pdurlej/platform

Fork 0

ops(forgejo): finish cross-repo baseline rollout and keep repo policy in one place #742

New issue

Open

opened 2026-06-07 17:38:30 +02:00 by pdurlej · 1 comment

pdurlej commented

2026-06-07 17:38:30 +02:00

Owner

Context

We completed the first Forgejo baseline waves for the pdurlej repo estate:

Wave A: repo UX metadata / descriptions / topics.
Wave B: branch cleanup policy and delete-branch-after-merge baseline.
Wave C: additive label baseline.
Wave D: exact default-branch protection for selected active repos.

This issue is the canonical tracker for finishing the baseline safely, so the work does not live only in Codex threads.

Canonical repo: pdurlej/platform, because this is platform/control-plane policy for Forgejo estate behavior.

Related but not canonical:

agent-souls: agent practice docs once policy stabilizes.
patchwarden: enforcement/automation after access + CI/approval model is safe.
iskra-openclaw: runtime consumer, not source of truth for Forgejo baseline.

Current State

Applied:

Repo metadata/topics baseline exists.
Label baseline exists.
Branch cleanup policy exists.
Exact default-branch protection applied to:
- pdurlej/kan-ductor
- pdurlej/patchwarden
- pdurlej/hermes-agency
- pdurlej/iskra-openclaw
- pdurlej/openclaw-mail-infra

Held:

pdurlej/vps-home-platform-infra is likely dead/archive-candidate and was intentionally skipped.

Remaining Work

Wave E: Access Profile Cleanup

Produce current collaborator/access inventory.
Define target profiles:
- operator
- primary implementer: codex, claude
- small-task agent: gemini
- reviewer/guard: patchwarden
- orchestrator/merger: Iskra
- model substrate: ollama
Decide whether ollama should keep any write access.
Decide whether gemini needs write on selected small-task repos.
Decide whether patchwarden needs write/comment permissions.
Apply only after dry-run receipt and explicit operator approval.

Branch Cleanup B2

Generate stale merged branch report.
Mark deletion candidates only if:
- branch head came from merged PR,
- no open PR uses it,
- branch is not default/protected,
- branch head is already merged.
Delete branches only in a separate operator-approved batch.

Archive Candidates

Decide status of vps-home-platform-infra.
Decide status of home-platform-board.
Decide status of test.
No archive/delete without explicit operator approval.

CI / Required Checks

Do not enable required checks globally yet.
Enable checks only after stable CI evidence.
Start with narrow checks, not wildcard checks.

Patchwarden + Iskra Lane

Define when Patchwarden can approve.
Define when Iskra can merge.
Keep proposer / reviewer / merger roles separate.
Do not let one bot author, approve, and merge the same change.

Non-Goals

No repo deletion.
No archive/delete in this issue.
No broad branch globs.
No required checks until CI is stable.
No bot admin grants.
No token rotation in this issue.
No public exposure or visibility changes.
No mass issue relabeling.

Acceptance Criteria

Platform has one canonical Forgejo baseline tracker.
Wave E has a reviewed manifest and dry-run receipt.
Any live access changes have apply receipt and rollback note.
Archive candidates are explicitly decided or left parked.
Patchwarden automation is not started until access + role model are clear.

