knodin 0.7.4 → 0.7.6

package/dist/src/wait-for-fresh.js

@@ -1,98 +0,0 @@
-import childProcess from "node:child_process";
-import fs from "node:fs";
-import path from "node:path";
-import { attachLifecycleHealth, inspectLifecycleHealth } from "./lifecycle-health.js";
-const delay = (milliseconds) => new Promise((resolve) => setTimeout(resolve, milliseconds));
-const PROCESSOR_RETRY_MS = 500;
-function installedProcessorIsRunning(repo) {
-    try {
-        const pid = Number(fs.readFileSync(path.join(repo, ".knodin", "hooks", "refresh.lock", "pid"), "utf-8"));
-        if (!Number.isInteger(pid) || pid <= 0)
-            return false;
-        process.kill(pid, 0);
-        return true;
-    }
-    catch {
-        return false;
-    }
-}
-export function launchInstalledLifecycleProcessor(repo) {
-    const processor = path.join(repo, ".knodin", "hooks", "background-index.sh");
-    if (fs.statSync(processor).mode & 0o111) {
-        const child = childProcess.spawn(processor, [], {
-            cwd: repo,
-            stdio: "ignore",
-            detached: process.platform !== "win32",
-            windowsHide: true,
-        });
-        child.once("error", () => undefined);
-        child.unref();
-    }
-}
-function requiresStructuralRepair(graph) {
-    if (Object.values(graph.orphaned).some((count) => count > 0))
-        return true;
-    const ordinary = [
-        "indexed file no longer exists: ",
-        "indexed file is no longer eligible: ",
-        "indexed snapshot differs from disk: ",
-    ];
-    return graph.missing.records.some((record) => !ordinary.some((prefix) => record.startsWith(prefix)));
-}
-function launchQueuedProcessorIfNeeded(repo, elapsed, timeoutMs, lastAttemptAt, processQueuedEvents) {
-    if (elapsed >= timeoutMs ||
-        inspectLifecycleHealth(repo).queuedEvents === 0 ||
-        installedProcessorIsRunning(repo) ||
-        elapsed - lastAttemptAt < PROCESSOR_RETRY_MS)
-        return lastAttemptAt;
-    try {
-        processQueuedEvents(repo);
-    }
-    catch {
-        // Lifecycle health retains the queued event and wait remains truthful.
-    }
-    return elapsed;
-}
-function completedStatus(graph) {
-    if (graph.status === "healthy" && graph.freshness.state === "fresh")
-        return "fresh";
-    if (graph.status === "repair-needed" && requiresStructuralRepair(graph))
-        return "repair-needed";
-    if (graph.freshness.state === "unknown")
-        return "unknown";
-    return null;
-}
-async function reconcileOrdinaryDrift(engine, repo, graph) {
-    const shouldReconcile = (graph.status === "stale" || graph.status === "repair-needed") &&
-        graph.freshness.state !== "queued";
-    if (!shouldReconcile)
-        return graph;
-    await engine.query("stats", "", repo);
-    return attachLifecycleHealth(repo, await engine.status(repo, { audit: "deep" }));
-}
-function completedResult(status, startedAt, polls, graph) {
-    return { status, waitedMs: Date.now() - startedAt, polls, graph };
-}
-/** Wait for queued work and reconcile ordinary drift; structural repair stays explicit. */
-export async function waitForFresh(engine, repo, timeoutMs = 30_000, processQueuedEvents = launchInstalledLifecycleProcessor) {
-    const startedAt = Date.now();
-    let polls = 0;
-    let lastProcessorAttemptAt = Number.NEGATIVE_INFINITY;
-    for (;;) {
-        polls++;
-        const beforeStatusElapsed = Date.now() - startedAt;
-        lastProcessorAttemptAt = launchQueuedProcessorIfNeeded(repo, beforeStatusElapsed, timeoutMs, lastProcessorAttemptAt, processQueuedEvents);
-        let graph = attachLifecycleHealth(repo, await engine.status(repo, { audit: "cached" }));
-        let status = completedStatus(graph);
-        if (status)
-            return completedResult(status, startedAt, polls, graph);
-        graph = await reconcileOrdinaryDrift(engine, repo, graph);
-        status = completedStatus(graph);
-        if (status)
-            return completedResult(status, startedAt, polls, graph);
-        const elapsed = Date.now() - startedAt;
-        if (elapsed >= timeoutMs)
-            return { status: "timeout", waitedMs: elapsed, polls, graph };
-        await delay(Math.min(100, timeoutMs - elapsed));
-    }
-}

