# RMGR-WP-0013 live publisher conformance — 2026-09-01

## Scope

This evidence covers the Repo Manager classification publisher and hub-core's
frozen `helixforge.repository-classification-projection` 1.0.0 consumer. It
includes both the original workstation conformance proof and the production
Forgejo-backed deployment on railiance01.

## Registrar bootstrap

- State Hub source: `primary` / `railiance01`
- Discovery root: `/home/worsch` (operator-local, not published)
- Registered classified repositories: **123**
- Locally classified but unregistered checkouts: **2**
  (`snuggles-inventor`, `wise-validator`), reported as warnings and omitted
- Stable IDs: existing State Hub registrar UUIDs; none invented
- Bulk `/repos/` was not used because it timed out after 180 seconds
- Successful bounded import: four workers, 15-second request timeout, two
  transient retries

The generated private registry was written only to `/tmp` and was not committed.
It contained host paths for local observation; those paths did not enter the
published projection.

## End-to-end transfer

The publisher served the live registry with a page size of 25. Hub-core fetched
five HMAC-bound pages through its new HTTP `port.repo` client and accepted the
complete transfer atomically.

```json
{
  "status": "accepted",
  "snapshot_id": "c22faf46794ee9288102d6f0f98b04372ebfaa2c41017edf11c6101f157ec654",
  "repository_count": 123,
  "projection_status": "current",
  "content_hash": "a3a1d584c8245b6c339bd672551d0960bf2b0b133e259bec7e884fe302cfe14c",
  "source_revision": "b28a45e7c9592f6aecdc4537b463333545ba6f1c68746d6a5e904cff4d654008"
}
```

Repo Manager read classification from each repository's authoritative file and
published only contract fields. Hub-core derived its own navigation generation;
no database or private persistence model was shared.

## Verification

- Repo Manager: **157 passed**; Ruff clean
- Hub-core: **107 passed**
- Focused publisher tests cover duplicate identities, deterministic UUID order,
  Git/source provenance, multi-page transfer, cursor tampering, invalid source
  diagnostics, bearer authentication, readiness, and primary registrar import
- Hub-core focused tests cover cursor/token HTTP transport plus all frozen
  repository-navigation contract and ingestion behaviors

## Forgejo-backed production deployment

- Helm release `core-hub`, namespace `core-hub`, revision **24**
- Repo Manager image digest:
  `sha256:a78fa953815b7abe78afb63ce43a29da9f09f609ace9aad2aeb98a746544e849`
- hub-core image digest:
  `sha256:6f9a0318349221a6db4e958383791f5bc9398c0df7bef4c8118d8a16b9ec6e4d`
- Source: private in-cluster Forgejo Service, no checkout mount or State Hub
  runtime dependency
- Full anonymous scan: **3.45 seconds**, **114 accepted**, **9 bounded private
  source errors**
- Live verification: passed through the admitted hub-core candidate to
  publisher NetworkPolicy path

The residual production gate is recorded as `RAPPCOREHUB-WP-0003-T04`: mount a
dedicated Forgejo identity scoped exactly `read:repository`, prove all 123
repositories error-free, and only then enable `publisher.connectCandidate`.