Pre-public owner handoff

• Object ID: em:documentation:sha256:859e311841076405f0ed54de7e344977e19081494c06c5bde44fb4877fb1d7ad
• Kind: documentation
• Repository path: docs/pre-public-owner-handoff.md
• Content digest: 6c55e03eca8ff7f0a58cbdd71c707de6bb2c52dccc72f967d2c5059fed2a46e9

Source content

Pre-public owner handoff

Archived bootstrap handoff. The repository-publication and protected-contribution steps below are complete. The default-hostname Pages bootstrap is also live. Use ops/activation/2026-08-22-pages-bootstrap.md for current evidence and remaining owner boundaries. prepublic-ready is no longer an active recovery instruction; its exact identity and cleanup decision are preserved in that record.

This document starts at the GitHub account boundary. The code, tests, deterministic site compiler, API/MCP gateway, CLI package, workflows, and provider declarations are prepared before this point.

Verify promotion

1. Confirm branch prepublic-ready exists.

2. Confirm main contains the complete repository rather than the placeholder README.

3. The promoted Git tree is 03bc33f8dc1de76abc871bfd23cd2e2f853bc623.

4. If the verification branch is absent, run the manual workflow Promote validated Epistemedia pre-public tree on main and check again.

Make the repository public

Open Settings → General → Danger Zone → Change repository visibility, choose Public, confirm yoheinakajima/epistemedia, then verify the repository from a logged-out browser.

Configure merge behavior

Under Settings → General → Pull Requests:

• enable squash merging;
• disable merge commits;
• disable rebase merging;
• enable auto-merge;
• automatically delete head branches.

Configure Actions

Under Settings → Actions → General:

• allow the GitHub-authored, verified, and explicitly pinned actions used by the committed workflows;
• set default workflow permissions to read repository contents and packages;
• keep Allow GitHub Actions to create and approve pull requests disabled.

Manually run the CI workflow on main. Do not enable Pages, container publishing, release publishing, PyPI, DNS, or MCP Registry publication yet.

Protect main

After the first successful CI run has registered the exact check names, create an active branch ruleset targeting the default branch:

• require pull requests;
• require the successful CI checks;
• require branches to be up to date;
• require linear history;
• block force pushes;
• block deletion;
• do not grant routine contributor agents bypass authority.

Stop point

Stop after the repository is public, untrusted CI is green, and main is protected. Pages, epistemedia.org, the episte.media redirect, API/MCP deployment, GHCR, GitHub Releases, PyPI Trusted Publishing, and MCP Registry publication are the next activation phase.