[Maintenance] Complete the ByteFolk post-rename handoff #24

schemaVersion: requirement-record.v1
revision: R1
status: blocked
priority: P0
productOwner: "@PeterGuy326"
technicalOwner: "@PeterGuy326"
implementationOwner: "child issue owners"
humanReviewOwner: "@Bindy-lbb"
userOutcome: "A maintainer can find every remaining post-rename action, its owner, its evidence source, and its close condition without treating source state as published state or treating this handoff as npm execution authorization."
requirements:
  - REQ-001
  - REQ-002
  - REQ-003
  - REQ-004
  - REQ-005
  - REQ-006
acceptanceCriteria:
  - AC-001
  - AC-002
  - AC-003
  - AC-004
  - AC-005
  - AC-006
parent: "https://github.com/bytefolk/.github/issues/20"
dependencies:
  - "https://github.com/bytefolk/.github/issues/18"
  - "https://github.com/bytefolk/.github/issues/22"
  - "https://github.com/bytefolk/digital-employee/issues/237"
  - "https://github.com/bytefolk/mem/issues/122"
supersedes: []
lastDecisionAt: "2026-09-01T15:55:03Z"

Decision: DEC-GITHUB-24-001 (2026-09-01T15:55:03Z)

Outcome

Complete or explicitly hand off every material item left after the GitHub organization rename, while keeping the completed rename ledger immutable and keeping package publication behind a separate exact-write authorization.

This is the post-rename coordination record. The completed source ledger is #20 and remains CLOSED/COMPLETED. Child Issues and pull requests remain the source of truth for implementation and evidence.

Current handoff

Product decision

• Create this new child record instead of reopening migration: rename GitHub organization handle to bytefolk #20. Reopening a completed ledger to stack new revisions is forbidden by organization governance.
• Keep brand: use the selected Open Herd icon-only organization avatar #18 limited to the central GitHub organization avatar.
• Keep [Migration] Move npm packages from @fullstack-ai-infra to @bytefolk #22 limited to npm ownership, package topology, execution authorization, compatibility, deprecation, and rollback.
• Keep package/release details in release: publish v0.6.1 documentation-integrity patch digital-employee#237 and release: publish mem-mcp v0.1.1 and bootstrap npm Trusted Publishing mem#122; this Issue tracks their disposition, not their implementation.
• Treat old organization-profile 404 and old GHCR 403 behavior as accepted platform limits, not as open code defects.

Requirements

REQ-001 — Live organization avatar

The GitHub Organization Owner MUST upload the exact asset approved in PR #19, verify the anonymous organization page and API readback, verify that unrelated organization settings did not change, and complete #18.

REQ-002 — npm HOLD and exact authorization

The npm Organization Owner MUST verify control of the bytefolk organization and @bytefolk scope, classify every source package as public/private/retired/fixture, approve target names and versions, and review Trusted Publisher, provenance, 2FA, consumer, lockfile, compatibility, deprecation, and rollback decisions in #22.

This Issue MUST NOT be interpreted as authorization for npm login, scope reservation, membership changes, 2FA enforcement, token creation, Trusted Publisher mutation, publish, dist-tag, deprecate, unpublish, or any other registry write. Every actual write requires a separate exact change set and human operator authorization.

REQ-003 — Published-state integrity

The release owners MUST resolve the split between Digital Employee source version 0.6.1 and currently published 0.6.0 artifacts in bytefolk/digital-employee#237, and MUST reconcile bytefolk/mem#122's completed old-scope 0.1.1 publication with its incomplete OIDC publishing path. Source package metadata MUST NOT be described as proof of publication.

REQ-004 — Pull-request containment

No open pull request may merge while its final tree reintroduces obsolete GitHub or GHCR owner coordinates. The current npm scope stays unchanged until #22 authorizes a migration. Superseded candidates are closed with a trace to their replacement instead of receiving unnecessary new work.

REQ-005 — Owner-only organization readback

An Organization Owner MUST read back organization webhooks, self-hosted runners, organization Actions secrets/variables access configuration, and the full GitHub Packages inventory and permissions. Public evidence records only PASS/NOT VERIFIED and sanitized counts; it MUST NOT expose secret names or values, private package details, personal data, or credentials.

REQ-006 — Product-wide brand rollout boundary

A separate child Issue MUST inventory and govern product favicons, application icons, social previews, README/Release visuals, npm/documentation visuals, CLI/Quickstart assets, lockups, and mascot usage. It MUST define which surfaces use the primary mark, wordmark, or mascot and provide per-repository acceptance criteria. This work MUST NOT expand #18 silently.

Acceptance criteria

• AC-001: brand: use the selected Open Herd icon-only organization avatar #18 is CLOSED/COMPLETED with live avatar and protected-field readback evidence.
• AC-002: [Migration] Move npm packages from @fullstack-ai-infra to @bytefolk #22 either leaves HOLD through an owner-approved implementation plan with exact child work and write boundaries, or records an explicit not-planned decision; no implicit npm execution occurs.
• AC-003: release: publish v0.6.1 documentation-integrity patch digital-employee#237 records whether 0.6.1 is published or cancelled, and release: publish mem-mcp v0.1.1 and bootstrap npm Trusted Publishing mem#122 records the accepted Trusted Publishing route; public registry/release readback matches both decisions.
• AC-004: feat(release): add npm Trusted Publishing via OIDC mem#146, fix(web): reconcile nginx and API security-header ownership (#136) mem#143, and docs(onboarding): make deploy/compose the primary onboarding path mem#126 either have clean final trees plus fresh CI/review or are closed; chore(release): prepare v0.6.1 (#237) digital-employee#239 is closed as superseded by release: prepare v0.6.1 documentation-integrity patch digital-employee#242.
• AC-005: Owner-only organization readback is recorded with no sensitive values; any discovered defect has its own scoped child Issue.
• AC-006: A Brand Rollout child Issue exists with a public-surface inventory and acceptance criteria, or the Product Owner records an explicit not-planned decision. The old organization-profile and GHCR limitations remain documented and accepted.

Related context, not close blockers

• docs(release): align current public-version guidance with v0.6.0 digital-employee#235: the documentation change is merged; its product-acceptance/closure ledger should be reconciled separately.
• mem-mcp 上架执行 G1–G6（MCP hubs 硬前置，运营派单） mem#104: MCP directory distribution; parts of its npm/Release baseline need a fresh readback.
• feat(release): publish an installable memd artifact and reconcile /v1/version with client revision pins mem#151: installable memd distribution and runtime integration.
• Release governance gap: admin self-merge bypass and v0.1.0 tag churn (follow-up to #81) mem#124 and chore(codeowners): add third independent reviewer mem#138: normal CODEOWNERS/release-governance work.
• .github RFC: define the ByteFolk product vision and module boundaries #6, [Epic] O1: prove one durable digital employee across mem, doc, and runtime #7, [Governance] make GitHub Issues the traceable requirements source of truth #8, and [Epic] O2: prove one governed digital-employee team #23: product vision, cross-repository proof, and governance roadmap.

Known compatibility limits

• The old organization profile does not redirect to https://github.com/bytefolk.
• Existing repository redirects work today but are not a permanent public contract; current documentation uses the ByteFolk URLs directly.
• ghcr.io/bytefolk/digital-employee:0.6.0 is the supported image coordinate; the old owner path returns 403 and has no transparent alias.
• npm is an independent namespace and did not move with the GitHub organization rename.

Non-goals

• Reopening or changing the accepted result of migration: rename GitHub organization handle to bytefolk #20.
• Copying child implementation evidence or package runbooks into this coordination Issue.
• Bulk replacing stable npm, MCP, schema, application, cache, legal, tarball, or historical evidence identities.
• Turning ordinary product/RFC backlog into post-rename blockers.
• Creating or exposing credentials to finish an acceptance checkbox.

Validation and closing flow

1. Read every child Issue/PR from GitHub immediately before updating this ledger.
2. Record links to persisted evidence and distinguish source, public release, and planned state.
3. Obtain Product Owner ACCEPT for AC-001 through AC-006.
4. Post the requirement-decision:v1 closing decision, update this body to status=accepted, and close as completed.

Revision history

• R1 (2026-09-01T15:55:03Z): created the post-rename coordination child of migration: rename GitHub organization handle to bytefolk #20; no npm or organization-setting write authorized.