epic: repository health and release-readiness swarm

[WalksWithASwagger]

Summary

Coordinate the remaining repository-health and release-readiness work as a dependency-ordered, GitHub-only ledger.

Current Audit Snapshot (2026-07-20)

• Current main is clean, synced, and green at b61a6d3.
• PRs fix: protect environment file variants #343 through fix: make agent-ready intake atomic #347 and pipeline: make branch and PR traceability GitHub-only #350 merged; issues security: reject cross-origin and non-JSON portal mutations #316, security: protect local environment-file variants from tracking #317, frontend: remove unreachable UI scaffolding and dead dependencies #319, pipeline: disable retired Linear synchronization and remove its client #320, pipeline: make branch and PR traceability GitHub-only #324, and pipeline: make agent-ready intake atomic and idempotent #338 are closed.
• This 35-issue audit also closed completed or superseded roadmap issues Track 1: Floyo video pipeline (value-first) #263, Track 3: Clips review surface in the portal #271, and Track 7: gorgeous-ghost carve-out (work repo) #274.
• review: PR #305 dark-crystal style human gate #307 is closed and PR feat: add dark-crystal signature style (order + chaos poles) #305 is merged.
• pipeline: disable retired Linear synchronization and remove its client #320 and pipeline: make agent-ready intake atomic and idempotent #338 are complete; disposable issue test: verify atomic noop intake after #338 #348 proved one authoritative quality decision, one noop attempt, and no residual PR, branch, or stop label.
• Normalize and disambiguate Rafiki project skills #315 is implemented in PR fix: normalize Rafiki project skills #349 and paused for a human file-count exception; pipeline: make branch and PR traceability GitHub-only #324 is complete; frontend: add a focused unit and component test foundation #328 is implemented in PR frontend: add focused unit and component test foundation #351 and paused for a dev-lockfile line-count exception.
• skill: remove machine-specific paths from the real-sky upscaler #318 and build: align fresh-clone setup with the canonical verification gate #321 remain human-stopped until pipeline: make agent-ready intake atomic and idempotent #338 is merged and a maintainer re-arms them.
• PRs fix: normalize Rafiki project skills #349 and frontend: add focused unit and component test foundation #351 are the only open pull requests; both are technically green and stopped only at documented needs-human diff-limit exceptions.

Completed Foundation

• pipeline: disable retired Linear synchronization and remove its client #320 - disabled retired Linear synchronization and removed its client via PR fix: disable retired Linear synchronization #346 (516bded).

Intake Repair and Near-Ready Work

• pipeline: make agent-ready intake atomic and idempotent #338 - fixed atomic/idempotent ready intake via PR fix: make agent-ready intake atomic #347 (aebaad9); disposable noop proof test: verify atomic noop intake after #338 #348 passed and was closed.
• Normalize and disambiguate Rafiki project skills #315 - implementation complete in PR fix: normalize Rafiki project skills #349; all checks pass, pending human approval of a 23-file versus 20-file structural exception.
• frontend: add a focused unit and component test foundation #328 - implementation complete in PR frontend: add focused unit and component test foundation #351; all checks pass, pending human approval of the dev-only lockfile line-count exception.
• skill: remove machine-specific paths from the real-sky upscaler #318 - portable real-sky upscaler after Normalize and disambiguate Rafiki project skills #315 and pipeline: make agent-ready intake atomic and idempotent #338, then maintainer re-arm.
• build: align fresh-clone setup with the canonical verification gate #321 - fresh-clone setup and canonical verification after pipeline: make agent-ready intake atomic and idempotent #338, then maintainer re-arm.

Human Decisions and External Gates

• Verify Notion signed upload against live workspace #69 - live throwaway Notion upload verification.
• Validate Curriculum Atlas story rail with real review sessions #200 - real Curriculum Atlas review session.
• Track 4: Audio surface (Suno ingest/management) #264 - choose whether any Suno-specific workflow is still needed beyond current audio indexing/playback/mux.
• Track 5a: Production-knowledge indexing (importer extension) #265 - choose local indexing versus knowledge-base routing and the privacy boundary.
• Track 5b: Canonical gitignored media home + corpus migration #266 - approve canonical external media location, migration, backup, and rollback plan.
• Track 2: LoRA lite slice (film LoRAs only) #270 - define album input, sample prompts, review output, and provider-spend gate.
• Develop an AI Ethical Futures Lab thumbnail style and regenerate covers #314 - approve AEFL visual direction before live Luma changes.
• decision(security): classify tracked keyframe configs before public release #322 - classify tracked keyframe configurations.
• decision(security): enforce reviewed branch protection on main #327 - approve the exact branch-protection mutation after implementation prerequisites.
• release: approve and publish the first verified scoped npm release #334 - approve exact npm version, public publish, tag, and release.
• decision(evals): ratify a privacy-safe model-output benchmark contract #335 - ratify the privacy-safe eval contract.
• decision(security): retain and harden or retire agentic command mode #337 - retire or harden optional command-provider mode.

