CI-16: Public release/source mirror for the private development repository (SC-8 ruling 2026-09-03)

[Chris0Jeky]

Wave: Smart CI Fabric (ADR-0066). Tracker: CI-00 #2324. Human gate it serves: CI-13 #2337 section A (public assets) — OUTSTANDING_TASKS.md §J SC-8.

Ruling this issue implements

Maintainer decision packet, 2026-09-03, SC8 = private development repository + public release/source mirror. Development, CI, issues and the control plane go private for v0.3.0 (ADR-0066); Releases, checksums/provenance and the GPL-3.0-only source stay public through a mirror repository. GitHub Pages keeps publishing (Pro allows it from a private repository). The launch kit and any awesome-selfhosted wording point at the mirror, not at the private repository.

Scope (agent-preparable)

• Options memo, one page: (a) a separate public repository that receives a source snapshot per release tag plus the Release assets; (b) the same, but the whole history mirrored on every tag; (c) Releases only, source as a tarball attached to each Release. Score each against ADR-0050 (corresponding-source obligation), the checksum/provenance chain (release-desktop.yml), the awesome-selfhosted activity criteria, and the private-repository secret boundary (nothing in the mirror may carry a token, a runner label, or a private workflow).
• The publishing mechanism for the chosen option: a tag-triggered workflow in the private repository that pushes the snapshot/history and re-publishes the Release assets with unchanged sha256s, fail-closed on any mismatch; the mirror repository has no Actions of its own that execute pushed code.
• Docs: README.md install links, docs/product/LAUNCH_KIT.md ([Docs][Launch] Draft docs/product/LAUNCH_KIT.md for the v0.3.0 downloadable release (q-6 A) #2242), LICENSING.md corresponding-source pointer, docs/ci/PRIVATE_REPO_CUTOVER_CHECKLIST.md A/J, docs/REVIVAL_PLAN.md commitment 6 — all point at the mirror once it exists.
• Rehearsal while still public: a no-publish dry run that proves the mirror push and asset re-publication on a prerelease tag.

Human-only

• Creating the mirror repository and any token/deploy key for it (kept out of the repository), and confirming its name — recorded on CI-13 [HUMAN GATE]: Private-repository cutover — prove private-mode CI, budgets, runner trust; maintainer flips visibility for v0.3.0 #2337 (B2 settings evidence).
• The visibility flip itself stays SC-6.

Acceptance

• The chosen option is recorded on this issue with the memo linked; the mechanism is proven on a prerelease tag with unchanged asset hashes; every public-facing link above resolves to the mirror; OUTSTANDING_TASKS.md §J SC-8 stays [x] (decision made) and CI-13 section A carries the evidence.

[Chris0Jeky]

[Claude lane claim v2]
lane: beta-platform-integrity (session taskdeck-beta-a5)
issue: #2439, the agent-preparable half only: the one-page options memo with scores and a recommendation, the rehearsal design, and the publishing-mechanism design written down (not the workflow itself)
scope: one new document under docs/ci/ (the options memo, scored against ADR-0050 corresponding source, the release-desktop.yml checksum and provenance chain, the awesome-selfhosted activity criteria, and the private-repository secret boundary), plus a comment on this issue recording the recommended option. No README, LAUNCH_KIT, LICENSING, cutover-checklist or REVIVAL_PLAN edit until the mirror exists (those pointers are the follow-up once the human-only step lands). No .github/workflows/** change in this slice; the tag-triggered mirror workflow is drafted only as a design section, and its PR, when written, parks under SC-10.
branch: issue-2439/mirror-options-memo (worktree codex-2439-mirror-options-memo)
proving checks: node scripts/check-docs-governance.mjs; node scripts/check-golden-principles.mjs if the memo touches invariants; git diff --check.
merge disposition: docs-only, T3 gate (a fresh-context review, exact-head ci-required, three-minute aging; Codex connector credits are exhausted so the review is a fresh-context agent).

