Publish mirrors and wipe old history

Original work item (epic Task 10454, verbatim): - Remove Draft state from anywhere of the jaah-ce, agent-sdk, agent-connectors. It needs to be removed at the source and then propagated using standard mechanism - remove any references on the source of documents (especially do not mention any brands) - agent-sdk. must borrow and share the process from jaah-ce, as well as terms. We want them mirrors from the main repo. Only main branch for now - do we want the same with agent-connector? make sure it is up to date with agent-sdk - Look for any sensitive or internal information or any brands - scrub all old versions from all three repos Full settled inputs: the epic's `prd` and `architecture` artifacts (Task 10454; read with `task_read`/`artifact_read`). Decisions quoted below are verbatim from them. Child H — Environments, confirm, wipe, publish (architecture §1.9). Runs only after every other child is merged AND promoted to master (operator promotion; if not yet promoted, ASK with header `Human act`). Requirements (PRD verbatim): R5 "After the final publish of each repo: exactly one branch (`main`), exactly one commit on it, one tag (the current version) and at most one release; no other tags, releases or branches; GHCR packages for jaah-ce keep only the current version's images. Default branch of every repo = `main`." D5 "Each of the three repos ends with exactly one commit on `main` (the current scrubbed snapshot). All other branches (`develop`, `v1`), all old tags and releases, and old GHCR image versions are deleted. Irreversible." Plus the live parts of R3, R4, R8 and AC9. Steps (architecture verbatim kernels): 1. Environments: create the deploy key on `agent-connectors` and the `agent-connectors-mirror` environment (`MIRROR_DEST`, deployment branch `master`); re-key `agent-sdk-mirror` (fresh deploy key as `MIRROR_DEPLOY_KEY`, `MIRROR_DEST`, branch `master`; remove `AGENT_SDK_MIRROR_DEPLOY_KEY` and its old deploy key). `ce-mirror` and `ce-staging` untouched. Probe the admin credential's scopes first (`repo`, environments, `delete:packages`); if one is missing, ASK (`Credential`). 2. Ask: ONE `AskUserQuestion` round (header `External`) naming every ref, tag, release and GHCR version that will be deleted (approve / stop). Stop on "stop". 3. Wipe: probe rulesets/branch protection (`repos/<r>/rulesets`, `branches/main/protection`), disable what blocks force push/deletion, restore after; retarget every open PR whose base is `develop`/`v1` to `main`; root publish by dispatching each mirror workflow from `master` with `root_reset=<repo>` (parentless commit, `--force` to `main`, tag); set default branch to `main`; delete the other branches, then every tag and release, then every GHCR version of `jaah-ce-{api,web,node}` except the current tag's; jaah-ce's release workflow builds the images and the one release on that tag. 4. Prove the normal path: run each of the three workflows by hand from `master` with `publish` set; each reports it already holds the tree, no new commit (AC3c). 5. Closing PR (merged after the publish): delete `--root` and `root_reset` with their guard test; delete `tools/mirror/strip_refs.py`; delete `tools/mirror/sensitive_baseline.toml` and make the gate run strict; one idempotent alembic data migration rewriting every `agents` row whose repo is `jaah-ai/agent-connectors` or `jaah-ai/agent-sdk` and whose ref is `develop` or `v1` to `main`. 6. Verify AC1, AC2, AC3, AC4 live, AC5, AC7, AC8 per repo; repos stay `private: true`. Credentials & reach: - H: environments, deploy keys, default branch, branch/tag/release deletion, GHCR version list and delete | `me/users/roman@gmind.tech/github_admin` (admin GitHub token) | **verified** (on roster, `credential_get` succeeded); the scopes are probed by H before use (risk 5). The runner's forge token gets 403 on `orgs/jaah-ai/packages`, so it is not used for GHCR. - AC3/AC5/AC7 read oracles (branches, commits, tags, releases, file contents) | the runner's `jaah-forge` (task forge auth), GitHub API | **verified**: `jaah-forge api get repos/jaah-ai/agent-connectors/git/trees/develop` and `repos/jaah-ai/jaah/environments` answered - AC4 / AC6 / AC8 console flows on dev; node census on dev | `me/jaah/debug/main/operator-login` (operator; switches tenants), `https://app.dev.jaah.ai` | **verified**: `credential_get` succeeded; `GET /api/health` → 200 - Node census on prod (rename waves R3/R5, A6) | the same credential, `https://app.jaah.ai` | **verified**: `credential_get` succeeded; `GET /api/health` → 200 - AC4 live report-sample flow and `broken-manifest` registration on dev | operator login (above); the published `agent-connectors@main` | **verified** (credential and console reach as above); runs in H after the publish - Stored-ref oracle (H's migration) | operator login, Agents list Ref column / `GET /api/agents` per tenant on dev and prod | **verified** (credential and console reach as above) - AC4 live codex-reference flow (merged PR on dev) | a Codex/OpenAI credential on a dev node, plus a dev project | **deferred**: the operator answered "We can skip it" (A8). Named behaviour tests in C replace it. - `./dc check full`, unit and gate oracles | nothing beyond the worktree | n/a Out of scope: - Do NOT change visibility of any repo. Do NOT touch `ce-mirror`/`ce-staging`. Do NOT force-push except through the `--root` workflow path. Do NOT delete anything before the operator approves step 2. - Do NOT rename or change the product's `draft` task state or the SDK spec's "draft task" wording (D1). - Do NOT change any repo's visibility (D8); do NOT publish packages to PyPI/npm. - Do NOT relicense agent-sdk or agent-connectors (Apache-2.0 stays); do NOT change the CE license's terms beyond removing the draft banner and origin line. - Do NOT remove functionally required third-party names (S1) — provider CLIs, protocols, dependencies, forge names. - Do NOT edit monorepo files that ship to no mirror for §5 hygiene (S2) (the `skynet` rename alone is exempt, A2); do NOT rewrite the monorepo's own history. - Do NOT change jaah-ce's `ce-staging` environment or the edition seam / API cut. - Do NOT edit the mirrors directly except the one-time history reset and branch/tag/release/package deletion in R5; every content change lands in the monorepo and reaches the mirror by its publish workflow. - Do NOT change the SDK v2 API or the `jaah.ai` extension spec semantics. Done means: - AC1 (PRD verbatim): "for each repo, clone `main` and run `grep -rniE "draft|pending the licensor|not yet in force" LICENSE README* docs 2>/dev/null` plus a full-tree `grep -rniE "pending the licensor|not yet in force|license.{0,20}draft"`; observe **zero** hits." (SDK "draft task" lines excluded by D1.) - AC2 (PRD verbatim, amended by A7): "per repo `grep -rniE "n8n|adapted from|jaah-ai/jaah([^-]|$)|Jaah Local|SOURCE_COMMIT"` over the cloned tree → zero [excluding the credential registry and its fixtures]; `test ! -e SOURCE_COMMIT`; `git log --format=%B` of the one commit contains no sha of the monorepo, no `jaah-ai/jaah` URL." Quality: LICENSE reads as a complete, coherent license. - AC3 (PRD verbatim): "(a) `jaah-forge api get repos/jaah-ai/agent-sdk` → `default_branch: main`; (b) merge an unrelated change touching `packages/agent-sdk/**` to develop → no new commit on agent-sdk (compare `repos/jaah-ai/agent-sdk/commits?sha=main` before/after); (c) run the publish workflow by hand from GitHub Actions for agent-sdk → one commit on `main` whose tree equals `packages/agent-sdk/` (plus generated bundles), tag = repo-wide version." - AC4 live (PRD verbatim): "on the dev control plane console, Agents › Register agent with Repository `https://github.com/jaah-ai/agent-connectors`, Sub-path `connectors/report-sample`, Ref `main` → registers; start a task on it → the task ends `done` with an HTML report artifact that renders readably. … Registering `fixtures/broken-manifest` → one sentence per bad field." The codex-reference merged-PR run (deferred — A8, no Codex credential/dev project). - AC5 (PRD verbatim): "per repo: `branches` → `["main"]`; `commits?sha=main&per_page=2` → exactly 1 commit; `tags` → exactly one (the current version); `releases` → ≤1; for jaah-ce `orgs/jaah-ai/packages/container/<name>/versions` → only the current tag's versions for each of api/web/node. Repos still `private: true` (D8)." - AC7 on clones (PRD verbatim): "`grep -rnE "\b(Task|epic) [0-9]{3,}|ADR-[0-9]{4}|WU-[A-Z][0-9]|ruzhukov|ts\.net|dev\.jaah\.ai|jaah-ce-staging"` → zero; gitleaks over each repo → clean." and `test ! -e tools/mirror/sensitive_baseline.toml` in the monorepo; publish ran strict. - AC8 (PRD verbatim): "dev console Agents › Catalog "contribute"/repo link opens `https://github.com/jaah-ai/agent-connectors` (repo root, branch main); docs page "Contribute a catalog connector" names Ref `main`; `grep -rn "develop" ` over the connectors' and SDK's READMEs/docs → no ref advice naming `develop`." - AC9 (PRD verbatim): "the three workflows appear in the monorepo's Actions tab, each runnable by hand from the branch its environment admits, each with its environment and deploy key set (missing key → the job fails before any push, as jaah-ce today)." - Stored refs: as the operator, for each tenant, Agents list › Ref column (or `GET /api/agents`) shows no `develop`/`v1` ref for those two repos, on dev and prod (prod after promotion). - `test ! -e tools/mirror/strip_refs.py`; `grep -rn "root_reset\|--root" tools/mirror .github` → zero after the closing PR; Jaah Deploy of the closing PR green.