Point sophia/polaris at the Garden-Ai serving root (#213)

The catalyst world-shared arrangement is abandoned (2026-08-11): Owen now
mirrors the /eagle/projects/Rootstock build root himself into the Garden-Ai
project space with scripts/mirror_alcf.sh. Serving is group-scoped (Garden-Ai
project membership) rather than world-readable.

Updates the registry, the CLAUDE.md cluster table, and the
sophia-polaris-delta permissions runbook.

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Author: OwenPriceSkelly

CLAUDE.md

@@ -118,13 +118,13 @@ predate the declaration. Most clusters use the same path for both.
 | Cluster | Install Root | Cache Root (if split) |
 |---------|--------------|-----------------------|
 | `della` | `/scratch/gpfs/ROSENGROUP/common/rootstock` | (same as install root) |
-| `sophia` | `/lus/eagle/projects/catalyst/world-shared/rootstock` | (same as install root) |
-| `polaris` | `/lus/eagle/projects/catalyst/world-shared/rootstock` (shared with sophia) | (same as install root) |
+| `sophia` | `/lus/eagle/projects/Garden-Ai/rootstock` | (same as install root) |
+| `polaris` | `/lus/eagle/projects/Garden-Ai/rootstock` (shared with sophia) | (same as install root) |
 | `perlmutter` | `/global/cfs/cdirs/m5268/rootstock` | `/pscratch/sd/o/oprice/rootstock-cache` |
 | `delta` | `/work/hdd/data/rootstock` | (same as install root) |
 | `frontier` | `/sw/frontier/ums/ums047/rootstock` | `/lustre/orion/ums047/world-shared/rootstock-cache` |
 
-The sophia/polaris registry path is a world-shared *serving copy*, periodically rsync'd from the `/eagle/projects/Rootstock/rootstock` build root (not world-readable); admin sync/smoke-test jobs target the build root via explicit `--root`/`ROOTSTOCK_ROOT`.
+The sophia/polaris registry path is a *serving copy* under the Garden-Ai project, mirrored from the `/eagle/projects/Rootstock/rootstock` build root (not world-readable); serving is group-scoped (Garden-Ai project membership), and admin sync/smoke-test jobs target the build root via explicit `--root`/`ROOTSTOCK_ROOT`.
 
 sophia/polaris share one install and one manifest (`clusters: ["sophia", "polaris"]`), but verification records and pushed manifests are per-cluster; verify-recording commands there need `--cluster`. An env source may declare `CLUSTERS = ["polaris"]` to ship a cluster-specific variant (see `docs/environments.md`); smoke-test selection and the pushed payloads are checkpoint-first — each id is tested and reported via the env it resolves to on that cluster.
 

rootstock/clusters.py

@@ -37,16 +37,17 @@ def resolved_cache_root(self) -> Path:
     "della": Cluster(
         root=Path("/scratch/gpfs/ROSENGROUP/common/rootstock"),
     ),
-    # sophia/polaris resolve the world-shared serving copy, periodically
-    # rsync'd from the /eagle/projects/Rootstock build root (which is not
+    # sophia/polaris resolve the serving copy under the Garden-Ai project,
+    # mirrored from the /eagle/projects/Rootstock build root (which is not
     # world-readable; admin jobs target it via explicit --root/ROOTSTOCK_ROOT).
+    # Serving is group-scoped: users need Garden-Ai project membership.
     # Polaris mounts the same Eagle filesystem as Sophia, so both ALCF
     # machines share one install.
     "sophia": Cluster(
-        root=Path("/lus/eagle/projects/catalyst/world-shared/rootstock"),
+        root=Path("/lus/eagle/projects/Garden-Ai/rootstock"),
     ),
     "polaris": Cluster(
-        root=Path("/lus/eagle/projects/catalyst/world-shared/rootstock"),
+        root=Path("/lus/eagle/projects/Garden-Ai/rootstock"),
     ),
     "perlmutter": Cluster(
         root=Path("/global/cfs/cdirs/m5268/rootstock"),

scripts/runbooks/sophia-polaris-delta.md

@@ -7,9 +7,10 @@ tree once, but run the compute-node check on both machines.
 ## 0. Setup
 
 ```bash
-# sophia/polaris — audit the serving copy users resolve (owned by the
-# catalyst project, not us; findings there go to its owner, not setup-perms):
-#   ROOT=/lus/eagle/projects/catalyst/world-shared/rootstock    GROUP=<catalyst project group>
+# sophia/polaris — audit the serving copy users resolve (our mirror under the
+# Garden-Ai project; group-scoped, so users need Garden-Ai membership — fix
+# findings by re-running scripts/mirror_alcf.sh rather than setup-perms):
+#   ROOT=/lus/eagle/projects/Garden-Ai/rootstock    GROUP=<Garden-Ai project group>
 # sophia/polaris build root (ours; admin jobs only, not world-readable by design):
 #   ROOT=/eagle/projects/Rootstock/rootstock    GROUP=Rootstock
 # delta: