[Maintenance] Complete the ByteFolk post-rename handoff

[PeterGuy326]

schemaVersion: requirement-record.v1
revision: R1
status: blocked
priority: P0
productOwner: "@PeterGuy326"
technicalOwner: "@PeterGuy326"
implementationOwner: "child issue owners"
humanReviewOwner: "@Bindy-lbb"
userOutcome: "A maintainer can find every remaining post-rename action, its owner, its evidence source, and its close condition without treating source state as published state or treating this handoff as npm execution authorization."
requirements:
  - REQ-001
  - REQ-002
  - REQ-003
  - REQ-004
  - REQ-005
  - REQ-006
acceptanceCriteria:
  - AC-001
  - AC-002
  - AC-003
  - AC-004
  - AC-005
  - AC-006
parent: "https://github.com/bytefolk/.github/issues/20"
dependencies:
  - "https://github.com/bytefolk/.github/issues/18"
  - "https://github.com/bytefolk/.github/issues/22"
  - "https://github.com/bytefolk/digital-employee/issues/237"
  - "https://github.com/bytefolk/mem/issues/122"
supersedes: []
lastDecisionAt: "2026-09-01T15:55:03Z"

Decision: DEC-GITHUB-24-001 (2026-09-01T15:55:03Z)

Outcome

Complete or explicitly hand off every material item left after the GitHub organization rename, while keeping the completed rename ledger immutable and keeping package publication behind a separate exact-write authorization.

This is the post-rename coordination record. The completed source ledger is #20 and remains CLOSED/COMPLETED. Child Issues and pull requests remain the source of truth for implementation and evidence.

Current handoff

Priority	Work	Owner	Source of truth	Current boundary
P0	Apply and verify the approved organization avatar	GitHub Organization Owner	#18, PR #19	Repository asset is merged; live organization image is still the previous avatar
P0 / HOLD	Decide and implement the npm scope migration	npm Organization Owner and package maintainers	#22	No npm account, organization-setting, package, token, deprecation, or registry write is authorized here
P0	Reconcile Digital Employee 0.6.1 release state	Release Owner	bytefolk/digital-employee#237	main is 0.6.1; npm latest and the public GitHub Release remain 0.6.0; publication needs a new explicit decision
P0	Complete or redesign mem-mcp Trusted Publishing	npm Organization Owner and mem maintainers	bytefolk/mem#122, bytefolk/mem#146	The old-scope 0.1.1 package exists; OIDC publishing is not complete and must be coordinated with #22
P1	Prevent stale coordinates from entering main	Contributors and reviewers	bytefolk/mem#146, bytefolk/mem#143, bytefolk/mem#126, bytefolk/digital-employee#239	Update or close each PR; #239 is superseded by merged PR #242 and should not be repaired as a live candidate
P1	Finish owner-only organization readback	GitHub Organization Owner	This Issue	Webhooks, self-hosted runners, organization Actions settings, and full Packages inventory remain unverified from an owner session
P1	Establish product-wide brand rollout	Brand Owner	New child Issue required	#18 intentionally excludes product-specific icons, favicons, social previews, and other product surfaces

Product decision

• Create this new child record instead of reopening migration: rename GitHub organization handle to bytefolk #20. Reopening a completed ledger to stack new revisions is forbidden by organization governance.
• Keep brand: use the selected Open Herd icon-only organization avatar #18 limited to the central GitHub organization avatar.
• Keep [Migration] Move npm packages from @fullstack-ai-infra to @bytefolk #22 limited to npm ownership, package topology, execution authorization, compatibility, deprecation, and rollback.
• Keep package/release details in release: publish v0.6.1 documentation-integrity patch digital-employee#237 and release: publish mem-mcp v0.1.1 and bootstrap npm Trusted Publishing mem#122; this Issue tracks their disposition, not their implementation.
• Treat old organization-profile 404 and old GHCR 403 behavior as accepted platform limits, not as open code defects.

Requirements

REQ-001 — Live organization avatar

The GitHub Organization Owner MUST upload the exact asset approved in PR #19, verify the anonymous organization page and API readback, verify that unrelated organization settings did not change, and complete #18.

REQ-002 — npm HOLD and exact authorization

The npm Organization Owner MUST verify control of the bytefolk organization and @bytefolk scope, classify every source package as public/private/retired/fixture, approve target names and versions, and review Trusted Publisher, provenance, 2FA, consumer, lockfile, compatibility, deprecation, and rollback decisions in #22.

