GoreeCloud Code: Fork-to-Native release and integration gates #1

Objective

Rebuild Forgejo as GoreeCloud Code within GoreeCloud/code, using an upstream-derived source bridge and GoreeCloud-owned contracts, design, and policy. This issue tracks work remaining after the development bootstrap; it is not a release declaration.

Gates (all pending until authoritative evidence)

• Validate tracked Forgejo v15.0.9 LTS source import, exact SHA, license, provenance, all required notices and build.
• Implement trustworthy Identity sessions, per-resource Code authorization, Wardveil Security/Policy decisions, durable pre-execution audit and recovery-safe write semantics.
• Integrate Glaze current Stable semantic tokens and components; complete exact-source accessible consumer acceptance.
• Validate Privacy Shield, Everkeep, Mesh, Manager, Observability, plus all nine Integral Platform System applicability decisions.
• Implement repos, branches, issues, pull requests/reviews, releases, packages and migration contracts with live Forgejo interoperability tests.
• Add container-isolated CI, provenance, SBOM and dependency/secrets scanning, plus GoreeCloud AI's explicitly authorized workflows.
• Prove Git and non-Git metadata migration, backups, restore drills, performance and rollback.
• Verify exact PR head, protection rules, review, checks, environment acceptance and lifecycle requirements before merge/Stable.

Current known source baseline

Development branch: feat/forgejo-bootstrap. It contains the read-only API and the pinned-source import workflow; source-import success is separately verified in GitHub. Never mark a gate complete from a workflow definition alone.

Priority: P0 for upstream provenance, security and restore gates; P1 for workflows/UI integrations; P2 for enhancements.

Latest verified development increment

• Code read API now includes an explicit owner-only JSON repository allowlist loaded for each request. Unknown repositories are denied before contacting Forgejo.
• Sanitized repository, branch, open issue and open pull request summaries exist in source with bounded collections and no mutation route.
• Security tests include permission-unsafe and symlink-based policy-file rejection, denied repository access, mismatched provider repository identity, and provider-field minimization.
• Read contract: https://github.com/GoreeCloud/code/blob/feat/forgejo-bootstrap/docs/API-READ-CONTRACT.md
• Source validation succeeded for candidate 5a2a18b9d013576c75789131139d6252d25a938b: https://github.com/GoreeCloud/code/actions/runs/37717911745

All P0/P1 production, upstream build, integration, migration and exact Glaze consumer acceptance gates remain open. Draft PR #2 is the current integration review surface.

Documentation follow-up

• Reconcile legacy docs/IMPLEMENTED-FEATURES.md, docs/FEATURES.md, docs/USER-MANUAL.md and goreecloud.platform.yaml with the new four-route read contract. This documentation reconciliation has not been fully committed; docs/API-READ-CONTRACT.md and draft PR Bootstrap GoreeCloud Code with Forgejo LTS source and governed foundation #2 currently describe the new routes.