Use WithAutonomi as the canonical documentation source

[JimCollinson]

Important

The repository transfer is complete. This PR remains Draft and must not be merged or deployed until the current-head checks and final reviews pass and Jim explicitly approves the merge. Production deployment is a separate later approval gate.

Summary

• Use WithAutonomi/autonomi-llm-docs as the Worker raw-content origin and the owner namespace for all five whitepaper PDF links.
• Preserve the existing repository object, Worker behavior, routes, deployment controls, and historical MaidSafe references unrelated to the repository namespace.
• Record Jim acceptance of ADR-0007. ADR-0004 remains Proposed.
• Clarify source-controlled production configuration and add the missing-path commands claimed by the deployment smoke-test runbook.

Transfer completed and validated

• Canonical repository: https://github.com/WithAutonomi/autonomi-llm-docs
• Repository identity preserved: database ID 1113110246, GraphQL ID R_kgDOQli25g
• main preserved at 645012f; this Draft branch and PR moved with the repository.
• Old repository, API, Git, raw-file, and PDF URLs redirect or resolve correctly.
• Old/new raw and live documentation bytes were compared by enumerating the current Git-tracked public Markdown/LLM paths; all matched. All five old/new/local PDFs were also hash-matched.
• Existing organization-derived access was reviewed and accepted by Jim; default GITHUB_TOKEN permissions are read-only.
• Actions, the production environment, both Cloudflare secret names, reviewers, deployments, and fork relationships were preserved.
• Repository package count is zero; installed GitHub Apps are not functional dependencies.
• Never recreate maidsafe/autonomi-llm-docs; doing so would invalidate GitHub redirects.

Validation

• cd worker && npm run check — passed on the current head: formatting, syntax, 27 tests, config assertions, and preview/production dry-runs.
• python3 scripts/adr-governance.py — passed; 7 ADR files checked.
• git diff --check — passed.
• Post-transfer verification covered repository/ref continuity, redirects, raw/PDF/live bytes, access, environment/secrets, workflows, integrations, package count, CI, and absence of merge/deploy; no gaps were found.
• Destination CI is green on current head 2f8ec14: ADR Governance run 31000948399 and Worker Check run 31000948395 passed and are the green of record.
• Final independent verification passed with no gaps.
• Final Craft Review passed with no CONFORMANCE, SIMPLICITY, or NIT findings.
• Final clean-context review passed and found the candidate ready for Jim to make the Draft-to-merge decision.
• models: claude-fable-5 · 336s
• Final adversarial review: READY-WITH-NITS, with no CRITICAL/HIGH/MEDIUM findings. Its durable-evidence LOW is resolved by the linked checkpoint.
• Final merge-readiness evidence and review checkpoint.

Known preserved control posture

• main has no branch protection or ruleset.
• The production environment has required reviewers but currently permits self-review and admin bypass.
• These are preserved organization/repository settings, not source changes. Jim must consciously accept them for merge; production deployment remains separately approval-gated.

Remaining human gates

1. Confirm current-head destination CI and final review results.
2. Jim explicitly approves taking this Draft through merge. No agent may merge without that approval.
3. Confirm post-merge CI on main.
4. Manually deploy the preview Worker from main, approve the GitHub production environment gate, and run the documented preview smoke tests.
5. Jim separately approves production deployment.
6. Manually deploy production and run the routed autonomi.com smoke tests.

Merging does not deploy. Both deployment workflows are manual-only, main-gated, and protected by the GitHub production environment.

Explicitly deferred follow-up

npm audit reports pre-existing findings in the Wrangler → Miniflare → sharp/undici development-tooling chain. The manifests and lockfile are unchanged by this PR; the packages are not shipped in the Worker; npm audit --omit=dev reports zero production vulnerabilities; and the known exploit paths do not match this deployment. Jim explicitly deferred the issue because the latest official Wrangler still pins affected undici@7.28.0, so there is no clean official upgrade-only fix today. Revisit when Cloudflare publishes patched transitive dependencies.

Current limitations

• Production still runs the previous Worker origin until this PR is merged and the separate production workflow is approved and run.
• PDF links intentionally resolve directly through raw.githubusercontent.com; ADR-0004 remains Proposed and documents that trade-off.

