chore(content)!: retire 1.x branch governance after cutover

[zoeyrose]

Current cutover state — 2026-08-12

Final destructive gate for atrinik/atrinik#357. Blocked by atrinik/content#166, atrinik/atrinik#358, atrinik/classic#170, and atrinik/playtester#2.

The final immutable rollback release is now v1.8.18@0032e319dde316c2076832066fb5381177b34f42, with published source/runtime archives and SHA256SUMS. Live maintenance ruleset 20571870 remains active. No open PR currently targets 1.x.

Issue #63 is already completed. Before cutover, audit whether its installed automation identity has any justified main-target consumer; retain only reviewed minimum permissions or remove it through normal desired/live governance. Its completion does not authorize this issue's publisher apply or branch deletion.

Parent: atrinik/atrinik#357

Depends on: atrinik/content#166, atrinik/atrinik#358, atrinik/classic#170, atrinik/playtester#2

Audits completed automation identity: #63

Outcome

Remove the desired and live governance that keeps atrinik/content@1.x active, then delete exactly refs/heads/1.x as the last step of the single-source cutover. Preserve all immutable content tags, releases, assets, checksums, licenses, attribution, and reachable history. Leave main protections and organization-wide controls unchanged.

This is the final gate of atrinik/atrinik#357. No policy apply or branch deletion may occur merely because this issue is open or its configuration pull request is merged.

Live baseline

The content repository's default branch is main. Exact maintenance ruleset 20571870, 05 - Maintenance branch - content - 1.x, protects refs/heads/1.x from deletion/non-fast-forward updates and requires the content validation and conventional-title checks. Its desired state originated in the split-line rollout.

The current final rollback candidate is the immutable v1.8.18 release at 0032e319dde316c2076832066fb5381177b34f42. If atrinik/content#166 advances the branch for reconciliation, its normal Semantic Release output replaces that candidate; no tag or asset is created, moved, or edited manually.

Preconditions

Before planning the destructive live step, record evidence that:

• refactor(release-lines)!: make main the sole authored content source content#166 has certified exact authored-tree and Classic-runtime parity and published the main-built Classic target;
• refactor(content)!: route Classic through content@main atrinik#358 has shipped and audited the persisted-state migration and the built-in Classic profile resolves content@main;
• refactor(content)!: consume Classic artifacts built from content@main classic#170 has pinned, integration-tested, and release-rehearsed the exact main artifact;
• Make installation and content inputs reproducible playtester#2 accepts the same canonical source/runtime coordinate;
• no supported build, release, deployment, profile, open pull request, updater, or documented operator path still resolves 1.x;
• the final 1.x tag/release/assets/checksums and recovery instructions have been verified independently;
• an organization owner has explicitly authorized the reviewed publisher apply and exact branch deletion.

Any missing, stale, ambiguous, or mismatched evidence blocks apply.

Desired-state change

• Remove only the content 1.x maintenance-branch ruleset record from github-settings desired/manual state.
• Preserve default-branch integrity, linear history, pull-request, required-CI, immutable-tag, Actions allowlist, permissions, merge-method, and release-governance controls.
• Audit the completed feat(automation): provision a least-privilege Classic dependency update identity #63 App identity against the main-target design; retain only a still-required least-privilege installation, otherwise remove its credentials and metadata through reviewed desired/live changes.
• Update validation fixtures and governance documentation to explain the single-source branch contract and emergency recovery boundary.
• Run the publisher in plan mode and verify that no repository, rule, required check, permission, tag policy, or unrelated branch is changed.

Ordered live operation

1. Re-read all dependency issues and exact final coordinates immediately before apply.
2. Compare desired state with the live content rulesets and branch/tag/release state.
3. Apply the reviewed desired-state change through the normal publisher workflow.
4. Verify that only maintenance ruleset 20571870 was removed and all main/tag protections remain effective.
5. Recheck that no open pull request targets 1.x and no consumer resolves it.
6. Delete exactly refs/heads/1.x through the authorized GitHub operation.
7. Verify the branch is absent and every preserved tag, release, asset, checksum, and commit remains accessible.
8. Record final live evidence on Unify authored content on main for Classic and replacement atrinik#357 and update roadmap #168, retirement #273, rollout #356, content chore: record website preview environment #46, and other superseded branch guidance.

Do not combine branch deletion with repository archival, tag deletion, release deletion, force-push, default-branch changes, Classic retirement, or local workspace cleanup.

Acceptance criteria

• Publisher plan contains only the intended 1.x maintenance-ruleset retirement and directly required documentation/inventory changes.
• A separately authorized apply removes exact live ruleset 20571870; all main and immutable-tag rules remain unchanged and active.
• No open pull request, workflow, updater, release job, lock, wrapper profile, or supported document references 1.x as an active source.
• Exact refs/heads/1.x is deleted only after a second live preflight and explicit owner authorization.
• The final v1.x tag and release, source/runtime archives, SHA256SUMS, manifest, licenses, and attribution remain publicly accessible and verifiable.
• The final commit remains reachable from the preserved release tag.
• main remains the default branch and its required checks, squash-only merge policy, and immutable-release controls are unchanged.
• feat(automation): provision a least-privilege Classic dependency update identity #63 is closed and its installed identity is either justified for the main target or removed; no unused secret or App installation is left behind.
• Conflicting roadmap, support, and recovery guidance records the new single-source decision.

Validation

Run the repository's documented aggregate checks, including:

bin/validate
bin/verify-manual-settings
bin/publish

git diff --check

The publisher command above is plan mode only. Also run actionlint/ShellCheck if automation changes, compare the complete live before/after rule inventory, and verify the preserved release assets and exact branch absence through the GitHub API.

Rollback and recovery

Before branch deletion, restore the reviewed ruleset desired state and reapply if the cutover is rolled back. After deletion, the immutable final Semantic Release tag is the recovery anchor. Recreating 1.x from that tag requires a new explicit organization-owner decision and restored protection; it is not automatic rollback behavior.

Never alter or remove historical tags/releases to make desired and live state appear consistent.