epic: repository health and release-readiness swarm

[WalksWithASwagger]

Summary

Coordinate the remaining repository-health and release-readiness work as a dependency-ordered, GitHub-only ledger.

Current Audit Snapshot (2026-07-20)

• main is clean and green at 8786aeca05748ab76b34d693c3006c1cfcbcadf2.
• Post-merge CI run 29770072547 passed the hashed Python lock, all four dependency-security audits, 561 Python tests, 7 frontend tests, builds, portal E2E, docs/public/package/doctor checks, and secret-scan.
• Post-merge CodeQL run 29770072604 passed for JavaScript/TypeScript and Python.
• There are zero open pull requests, zero agent:ready issues, and zero in-progress issues.
• 20 issues remain open: 12 carry an explicit needs-human gate, 8 are dependency-blocked (including decision(security): enforce reviewed branch protection on main #327 and release: approve and publish the first verified scoped npm release #334, which are also human-gated), and epic: repository health and release-readiness swarm #308/Epic: retire alex-samuel studio into Rafiki (value-first) #268 are tracking epics.
• Live main protection is strict and enforced for administrators; required checks are test and secret-scan. Required reviews and conversation resolution remain disabled. Force pushes and branch deletion are disabled.

Completed Foundation

• review: PR #305 dark-crystal style human gate #307 - workflow foundations.
• Normalize and disambiguate Rafiki project skills #315 - project skills canonicalization via PR fix: normalize Rafiki project skills #349 (5f09851).
• security: protect local environment-file variants from tracking #317 - public keyframe boundary prerequisite.
• skill: remove machine-specific paths from the real-sky upscaler #318 - portable real-sky upscaler via PR fix: make the real-sky upscaler portable #352 (40a6690).
• pipeline: disable retired Linear synchronization and remove its client #320 - retired Linear synchronization removed via PR fix: disable retired Linear synchronization #346 (516bded).
• build: align fresh-clone setup with the canonical verification gate #321 - fresh-clone and canonical verification contract via PR build: align fresh setup with Node 22 #355 (14f78ab).
• pipeline: make branch and PR traceability GitHub-only #324 - GitHub-only traceability via PR pipeline: make branch and PR traceability GitHub-only #350 (b61a6d3).
• docs: remove Linear from active delivery instructions and mirrored skills #325 - active docs and canonical skills moved to GitHub-only delivery via PR docs: make Rafiki delivery guidance GitHub-only #353 (bfdf571).
• pipeline: make stop labels sticky and PR policy checks blocking #326 - sticky stop labels and blocking policy check via PR ci: make stop labels sticky and PR policy blocking #354 (0c98e9d).
• frontend: add a focused unit and component test foundation #328 - frontend test/bootstrap repair via PR frontend: add focused unit and component test foundation #351 (2eb8436).
• build: add a reproducible hashed Python 3.11 CI lock #329 - reproducible hashed Python 3.11 CI lock via PR build: add hashed Python 3.11 CI lock #356 (d9c1a13).
• security: add a dependency audit command and CI gate #330 - unified dependency security gate via PR security: add dependency audit gate #357 (ad1906a).
• ci: pin Actions and add dependency and code-security monitoring #331 - SHA-pinned Actions, Dependabot, CodeQL, and dependency review via PR ci: harden supply-chain monitoring #358 (e989b0f).
• pipeline: make agent-ready intake atomic and idempotent #338 - atomic/idempotent ready intake via PR fix: make agent-ready intake atomic #347 (aebaad9), with disposable noop proof test: verify atomic noop intake after #338 #348.
• ci: make Dependabot updates policy-compatible and reviewable #363 - Dependabot policy/config boundary repair via PR ci: make Dependabot updates policy-compatible #364 (74f9bd4).
• Root routine dependency batch via PR build(deps): bump the root-npm group across 1 directory with 2 updates #365 (eb5b679).
• Frontend minor/patch batch plus npm-10 lock repair via PR build(deps): bump the frontend-npm group across 1 directory with 11 updates #366 (0207391).
• build: raise the canonical Node floor to 22.13 #367 - canonical Node 22.13 runtime floor via PR build: raise Node floor to 22.13 #368 (8786aec).