This Issue MUST NOT be interpreted as authorization for npm login, scope reservation, membership changes, 2FA enforcement, token creation, Trusted Publisher mutation, publish, dist-tag, deprecate, unpublish, or any other registry write. Every actual write requires a separate exact change set and human operator authorization.

REQ-003 — Published-state integrity

The release owners MUST resolve the split between Digital Employee source version 0.6.1 and currently published 0.6.0 artifacts in bytefolk/digital-employee#237, and MUST reconcile bytefolk/mem#122's completed old-scope 0.1.1 publication with its incomplete OIDC publishing path. Source package metadata MUST NOT be described as proof of publication.

REQ-004 — Pull-request containment

No open pull request may merge while its final tree reintroduces obsolete GitHub or GHCR owner coordinates. The current npm scope stays unchanged until #22 authorizes a migration. Superseded candidates are closed with a trace to their replacement instead of receiving unnecessary new work.

REQ-005 — Owner-only organization readback

An Organization Owner MUST read back organization webhooks, self-hosted runners, organization Actions secrets/variables access configuration, and the full GitHub Packages inventory and permissions. Public evidence records only PASS/NOT VERIFIED and sanitized counts; it MUST NOT expose secret names or values, private package details, personal data, or credentials.

REQ-006 — Product-wide brand rollout boundary

A separate child Issue MUST inventory and govern product favicons, application icons, social previews, README/Release visuals, npm/documentation visuals, CLI/Quickstart assets, lockups, and mascot usage. It MUST define which surfaces use the primary mark, wordmark, or mascot and provide per-repository acceptance criteria. This work MUST NOT expand #18 silently.

Acceptance criteria

• AC-001: brand: use the selected Open Herd icon-only organization avatar #18 is CLOSED/COMPLETED with live avatar and protected-field readback evidence.
• AC-002: [Migration] Move npm packages from @fullstack-ai-infra to @bytefolk #22 either leaves HOLD through an owner-approved implementation plan with exact child work and write boundaries, or records an explicit not-planned decision; no implicit npm execution occurs.
• AC-003: release: publish v0.6.1 documentation-integrity patch digital-employee#237 records whether 0.6.1 is published or cancelled, and release: publish mem-mcp v0.1.1 and bootstrap npm Trusted Publishing mem#122 records the accepted Trusted Publishing route; public registry/release readback matches both decisions.
• AC-004: feat(release): add npm Trusted Publishing via OIDC mem#146, fix(web): reconcile nginx and API security-header ownership (#136) mem#143, and docs(onboarding): make deploy/compose the primary onboarding path mem#126 either have clean final trees plus fresh CI/review or are closed; chore(release): prepare v0.6.1 (#237) digital-employee#239 is closed as superseded by release: prepare v0.6.1 documentation-integrity patch digital-employee#242.
• AC-005: Owner-only organization readback is recorded with no sensitive values; any discovered defect has its own scoped child Issue.
• AC-006: A Brand Rollout child Issue exists with a public-surface inventory and acceptance criteria, or the Product Owner records an explicit not-planned decision. The old organization-profile and GHCR limitations remain documented and accepted.

Related context, not close blockers

• docs(release): align current public-version guidance with v0.6.0 digital-employee#235: the documentation change is merged; its product-acceptance/closure ledger should be reconciled separately.
• mem-mcp 上架执行 G1–G6（MCP hubs 硬前置，运营派单） mem#104: MCP directory distribution; parts of its npm/Release baseline need a fresh readback.
• feat(release): publish an installable memd artifact and reconcile /v1/version with client revision pins mem#151: installable memd distribution and runtime integration.
• Release governance gap: admin self-merge bypass and v0.1.0 tag churn (follow-up to #81) mem#124 and chore(codeowners): add third independent reviewer mem#138: normal CODEOWNERS/release-governance work.
• .github RFC: define the ByteFolk product vision and module boundaries #6, [Epic] O1: prove one durable digital employee across mem, doc, and runtime #7, [Governance] make GitHub Issues the traceable requirements source of truth #8, and [Epic] O2: prove one governed digital-employee team #23: product vision, cross-repository proof, and governance roadmap.