[JimCollinson]

Final GSD merge-readiness evidence — 2f8ec14

This is the durable review checkpoint for the exact Draft head 2f8ec1496ca8ce423c1f58cddce09c8e9bc65d64 against main at 645012f28c1b0609bbde2ac194ba53b3837ecb62. It records readiness for Jim to make the merge decision; it is not merge authorization and does not authorize preview or production deployment.

Green of record

• ADR Governance run 31000948399 — passed on the exact candidate tree.
• Worker Check run 31000948395 — passed on the exact candidate tree.
• Local reproduction: cd worker && npm run check passed formatting, syntax, 27/27 tests, preview/production config assertions, and both Wrangler dry-runs.
• python3 scripts/adr-governance.py passed; git diff --check 645012f..2f8ec14 passed.
• The synthetic merge commit tested by Actions has the same tree SHA as 2f8ec14.

Code review — passed

The final code review inspected the complete six-commit diff and reran the branch checks. It found no remaining source, security, or quality issue after these remediations:

• worker/README.markdown now distinguishes repository production configuration from source-controlled behavior.
• Missing-path commands are present in both preview and production smoke-test sets.
• ADR-0004 remains Proposed and no longer claims automatic acceptance on merge.
• PR title/body now describe the completed transfer and exact-head CI accurately.

Security evidence: npm audit --omit=dev reports zero production vulnerabilities; the full audit findings are confined to the unchanged, owner-deferred Wrangler/Miniflare development chain. Package manifests and lockfile are identical at base and head. No hardcoded credentials were found.

Independent goal verification — passed, no gaps

The verifier checked all transfer controls independently:

1. Existing repository object preserved: ID 1113110246, GraphQL ID R_kgDOQli25g; old API/web namespaces redirect to the destination.
2. All 32 old/new Git refs match; main, branch, PR, local, and CI SHAs agree.
3. PR Use WithAutonomi as the canonical documentation source #15 remains open, Draft, clean/mergeable, unmerged.
4. Namespace diff is surgical; remaining old namespace references are governed historical text.
5. All 34 current Git-tracked public Markdown/LLM paths matched byte-for-byte across old raw, new raw, live autonomi.com, and local main where applicable; headers/fallbacks matched policy.
6. All five old/new/local PDF files hash-matched and destination links resolve.
7. Worker validation passed 27 tests and both config/dry-run paths.
8. ADR governance passed; Accepted ADRs remained immutable; ADR-0004 remains Proposed.
9. Destination CI is green on the exact head.
10. Workflows remain unchanged, manual-only, main-gated, and production-environment gated.
11. production exists with main-only branch policy, reviewers JimCollinson/jacderida/dirvine, and secret names CLOUDFLARE_ACCOUNT_ID / CLOUDFLARE_API_TOKEN; no values were accessed.
12. Current access/rules/integration/package/fork state was inspected; package count is zero and no GitHub App is a source/workflow dependency.
13. No merge or post-transfer preview/production deployment occurred.

Honesty rules passed: no harness/mechanism change; baseline evidence attached for deferred audit findings; all readiness commands reproduce from branch; local and CI evidence agree.

Craft Review — PASS

No CONFORMANCE, SIMPLICITY, or NIT findings. The reviewer compared the transfer diff with the ADR template/tooling and Accepted siblings, paired deployment workflows/configs, Worker source/test conventions, and all five whitepaper link siblings. It found the origin change/test expectation, ADR states, runbook remediation, and overall scope idiomatic and surgical.

Clean-context gate — Pass

A fresh Claude lane started only from the repository/docs and live Draft PR, reproduced local validation and CI state, checked representative public/missing/internal routes, verified all five destination PDFs returned 200, spot-hashed old/new/local PDF bytes, confirmed repository identity/redirect/environment/secret-name state, and reconstructed the transfer and separate deploy boundaries without hidden implementation context.

Non-blocking observations surfaced for Jim:

• main has no branch protection/ruleset.
• The production environment permits self-review/admin bypass despite having required reviewers.
• Some historical preservation claims necessarily rely on pre-transfer attestation, though current state and repository identity were reproduced.

