Enforce private-by-default enablement templates
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
CI Smoke / container-smoke (push) Successful in 1s

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02669-87ee-7a31-b111-edc95a16e0fa
This commit is contained in:
tegwick 2026-08-22 12:34:25 +02:00
parent abe1865877
commit 27ac54b32d
9 changed files with 138 additions and 28 deletions

View file

@ -108,26 +108,25 @@ This layer is:
* a **promotion handoff** surface between source repos and S5 deployments
* a future **developer portal** and self-service entry point
* a place to codify delivery knowledge into **repeatable automation**
* as of 2026-08-11, the owner of the **forge layer responsibility**: runner
placement and labels, registry retention, artifact lifecycle, and package
credentials
* the owner of the **consumer-facing forge contract**: which runner labels,
registry interfaces, credentials, and artifact evidence paved paths require;
`railiance-forge` remains the operational provider of those capabilities
---
## Inherited: the forge layer responsibility
## Forge accountability and operating boundary
Decision `d151d817` (2026-08-11) placed `railiance-forge`. The Forgejo
**workload** becomes `rapp-forgejo`; the **layer responsibility** folds into S4
— here — because this layer already declared a handoff contract with forge for
runner labels, package credentials, registry endpoints, and artifact evidence.
Owning the contract's other side is the natural resolution.
Decision `d151d817` (2026-08-11) placed the consumer-facing forge
responsibility in S4. That means this repo owns the reusable workflow contract
for runner labels, package credentials, registry endpoints, and artifact
evidence. It does not make this repo the operator of those systems:
`railiance-forge` continues to own the live forge, registries, runners,
credentials, retention, and operating evidence until a separately approved
migration changes that boundary. The Forgejo workload itself belongs in
`rapp-forgejo`.
This is S4's first concrete owned responsibility. That is worth stating plainly:
until now this layer has been almost entirely aspiration — a rich Direction of
Evolution with 25 commits and no workplans behind it. The forge responsibility
gives it something real to be accountable for, and the gap between what this
INTENT promises and what the repo contains should be read as an open debt, not
as a description of the present.
The split is deliberate: S4 makes the correct delivery path reusable;
`railiance-forge` makes the underlying capability dependable.
---