Dependency-Ordered Implementation

• Add Curriculum Atlas presentation/export controls #201 - Curriculum Atlas export controls after Validate Curriculum Atlas story rail with real review sessions #200.
• security: enforce the approved keyframe repository and package boundary #323 - keyframe repository/package boundary after decision(security): classify tracked keyframe configs before public release #322 (security: protect local environment-file variants from tracking #317 is complete).
• pipeline: make branch and PR traceability GitHub-only #324 - GitHub-only traceability merged via PR pipeline: make branch and PR traceability GitHub-only #350 (b61a6d3); main CI run 29718496316 passed.
• docs: remove Linear from active delivery instructions and mirrored skills #325 - active GitHub-only docs and canonical skills after Normalize and disambiguate Rafiki project skills #315 and pipeline: make branch and PR traceability GitHub-only #324.
• pipeline: make stop labels sticky and PR policy checks blocking #326 - sticky stop labels and blocking policy check after docs: remove Linear from active delivery instructions and mirrored skills #325 (review: PR #305 dark-crystal style human gate #307 is complete).
• build: add a reproducible hashed Python 3.11 CI lock #329 - hashed Python 3.11 CI lock after build: align fresh-clone setup with the canonical verification gate #321 and frontend: add a focused unit and component test foundation #328.
• security: add a dependency audit command and CI gate #330 - dependency audit command after build: add a reproducible hashed Python 3.11 CI lock #329.
• ci: pin Actions and add dependency and code-security monitoring #331 - SHA-pinned Actions, Dependabot, CodeQL, and dependency review after pipeline: make stop labels sticky and PR policy checks blocking #326 and security: add a dependency audit command and CI gate #330.
• package: adopt the scoped npm identity without publishing #332 - scoped npm identity after build: align fresh-clone setup with the canonical verification gate #321 and security: enforce the approved keyframe repository and package boundary #323.
• package: ship a prebuilt React portal in the npm tarball #333 - prebuilt portal tarball after frontend: add a focused unit and component test foundation #328, ci: pin Actions and add dependency and code-security monitoring #331, and package: adopt the scoped npm identity without publishing #332.
• evals: implement an offline human-review benchmark report #336 - offline human-review eval report after decision(evals): ratify a privacy-safe model-output benchmark contract #335.
• Track 6: Retirement cutover + verification #267 - final external retirement cutover after the retained alex-samuel tracks and explicit sign-off.

Collision Map

Shared surface	Required order
Agentic runtime	#320 -> #338 -> #324 -> #325 -> #326
Project skills	#338 -> #315 -> #318; #315 + #324 -> #325
Frontend lock and CI	#338 -> #328 -> #329 -> #330 -> #331 -> #333
Setup and package identity	#338 -> #321 -> #329 and #332
Public keyframe boundary	#322 -> #323 -> #332 -> #333
Live GitHub settings	#321 + #326 -> #327
Publication	#327 + #333 -> #334

Promotion Protocol

1. A blocked issue remains without agent:ready until every named predecessor is merged and current main is green.
2. Until pipeline: make agent-ready intake atomic and idempotent #338 is fixed, do not add agent:ready to newly prepared issues.
3. After pipeline: make agent-ready intake atomic and idempotent #338, the coordinator re-reads the issue against current code, removes blocked, and adds agent:ready only if scope and verification still match.
4. skill: remove machine-specific paths from the real-sky upscaler #318 and build: align fresh-clone setup with the canonical verification gate #321 additionally require explicit maintainer re-arm because they were falsely escalated by the observed race.
5. Use one issue, one codex/issue-- branch, and one pull request with Closes #N or Refs #N.
6. Agents stop at needs-human or blocked. Automation never grants approval, publishes, deploys, changes settings, or auto-merges.

Acceptance Criteria

• All 35 issues open at audit start were inspected against current main, comments, dependencies, merged PRs, and live GitHub state.
• Completed or redundant issues with direct evidence were closed.
• Ambiguous legacy work has an explicit human decision gate.
• Newly found skill-path collisions have a serialization order.
• No open issue carries agent:ready while the intake race remains.
• pipeline: disable retired Linear synchronization and remove its client #320 merged via PR fix: disable retired Linear synchronization #346 and current main CI passed.
• pipeline: make agent-ready intake atomic and idempotent #338 merged, disposable issue test: verify atomic noop intake after #338 #348 proved the noop intake, and the next ready lanes were re-evaluated.
• pipeline: make branch and PR traceability GitHub-only #324 merged via PR pipeline: make branch and PR traceability GitHub-only #350 and current main CI passed.\n- [ ] Remaining dependencies are promoted only under the protocol above.

Tests/Evals

• Promotion requires predecessor-specific verification plus current main CI.
• No provider call, deployment, publication, generated-media commit, secret read, or automatic merge is authorized by this tracker.

Verification

• gh issue list --repo WalksWithASwagger/rafiki --state open --label agent:ready
• gh pr list --repo WalksWithASwagger/rafiki --state open
• gh run list --repo WalksWithASwagger/rafiki --branch main
• gh api repos/WalksWithASwagger/rafiki/branches/main/protection

Agent Instructions

• Use this issue only as the coordination ledger; do not create an implementation branch for epic: repository health and release-readiness swarm #308.
• Preserve one-issue/one-branch/one-PR and the repository size limits.
• Never read ignored environment value files or print secrets.
• Do not publish, deploy, merge, rewrite history, or mutate repository settings without the named gate.

Human Checkpoints

• KK owns every issue carrying needs-human and the post-pipeline: make agent-ready intake atomic and idempotent #338 re-arm of skill: remove machine-specific paths from the real-sky upscaler #318/build: align fresh-clone setup with the canonical verification gate #321.
• History remediation, credential changes, provider spend, public release, live settings, and external corpus migration require separate explicit approval.

Out of Scope

• Implementing child issues in this tracker.
• Live provider calls, generated media, deployments, publication, branch deletion, or destructive migration.
• Generic large-file refactors without characterization tests.

Linear

Not applicable. Rafiki delivery is GitHub-only; do not create or update a Linear issue.