Verdict: Pass — ready for Jim to make the Draft-to-merge decision.

models: claude-fable-5 · 336s

Adversarial review — READY-WITH-NITS

The final adversarial reviewer independently reproduced the full diff, CI logs, 27-test suite, ADR governance, redirects, 34 public paths, all five PDFs, fallthrough behavior, access/environment/workflow/deployment state, and exact-head consistency. It found no CRITICAL, HIGH, or MEDIUM issue and no behavioral, redirect, PDF, CI, or deployment-boundary overclaim.

• LOW: final reports were previously available only in local untracked planning state. Disposition: resolved by this durable checkpoint.
• NIT: the governance script says seven ADR files were checked although full structural validation applies to changed ADRs; duplicate-number checks cover all seven. Disposition: pre-existing tooling wording, not expanded in this transfer slice.

Reviewer independence: adversarial review used OpenAI gpt-5.6-sol; clean-context used Claude Fable. The implementation and reviews did not share the clean-context lane.

Remaining owner gates

1. Jim consciously accepts the preserved unprotected-main and production self-review/admin-bypass posture and explicitly authorizes merge.
2. After merge, confirm main CI.
3. Manually deploy and smoke-test preview.
4. Jim separately authorizes production deployment.
5. Manually deploy and smoke-test production.

[JimCollinson]

Post-merge checkpoint

• Jim explicitly authorized converting and merging this Draft after accepting the preserved control posture.
• PR merged as 00f15d47aad28874b9a439b55987aa1bc69ae708.
• Post-merge ADR Governance passed: https://github.com/WithAutonomi/autonomi-llm-docs/actions/runs/31004278578
• Post-merge Worker Check passed: https://github.com/WithAutonomi/autonomi-llm-docs/actions/runs/31004278538
• Live autonomi.com/whitepapers/autonomous-network.md is byte-identical to merged main.
• No preview or production deploy workflow ran during merge; the latest deploy runs remain from June.

Preview deployment remains the next separate attended gate. Production deployment remains separately gated after preview validation.

[JimCollinson]

Preview deployment checkpoint

Production remains unauthorized.

Deployment evidence

• Owner authorization: preview only; production explicitly withheld.
• Workflow run: https://github.com/WithAutonomi/autonomi-llm-docs/actions/runs/31004723373
• Exact source: merged main at 00f15d47aad28874b9a439b55987aa1bc69ae708
• Worker: autonomi-md-proxy-preview
• URL: https://autonomi-md-proxy-preview.autonomi.workers.dev
• Cloudflare version from immutable run log: b4a38c4e-9dfa-46d5-8d79-d001b4cf0897
• The preview config assertion passed and the run log lists only the workers.dev trigger; no production workflow ran.

Smoke evidence

/llms.txt, /llms-full.txt, /overview.md, and /whitepapers/autonomous-network.md returned 200 with policy headers and bytes identical to canonical raw main and the exact Git object. Internal, encoded-internal, missing, non-matching, root, and non-GET probes returned no GitHub raw content. workers.dev cannot prove Framer fallthrough; that remains a post-production autonomi.com check.

• Independent verification: passed 7/7.
• Clean-context: Pass; ready for the separate production owner checkpoint, not production authorization.
• models: claude-fable-5 · 180s
• Craft Review: N/A; the deployment work-unit changed no tracked source.

Wrangler follow-up discovered during adversarial review

The preview run used pinned Wrangler 4.104.0 and reported four high development-toolchain findings. Wrangler 4.119.0 was published after the preview. npm labels it as a fix candidate, but isolated evaluation shows that is only partial:

• 4.119.0 successfully dry-runs both this repo preview and production configs.
• It updates sharp to 0.35.2, clearing the sharp findings.
• Its Miniflare dependency still pins vulnerable undici@7.28.0 (<7.29.0).
• A real isolated 4.119.0 install audits at 1 high + 2 moderate, not zero.
• npm audit --omit=dev remains zero for shipped production dependencies.

Therefore Cloudflare still has not published a clean complete official fix, but a partial reduction is now available. Before production, Jim must either reaffirm the existing deferral for the already-previewed 4.104.0, or stop and authorize a separate 4.119.0 update/CI/review/re-preview work-unit.

GitHub deployment records use the shared environment name production for both workflows, so the successful preview made that generic environment record look current. Workflow-specific history/logs remain the truthful source: no production workflow has run since June.