package/dist/src/worktree-lifecycle.js

@@ -1,231 +0,0 @@
-import childProcess from "node:child_process";
-import crypto from "node:crypto";
-import fs from "node:fs";
-import path from "node:path";
-function git(repo, args) {
-    return childProcess.execFileSync("git", args, {
-        cwd: repo,
-        encoding: "utf-8",
-        stdio: ["ignore", "pipe", "pipe"],
-    });
-}
-function canonicalPath(target) {
-    try {
-        return fs.realpathSync(target);
-    }
-    catch {
-        return path.resolve(target);
-    }
-}
-function commonDirectory(repo) {
-    const value = git(repo, ["rev-parse", "--path-format=absolute", "--git-common-dir"]).trim();
-    return path.resolve(repo, value);
-}
-function registryPath(repo) {
-    return path.join(commonDirectory(repo), "knodin", "worktrees.json");
-}
-function emptyRegistry() {
-    return { schemaVersion: 1, graphState: "per-worktree", entries: [] };
-}
-function readRegistry(repo) {
-    try {
-        const parsed = JSON.parse(fs.readFileSync(registryPath(repo), "utf-8"));
-        return parsed.schemaVersion === 1 && Array.isArray(parsed.entries) ? parsed : emptyRegistry();
-    }
-    catch {
-        return emptyRegistry();
-    }
-}
-function writeRegistry(repo, registry) {
-    const target = registryPath(repo);
-    fs.mkdirSync(path.dirname(target), { recursive: true });
-    const temporary = `${target}.${process.pid}.tmp`;
-    fs.writeFileSync(temporary, `${JSON.stringify(registry, null, 2)}\n`, { mode: 0o600 });
-    fs.renameSync(temporary, target);
-}
-function identityFor(repo, worktreePath, classification) {
-    let administrativePath = classification;
-    try {
-        administrativePath = path.resolve(worktreePath, git(worktreePath, ["rev-parse", "--path-format=absolute", "--git-dir"]).trim());
-    }
-    catch {
-        // A removed worktree retains its registry identity.
-    }
-    return crypto
-        .createHash("sha256")
-        .update(`${commonDirectory(repo)}\0${administrativePath}`)
-        .digest("hex")
-        .slice(0, 24);
-}
-function listGitWorktrees(repo) {
-    const fields = git(repo, ["worktree", "list", "--porcelain", "-z"]).split("\0");
-    const records = [];
-    for (const field of fields) {
-        if (field.startsWith("worktree ")) {
-            records.push({
-                path: path.resolve(field.slice("worktree ".length)),
-                classification: records.length === 0 ? "main" : "linked",
-                head: null,
-                branch: null,
-                locked: false,
-                prunable: null,
-            });
-            continue;
-        }
-        const current = records.at(-1);
-        if (!current)
-            continue;
-        if (field.startsWith("HEAD "))
-            current.head = field.slice(5);
-        else if (field.startsWith("branch "))
-            current.branch = field.slice(7).replace(/^refs\/heads\//, "");
-        else if (field === "detached")
-            current.branch = null;
-        else if (field.startsWith("locked"))
-            current.locked = true;
-        else if (field.startsWith("prunable "))
-            current.prunable = field.slice(9);
-    }
-    return records;
-}
-/** Register one initialized checkout in Git-common metadata without sharing its graph database. */
-export function registerInitializedWorktree(repoPath) {
-    const repo = path.resolve(repoPath);
-    const current = listGitWorktrees(repo).find((worktree) => canonicalPath(worktree.path) === canonicalPath(repo));
-    if (!current)
-        throw new Error(`knodin worktrees: ${repo} is not a registered Git worktree`);
-    const registry = readRegistry(repo);
-    const now = new Date().toISOString();
-    const identity = identityFor(repo, current.path, current.classification);
-    const existing = registry.entries.find((entry) => entry.identity === identity);
-    if (existing) {
-        existing.path = current.path;
-        existing.lastSeenAt = now;
-        delete existing.removedAt;
-    }
-    else {
-        registry.entries.push({
-            identity,
-            path: current.path,
-            classification: current.classification,
-            registeredAt: now,
-            lastSeenAt: now,
-        });
-    }
-    registry.entries.sort((left, right) => left.path.localeCompare(right.path));
-    writeRegistry(repo, registry);
-}
-export async function inspectWorktrees(repoPath, status) {
-    const repo = path.resolve(repoPath);
-    const current = listGitWorktrees(repo);
