Settle the Forge publication endpoint

docs/roadmap/migration.md

@@ -1,6 +1,6 @@
 # Vanity Module Path Migration
 
-Status: target defined; implementation has not begun.
+Status: target settled; implementation has not begun.
 Planning baseline: `21c9bc0ad0315c4ac96268b487a52376558a18d7`.
 
 This roadmap defines the target and work needed to adopt
@@ -30,7 +30,7 @@ No runtime API redesign or compatibility-shim system is needed for this scope.
 | Self-imports | Old module prefix throughout production packages, tests, benchmarks, and examples | New module prefix with the same package layout |
 | Public package | Root-owned `configkit` facade over private internal packages | Same name and ownership under the new module identifier |
 | Vanity discovery | Root and nested requests already advertise the Forge repository | Existing discovery continues to locate the migrated module |
-| Git remote | `origin` uses `ssh://git@forge.maximumdirect.net:22222/base-layer/configkit.git` | The selected authoritative Forge endpoint agrees with release configuration |
+| Git remote | `origin` uses `ssh://git@forge.maximumdirect.net:22222/base-layer/configkit.git` | Retain this SSH endpoint and align release configuration with it |
 | Release configuration | [releasekit.json](../../releasekit.json), its test, and [runbook](../release.md) still name the old Gitea HTTPS endpoint | Consistent Forge publication references and vanity-path consumer commands |
 
 Path-sensitive test expectations include
@@ -107,11 +107,16 @@ The vanity path identifies Go packages. Forge URLs identify the source repositor
 browser pages, and publication transport. They remain distinct: Go HTTPS discovery
 can use the public Forge HTTPS repository while maintainers push through SSH.
 
-The selected publication endpoint is used consistently by the effective `origin`
+The authoritative publication endpoint remains
-push URL, ReleaseKit's exact `expected_push_url`, its existing profile test, and
+`ssh://git@forge.maximumdirect.net:22222/base-layer/configkit.git`. Retaining the
-the runbook's literal publication/recovery commands. Browser/tag links in current
+existing SSH `origin` avoids an unnecessary transport/credential change.
-release guidance refer to the Forge project, not to the vanity import path.
+ReleaseKit's exact `expected_push_url`, its existing profile test, and the
-The endpoint choice is the remaining open decision below.
+runbook's literal publication/recovery commands agree with that endpoint.
+Browser/tag links in current release guidance refer to the Forge HTTPS project,
+not to the SSH transport or vanity import path. Public Go retrieval continues
+using the verified Forge HTTPS repository independently. Authenticated write
+capability still belongs to ordinary authorized release preparation; anonymous
+HTTPS read success does not prove push access.
 
 The existing release sequence, validation profile, permissions, immutable tags,
 and successful-publication completion point are unchanged. This migration does
@@ -136,11 +141,11 @@ without using that review to bundle unrelated upgrades or tool migrations.
 
 ### Release Configuration And Current Guidance
 
-Resolve the Forge publication endpoint, then align `releasekit.json`, its test,
+Align `releasekit.json`, its test, and the runbook's publication/recovery commands
-and the runbook's module identity, push/recovery commands, source links, and
+with the retained SSH endpoint. Update the runbook's module identity, HTTPS source
-consumer verification examples. Reflect only necessary endpoint wording changes
+links, and consumer verification examples accordingly. Reflect only necessary
-in the adopted release policy if its current text requires them; its release
+endpoint wording changes in the adopted release policy if its current text
-guarantees and gates remain the same.
+requires them; its release guarantees and gates remain the same.
 
 Review README, declaration documentation, the consumer guide, and applicable
 development/internal documentation for current identity references. Describe the
@@ -195,23 +200,4 @@ Repository implementation completion, external retrieval evidence, downstream
 application adoption, and release publication are separate outcomes. No push,
 tag, or downstream change is authorized merely by completing this roadmap.
 
-## Open Decisions
+No significant open decision remains for this migration.
-
-### Authoritative Forge Publication Endpoint
-
-**Recommendation:** retain the existing SSH `origin` endpoint,
-`ssh://git@forge.maximumdirect.net:22222/base-layer/configkit.git`, and align
-ReleaseKit's expected URL and runbook with it. This matches the current maintainer
-checkout and avoids an unnecessary transport/credential change. Public Go
-retrieval can continue using the verified Forge HTTPS endpoint independently.
-Authenticated write capability still belongs to ordinary authorized release
-preparation; anonymous HTTPS read success does not prove push access.
-
-**Alternative:** standardize publication on
-`https://forge.maximumdirect.net/base-layer/configkit.git`, updating the effective
-`origin` push URL, ReleaseKit expectation, profile test, and runbook together.
-HTTPS may fit other maintainer/automation credentials and resembles the previous
-runbook's transport. It also changes the current push configuration and requires
-appropriate HTTPS write credentials, which the read-only checks did not test.
-Either option can preserve existing release integrity; the important requirement
-is agreement on the selected endpoint, not imposing one Git transport universally.