, README.md and LICENSE.md are candidates to link from public/ where showing what a repository is about is wanted.
• Sanitization: published content passes a check before it leaves (secrets, internal hostnames and addresses, personal data, links into private repositories).
• Hall of Helix content is published: it is a PR edge. This connects to coulomb.social, where a coulomb.social space corresponds to a repository and its content is a projection of information in that repository.

Consequences to carry into the design

• Withdrawal must propagate. Renaming public/ stops new publication. It only removes content from the outside if the projection mirrors absence: the publisher deletes what is no longer in public/ on its next run, and a withdrawal can trigger that run immediately. What has already been fetched outside stays fetched.
• The publisher is the only reader that crosses the boundary. It reads private repositories with its own read identity, resolves the symlinks, sanitizes, and writes to the public target. The forge itself never serves public/ anonymously, which is consistent with point 1.
• The convention is checkable. A repository check can enforce that public/ contains only relative symlinks resolving inside the repository, with no absolute paths, no .. escapes and no links to other symlinks.
• This is ecosystem convention. The public/ rule belongs in canon (a the-custodian standard, review-gated). The publisher and the coulomb.social projection belong to their own owners (coulomb-social, plus a publishing component). This plan only needs the forge to be closable without breaking the Hall's PR edge.

3. Packages follow their repository: private — open

Proposed: one node-level registry login (k3s registries.yaml, read-only package identity) for all 43 workloads; one ArgoCD credential template for the coulomb/ repositories; job tokens in CI; package-read tokens for PyPI and npm.

4. Telegram post images — open

Proposed: the fluid-telegram adapter fetches the image with a read identity and uploads it to Telegram, so no image URL needs to be public. Under point 2 the alternative is the publisher's public target (the Hall's coulomb.social space) once it exists.

5. Interim lockdown — open

Proposed: close now the sensitive repositories with no anonymous reader (inventory 2026-10-08): disaster-control, railiance-hosts, secrets-engine, rapp-secrets-engine, rapp-openbao, rapp-policy-nexus, fin-hub, qonto-assistant, rapp-tenant-engine, executor-sandbox, ops-mason, rein-aharness, rein-openweights.

Under point 2, hall-of-helix should stay readable until its publication path exists, so it is not in the interim set.

6. Exposed history — open

Proposed: T03 scans public history and drives rotations in parallel; it does not block the waves.

Owner — open

Proposed: the founder holds T01 and T08; an agent drives the rest.