-    const registry = readRegistry(repo);
-    const livePaths = new Set(current.map((worktree) => worktree.path));
-    const worktrees = [];
-    for (const worktree of current) {
-        const identity = identityFor(repo, worktree.path, worktree.classification);
-        const registered = registry.entries.some((entry) => entry.identity === identity);
-        const graphInitialized = fs.existsSync(path.join(worktree.path, ".knodin", "db.sqlite"));
-        let indexedHead = null;
-        if (graphInitialized) {
-            try {
-                indexedHead = (await status(worktree.path)).lastIndexedHead || null;
-            }
-            catch {
-                indexedHead = null;
-            }
-        }
-        worktrees.push({
-            ...worktree,
-            identity,
-            registered,
-            graphInitialized,
-            indexedHead,
-            freshness: indexedHead === null || worktree.head === null
-                ? "unknown"
-                : indexedHead === worktree.head
-                    ? "fresh"
-                    : "stale",
-            removedAt: null,
-        });
-    }
-    for (const entry of registry.entries) {
-        if (livePaths.has(entry.path))
-            continue;
-        worktrees.push({
-            identity: entry.identity,
-            path: entry.path,
-            classification: entry.classification,
-            head: null,
-            branch: null,
-            locked: false,
-            prunable: "registered worktree is absent from Git's worktree inventory",
-            registered: true,
-            graphInitialized: fs.existsSync(path.join(entry.path, ".knodin", "db.sqlite")),
-            indexedHead: null,
-            freshness: "removed",
-            removedAt: entry.removedAt ?? null,
-        });
-    }
-    worktrees.sort((left, right) => left.path.localeCompare(right.path));
-    return { schemaVersion: 1, graphState: "per-worktree", worktrees };
-}
-/** Reconcile the durable registry with Git metadata; no checkout or graph is deleted. */
-export function reconcileWorktrees(repoPath) {
-    const repo = path.resolve(repoPath);
-    const current = listGitWorktrees(repo);
-    const registry = readRegistry(repo);
-    const now = new Date().toISOString();
-    const seen = new Set();
-    const added = [];
-    const restored = [];
-    for (const worktree of current) {
-        const identity = identityFor(repo, worktree.path, worktree.classification);
-        seen.add(identity);
-        const existing = registry.entries.find((entry) => entry.identity === identity);
-        if (!existing) {
-            registry.entries.push({
-                identity,
-                path: worktree.path,
-                classification: worktree.classification,
-                registeredAt: now,
-                lastSeenAt: now,
-            });
-            added.push(worktree.path);
-        }
-        else {
-            if (existing.removedAt)
-                restored.push(worktree.path);
-            existing.path = worktree.path;
-            existing.lastSeenAt = now;
-            delete existing.removedAt;
-        }
-    }
-    const removed = [];
-    for (const entry of registry.entries) {
-        if (!seen.has(entry.identity) && !entry.removedAt) {
-            entry.removedAt = now;
-            removed.push(entry.path);
-        }
-    }
-    registry.entries.sort((left, right) => left.path.localeCompare(right.path));
-    writeRegistry(repo, registry);
-    return { schemaVersion: 1, added, restored, removed };
-}
-/** Remove exactly one linked worktree through Git, then retain removal evidence in the registry. */
-export function removeManagedWorktree(repoPath, targetPath, dryRun) {
-    const repo = path.resolve(repoPath);
-    const target = path.resolve(targetPath);
-    const record = listGitWorktrees(repo).find((worktree) => canonicalPath(worktree.path) === canonicalPath(target));
-    if (!record)
-        throw new Error(`knodin worktrees remove: ${target} is not a registered Git worktree`);
-    if (record.classification === "main")
-        throw new Error("knodin worktrees remove: refusing to remove the main worktree");
-    if (dryRun)
-        return { schemaVersion: 1, target, dryRun: true, removed: false };
-    childProcess.execFileSync("git", ["worktree", "remove", target], {
-        cwd: repo,
-        stdio: ["ignore", "pipe", "pipe"],
-    });
-    reconcileWorktrees(repo);
-    return { schemaVersion: 1, target, dryRun: false, removed: true };
-}