Known compatibility limits

• The old organization profile does not redirect to https://github.com/bytefolk.
• Existing repository redirects work today but are not a permanent public contract; current documentation uses the ByteFolk URLs directly.
• ghcr.io/bytefolk/digital-employee:0.6.0 is the supported image coordinate; the old owner path returns 403 and has no transparent alias.
• npm is an independent namespace and did not move with the GitHub organization rename.

Non-goals

• Reopening or changing the accepted result of migration: rename GitHub organization handle to bytefolk #20.
• Copying child implementation evidence or package runbooks into this coordination Issue.
• Bulk replacing stable npm, MCP, schema, application, cache, legal, tarball, or historical evidence identities.
• Turning ordinary product/RFC backlog into post-rename blockers.
• Creating or exposing credentials to finish an acceptance checkbox.

Validation and closing flow

1. Read every child Issue/PR from GitHub immediately before updating this ledger.
2. Record links to persisted evidence and distinguish source, public release, and planned state.
3. Obtain Product Owner ACCEPT for AC-001 through AC-006.
4. Post the requirement-decision:v1 closing decision, update this body to status=accepted, and close as completed.

Revision history

• R1 (2026-09-01T15:55:03Z): created the post-rename coordination child of migration: rename GitHub organization handle to bytefolk #20; no npm or organization-setting write authorized.

[PeterGuy326]

schemaVersion: post-rename-handoff-readback.v1
canonicalIssue: "https://github.com/bytefolk/.github/issues/24"
observedAt: "2026-09-01T16:57:00Z"
actor: "@PeterGuy326"
result: partial-progress
status: blocked
npmOrOrgSettingWrites: 0

Acceptance readback

AC	Result	Persisted evidence
AC-001	PARTIAL	The live organization avatar now matches the tracked horned-B asset and anonymous/API/pixel readback passed. Full protected-field before/after evidence is still NOT VERIFIED, so #18 remains open: #18 (comment)
AC-002	HOLD	Public registry state was read without login; npm ownership/private classification and an exact implementation decision remain missing. No npm write was authorized or performed: #22 (comment)
AC-003	BLOCKED	Digital Employee source is 0.6.1 while npm/GitHub Release remain 0.6.0; publish versus cancel is undecided: bytefolk/digital-employee#237 (comment) . mem 0.1.1 is public under the current npm scope, but the accepted OIDC route is unresolved: bytefolk/mem#122 (comment)
AC-004	PASS	The four named stale candidates are closed without merge and with exact-head/supersession traces: digital-employee#239, mem#146, mem#143, and mem#126.
AC-005	NOT VERIFIED	The authenticated account is an active organization admin, but the current automation credential cannot read the required owner-only webhooks, runner, Actions, audit, or full Packages endpoints (404/403). No secret name/value, private package detail, personal data, or credential was read or posted. A scoped owner-UI/API readback is still required.
AC-006	PASS	Brand Rollout child #25 now records the seven-public-repository surface inventory, per-repository acceptance, asset provenance, social-preview write boundary, mascot N/A, and package/application/user/third-party identity protections: #25

AC-004 closure ledger

• digital-employee#239: CLOSED at 2026-09-01T16:48:51Z; superseded by merged #242; trace: chore(release): prepare v0.6.1 (#237) digital-employee#239 (comment)
• mem#146: CLOSED at 2026-09-01T16:49:28Z; replacement candidate #152 remains unaccepted and HOLD-bound; trace: feat(release): add npm Trusted Publishing via OIDC mem#146 (comment)
• mem#143: CLOSED at 2026-09-01T16:49:22Z; #136 retains the requirement for a fresh implementation; trace: fix(web): reconcile nginx and API security-header ownership (#136) mem#143 (comment)
• mem#126: CLOSED at 2026-09-01T16:49:22Z; newer candidate #148 must earn its own evidence/review; trace: docs(onboarding): make deploy/compose the primary onboarding path mem#126 (comment)

Current close decision

Do not close this Issue. AC-004 and AC-006 are now satisfied, but AC-001, AC-002, AC-003, and AC-005 still require explicit owner evidence or product/release decisions. No Product Owner ACCEPT for AC-001 through AC-006 is recorded by this readback.

No organization setting, npm account, npm organization, package, token, Trusted Publisher, tag, Release, GHCR, dist-tag, deprecation, or registry write occurred in this pass.

