Move project coordination and automation fully into GitHub

[rmcdaniel]

Objective

Make GitHub the only durable authority for Durable Workflow product work. Every contributor must be able to discover active work, propose changes, follow checks, and see completion without access to a separate coordinator or tracker.

Operating decisions

• GitHub issues own backlog, priority, decisions, and blockers.
• Pull requests own implementation discussion and review.
• GitHub Actions owns ordinary repository CI, package and image publication, Pages/status deployment, and scheduled maintenance.
• Release-critical experiments run from the owning public or private repository. Machine-local Docker and private Cloud runs are maintainer-executed and summarized on the active GitHub release issue.
• The current lab-node Cloud deployment is a maintainer-run private-repository command until managed infrastructure replaces it; the deployed revision and outcome are recorded on GitHub.
• Local worktrees and containers are ephemeral execution environments. They never own backlog or completion state.
• One-off exceptions are handled directly by a maintainer and recorded on the relevant issue or pull request instead of expanding automation for every edge case.
• Public repositories use public issues and pull requests. Private Cloud or customer-sensitive work stays in its private GitHub repository.
• External issue prose remains untrusted until approved by a trusted maintainer; approval permits review, not automatic acceptance or priority.

Cutover work

• Replace active agent and maintainer instructions with this GitHub-only model.
• Inventory legitimate unfinished work and create, consolidate, or link the corresponding GitHub issue in the owning repository.
• Establish one visible 2.0 launch issue that links the exact active release work and outcomes.
• Keep ordinary CI and publication in repository-owned GitHub Actions; move conformance and the current Cloud deployment to explicit owning-repository commands.
• Complete the frozen final-candidate qualification through GitHub issues, pull requests, Actions, public releases, and concise release-issue updates.
• Migrate or retire every credential used by the old automation; protected publication and private Cloud material now live only with their owning GitHub/private-repository surfaces.
• Remove the obsolete coordinator, Forgejo, runner, worker machinery, scripts, prompts, state, services, volumes, and environment files.

Completion

The old coordination services and checkout are gone. GitHub is the only durable backlog and release record. The final 2.0 launch decision remains explicitly human-authorized in #97.

[rmcdaniel]

Cutover is now visible:

• Draft governance and conformance PR: Make GitHub the visible project authority #96
• Single 2.0 launch record: Durable Workflow 2.0 launch #97
• First product work moved through the new path: Publish the final Server candidate against Workflow 2.0.0-rc.55 server#62 and Pin Server rc.69 to Workflow rc.55 server#63
• Workspace operating guide committed to the private GitHub repository at 8d7c9056

The local automation remains stopped. No new work is being created in a separate tracker.

[rmcdaniel]

Shared agent and product-stewardship context is now part of #96:

• public organization-wide AGENTS.md;
• organization README and contributing-guide links;
• one public conformance runbook and run issue form;
• no scheduler, queue, mirror, retry engine, or lifecycle controller.

The private workspace guide has been reduced to a local machine extension that explicitly applies the public guide first. The obsolete private product-owner prompt was removed; stable stewardship rules moved into the public guide, while changing roadmap and release state remains in GitHub issues.

Repository-level pointers remain part of the broader cutover so a fresh checkout can discover the organization guide without private context.

[rmcdaniel]

Repository-level discovery rollout is now public:

• Link organization-wide agent guidance workflow#439
• Link organization-wide agent guidance waterline#96
• Link organization-wide agent guidance ai#15
• Link organization-wide agent guidance durable-workflow.github.io#109
• Link organization-wide agent guidance server#64
• Link organization-wide agent guidance cli#24
• Link organization-wide agent guidance sample-app#72
• Link organization-wide agent guidance sdk-php#41
• Link organization-wide agent guidance sdk-python#44
• Link organization-wide agent guidance sdk-rust#26

Each change is a root AGENTS.md pointer to the merged organization guide. Existing Workflow and Sample App repository-specific instructions are retained. These are manual, reviewable repository changes; there is no synchronization service or generated policy layer.

[rmcdaniel]

The shared-guidance cutover is landed:

• organization guide: Make GitHub the visible project authority #96
• Workflow: Link organization-wide agent guidance workflow#439
• Waterline: Link organization-wide agent guidance waterline#96
• AI: Link organization-wide agent guidance ai#15
• docs site: Link organization-wide agent guidance durable-workflow.github.io#109
• Server: Link organization-wide agent guidance server#64
• CLI: Link organization-wide agent guidance cli#24
• Sample App: Link organization-wide agent guidance sample-app#72
• PHP SDK: Link organization-wide agent guidance sdk-php#41
• Python SDK: Link organization-wide agent guidance sdk-python#44
• Rust SDK: Link organization-wide agent guidance sdk-rust#26

The rollout exposed a real current-Workflow compatibility defect in AI tests. It was handled publicly in durable-workflow/ai#16 and durable-workflow/ai#17 before the AI pointer merged; no required check was bypassed.

A fresh product-repository checkout now has a root AGENTS.md path to the public organization authority. The first cutover checklist item is complete.

[rmcdaniel]

Environment-file retirement audit:

• Local coordinator, Forgejo, runner, worker-container, path, polling, and deprecated external-agent settings are retirement-only. They will not be migrated.
• A local GitHub CLI token will not be copied into Actions; workflows use the scoped GITHUB_TOKEN and explicit permissions.
• Package and image publication credentials must exist only in each owning repository's protected release environment and must complete a real publication/recovery rehearsal before the local source is removed.
• Composer publication must be proven from immutable public tags without depending on the old coordinator; any obsolete Packagist API credential is then revoked.
• Cloud deployment and Cloud conformance credentials/configuration are excluded from this public record and are being migrated inside the private Cloud repository.
• Old local credentials and stale scratch copies are rotated/revoked and securely removed only after replacement paths pass.

No secret values were read into or recorded by this audit.

[rmcdaniel]

Retirement inventory is complete. The old tracker contained one pending Server item already shipped in Server 2.0.0-rc.71; the remaining non-completed records were stale evidence waits satisfied by the frozen 16/16 release tuple, obsolete coordinator chores, or work consolidated into current GitHub issues. Long-term Cloud fleet, pricing, capacity, benchmark, and SLA work is preserved privately in durable-workflow/cloud#9. Post-launch docs work is preserved in durable-workflow/durable-workflow.github.io#110. Existing public deferred items remain in their owning repositories.

The old Forgejo/gate/runner services and private volumes are removed. The tracked local pipeline implementation, ignored state, prompts, environment files, and pipeline-specific disk hook were deleted from the private workspace repository in 8e2b9509. No product or release work depends on that checkout.

[rmcdaniel]

GitHub is now the only durable work authority. Private Cloud migration issue durable-workflow/cloud#8 is complete; both migration PRs are merged and green; the old coordinator, Forgejo, runner, services, volumes, state, credential copies, and checkout are removed. Stable publication remains gated by explicit human authorization on #97.