Governance: add exact migration inventory and dry-run orchestration

[Niko4417]

Scope

• Accepted issue: Exact migration inventory, one-time reconciliation, and activation orchestration #52
• Accepted planning-contract version: v2
• Automated readiness record: Exact migration inventory, one-time reconciliation, and activation orchestration #52 (comment)
• Actual source branch: codex/52-migration-inventory-orchestrator-v2
• Accepted target branch: dev
• Parent epic and Quality Envelope rows: Epic: Contract-as-Code migration and lifecycle activation cutover (ADR-0003/ADR-0004) #49 — contract behavior, migration failure/recovery, production composition, machine acceptance, security, and bounded resources
• Change classification: architecture/governance
• Product decision, finding, or incident: implement a complete deterministic migration inventory and bounded no-effect dry run before lifecycle activation
• In scope: paginated live inventory, classification and reconciliation planning, immutable manifest/candidate inputs, independent rebuild verification, bounded dry-run orchestration, sanitized reporting
• Out of scope: lifecycle or authority mutation, publication, activation, labels, merges, product source, credentials
• Native targets, contracts, or trust boundaries affected: GitHub provider input and governance control plane only; no native/product source changed

Product and architecture alignment

• The implemented contract version and fingerprint match the automated readiness record; no semantic planning change was absorbed during implementation.
• The change follows the Decision Addendum, CONTEXT.md, accepted ADRs, and the issue Quality Plan.
• Existing Keiko material was used only after a recorded Reuse Assessment, or the issue records why Existing Keiko evidence is not applicable. Exact migration inventory, one-time reconciliation, and activation orchestration #52 records the not-applicable rationale.
• This greenfield change creates no mandatory build-time or runtime dependency on Existing Keiko.
• Product authority, policy, evidence, and privileged effects remain in their owning Native layer.
• Any durable architecture change is recorded in an ADR. No new durable architecture decision was introduced beyond the accepted Epic: Contract-as-Code migration and lifecycle activation cutover (ADR-0003/ADR-0004) #49/Exact migration inventory, one-time reconciliation, and activation orchestration #52 contract and ADR-0003/ADR-0004.

Acceptance criteria and evidence

Acceptance criterion	Evidence	Exact head or artifact	Result
AC1	quality/migration-github-provider.mjs, quality/migration-inventory.mjs, provider/inventory tests, live repository dry run	adc2fdf0a6e0d0738b08d947c77c57dfb9b81c4f	Complete deterministic pagination/classification; preserved #94/PR #107 and other in-flight identities
AC2	planReconciliation fixtures and live sanitized disposition report	adc2fdf0a6e0d0738b08d947c77c57dfb9b81c4f	Sole-label plan for open items, verified completion handling, no lifecycle on PRs/non-completed closures, explicit unresolved dispositions
AC3	manifest/candidate generators, independent rebuild verifier, hostile duplicate/omission/drift/stale/unavailable tests	adc2fdf0a6e0d0738b08d947c77c57dfb9b81c4f	Deterministic digest chain with no title/body persistence and fail-closed validation
AC4	authenticated local production-composition read-only dry run and quality/migration-orchestrator.test.mjs; report digest 842caff41ba1a09fe728449d0bae9434e7b216715dcc0bf9ce75e2496f2b744d	adc2fdf0a6e0d0738b08d947c77c57dfb9b81c4f	69 issues, 100 PRs, no mutation; bounded cancellation/supersession/forward-recovery plan

Acceptance journey evidence

• Applicability: Not applicable — migration control-plane tooling with no desktop surface, per accepted issue rationale.
• Automated checks exercise user-visible outcomes rather than incidental implementation details. Not applicable to this non-UI control plane; tests exercise its observable reports and no-effect boundary.
• Required failure, recovery, accessibility, visual, and platform observations are settled. Failure and recovery are tested; UI dimensions are excluded by Exact migration inventory, one-time reconciliation, and activation orchestration #52.

Quality Plan settlement

• Applicable positive, negative, boundary, failure, cancellation, and recovery behavior is covered.
• The actually wired production composition was tested against read-only live GitHub metadata.
• Applicable security, accessibility, performance, resource, visual, and platform evidence is attached or linked. Security, redaction, bounded-resource, cancellation, and no-effect evidence applies; UI dimensions are excluded by Exact migration inventory, one-time reconciliation, and activation orchestration #52.
• Excluded quality areas retain the rationale accepted in Exact migration inventory, one-time reconciliation, and activation orchestration #52.
• Secrets, credentials, raw customer content, private endpoints, and PII are absent from source, tests, logs, evidence, artifacts, issues, and this pull request.

Verification

• npm ci --ignore-scripts
• npm run quality
• npm audit --audit-level=high — 0 vulnerabilities
• Every declared native target-specific gate passed on macOS.
• I reviewed the complete diff against requirements, contracts, trust boundaries, and failure modes.