[Chris0Jeky]

Design residuals from the PR #2680 reviews, for the implementing workflow PR

The memo (docs/ci/PUBLIC_MIRROR_OPTIONS.md, PR #2680) went through two fresh-context review rounds; these three design points survived the ceiling and belong to whoever writes the tag-triggered mirror workflow (which parks under SC-10 in any case):

1. Gitleaks filesystem scan of the snapshot. Step 4 requires a fail-closed scan of the extracted tree with the repository's .gitleaks.toml. Five documentation placeholders under docs/api/ (AUTHENTICATION.md, QUICKSTART.md, WEBHOOKS.md: sample bearer tokens and whsec_... values) are suppressed today only by commit-pinned .gitleaksignore fingerprints, which a history-less snapshot cannot match. The implementing PR must either add path or regex allowlist entries for those placeholders to .gitleaks.toml, or exclude them from the export, and the rehearsal's "zero Gitleaks findings" pass condition depends on that choice.
2. Nested agent-instruction files. The export keep list takes backend/ and frontend/ wholesale, so backend/AGENTS.md, backend/CLAUDE.md, frontend/AGENTS.md, frontend/taskdeck-web/CLAUDE.md and backend/src/Taskdeck.Api/AGENTS.md would be published while their root counterparts are denied. The deny classes should match the basenames AGENTS.md, CLAUDE.md and GEMINI.md at any depth, and step 3's post-filter assertion should be defined as a basename match so it trips on them.
3. Token-shape check regex. The memo names ghp_, gho_, ghs_ and github_pat_ shapes as failing the run but does not pin the pattern. The strict shapes (ghp_[A-Za-z0-9]{36}, gho_[A-Za-z0-9]{36}, ghs_[A-Za-z0-9]{36}, github_pat_[A-Za-z0-9_]{82}) match nothing in the current tree; a naive prefix grep matches 11 fixture lines in three exported backend test files. Pin the strict form.

Measured at 7554316: 7 literal self-hosted occurrences in 6 exported files (reported, not failing); 0 strict token-shape hits; the memo's export keep list paths all exist. The memo itself is unchanged by this note.

[Chris0Jeky]

[Claude lane release v2]
lane: beta-platform-integrity (session taskdeck-beta-a5)
issue: #2439 (agent-preparable half: options memo, recommendation, mechanism and rehearsal design; the issue stays open for the workflow PR and the pointer edits after the human-only mirror creation)
PR: #2680
exact head: 7554316
merge commit: 62d1bb4
result: merged (documentation only)
shipped outcome: docs/ci/PUBLIC_MIRROR_OPTIONS.md (indexed in docs/ci/README.md and docs/INDEX.md) scores the three SC-8 options against ADR-0050 corresponding source, the release-desktop.yml checksum and provenance chain, the awesome-selfhosted criteria as recorded in the launch kit (with the launch kit's "withheld; not eligible" status and the empty history of a new mirror stated), and the private-repository secret boundary, and recommends option (a), a source snapshot per release tag plus the Release assets. The mechanism design: triggered on release: published (which cannot run ahead of the assets because release-desktop.yml flips the draft last), git archive snapshot filtered through a default-deny export allowlist (ci/mirror-export.txt in the implementing PR; deny classes and keep list enumerated), a fail-closed check split into a failing half (any surviving .github/ directory, any YAML mapping with runs-on:, any secrets. expression, GitHub token shapes, Gitleaks) and a report-only listing, private Release assets downloaded and sha256sum -c verified before anything public is written, the mirror Release created as a draft and re-verified, and the commit, tag and publish done last so a mismatch leaves nothing public; MIRROR_PUBLISH_TOKEN fine-grained to the mirror with Contents read and write; Actions disabled in the mirror. The rehearsal is a workflow_dispatch dry run on a prerelease tag with a 90-day evidence artifact, its ordering constraint stated (mirror repository and token before cutover checklist section I completes) and a fallback that records the push as skipped. Nine open questions for the maintainer, each with a proposed default. Two fresh-context review rounds, both SHIP; six findings fixed in the fix round.
remaining residual: three design points recorded on this issue for the implementing workflow PR: the Gitleaks snapshot scan needs allowlist entries or exclusion for the docs/api/ placeholders that only commit-pinned fingerprints suppress today; the deny classes must match AGENTS.md, CLAUDE.md and GEMINI.md at any depth (five nested copies survive the current keep list); the token-shape regex must be pinned to the strict forms. Nothing in the memo executes; the workflow PR parks under SC-10 when written, and the README, launch kit, LICENSING, cutover checklist and REVIVAL_PLAN pointers wait for the mirror to exist.
released paths/leases: docs/ci/PUBLIC_MIRROR_OPTIONS.md; docs/ci/README.md; docs/INDEX.md
next dependency now unblocked: the maintainer's option and open-question rulings on this issue; then the workflow PR.

