Governance: add exact migration inventory and dry-run orchestration

[Niko4417]

Superseded delivery record: active implementation moved to #168 without rewriting signed history.

Scope

• Superseded accepted issue: Exact migration inventory, one-time reconciliation, and activation orchestration #52 (delivery moved to Governance: add exact migration inventory and dry-run orchestration #168)
• Accepted planning-contract version: v2
• Automated readiness record: Exact migration inventory, one-time reconciliation, and activation orchestration #52 (comment)
• Actual source branch: codex/52-migration-inventory-orchestrator
• Accepted target branch: dev
• Parent epic and Quality Envelope rows: Epic: Contract-as-Code migration and lifecycle activation cutover (ADR-0003/ADR-0004) #49 — contract behavior, migration failure/recovery, production composition, machine acceptance, security, and bounded resources
• Change classification: architecture/governance
• Product decision, finding, or incident: implement a complete deterministic migration inventory and bounded no-effect dry run before lifecycle activation
• In scope: paginated live inventory, classification and reconciliation planning, immutable manifest/candidate inputs, independent rebuild verification, bounded dry-run orchestration, sanitized reporting
• Out of scope: lifecycle or authority mutation, publication, activation, labels, merges, product source, credentials
• Native targets, contracts, or trust boundaries affected: GitHub provider input and governance control plane only; no native/product source changed

Product and architecture alignment

• The implemented contract version and fingerprint match the automated readiness record; no semantic planning change was absorbed during implementation.
• The change follows the Decision Addendum, CONTEXT.md, accepted ADRs, and the issue Quality Plan.
• Existing Keiko material was used only after a recorded Reuse Assessment, or the issue records why Existing Keiko evidence is not applicable. Exact migration inventory, one-time reconciliation, and activation orchestration #52 records the not-applicable rationale.
• This greenfield change creates no mandatory build-time or runtime dependency on Existing Keiko.
• Product authority, policy, evidence, and privileged effects remain in their owning Native layer.
• Any durable architecture change is recorded in an ADR. No new durable architecture decision was introduced beyond the accepted Epic: Contract-as-Code migration and lifecycle activation cutover (ADR-0003/ADR-0004) #49/Exact migration inventory, one-time reconciliation, and activation orchestration #52 contract and ADR-0003/ADR-0004.

Acceptance criteria and evidence

Acceptance criterion	Evidence	Exact head or artifact	Result
AC1	quality/migration-github-provider.mjs, quality/migration-inventory.mjs, provider/inventory tests, live repository dry run	591bf17a016be49ff4dde9346b8f0936ecc7e515	Complete deterministic pagination/classification; preserved #94/PR #107 and other in-flight identities
AC2	planReconciliation fixtures and live sanitized disposition report	591bf17a016be49ff4dde9346b8f0936ecc7e515	Sole-label plan for open items, verified completion handling, no lifecycle on PRs/non-completed closures, explicit unresolved dispositions
AC3	manifest/candidate generators, independent rebuild verifier, hostile duplicate/omission/drift/stale/unavailable tests	591bf17a016be49ff4dde9346b8f0936ecc7e515	Deterministic digest chain with no title/body persistence and fail-closed validation
AC4	production-composition read-only dry run and quality/migration-orchestrator.test.mjs; report digest 0fd36948e0f222f5c5bed1800627ca6b30856a274e732bdb206b50084a706c37	591bf17a016be49ff4dde9346b8f0936ecc7e515	64 issues, 92 PRs, exact member set, no mutation; bounded cancellation/supersession/forward-recovery plan

Acceptance journey evidence

• Applicability: Not applicable — migration control-plane tooling with no desktop surface, per accepted issue rationale.
• Automated checks exercise user-visible outcomes rather than incidental implementation details. Not applicable to this non-UI control plane; tests exercise its observable reports and no-effect boundary.
• Required failure, recovery, accessibility, visual, and platform observations are settled. Failure and recovery are tested; UI dimensions are excluded by Exact migration inventory, one-time reconciliation, and activation orchestration #52.

Quality Plan settlement

• Applicable positive, negative, boundary, failure, cancellation, and recovery behavior is covered.
• The actually wired production composition was tested against read-only live GitHub metadata.
• Applicable security, accessibility, performance, resource, visual, and platform evidence is attached or linked. Security, redaction, bounded-resource, cancellation, and no-effect evidence applies; UI dimensions are excluded by Exact migration inventory, one-time reconciliation, and activation orchestration #52.
• Excluded quality areas retain the rationale accepted in Exact migration inventory, one-time reconciliation, and activation orchestration #52.
• Secrets, credentials, raw customer content, private endpoints, and PII are absent from source, tests, logs, evidence, artifacts, issues, and this pull request.