[PeterGuy326]

2026-09-02 npm migration handoff update:

• Product decision is now explicit: migrate every active @fullstack-ai-infra/* package identity and consumer to the corresponding @bytefolk/* identity. Preserve public/private/fixture classification; @context/* and @org-workbench/* are not silently renamed.
• [Migration] Move npm packages from @fullstack-ai-infra to @bytefolk #22 is no longer a decision HOLD. It now contains the verified registry baseline, exact 10-identity map, versions, four-package write set, Trusted Publisher bindings, consumer order, deprecation boundary, rollback, and responsible operator.
• Implementation records:
  • [Release] Migrate Digital Employee packages to @bytefolk digital-employee#247
  • [Release] Bootstrap @bytefolk/ui v0.2.1 design-system#19
  • [Release] Migrate mem-mcp to @bytefolk/mem-mcp v0.1.2 mem#153
  • [Maintenance] Migrate private workspaces and UI dependency to @bytefolk doc#36
  • [Maintenance] Switch Quickstart to verified @bytefolk/digital-employee digital-employee-quickstart#20
  • [Maintenance] Migrate Design System consumption to @bytefolk/ui roleweave#121
  • private bytefolk/digital-employee-platform#10
• First source PR: private platform package migration bytefolk/digital-employee-platform#11; no package publication is involved.
• Current hard gate: the local npm credential returns E401, so @bytefolk npm organization ownership/role/2FA/team access and Trusted Publisher capability are still NOT VERIFIED. No npm registry or npm settings write has occurred.

REQ-002 / AC-002 therefore advances from “decision not made” to “exact plan approved, implementation active, registry phase blocked on owner authentication/control readback.” #22 remains the source of truth.

[PeterGuy326]

Post-rename handoff — current readback (2026-09-02, owner session PeterGuy326, org admin)

Continuing the interrupted Codex handoff. Read-only readback, sanitized per REQ-005 (no secret names/values, private package details, or credentials exposed).

Verified this pass

• AC-004 (PR containment): feat(release): add npm Trusted Publishing via OIDC mem#146 MERGED (npm OIDC Trusted Publishing), fix(web): reconcile nginx and API security-header ownership (#136) mem#143 MERGED (security-header reconcile), docs(onboarding): make deploy/compose the primary onboarding path mem#126 CLOSED, chore(release): prepare v0.6.1 (#237) digital-employee#239 CLOSED as superseded by MERGED #242. No open PR reintroduces obsolete coordinates. SATISFIED.
• AC-005 (owner-only readback): org=bytefolk role=admin. Packages (container) inventory count=1. Webhooks endpoint: 404 (none configured / not exposed) → recorded NOT VERIFIED. Self-hosted runners: 403 (fine-grained permission not held by this token) → NOT VERIFIED. Org Actions secrets: 403 → NOT VERIFIED. No sensitive values exposed. PARTIAL — the 403-scoped surfaces need an owner session with the runners/secrets fine-grained permission; any discovered defect gets its own scoped child Issue.
• AC-006 (brand rollout): child epic [Epic] Roll out ByteFolk branding across product surfaces #25 "[Epic] Roll out ByteFolk branding across product surfaces" EXISTS with public-surface scope. SATISFIED.

Owner-gated (not blocked by implementation; require owner/npm decisions, NOT authorized here)

• AC-001: brand: use the selected Open Herd icon-only organization avatar #18 OPEN — live org avatar is still the identicon (avatars.githubusercontent.com/u/309981672), not the PR brand(#18): add the ByteFolk organization avatar #19 asset. Needs Organization Owner to upload the approved asset + readback.
• AC-002: [Migration] Move npm packages from @fullstack-ai-infra to @bytefolk #22 OPEN (HOLD) — npm scope migration. Per REQ-002 this Issue authorizes NO npm write; leaving HOLD until the npm Organization Owner approves an exact plan or records not-planned.
• AC-003: release: publish v0.6.1 documentation-integrity patch digital-employee#237 (v0.6.1 publish/cancel) and release: publish mem-mcp v0.1.1 and bootstrap npm Trusted Publishing mem#122 (mem-mcp v0.1.1 + Trusted Publishing route) both OPEN. Publication needs separate exact-write authorization; source metadata is not proof of publication.

Disposition

#24 stays OPEN/blocked only on AC-001/002/003, all of which are owner/npm/release decisions explicitly outside this Issue's write authority. AC-004/005/006 are recorded above. No npm or organization-setting write was performed.