Repository navigation
chore: remove the private GitLab peer's identity from tracked content - #247
Merged
Merged
Conversation
…cked content The owner ruled that publication peers stay independent and that tracked content must not expose the private GitLab peer: not its address, port, namespace, project path or numeric project ID. One public GitHub identity is allowed. The tip of dev still names the GitLab peer in seven files: .ethos/release.toml, CHANGELOG's link index, two archived task records and three tests. The Change removes those occurrences, resolves the GitLab peer from the clone's local remote.gitlab.forgeRepository, which ETHOS reads first since beta.3, and adds a repository-organization requirement that tracked content names only the public peer. A history rebuild prepared with ETHOS removes the same identity from history after this lands. Change peer-identity-scrub.
The owner ruled that tracked content must not expose the private GitLab peer: not its address, port, namespace, project path or numeric project ID. This removes the last occurrences from the tip. - .ethos/release.toml keeps the GitLab peer's git_remote and drops its forge_repository. ETHOS resolves the repository from the clone's local remote.gitlab.forgeRepository first, since beta.3. - CHANGELOG's history lines and link index keep the GitHub compare links only: 83 GitLab lines and 83 references go. validate-changelog and the link check pass. - Two archived task records cite their GitLab pipelines by number instead of linking them. - The private-forge tests use fixture identities: an RFC 1918 fixture host, and project 101 with job 202. The mirror-prelude test refused the operator's literal host and project ID by naming them. It now refuses any IPv4 literal and any projects/<digits> path, which is stricter and names nothing. go test passes for internal/program and tools/ci/projection, and go vet passes for darwin, linux and windows. Change peer-identity-scrub.
Tasks 1.1 to 1.4 are done in d54bb01. At that head ETHOS status is ready, and a GitLab publish preview of the lane's proposal passes, resolving the repository from the clone's remote.gitlab.forgeRepository. validate-changelog and the link check pass. go test passes for internal/program and tools/ci/projection, and go vet passes for darwin, linux and windows. git grep of the tracked tree finds none of the peer's identity forms. Change peer-identity-scrub.
…ion declaration ETHOS's decided paradigm retires every tracked peer coordinate, not only the private peer's. A peer's copy of the changelog must not expose another peer, and ETHOS's peer-resolution will refuse forge_repository for any peer. - .ethos/release.toml keeps each peer's git_remote and drops GitHub's forge_repository, as it already dropped GitLab's. ETHOS resolves each repository from the clone's remote.<name>.forgeRepository or the remote's URL. - CHANGELOG keeps its headings and text and drops the 83 History rows and 83 GitHub compare links; its preface says that the file names no peer. validate-changelog and the link check pass, and nothing in aigw reads the rows or forge_repository. - The Change's proposal, design and repository-organization delta say the same. Tasks 1.1 and 1.2 reopen for the wider scope. Public-distribution references to GitHub, such as install instructions and package metadata, stay until ETHOS's peer-neutral-outputs states their scope. Change peer-identity-scrub.
Tasks 1.1 and 1.2 are done again at their wider scope in 296539a. ETHOS status is ready there, and publish previews of the lane's proposal pass for both peers, each repository resolved from the clone's Git configuration. validate-changelog and the link check pass. ETHOS's owner confirmed the scope: peer coordinates and changelog links go, and the declared public distribution references to the GitHub repository stay. Change peer-identity-scrub.
d54bb01 made the mirror-prelude test refuse any IPv4 literal and any projects/<digits> path, which added a loop and a branch to TestGitLabUnixLockedToolsUseJobScopedMirrorWithoutChangingGitHub. Its cyclomatic complexity reached 26, over golangci-lint's limit of 25, on darwin and windows. The check moves into assertPreludeNamesNoInstance, which the test calls once per prelude; what it asserts does not change. golangci-lint reports 0 issues for tools/ci/projection on darwin and windows, and the test passes. Change peer-identity-scrub.
The design of gitlab-peer-reconciliation cited the AIGW GitLab project's numeric ID where it explains why GitLab cannot refuse an unsigned push. The owner ruled on 2026-11-06 that the private peer's project IDs leave tracked content, so the sentence names the project instead. The reasoning is unchanged. Change gitlab-peer-reconciliation.
The owner ruled on 2026-11-06 that the private GitLab peer's numeric project IDs are part of its identity and leave tracked content. A census of every prose form found two left in the archived tasks of terminal-product-convergence. They now name the AIGW GitLab project and the proxy's canonical GitLab project instead; the package number and every other fact in the record stay as written. Change peer-identity-scrub.
The relative-mirror cleanup test asserted that a directory named after the private peer's numeric project ID was gone after cleanup. The GitLab prelude names its mirror after CI_JOB_ID (.config/ci/pipeline.cue:62), and the test sets CI_JOB_ID=202, so that directory never existed and the assertion always passed. It now checks .aigw-mise-mirror-202. Skipping the cleanup fails the test with "relative mirror remains after cleanup"; with the cleanup it passes. This also removes the last project-ID form from the tracked tree. Change peer-identity-scrub.
The history rebuild retires every native-inputs tag, and CI's glab supply still reads its glab_1.122.0 assets from one of those carriers (.config/ci/pipeline.cue:104). Those assets were scanned and are clean, so task 3.2 moves the supply to a dedicated mise-glab-v1.122.0 Release, as v1.120.0 and v1.121.0 are, before the rebuild applies. A committee review on 2026-11-07 found this commitment recorded only outside any task ledger. Change gitlab-peer-reconciliation.
Task 2.1: the local quality graph passed at 27871b1, the lane head, with statement coverage 95.30% and the dependency check. Task 2.2: the hosted graph of PR 247 passed at the same head, with 5 checks passed and 2 skipped. Task 2.3: a scan of every tracked file and every commit message of the lane finds no form of the private peer's identity. The scan covered the host, both ports, every namespace and the project-ID contexts, each pattern with a positive control. Change peer-identity-scrub.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This removes every coordinate of the private GitLab peer from aigw-cli's tracked files: its host, port, namespace, project path and numeric project IDs. The owner ruled that this identity must not be public, and today's default branch still serves it in
CHANGELOG.md,.ethos/release.toml, two archived task records and several tests. The public GitHub distribution identity stays.The commits were first written in the 0.7.0 lane. They are carried here unchanged so the public tip is clean before 0.7.0 ships. Git history still holds the identity; a separate history rebuild, owned by ETHOS, removes it there.
What changed
CHANGELOG.mdloses its History rows and compare links; its headings and release text stay.validate-changelogand the link check pass..ethos/release.tomlno longer declares aforge_repositoryfor either peer. Publication resolves each peer from the clone's Git configuration.projects/<digits>path.CI_JOB_IDactually names. Before, it checked a directory that never existed, so it could not fail.gitlab-peer-reconciliationgains task 3.2: move CI's glab supply to a dedicated Release before the history rebuild retires its current carrier.Validation