Verification

• npm ci --ignore-scripts
• npm run quality
• npm audit --audit-level=high — 0 vulnerabilities
• Every declared native target-specific gate passed on macOS.
• I reviewed the complete diff against requirements, contracts, trust boundaries, and failure modes.

Additional affected checks and concise results:

node --test quality/github-api.test.mjs quality/migration-dry-run.test.mjs quality/migration-github-provider.test.mjs quality/migration-inventory.test.mjs quality/migration-orchestrator.test.mjs
31 tests passed

npm run quality
Complete control-plane and native gate passed; control-plane coverage: lines 94.29%, branches 86.97%, functions 94.58%; frontend coverage: lines 95.92%, branches 94.26%, functions 90.24%.

Read-only production-composition dry run
ok=true; status=disposition-required; mutation=none; protected dev=77b7324894715335b856ed911f9584f679026eee
digest=0fd36948e0f222f5c5bed1800627ca6b30856a274e732bdb206b50084a706c37
members=[49,53,54,55,98,131,141,146,149]
64 issues; 92 pull requests; #52/PR #156 is explicitly dispositioned as linked-pr-topology-invalid while pre-activation lifecycle remains inert at status: ready
The disposition-required result is expected and deliberately prevents publication until #53 reconciles the explicitly reported historical inconsistencies.

Independent audit and findings

• Audit scope and dimensions: exact pagination/set membership, deterministic bytes, association topology, in-flight continuity, redaction, partial failure, timeout/cancellation, and authority non-mutation; independently supplemented by exact-head SonarCloud, CodeQL, OSV, Socket, and dependency review
• Audited commit: 591bf17a016be49ff4dde9346b8f0936ecc7e515

Confirmed finding	Evidence	Disposition	Settlement evidence or follow-up
Sonar found one always-true strict comparison and ten maintainability findings in the migration classifier	SonarCloud analysis on prior head d19598311f09fc377f32ff98c89330c13d8b4975	Resolved in owning classifier	Exact-head 591bf17a016be49ff4dde9346b8f0936ecc7e515 has zero open Sonar issues and A reliability; focused and full suites green

• Findings are evidence-cited; speculative observations are advisory rather than blockers.
• Every confirmed finding is resolved, explicitly accepted by an authorized human, or linked to a scoped follow-up that does not invalidate current acceptance.
• Verification and audit were repeated after the latest implementation or audit fix.

Integrated epic acceptance

• Applicability: Not applicable — Exact migration inventory, one-time reconciliation, and activation orchestration #52 prepares migration inputs and dry-run evidence; it does not deliver the epic's integrated activation surface.

Delivery

• Target path: epic/standalone -> dev
• The target branch matches the delivery path accepted in the issue; no direct push, force push, gate bypass, finding dismissal, or authority widening occurred.
• Commits are signed and every required check is bound to the exact current head and expected producer. Commit 591bf17a016be49ff4dde9346b8f0936ecc7e515 has a verified SSH signature for niko.vasilopoulos96@gmail.com; remote exact-head checks are being collected while draft.
• Advisory tools are not treated as required merge authority.
• Documentation, ADRs, contracts, known limitations, and follow-ups are current. Unresolved historical inventory is emitted as disposition input for Terminal migration manifest publication under legacy authority #53 rather than concealed.
• A draft pull request was not promoted to Ready for Human Review before every required Acceptance Journey result and exact-head gate was complete. This PR remains draft.

For this dev-target pull request, only Niko or Oscharko may manually initiate merge. No agent will enable auto-merge, enqueue, merge, or update dev.

Residual risks and follow-ups

• Live inventory currently reports explicit historical dispositions. This is correct fail-closed behavior; Terminal migration manifest publication under legacy authority #53 owns authorized reconciliation before Signed activation switch, in-flight continuity, and integrated acceptance #55 activation.
• GitHub provider availability and live repository drift can invalidate a dry-run result; the implementation requires a fresh stable double-read and pre-switch inventory.

Superseded by #168; issue #52 remains open.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
87.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[Niko4417]

Protected post-merge zero-effect lifecycle reconciliation requested after PR #161 reached protected dev at 9f63e23.

[Niko4417]

Post-merge lifecycle replay for #162 AC4. This ordinary PR comment intentionally exercises the protected PR-comment wake path with lifecycle activation disabled; no lifecycle transition or other external effect is requested.

[Niko4417]

This draft is superseded by the freshly based signed branch codex/52-migration-inventory-orchestrator-v2 at exact head 5dda02a2de7bc46d3c64964247bb24a5367af022. The replacement preserves linear verified-signature history after dev advanced through PR #167; no force-push was used. I am closing this stale draft before opening its replacement so issue #52 has only one active delivery PR.

[Niko4417]

Replacement draft is now open as #168: #168