[Chris0Jeky]

Maintainer ruling, recorded 2026-09-06 (guided walkthrough, in-session interactive reply; map:v1:e5beef60c3235e76726721636988f12e53ad55368f875b9a64c8ce71ae621b93; OUTSTANDING_TASKS.md §J/§K).

D-14 = A: the memo's nine defaults are adopted. (1) Chris0Jeky/taskdeck-release; (2) option (a), source snapshot per release tag plus the Release assets; (3) the default-deny allowlist ci/mirror-export.txt with the deny classes asserted absent, a pointer .github/README.md, Actions disabled in the mirror; (4) a source tarball on every Release; (5) backfill v0.1.0 through v0.2.x once, dry-run first; (6) Issues and Discussions off, README pointing at the security route; (7) fine-grained MIRROR_PUBLISH_TOKEN, Contents read and write, 90-day rotation reminder on #2337; (8) GHCR image visibility raised on #2337 as its own item; (9) ci/ and scripts/ci/ are stripped from the snapshot. The three design residuals above bind the implementing PR. The workflow PR is now writable and parks under SC-10 when written; creating the mirror repository stays the maintainer's.

[Chris0Jeky]

Launch-copy integration dependencies from #2784: a concrete signed-out-reachable public support destination is still needed because D-14 keeps mirror Issues/Discussions disabled and exported README links the development issue tracker. The mirrored SECURITY policy also needs an end-to-end reachable private disclosure route after cutover, and the public telemetry destination table must be exported or otherwise provided. #2784 explicitly gates publication on these plus final signed-out artifact/URL verification; it enables no settings or public channel.

[Chris0Jeky]

Release assessment integration (2026-09-17)

PR #3151 treats this issue as a hard distribution-continuity gate for the private-repository cutover.

The approved public mirror is Chris0Jeky/taskdeck-release under the existing D-14 ruling. The assessment uses that settled name throughout.

Remaining sequence:

1. create Chris0Jeky/taskdeck-release with Actions disabled;
2. provide a fine-grained credential scoped only to that mirror's Contents read/write boundary;
3. implement the fail-closed export/publish workflow, including snapshot-safe Gitleaks handling, nested instruction-file denial, and strict GitHub-token shapes;
4. run a no-publish source and private-Release asset-verification rehearsal;
5. before the development repository becomes private, set every release GHCR package explicitly public and prove anonymous pull/read access;
6. after final tag qualification, publish the private v0.3.0 Release first; it supplies the trigger, body, and assets to the mirror workflow;
7. stage and verify an invisible mirror draft, then publish the mirror commit, tag, and public Release;
8. move README, licensing, launch-kit, install, support, security, telemetry, and public-home links to signed-out-reachable destinations;
9. verify the public mirror and GHCR anonymously after the repository flip and before announcement.

GHCR and the source/release mirror have different ordering: public GHCR visibility is established before repository privacy, while the mirror republishes the already-published private Release afterward.

No repository, token, package-visibility mutation, or secret-setting action has been performed by this assessment.

[Chris0Jeky]

Public-distribution direction refresh

PR #3353 updates the live v0.3 programme and readiness documents to use the settled mirror and package-continuity contract consistently.

The accepted public home remains Chris0Jeky/taskdeck-release, with mirror Actions disabled and a private-side publisher using a narrowly scoped contents credential. Release GHCR packages are made explicitly public and anonymously verified before repository privacy, then verified again afterward. The private v0.3.0 Release is published first; the mirror stages and re-downloads/verifies the corresponding source and byte-identical assets before public publication.

Final README, licensing, install, support, security, telemetry, launch-kit, and external-channel URLs remain dependent on the real mirror and anonymous reachability evidence. PR #3353 changes no repository, credential, package visibility, Release, or public link.