package/docs/CONTAINED-EXECUTION.md

@@ -1,77 +0,0 @@
-# Profile-based contained execution
-
-`knodin` can execute one immutable repository-defined profile through the
-single MCP gateway. It never accepts a command string, executable, argv, cwd,
-environment, or limit from an MCP caller.
-
-Execution is disabled by two independent defaults. Enable it globally in
-`$XDG_CONFIG_HOME/knodin/execution.json` (or
-`~/.config/knodin/execution.json`):
-
-```json
-{"execution":{"enabled":true}}
-```
-
-Then define and enable exact profiles in `.knodin/execution.json`:
-
-```json
-{
-  "execution": {
-    "enabled": true,
-    "profiles": {
-      "test": {
-        "executable": "/opt/homebrew/bin/bun",
-        "args": ["run", "test"],
-        "network": "deny",
-        "timeoutMs": 120000,
-        "maxOutputBytes": 2097152,
-        "maxProcesses": 1,
-        "containment": "fully-contained"
-      }
-    }
-  }
-}
-```
-
-An agent may call `{ "operation": "execute", "profile": "test" }`. Profile
-names are bounded identifiers. Shell strings and caller-supplied argument
-suffixes are not part of the schema.
-
-## Containment contract
-
-The initial certified adapter is macOS `sandbox-exec`. It runs with a minimal
-environment (`PATH`, `LANG`, `LC_ALL`, and repository-local `TMPDIR`), closed
-stdin, no shell, repository cwd, a detached process group, hard timeout and
-combined-output caps, and Seatbelt rules that:
-
-- deny all network operations;
-- deny process forks, making `maxProcesses: 1` a hard contract;
-- deny all writes outside the repository;
-- deny reads under user homes, mounted volumes, network mounts, and shared
-  temporary roots outside the repository; and
-- allow repository reads/writes and read-only system runtime paths required to
-  load the approved executable.
-
-Profiles needing child processes are rejected by this first contract. Define
-the profile around a single-process test/lint/typecheck/build executable. The
-macOS adapter reports `fully-contained` only when every configured boundary is
-active. It also reports that `sandbox-exec` is deprecated; this certification
-is tied to the checked-in adversarial tests, not a claim that Seatbelt is a
-supported public Apple API.
-
-Linux and Windows currently report `containment-unavailable` and do not spawn
-the profile. A future Bubblewrap or Windows Job Object/restricted-token adapter
-requires its own native evidence before it can change that result.
-
-## Output, diagnosis, and audit
-
-Captured stdout/stderr goes directly through recoverable compression. Failed,
-timed-out, and output-limited MCP executions then request source-evidenced
-failure diagnosis from the existing graph. Raw command text, argv, environment,
-and output are never written to execution telemetry. The private repository
-audit `.knodin/execution-audit.jsonl` records only timestamp, profile identity,
-status, exit/signal, reported containment, and retained output-artifact identity.
-
-Repository code can still be destructive inside the authorized repository.
-This is a constrained trusted-repository workflow, not a guarantee that an
-approved test/build profile cannot modify its own checkout.

package/docs/DIAGNOSTICS.md

@@ -1,45 +0,0 @@
-# Local troubleshooting diagnostics
-
-knodin can retain a small, local diagnostic journal and build a redacted bundle
-for a user to inspect and share with support. Diagnostics are disabled until the
-user enables them, never upload automatically, and require no account or hosted
-service.
-
-```bash
-knodin diagnostics enable --retention-days 14
-knodin diagnostics status
-knodin diagnostics collect --since 24h
-knodin diagnostics inspect .knodin/diagnostics/knodin-diagnostics-….json.gz
-knodin diagnostics clear
-knodin diagnostics disable
-```
-
-`enable` records bounded failure envelopes from the CLI and MCP gateway. Each
-record contains a timestamp, random correlation ID, surface, operation, phase,
-safe error name/code, a message fingerprint, and sanitized stack shape. It does
-not retain the command arguments, query, error message, source, raw output,
-environment, username, repository path, or source paths. Records are stored in
-`.knodin/diagnostics/events.jsonl`, mode `0600`, capped at 500 events, and
-pruned to the configured 1–365 day retention window.
-
-`collect` runs local installation and deep graph diagnostics and combines their
-redacted results with recent failure envelopes, metadata-only telemetry when
-present, and at most 64 KiB/200 lines from the lifecycle indexer log. The
-default collection window is 24 hours; `--since` accepts hours or days. Bundle
-output must remain inside the repository and cannot traverse a symlink.
-
-The bundle is gzip-compressed JSON, written mode `0600`, and includes a privacy
-manifest, explicit omissions, and a redaction count. `inspect` validates the
-manifest and a 10 MiB compressed-size ceiling before returning its contents.
-Users should inspect the bundle before attaching it to Jira, GitHub, email, or
-another support channel. knodin does not transmit it.
-
-`clear` removes only the event journal. It does not delete previously created
-bundles or ROI telemetry. `disable` stops future failure recording but preserves
-existing events so disabling never silently destroys troubleshooting evidence.
-Run `clear` when deletion is intended.
-
-Diagnostics are evidence, not runtime-causality proof. Message fingerprints can
-group identical sanitized failures but cannot reconstruct the original message.
-Redaction is defense in depth; users remain responsible for inspecting an
-artifact before sharing it outside their organization.