Additional affected checks and concise results:

node --test quality/github-api.test.mjs quality/migration-dry-run.test.mjs quality/migration-github-provider.test.mjs quality/migration-inventory.test.mjs quality/migration-orchestrator.test.mjs
68 focused migration and GitHub API tests passed after the review hardening

npm run quality
Complete control-plane and native gate passed; control-plane coverage: lines 94.77%, branches 87.44%, functions 94.78%; frontend coverage: lines 95.92%, branches 94.26%, functions 90.24%.

Read-only production-composition dry run
ok=true; status=disposition-required; mutation=none; protected dev=cb44c38881649d997dd5d1405a6f7e57880cc9e0
digest=842caff41ba1a09fe728449d0bae9434e7b216715dcc0bf9ce75e2496f2b744d
members=[49,52,53,54,55,98,131,141,146,149]
69 issues; 100 pull requests; fail-closed history now explicitly reports 49 unverifiable completions, 31 legacy PR check failures, 4 legacy unsigned-commit chains, 6 unassociated PRs, 3 invalid issue contracts, and 1 unverifiable PR association
The disposition-required result is expected and deliberately prevents publication until #53 reconciles the explicitly reported historical inconsistencies. Closed superseded PR #156 no longer contributes a stale delivery association.

Independent audit and findings

• Audit scope and dimensions: exact pagination/set membership, deterministic bytes, association topology, in-flight continuity, redaction, partial failure, timeout/cancellation, and authority non-mutation; independently supplemented by exact-head SonarCloud, CodeQL, OSV, Socket, and dependency review
• Audited commit: adc2fdf0a6e0d0738b08d947c77c57dfb9b81c4f

Confirmed finding	Evidence	Disposition	Settlement evidence or follow-up
Successive Codex reviews found thirty-six migration-evidence and workflow-boundary defects	Reviews on prior heads through 3ae080e453465d1c56cee56b6c42254174a13c79	Resolved at owning layers	Exact-head local and remote gates pass; Codex reviewed adc2fdf0a6e0d0738b08d947c77c57dfb9b81c4f cleanly and all 41 settled conversations are resolved
SonarCloud reported seven open maintainability and correctness findings	Exact issue API for the prior head	Resolved by decomposition and explicit control flow; no finding was accepted or dismissed	Exact-head Sonar reports 0 open findings, 0 accepted issues, 0 security hotspots, 90.7% new-code coverage, and 0.0% new-code duplication

• Findings are evidence-cited; speculative observations are advisory rather than blockers.
• Every confirmed finding is resolved, explicitly accepted by an authorized human, or linked to a scoped follow-up that does not invalidate current acceptance.
• Verification and audit were repeated after the latest implementation or audit fix.

Integrated epic acceptance

• Applicability: Not applicable — Exact migration inventory, one-time reconciliation, and activation orchestration #52 prepares migration inputs and dry-run evidence; it does not deliver the epic's integrated activation surface.

Delivery

• Target path: epic/standalone -> dev
• The target branch matches the delivery path accepted in the issue; no direct push, force push, gate bypass, finding dismissal, or authority widening occurred.
• Commits are signed and every required check is bound to the exact current head and expected producer. Commit adc2fdf0a6e0d0738b08d947c77c57dfb9b81c4f has a verified SSH signature for niko.vasilopoulos96@gmail.com; all exact-head remote gates are green, the fresh Codex review is clean, and zero review conversations remain unresolved.
• Advisory tools are not treated as required merge authority.
• Documentation, ADRs, contracts, known limitations, and follow-ups are current. Unresolved historical inventory is emitted as disposition input for Terminal migration manifest publication under legacy authority #53 rather than concealed.
• A draft pull request was not promoted to Ready for Human Review before every required Acceptance Journey result and exact-head gate was complete. This replacement PR was kept draft until every required exact-head gate and acceptance result completed successfully.

This PR replaces closed stale draft #156 without rewriting history. For this dev-target pull request, only Niko or Oscharko may manually initiate merge. No agent will enable auto-merge, enqueue, merge, or update dev.

Residual risks and follow-ups

• Live inventory currently reports explicit historical dispositions. This is correct fail-closed behavior; Terminal migration manifest publication under legacy authority #53 owns authorized reconciliation before Signed activation switch, in-flight continuity, and integrated acceptance #55 activation.
• GitHub provider availability and live repository drift can invalidate a dry-run result; the implementation requires a fresh stable double-read and pre-switch inventory.