## Context We completed the first Forgejo baseline waves for the pdurlej repo estate: - Wave A: repo UX metadata / descriptions / topics. - Wave B: branch cleanup policy and delete-branch-after-merge baseline. - Wave C: additive label baseline. - Wave D: exact default-branch protection for selected active repos. This issue is the canonical tracker for finishing the baseline safely, so the work does not live only in Codex threads. Canonical repo: `pdurlej/platform`, because this is platform/control-plane policy for Forgejo estate behavior. Related but not canonical: - `agent-souls`: agent practice docs once policy stabilizes. - `patchwarden`: enforcement/automation after access + CI/approval model is safe. - `iskra-openclaw`: runtime consumer, not source of truth for Forgejo baseline. ## Current State Applied: - Repo metadata/topics baseline exists. - Label baseline exists. - Branch cleanup policy exists. - Exact default-branch protection applied to: - `pdurlej/kan-ductor` - `pdurlej/patchwarden` - `pdurlej/hermes-agency` - `pdurlej/iskra-openclaw` - `pdurlej/openclaw-mail-infra` Held: - `pdurlej/vps-home-platform-infra` is likely dead/archive-candidate and was intentionally skipped. ## Remaining Work ### Wave E: Access Profile Cleanup - [ ] Produce current collaborator/access inventory. - [ ] Define target profiles: - operator - primary implementer: `codex`, `claude` - small-task agent: `gemini` - reviewer/guard: `patchwarden` - orchestrator/merger: `Iskra` - model substrate: `ollama` - [ ] Decide whether `ollama` should keep any write access. - [ ] Decide whether `gemini` needs write on selected small-task repos. - [ ] Decide whether `patchwarden` needs write/comment permissions. - [ ] Apply only after dry-run receipt and explicit operator approval. ### Branch Cleanup B2 - [ ] Generate stale merged branch report. - [ ] Mark deletion candidates only if: - branch head came from merged PR, - no open PR uses it, - branch is not default/protected, - branch head is already merged. - [ ] Delete branches only in a separate operator-approved batch. ### Archive Candidates - [ ] Decide status of `vps-home-platform-infra`. - [ ] Decide status of `home-platform-board`. - [ ] Decide status of `test`. - [ ] No archive/delete without explicit operator approval. ### CI / Required Checks - [ ] Do not enable required checks globally yet. - [ ] Enable checks only after stable CI evidence. - [ ] Start with narrow checks, not wildcard checks. ### Patchwarden + Iskra Lane - [ ] Define when Patchwarden can approve. - [ ] Define when Iskra can merge. - [ ] Keep proposer / reviewer / merger roles separate. - [ ] Do not let one bot author, approve, and merge the same change. ## Non-Goals - No repo deletion. - No archive/delete in this issue. - No broad branch globs. - No required checks until CI is stable. - No bot admin grants. - No token rotation in this issue. - No public exposure or visibility changes. - No mass issue relabeling. ## Acceptance Criteria - Platform has one canonical Forgejo baseline tracker. - Wave E has a reviewed manifest and dry-run receipt. - Any live access changes have apply receipt and rollback note. - Archive candidates are explicitly decided or left parked. - Patchwarden automation is not started until access + role model are clear.

pdurlej added the

status:operator-needed

type:policy

tier:0-platform-substrate

mode:operator-only

domain:forgejo

domain:infra

labels

2026-06-07 17:38:30 +02:00

Iskra commented

2026-06-14 03:04:01 +02:00

Collaborator

Iskra judgment

Field	Value
Target	`pdurlej/platform#issue#742`
Priority	p1
Action	operator_needed
Scores	reach 5 / impact 5 / confidence 5
Piotr fit	high
Effort	medium
Labels	`judge/p1`, `judge/operator-needed`
Judge	`iskra` via `openclaw`

Rationale: This is P1 operator-needed platform policy work because cross-repo Forgejo baselines define the safety and governance substrate for the whole repo estate.

Caveat: Keep policy centralized and proposal-first; do not mutate branch protection, labels, or cleanup behavior without receipts and rollback notes.

Structured openclaw.judge.v0 payload

<!-- openclaw.judge.v0 -->
{
  "confidence": 5,
  "effort_hint": "medium",
  "escalation": {
    "kind": "operator",
    "reason": "Cross-repo Forgejo baseline policy affects branch protection, labels, cleanup, and platform-wide repository governance, so operator sequencing is required."
  },
  "evidence_refs": [
    {
      "note": "Issue tracks finishing the Forgejo baseline rollout after metadata, branch cleanup, labels, and selected default-branch protections were applied.",
      "type": "forgejo",
      "value": "issue-title-body-labels-and-target-snapshot"
    },
    {
      "note": "Body declares pdurlej/platform as the canonical policy source for Forgejo estate behavior rather than scattering decisions across repos.",
      "type": "forgejo",
      "value": "issue-body-canonical-repo"
    },
    {
      "note": "Current labels mark the issue as operator-only tier-0 platform substrate policy work.",
      "type": "snapshot",
      "value": "target-snapshot-labels"
    }
  ],
  "impact": 5,
  "judge_actor": {
    "name": "iskra",
    "runtime": "openclaw"
  },
  "judged_at": "2026-06-14T01:03:00Z",
  "labels_to_apply": [
    "judge/p1",
    "judge/operator-needed"
  ],
  "piotr_fit": "high",
  "priority": "p1",
  "rationale_summary": "This is P1 operator-needed platform policy work because cross-repo Forgejo baselines define the safety and governance substrate for the whole repo estate.",
  "reach": 5,
  "recommended_next_action": "operator_needed",
  "rerun_reason": "no_prior_judgment",
  "schema": "openclaw.judge.v0",
  "target": {
    "kind": "issue",
    "number": 742,
    "repo": "pdurlej/platform"
  },
  "target_snapshot": {
    "body_hash": "sha256:23d83c6e4a198be213e074224746319b9955502da4905d692f5b6c890ebb852b",
    "commit_count": null,
    "evidence_hash": "sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
    "head_sha": null,
    "labels": [
      "domain:forgejo",
      "domain:infra",
      "mode:operator-only",
      "status:operator-needed",
      "tier:0-platform-substrate",
      "type:policy"
    ],
    "labels_hash": "sha256:17fdf9f125bd06c8f0319f5d7c876745927e07daa23f9c266c3f11c979e7e73c",
    "state": "open",
    "title_hash": "sha256:cfc9795881504efff08d99ced86068a77641f19f089323c30a5f7babbe1bb24e",
    "updated_at": "2026-06-07T17:38:30+02:00"
  },
  "top_caveat": "Keep policy centralized and proposal-first; do not mutate branch protection, labels, or cleanup behavior without receipts and rollback notes."
}
<!-- /openclaw.judge.v0 -->

