DEN-3945: consolidate all branches into main (2026-09-12 sweep)

[ORESoftware]

Consolidation of all branches into main — DEN-3945 fleet sweep (2026-09-12)

Linear: DEN-3945. Every local branch, worktree and uncommitted change under ~/codes was published without force; this PR merges every branch not already in main with merge commits only, conflicts resolved semantically per ORESoftware/my-ai/AGENTS.md. Durable sweep record: ORESoftware/den-3945-fleet-sweep.

Semantically resolved and merged

• origin/main (base) — Merged origin/main (15 commits: modules-first environments + RPC Durable Object coordinator infra: modules-first environments and RPC Durable Object coordinator #54, provider-repo consolidation infra: fold zed-supabase into zed-infra #56, Terraform root/child module boundaries infra: enforce Terraform root vs child module layout #55, Supabase seed import, digest-named release assets fix(edge): serve digest-named GitHub release assets from the registry Worker #64, data-platform pipelines data: govern package, install, download, build and dependency analytics #63) into the sweep with no conflicts and no deletions. The sweep branch did not previously exist on origin and was pushed.

Not merged — already landed / superseded (evidence)

• macs-mbp/wip-20260912/main — One of FOUR byte-identical captures of the same laptop working tree (git ls-tree -r of macs-mbp/wip-20260912/main, rescue/worktree-20260905, rescue/worktree-macbook-20260912 and wip/sync-preserve-20260911 are identical), all 4 files / +39 -5. Its whole content is adding cloudflare_r2_custom_domain.cdn for cdn.zpkg.net, plus the matching docs and drift-script allowlist, and replacing the artifacts_bucket output with cdn_hostname. Main reached the same goal with a deliberately DIFFERENT and safer design and forbids this one in terms: terraform/cloudflare/main.tf now reads 'The production bucket stays private. cdn.zpkg.net is an exact Worker Route declared in workers/cdn-proxy/wrangler.toml... Do not attach an R2 custom domain or make the bucket public: either would bypass the Worker read-only key-space confinement.' docs/dns-zpkg-net.md line 26 says cdn.zpkg.net is 'Not an R2 custom domain or k8s origin', and check-cloudflare-drift.sh already allowlists cdn.zpkg.net as a route-owned record. Main also KEPT the artifacts_bucket output (consumed as zed-api-server S3_BUCKET) that this branch deletes, and added cdn_hostname, edge_hostnames, cdn_public_url and cdn_workers_dev_hostname besides. Merging would have made the production bucket publicly readable and deleted a consumed output. Tip b7cd495: no PRs via REST.
• rescue/worktree-20260905 — byte-identical tree to macs-mbp/wip-20260912/main; same evidence. Tip cf2fadf: no PRs via REST.
• rescue/worktree-macbook-20260912 — byte-identical tree to macs-mbp/wip-20260912/main; same evidence. Tip 481e2a8: no PRs via REST.
• wip/sync-preserve-20260911 — byte-identical tree to macs-mbp/wip-20260912/main; same evidence. Tip 17ce347: no PRs via REST.
• rescue/DEN-4134-dirty-20260829/feat-mirror-fallback-and-forge-interop-270d5e40a786-421bbbb3 — carries the LEGACY cloudflare/workers/* layout that main deleted in the modules-first restructure; merging it would resurrect a removed tree. Its 131-line cloudflare/workers/zpkg-registry-gateway/src/worker.js (an allowlist keeping the account plane off registry.zpkg.net) is superseded by main's 726-line workers/registry-proxy/src/index.js plus workers/shared/github-fallback.js, which preserves the property and strengthens it: classifyRegistryRequest returns DENY_ROUTE for /v1/account/me, /v1/me, /v1/session/bootstrap, /api/v1/account/me, /v1/admin and /auth/login, adds path-traversal denials (/v1/../secret, /v1/%2e%2e/secret) the branch lacked, distinguishes DENY_METHOD, and fails closed BEFORE any origin I/O (tests assert zero fetches). cloudflare/workers/zpkg-cdn is now workers/cdn-proxy, and the branch's real workers.dev subdomain correction has landed (main's workers/cdn-proxy/wrangler.toml carries it). The branch's terraform hunks are the same forbidden R2-custom-domain design as the four-way group. Tip 23b4c36: no PRs via REST.
• wip/app-repair-source-preservation-20260829 — same tree as the DEN-4134 branch except for the stray empty _to_delete/.writetest (which is on main anyway); same supersession evidence. Tip e398006: no PRs via REST.

Not merged — the branch has its own open PR

• none

Not merged — needs a human/product decision

• rescue/DEN-4134-dirty-20260829/feat-mirror-fallback-and-forge-interop-270d5e40a786-421bbbb3 (one hunk only) — DECISION NEEDED, deliberately not merged: k8s/manifests/zed-api-server/base/configmap.yaml. Both WIP branches replace S3_ENDPOINT_URL's 'REPLACE-ME-account-id' placeholder with the literal Cloudflare account id. Main still carries the placeholder, and main's terraform/cloudflare/outputs.tf derives s3_endpoint_url from var.account_id - i.e. the account id is a Terraform variable substituted at deploy time, not a value baked into the base manifest. Committing it would persist an account identifier into a tracked manifest against that design and against the AGENTS.md credentials rule, so it is left for a human. Everything else on both branches is superseded.

Local verification (exact head 4356c813a799)

open-pr-heads.sh rc=0; 2 open PRs (#37 rescue/fix-app-zpkg-edge-outage-response-local-20260904, #26 rescue/DEN-4134-fleet-20260829/main-8cf10d8d8779), neither in the claim set. OUTCOME: after merging origin/main, the sweep head's tree is byte-identical to origin/main's (both 5242718c) - every one of the six claimed branches is superseded, so there is NOTHING to consolidate here and the sweep PR would have a zero-file diff. No deletions vs main, git diff --check clean, no conflict markers. No build or test run: with an identical tree, any verdict on this head is main's by construction. Disk 52 GB free.

Contracts (TJSV)

not applicable: no TypeSpec or JSON Schema peer contracts in this repository, and the sweep tree is identical to main's.

Merge policy

Draft until verified on the exact head. Where this org has no GitHub Actions minutes, zero-step jobs are admission refusals, not passes.

🤖 Generated with Claude Code