From 335bd7bc316edd8466a4211ef04a2be9b51ce3cb Mon Sep 17 00:00:00 2001 From: Eric Rakestraw Date: Sun, 1 Nov 2026 14:04:15 +0000 Subject: [PATCH] Settle the Forge publication endpoint --- docs/roadmap/migration.md | 50 ++++++++++++++------------------------- 1 file changed, 18 insertions(+), 32 deletions(-) diff --git a/docs/roadmap/migration.md b/docs/roadmap/migration.md index 7d3ea36..1a309c7 100644 --- a/docs/roadmap/migration.md +++ b/docs/roadmap/migration.md @@ -1,6 +1,6 @@ # Vanity Module Path Migration -Status: target defined; implementation has not begun. +Status: target settled; implementation has not begun. Planning baseline: `21c9bc0ad0315c4ac96268b487a52376558a18d7`. This roadmap defines the target and work needed to adopt @@ -30,7 +30,7 @@ No runtime API redesign or compatibility-shim system is needed for this scope. | Self-imports | Old module prefix throughout production packages, tests, benchmarks, and examples | New module prefix with the same package layout | | Public package | Root-owned `configkit` facade over private internal packages | Same name and ownership under the new module identifier | | Vanity discovery | Root and nested requests already advertise the Forge repository | Existing discovery continues to locate the migrated module | -| Git remote | `origin` uses `ssh://git@forge.maximumdirect.net:22222/base-layer/configkit.git` | The selected authoritative Forge endpoint agrees with release configuration | +| Git remote | `origin` uses `ssh://git@forge.maximumdirect.net:22222/base-layer/configkit.git` | Retain this SSH endpoint and align release configuration with it | | Release configuration | [releasekit.json](../../releasekit.json), its test, and [runbook](../release.md) still name the old Gitea HTTPS endpoint | Consistent Forge publication references and vanity-path consumer commands | Path-sensitive test expectations include @@ -107,11 +107,16 @@ The vanity path identifies Go packages. Forge URLs identify the source repositor browser pages, and publication transport. They remain distinct: Go HTTPS discovery can use the public Forge HTTPS repository while maintainers push through SSH. -The selected publication endpoint is used consistently by the effective `origin` -push URL, ReleaseKit's exact `expected_push_url`, its existing profile test, and -the runbook's literal publication/recovery commands. Browser/tag links in current -release guidance refer to the Forge project, not to the vanity import path. -The endpoint choice is the remaining open decision below. +The authoritative publication endpoint remains +`ssh://git@forge.maximumdirect.net:22222/base-layer/configkit.git`. Retaining the +existing SSH `origin` avoids an unnecessary transport/credential change. +ReleaseKit's exact `expected_push_url`, its existing profile test, and the +runbook's literal publication/recovery commands agree with that endpoint. +Browser/tag links in current release guidance refer to the Forge HTTPS project, +not to the SSH transport or vanity import path. Public Go retrieval continues +using the verified Forge HTTPS repository independently. Authenticated write +capability still belongs to ordinary authorized release preparation; anonymous +HTTPS read success does not prove push access. The existing release sequence, validation profile, permissions, immutable tags, and successful-publication completion point are unchanged. This migration does @@ -136,11 +141,11 @@ without using that review to bundle unrelated upgrades or tool migrations. ### Release Configuration And Current Guidance -Resolve the Forge publication endpoint, then align `releasekit.json`, its test, -and the runbook's module identity, push/recovery commands, source links, and -consumer verification examples. Reflect only necessary endpoint wording changes -in the adopted release policy if its current text requires them; its release -guarantees and gates remain the same. +Align `releasekit.json`, its test, and the runbook's publication/recovery commands +with the retained SSH endpoint. Update the runbook's module identity, HTTPS source +links, and consumer verification examples accordingly. Reflect only necessary +endpoint wording changes in the adopted release policy if its current text +requires them; its release guarantees and gates remain the same. Review README, declaration documentation, the consumer guide, and applicable development/internal documentation for current identity references. Describe the @@ -195,23 +200,4 @@ Repository implementation completion, external retrieval evidence, downstream application adoption, and release publication are separate outcomes. No push, tag, or downstream change is authorized merely by completing this roadmap. -## Open Decisions - -### Authoritative Forge Publication Endpoint - -**Recommendation:** retain the existing SSH `origin` endpoint, -`ssh://git@forge.maximumdirect.net:22222/base-layer/configkit.git`, and align -ReleaseKit's expected URL and runbook with it. This matches the current maintainer -checkout and avoids an unnecessary transport/credential change. Public Go -retrieval can continue using the verified Forge HTTPS endpoint independently. -Authenticated write capability still belongs to ordinary authorized release -preparation; anonymous HTTPS read success does not prove push access. - -**Alternative:** standardize publication on -`https://forge.maximumdirect.net/base-layer/configkit.git`, updating the effective -`origin` push URL, ReleaseKit expectation, profile test, and runbook together. -HTTPS may fit other maintainer/automation credentials and resembles the previous -runbook's transport. It also changes the current push configuration and requires -appropriate HTTPS write credentials, which the read-only checks did not test. -Either option can preserve existing release integrity; the important requirement -is agreement on the selected endpoint, not imposing one Git transport universally. +No significant open decision remains for this migration.