tegwick
fbf54e701b
Forge private without anonymous access; publication via a per-repo public/ folder of symlinks, projected outward by a shared, sanitizing publisher. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 5457@bnt-lap001 Assistant-Session: 792bf84a-3783-4f5d-a811-cded61dd2012
89 lines
4.3 KiB
Markdown
89 lines
4.3 KiB
Markdown
# Forge visibility policy (ORGREF-WP-0002-T01)
|
||
|
||
Status: **partly decided** (founder, 2026-10-08). Points 1 and 2 are decided.
|
||
Points 3–6 and the plan's owner are open.
|
||
|
||
## 1. The forge is private, with no anonymous access — decided
|
||
|
||
Every org, repository and package on `forgejo.coulomb.social` is private, and
|
||
the final wave sets `REQUIRE_SIGNIN_VIEW=true`. The forge is internal
|
||
infrastructure. Public codebases, when there are any, are published to a
|
||
separate location with its own publicity, probably not one we build
|
||
(GitHub or similar).
|
||
|
||
## 2. Publication is a per-repo `public/` convention, not a visibility setting — decided
|
||
|
||
Licensing is experimental and is **not** an input to access decisions.
|
||
|
||
What to publish, where and for whom is a series of decisions per repository.
|
||
They are made through a shared publication-flow mechanism, not reinvented per
|
||
repository. The baseline is the Unix home directory's public folder:
|
||
|
||
- **`public/` holds only symlinks**, never original content. Each link points to
|
||
a file inside the same repository.
|
||
- **Everything reachable through `public/` may be made readable from outside**,
|
||
by a publisher that projects it to the public location. Nothing outside
|
||
`public/` is published.
|
||
- **Emergency removal:** renaming the folder (for example to `public.withdrawn/`)
|
||
withdraws everything at once.
|
||
- **Transparency:** `INTENT.md`, `README.md` and `LICENSE.md` are candidates to
|
||
link from `public/` where showing what a repository is about is wanted.
|
||
- **Sanitization:** published content passes a check before it leaves (secrets,
|
||
internal hostnames and addresses, personal data, links into private
|
||
repositories).
|
||
- **Hall of Helix** content is published: it is a PR edge. This connects to
|
||
coulomb.social, where a coulomb.social space corresponds to a repository and
|
||
its content is a projection of information in that repository.
|
||
|
||
### Consequences to carry into the design
|
||
|
||
- **Withdrawal must propagate.** Renaming `public/` stops new publication. It only
|
||
removes content from the outside if the projection mirrors absence: the
|
||
publisher deletes what is no longer in `public/` on its next run, and a
|
||
withdrawal can trigger that run immediately. What has already been fetched
|
||
outside stays fetched.
|
||
- **The publisher is the only reader that crosses the boundary.** It reads
|
||
private repositories with its own read identity, resolves the symlinks,
|
||
sanitizes, and writes to the public target. The forge itself never serves
|
||
`public/` anonymously, which is consistent with point 1.
|
||
- **The convention is checkable.** A repository check can enforce that `public/`
|
||
contains only relative symlinks resolving inside the repository, with no
|
||
absolute paths, no `..` escapes and no links to other symlinks.
|
||
- **This is ecosystem convention.** The `public/` rule belongs in canon (a
|
||
the-custodian standard, review-gated). The publisher and the coulomb.social
|
||
projection belong to their own owners (coulomb-social, plus a publishing
|
||
component). This plan only needs the forge to be closable without breaking
|
||
the Hall's PR edge.
|
||
|
||
## 3. Packages follow their repository: private — open
|
||
|
||
Proposed: one node-level registry login (k3s `registries.yaml`, read-only package
|
||
identity) for all 43 workloads; one ArgoCD credential template for the
|
||
`coulomb/` repositories; job tokens in CI; package-read tokens for PyPI and npm.
|
||
|
||
## 4. Telegram post images — open
|
||
|
||
Proposed: the fluid-telegram adapter fetches the image with a read identity and
|
||
uploads it to Telegram, so no image URL needs to be public. Under point 2 the
|
||
alternative is the publisher's public target (the Hall's coulomb.social space)
|
||
once it exists.
|
||
|
||
## 5. Interim lockdown — open
|
||
|
||
Proposed: close now the sensitive repositories with no anonymous reader
|
||
(inventory 2026-10-08): `disaster-control`, `railiance-hosts`, `secrets-engine`,
|
||
`rapp-secrets-engine`, `rapp-openbao`, `rapp-policy-nexus`, `fin-hub`,
|
||
`qonto-assistant`, `rapp-tenant-engine`, `executor-sandbox`, `ops-mason`,
|
||
`rein-aharness`, `rein-openweights`.
|
||
|
||
Under point 2, `hall-of-helix` should stay readable until its publication
|
||
path exists, so it is not in the interim set.
|
||
|
||
## 6. Exposed history — open
|
||
|
||
Proposed: T03 scans public history and drives rotations in parallel; it does
|
||
not block the waves.
|
||
|
||
## Owner — open
|
||
|
||
Proposed: the founder holds T01 and T08; an agent drives the rest.
|