package/docs/GIT-HISTORY-REVIEW.md

@@ -1,39 +0,0 @@
-# Bounded Git-history review signals
-
-`knodin review` and the MCP gateway's `review` operation return `signals` beside
-the compatibility `riskScore`. The signal groups stay separate:
-
-- `graphImpact`: changed files and affected flows from indexed relationships;
-- `testGaps`: missing test-path/reference facts;
-- `structuralCentrality`: inbound, outbound, and total indexed references for
-  each changed symbol;
-- `history`: rename-aware churn, co-change commit facts, and coupling ratios.
-
-History output includes the exact contributing commit IDs, availability,
-confidence, configured bounds, commands executed, analyzed counts, truncation,
-and explicit omissions. Results are sorted deterministically. CLI and MCP output
-also retain the review's graph `staleness` field.
-
-## Bounds and unavailable states
-
-The defaults are 250 commits, 25 changed files, 100 related-file facts, a
-2-second timeout per Git command, and an 8 MiB output ceiling. Review uses one
-bounded `git log` pass after HEAD and shallow-state probes, and caches facts by
-repository, HEAD, requested files, and bounds. User-provided file paths must be
-repository-relative; revisions never enter the history command.
-
-`shallow`, `unborn`, `git-unavailable`, `not-a-repository`, `timeout`, and
-`unavailable` are explicit. Missing history never produces synthetic commits or
-coupling. Shallow results contain only locally present commits and disclose that
-omission. Commit, file, and related-file truncation likewise names what was
-omitted and why.
-
-## Interpretation limit
-
-Co-change and coupling show correlation in the inspected history only. They do
-not assert causation, defect likelihood, ownership, or mandatory remediation.
-Treat them as review context alongside graph impact, test gaps, and structural
-centrality—not as an opaque score or automated decision.
-
-The reproducible synthetic-DAG evidence, raw replay, resource measurement, and
-verifier are under `benchmarks/evaluations/c85-git-history/`.

package/docs/PROGRESSIVE-EVIDENCE.md

@@ -1,37 +0,0 @@
-# Progressive source evidence
-
-`knodin evidence` returns exact local source through four deterministic levels:
-
-1. `locate` — stable file identity, path, hash, size, freshness, and confidence.
-2. `outline` — top-level declaration signatures and exact line ranges.
-3. `evidence` — requested verbatim source lines with edit anchors intact.
-4. `expand` — the complete verbatim file within caller-selected hard budgets.
-
-CLI:
-
-```bash
-knodin evidence locate src/widget.ts
-knodin evidence evidence src/widget.ts --start 10 --end 30
-knodin evidence evidence src/widget.ts --continuation <evidence-handle> \
-  --baseline-hash <sha256> --baseline-bytes <bytes>
-```
-
-The single MCP gateway uses `operation: "evidence"`, `file`, and
-`evidenceLevel`. Supply a returned `continuation` to recover omitted source.
-Every response names returned and omitted material, a reason, whether more
-exists, a stable continuation and evidence handle, freshness, confidence, the
-path taken, and exact item/UTF-8-byte/local-token-estimate budgets.
-The mandatory recoverability envelope requires at least 1,600 effective bytes
-(the lower of the byte cap and four times the local token-estimate cap); smaller
-requests fail closed instead of dropping contract fields.
-
-Source omission occurs only when a server-issued evidence handle is valid and
-both `baselineHash` and `baselineBytes` equal the current complete local file.
-Missing or partial metadata/handle, a stale/tampered hash, source changed since
-a handle was issued, or a renamed path selects a named `full-*` recovery path.
-Invalid or tampered handles fail closed. Inputs
-must identify an exact repository-relative regular file; ambiguous selection,
-absolute/traversal paths, and symlinks are refused.
-
-This protocol does not summarize source and does not support token-savings or
-task-success claims. See the C83 checked-in replay and limitations for bounds.