### Iskra judgment | Field | Value | | --- | --- | | Target | `pdurlej/platform#issue#742` | | Priority | p1 | | Action | operator_needed | | Scores | reach 5 / impact 5 / confidence 5 | | Piotr fit | high | | Effort | medium | | Labels | `judge/p1`, `judge/operator-needed` | | Judge | `iskra` via `openclaw` | **Rationale:** This is P1 operator-needed platform policy work because cross-repo Forgejo baselines define the safety and governance substrate for the whole repo estate. **Caveat:** Keep policy centralized and proposal-first; do not mutate branch protection, labels, or cleanup behavior without receipts and rollback notes. <details> <summary>Structured openclaw.judge.v0 payload</summary> ```json  { "confidence": 5, "effort_hint": "medium", "escalation": { "kind": "operator", "reason": "Cross-repo Forgejo baseline policy affects branch protection, labels, cleanup, and platform-wide repository governance, so operator sequencing is required." }, "evidence_refs": [ { "note": "Issue tracks finishing the Forgejo baseline rollout after metadata, branch cleanup, labels, and selected default-branch protections were applied.", "type": "forgejo", "value": "issue-title-body-labels-and-target-snapshot" }, { "note": "Body declares pdurlej/platform as the canonical policy source for Forgejo estate behavior rather than scattering decisions across repos.", "type": "forgejo", "value": "issue-body-canonical-repo" }, { "note": "Current labels mark the issue as operator-only tier-0 platform substrate policy work.", "type": "snapshot", "value": "target-snapshot-labels" } ], "impact": 5, "judge_actor": { "name": "iskra", "runtime": "openclaw" }, "judged_at": "2026-06-14T01:03:00Z", "labels_to_apply": [ "judge/p1", "judge/operator-needed" ], "piotr_fit": "high", "priority": "p1", "rationale_summary": "This is P1 operator-needed platform policy work because cross-repo Forgejo baselines define the safety and governance substrate for the whole repo estate.", "reach": 5, "recommended_next_action": "operator_needed", "rerun_reason": "no_prior_judgment", "schema": "openclaw.judge.v0", "target": { "kind": "issue", "number": 742, "repo": "pdurlej/platform" }, "target_snapshot": { "body_hash": "sha256:23d83c6e4a198be213e074224746319b9955502da4905d692f5b6c890ebb852b", "commit_count": null, "evidence_hash": "sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "head_sha": null, "labels": [ "domain:forgejo", "domain:infra", "mode:operator-only", "status:operator-needed", "tier:0-platform-substrate", "type:policy" ], "labels_hash": "sha256:17fdf9f125bd06c8f0319f5d7c876745927e07daa23f9c266c3f11c979e7e73c", "state": "open", "title_hash": "sha256:cfc9795881504efff08d99ced86068a77641f19f089323c30a5f7babbe1bb24e", "updated_at": "2026-06-07T17:38:30+02:00" }, "top_caveat": "Keep policy centralized and proposal-first; do not mutate branch protection, labels, or cleanup behavior without receipts and rollback notes." }  ``` </details>

Iskra added the

judge/operator-needed

judge/p1

labels

2026-06-14 03:04:01 +02:00