Proven Human And External Gates

• Verify Notion signed upload against live workspace #69 - perform a live throwaway Notion upload verification.
• Validate Curriculum Atlas story rail with real review sessions #200 - run a real Curriculum Atlas review session.
• Track 4: Audio surface (Suno ingest/management) #264 - decide whether a Suno-specific workflow is still needed.
• Track 5a: Production-knowledge indexing (importer extension) #265 - choose local indexing versus knowledge-base routing and its privacy boundary.
• Track 5b: Canonical gitignored media home + corpus migration #266 - approve the canonical external media location, migration, backup, and rollback plan.
• Track 2: LoRA lite slice (film LoRAs only) #270 - define album input, review output, and provider-spend authorization.
• Develop an AI Ethical Futures Lab thumbnail style and regenerate covers #314 - approve AEFL visual direction before live Luma changes.
• decision(security): classify tracked keyframe configs before public release #322 - classify tracked keyframe configurations.
• decision(security): enforce reviewed branch protection on main #327 - approve the exact branch-protection mutation. Live settings require only test and secret-scan; required reviews and conversation resolution are disabled and policy is not required.
• release: approve and publish the first verified scoped npm release #334 - approve the exact npm version, public publication, tag, and release after its implementation prerequisites land.
• decision(evals): ratify a privacy-safe model-output benchmark contract #335 - ratify the privacy-safe eval contract.
• decision(security): retain and harden or retire agentic command mode #337 - retain and harden or retire optional command-provider mode.

Dependency-Ordered Implementation

• Add Curriculum Atlas presentation/export controls #201 - Curriculum Atlas export controls after Validate Curriculum Atlas story rail with real review sessions #200.
• security: enforce the approved keyframe repository and package boundary #323 - keyframe repository/package boundary after decision(security): classify tracked keyframe configs before public release #322.
• package: adopt the scoped npm identity without publishing #332 - scoped npm identity after security: enforce the approved keyframe repository and package boundary #323.
• package: ship a prebuilt React portal in the npm tarball #333 - prebuilt portal tarball after package: adopt the scoped npm identity without publishing #332; frontend and dependency-monitoring prerequisites are complete.
• evals: implement an offline human-review benchmark report #336 - offline human-review eval report after decision(evals): ratify a privacy-safe model-output benchmark contract #335.
• Track 6: Retirement cutover + verification #267 - final external retirement cutover after retained alex-samuel tracks and explicit sign-off.
• release: approve and publish the first verified scoped npm release #334 - first verified npm release after decision(security): enforce reviewed branch protection on main #327 and package: ship a prebuilt React portal in the npm tarball #333, with a separate exact publication approval.

Collision Map

Shared surface	Required order
Public keyframe boundary	#322 -> #323 -> #332 -> #333
Package identity and portal	#323 -> #332 -> #333
Live GitHub settings	#327 only after exact maintainer approval
Publication	#327 + #333 -> #334
Evaluation	#335 -> #336
Curriculum Atlas	#200 -> #201
Studio retirement	retained tracks + explicit sign-off -> #267

Promotion Protocol

1. Keep agent:ready off an issue until every named predecessor is merged, current main is green, and no human decision remains.
2. Re-read the issue against current code immediately before promotion.
3. Atomically remove blocked and add agent:ready; never remove needs-human without explicit maintainer approval.
4. Use one issue, one codex/issue-<N>-<slug> branch, and one pull request with Closes #N or Refs #N.
5. Stop at needs-human or blocked. Automation never grants approval, publishes, deploys, changes settings, or auto-merges.

Acceptance Criteria

• All 35 issues open at audit start were inspected against current code, comments, dependencies, merged PRs, and live GitHub state.
• Completed or superseded issues with direct evidence were closed.
• Ambiguous legacy work has an explicit human decision gate.
• Shared-surface collisions have a serialization order.
• All currently executable repository work has been shipped or parked at a proven gate.
• Current main CI/CodeQL, open PRs, ready labels, and branch-protection state were refreshed after the final merge.
• Promote remaining dependencies only under the protocol above.

Tests/Evals

• Promotion requires predecessor-specific verification plus current main CI.
• No provider call, deployment, publication, generated-media commit, secret read, or automatic settings mutation is authorized by this tracker.

Verification

• gh issue list --repo WalksWithASwagger/rafiki --state open --label agent:ready
• gh pr list --repo WalksWithASwagger/rafiki --state open
• gh run list --repo WalksWithASwagger/rafiki --branch main
• gh api repos/WalksWithASwagger/rafiki/branches/main/protection

Agent Instructions

• Use this issue only as the coordination ledger; do not create an implementation branch for epic: repository health and release-readiness swarm #308.
• Preserve one-issue/one-branch/one-PR and repository size limits.
• Never read ignored environment value files or print secrets.
• Do not publish, deploy, rewrite history, delete worktrees, or mutate repository settings without the named gate.

Out Of Scope

• Implementing child issues directly in this tracker.
• Live provider calls, generated media, deployments, publication, branch deletion, destructive migration, or secret changes.

Linear

Not applicable. Rafiki delivery is GitHub-only; do not create or update a Linear issue.