package/docs/PT-ACCESS-RECOMMENDATION.md

@@ -1,91 +0,0 @@
-# P&T access through Docusign GitHub Enterprise Server
-
-The knodin GHES path is planned as
-`github.docusignhq.com/Enterprise-Apps/knodin`, but this repository rename does
-not create or verify that external repository. Until the mirror is renamed and
-its knodin artifact is certified, P&T engineers must use the existing legacy
-mirror and its documented release asset. `Enterprise-Apps` is a legacy
-namespace; product changes must continue to originate in the authoritative
-GitHub SaaS repository, not the downstream mirror.
-
-The legacy `v0.3.0` release and its original artifact digest were verified on
-2026-08-01. That evidence does not certify a renamed knodin artifact or path.
-
-## Quick install without GitHub SaaS
-
-Node.js 24 or newer and an authenticated GHES CLI are required. Download the
-versioned release asset from GHES, verify its observed SHA-256, install it
-without dependency lifecycle scripts, and initialize the existing checkout:
-
-```bash
-mkdir knodin-install && cd knodin-install
-GH_HOST=github.docusignhq.com gh release download v0.3.0 \
-  --repo Enterprise-Apps/reckon-graph \
-  --pattern 'reckon-graph-0.3.0.tgz'
-printf '%s  %s\n' \
-  373ca7540e745915f195e51f4ed6383374e4df4a2b8663872b2f279380e60989 \
-  reckon-graph-0.3.0.tgz | shasum -a 256 --check
-npm install --global --ignore-scripts ./reckon-graph-0.3.0.tgz
-cd /path/to/existing/repository
-reckon init
-reckon doctor
-reckon status --deep
-```
-
-Unverified Windows guidance: PowerShell provides
-`Get-FileHash -Algorithm SHA256` instead of `shasum`, and the npm/CLI commands
-are intended to be portable. A native Windows named-client run has not yet been
-certified, so this is not a Windows support claim. The release page records the
-versioned filename and observed digest; do not substitute a branch archive or a
-mutable `latest` URL. GHES does not currently enforce immutable releases, which
-is why digest verification and the separate signed-update trust remain
-required.
-
-The same 0.3.0 tarball was published to Docusign Artifactory at
-`dts-productivity-engineering-npm-dev-local/knodin-0.3.0.tgz`. That raw
-artifact path requires normal corporate Artifactory authentication and is not
-an npm registry endpoint. GHES release download is the supported P&T bootstrap
-until an approved internal npm virtual repository exposes the package metadata.
-
-## Mirror operating model
-
-1. Source commits and reviewed release tags originate in the GitHub SaaS
-   repository.
-2. The GHES `main` branch and release tag are synchronized without rewriting
-   history.
-3. The exact retained release tarball is attached to the matching GHES release;
-   it is not rebuilt on GHES.
-4. A release is not certified merely because it appears on GHES. The final
-   cross-channel attestation must prove that npm, Artifactory, GitHub SaaS,
-   Homebrew, and GHES represent the same source and bytes.
-5. Developers do not dual-push feature branches. Mirror synchronization is a
-   release/operations responsibility and must eventually use a narrowly scoped
-   workload identity rather than a personal SSH key.
-
-The destination must eventually enforce repository visibility, branch
-protection, required reviews/checks, security scans, commit/tag provenance, and
-license notices. Today the repository is internal, but `main` is unprotected and
-maintainers retain push access. Those are open governance controls, not
-completed evidence. Future mirror automation must fail closed and must not
-accept changes back into the authoritative repository.
-
-## Required governance follow-up
-
-Record or complete:
-
-- repository-owner approval to disclose the source to P&T;
-- enterprise GitHub/security approval for cross-organization private forks or
-  mirrors;
-- legal/compliance confirmation for source and license visibility;
-- the exact destination GitHub organization and repository name;
-- confirmation of destination visibility and membership controls;
-- the required branch-protection, review, scan, and retention policy;
-- approval of a narrowly scoped GitHub App/workload identity, its installation
-  owners, secret store, rotation owner, and audit-log owner;
-- an owner for incident response and mirror decommissioning.
-
-The destination repository and current release asset are live. Branch
-protection, enforced read-only direction, automated mirror synchronization,
-production threshold-update trust, timed onboarding evidence, and a Windows
-named-client release certification remain open gates; the existence of this
-access path is not evidence that those separate controls are complete.