Closes #52

[Niko4417]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 5dda02a2de

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Niko4417]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 5dda02a2de

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Niko4417]

@codex review

Please review exact head 41bbcda2eb94825612425964486b9670160c1ecb. The prior twelve findings were addressed with failure-first regressions, the complete local quality bar passed, and the live provider completed a stable read-only double scan against protected dev with mutation none.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 41bbcda2eb

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Niko4417]

@codex review

Please review exact head 1c92819499b69541b9f92993576595d0fb79939b. The only delta from the prior reviewed-fix head is a failure-first LF/CRLF workflow-inspection regression prompted by the Windows gate. The full local quality suite and a fresh live read-only double scan both pass at this head.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 1c92819499

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Niko4417]

@codex review\n\nPlease review exact signed head be7048eb09ae29dad79bd91288c1a892d7443a57. The prior Windows-only failure was a regression-test fixture that double-converted existing CRLF to CRCRLF; the fixture now normalizes to LF before generating LF and CRLF variants. Full local npm run quality and npm audit --audit-level=high pass, and the live read-only inventory completed with mutation none and digest 3fb89e03955ceb32e909318e94adaf586c198fff6c7a653a0cc01321bf7f5fbe.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: be7048eb09

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Niko4417]

@codex review

Please review exact signed head cbb6c323304e3a632c81b4aec9878b4a5b5eb239, including the migration-history, immutable-manifest-chain, nested-pagination, and protected-dev binding fixes. Treat every actionable finding as blocking.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: cbb6c32330

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Niko4417]

@codex review

Please review exact signed head 603d82d1c252125ad4f63995cd7b3ca151047c6c. The four remaining prior review findings and all seven open Sonar findings were addressed with failure-first regressions or behavior-preserving decomposition. Full local quality, 59 focused tests, audit, and a live read-only double scan pass. Treat every actionable finding as blocking.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 603d82d1c2

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Niko4417]

@codex review

Please review exact signed head 42b2853620697fe53e4528fd3786316afbc705e7. The three findings from the prior exact-head review are fixed with failure-first coverage: all pull-request commits are now completely paginated and signature-checked, closed deleted-fork history preserves a nullable head repository without becoming eligible, and forged readiness evidence fails closed before planning exclusion. Full local npm run quality, 64 focused tests, audit, and a fresh authenticated read-only double scan pass. Treat every actionable finding as blocking.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 42b2853620

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Niko4417]

@codex review

Please review exact signed head 3ae080e453465d1c56cee56b6c42254174a13c79. The only delta from the prior reviewed head is the failure-first fix for collaborator-permission lookup outages: provider failures now propagate as sanitized migration-provider-collaborator-unavailable evidence, while a successful insufficient permission result remains false. Full local npm run quality, 65 focused tests, audit, and a fresh authenticated read-only double scan pass. Treat every actionable finding as blocking.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 3ae080e453

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Niko4417]

@codex review

Please review exact signed head adc2fdf0a6e0d0738b08d947c77c57dfb9b81c4f. The three latest findings were fixed failure-first at their owning layers: deleted-author historical comments remain explicit untrusted evidence, request-ceiling failures retain their bounded code, and completed issues are rejected while any associated delivery remains open. The complete local green bar, 68 focused tests, npm audit, verified SSH signature, and a fresh no-effect live inventory all pass.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
90.7% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Bravo.

Reviewed commit: adc2fdf0a6

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: adc2fdf0a6

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Identify the actual final PR before classifying completion

Fresh evidence on the exact head is that the new finalDeliveryValidated flag is applied independently to every merged association and this filter treats any single matching historical PR as the final delivery, without merge chronology or another final-delivery discriminator. With sequential delivery, an earlier PR can satisfy the terminal contract while the actual later/final PR is invalid; the earlier PR is then the sole item in finalDeliveries, so the issue is incorrectly reconciled to status: done. Select and validate the actual final delivery rather than any historical PR that passes terminal validation.

AGENTS.md reference: AGENTS.md:L44-L48

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Retain non-User historical assignees

When an assignment event references a non-User assignable, such as a mannequin retained after an account migration, this fragment returns no login; issueEvent() then rejects the event because every assignment requires a string assignee. Since the provider loads assignment history for every issue, one otherwise irrelevant historical event aborts both complete scans and permanently prevents a migration inventory. Preserve the assignable type as untrusted history and require a usable current identity only when reconstructing an in-progress claim.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Authenticate the merger as an allowlisted human

When historical mergedBy attribution resolves to a non-User actor such as a mannequin whose login matches an allowlisted name, this query discards the actor type and immutable database ID, and validMergeProof() accepts the remaining string. The inventory can consequently classify a completed delivery without proving that Niko or Oscharko personally initiated the merge; load the complete actor identity and validate it against the repository's ID/type-based governance-maintainer allowlist.

AGENTS.md reference: AGENTS.md:L196-L202

Useful? React with 👍 / 👎.