DocForge2/docs/MILESTONE_0_CLOSEOUT.md

# DocForge2 Milestone 0 closeout

Milestone 0 establishes the public DocForge2 successor without changing the supported `docforge`
product identity or the legacy DocForge repository.

## Repository state

- Public successor: <https://repo.andraxion.net/administrator/DocForge2>
- Successor default branch: `main`
- Successor development branches: `main` and `dev`
- Local `origin`: `forgejo@repo.andraxion.net:administrator/DocForge2.git`
- Local `legacy`: `forgejo@repo.andraxion.net:administrator/DocForge.git`
- Legacy repository: private, nonempty, unarchived, and defaulted to `main`
- Existing annotated tag: `v1.0.0`

`main` is the last completely verified milestone. `dev` is the integration branch for the next
explicitly activated milestone and begins at the same commit. Historical development branch names
remain in the legacy repository as v1 evidence; they are not replicated as active DocForge2
branches.

No tag, release, release announcement, or production integration change was made.

## Preserved lineage

The migration began from the advanced
`codex/language-agnostic-onboarding` tip
`bb13258861175aafd0e6c03c1a5235cbaddf6db2`, nine linear commits beyond the legacy `main`.

The original seven-file no-AST working patch had SHA-256:

```text
8cd10759c232cd4cf8c5eb024e31bbfed355e0be31fc3e732e1567c1a19a887e
```

It was preserved in commit `6c05607` before other integration. The independent local-only adapter
lifecycle commit `1ef76f0271bb339bc0d7eeb62f996d6d680548cb` was retained unchanged and merged by
`15a9130`. The resulting successor `main` contains every commit that was reachable from any local
ref before migration. No rebase, reset, squash, shallow seed, or older-remote seed was used.

A verified pre-migration bundle was written outside the repository:

```text
/tmp/DocForge2-milestone0-candidate-20260729.bundle
SHA-256 6cccd4ae2a65fa2d81e324e4592bee488b111942a496fb85f7ac6b8bd319ea2d
```

## Legacy integrity

Before and after the successor push, the legacy repository advertised these exact heads:

```text
Dev-Rewrite                         73165c9f511485ea397aaa00c5e0047bd3e635e2
DocForge-Dev                        82b3b905212e7949c0a440879f3bf866197c3927
codex/adapter-authoring-docs        7bc2ac1e3f7f9cf23ec4dcad108f9bb59978ca73
codex/language-agnostic-onboarding  bb13258861175aafd0e6c03c1a5235cbaddf6db2
main                                9fcafc290c5b5ee9cb83c4c3b2ff600f75210c8e
```

The annotated `v1.0.0` tag object remained
`2d7d306a37da89f1c860c7f0be161c45386acf61`, pointing to
`593c173b453236a6872d0a4e88e7a51a67a21cde`.

No push, deletion, visibility change, archive operation, or default-branch change was performed
against `legacy`.

## Compatibility and correctness

The stable guarantees are recorded in
[`COMPATIBILITY.md`](COMPATIBILITY.md). The dedicated contract gate verifies:

- Distribution, package, imports, and three executable names.
- CLI command and MCP tool names.
- Published JSON schemas and representative runtime envelopes.
- One-method `load_projection()` adapters.
- Optional incremental behavior and full-projection equivalence.
- Canonical JSON changeset hashing.
- Complete no-AST behavior, including pre-existing Logic, viewer, and application-refresh paths.

The no-AST policy does not claim to inspect arbitrary adapter internals. It enforces the owner-bound
policy at Logic publication and retrieval surfaces while preserving complete-projection and
genuinely non-AST incremental adapters.

## Security and publication checks

Gitleaks 8.30.1 scanned reachable Git history and an exact archive of the candidate tree with full
redaction. Both scans reported zero findings. `git fsck --full` passed. A broader filename and
credential-pattern audit also found no high-confidence matches.

Forgejo repository creation used one timestamped short-lived administrator token. Forgejo accepted
it for repository creation but returned HTTP 401 when it attempted self-deletion. The exact
task-created token row was then validated by ID, owner, and unique name, deleted in one SQLite
transaction, and rechecked. Zero matching temporary token rows remain.

The package metadata declares MIT, but the repository has no tracked standalone `LICENSE`,
`COPYING`, or `NOTICE` file. Milestone 0 records that publication weakness without inventing or
changing legal terms.

## Validation and fresh-clone proof

The repository-native aggregate gate is:

```bash
make gate
```

It passed in the working tree and in an anonymous HTTPS clone of the public successor. The
fresh-clone proof:

- Selected the expected `main` commit through the public default branch.
- Passed `git fsck --full`.
- Recreated the Python virtual environment from `uv.lock`.
- Recreated JavaScript dependencies with `npm ci`, with zero reported vulnerabilities.
- Passed Ruff formatting and lint.
- Passed HTML, rendered-manual HTML, CSS, and JavaScript lint.
- Passed Pyright with zero diagnostics.
- Passed Python compilation.
- Passed 8 public-contract tests and 42 schema subtests.
- Passed the complete 95-test and 44-subtest warning-strict suite.
- Passed lock and dependency-tree checks.
- Built the wheel and source distribution.
- Passed the disposable benchmark smoke run.
- Remained clean after validation.

The maintained performance evidence and known gaps are recorded in
[`MILESTONE_0_BASELINE.md`](MILESTONE_0_BASELINE.md) and
[`benchmarks/milestone0-2026-07-29.json`](../benchmarks/milestone0-2026-07-29.json).

## Scope confirmation

Milestone 0 made no speculative storage rewrite and introduced no self-hosting dependency.
WorldForge and ScrapeStation were not read as benchmark fixtures or changed. No production MCP
integration was repointed. `ManualRenderPlan`, `GraphViewPlan`, and a portable graph renderer remain
later-milestone direction, not claimed implementation.