Merge pull request #882 from MaplePrivacyLabs/chore/mapleprivacy-transfer

Apply MaplePrivacyLabs identity and proxy namespace after transfer

Author: AnthonyRonning

.agents/skills/develop-maple-proxy/SKILL.md

@@ -5,7 +5,7 @@ description: Develop and review the maple-proxy Rust crate, binary, container, a
 
 # Develop Maple Proxy
 
-Work from the `OpenSecretCloud/Maple` repository root; the component source is
+Work from the `MaplePrivacyLabs/Maple` repository root; the component source is
 under `proxy/`. Read the repository-root `AGENTS.md`, `proxy/README.md`,
 affected source and tests, and the root
 `.github/workflows/proxy-*.yml` files relevant to the change.
@@ -108,11 +108,11 @@ Release, `.github/workflows/proxy-publish.yml` independently compares that
 release's proxy version with the previous stable Maple Release. Unchanged
 versions skip, including the unbackfilled 0.3.3 baseline. A strictly newer,
 previously unpublished version automatically publishes Linux AMD64/ARM64 to
-`ghcr.io/opensecretcloud/maple-proxy` with exact, minor, major, and `latest`
+`ghcr.io/mapleprivacylabs/maple-proxy` with exact, minor, major, and `latest`
 tags. The workflow is serialized, rejects rollback and stale releases, verifies
-the public manifest, and supports manual retry from `master`. Maple's Actions
-repository must retain write access to that existing organization-scoped GHCR
-package. Treat any namespace, trigger, version policy, or package-access change
+the public manifest, and supports manual retry from `master`. The transferred Maple repository uses its `GITHUB_TOKEN` to publish in
+`MaplePrivacyLabs`; the new package must be public and grant Maple Actions write
+access. Existing old-namespace images remain available but receive no updates. Treat any namespace, trigger, version policy, or package-access change
 as a separate production-authority decision.
 
 ## Report

.agents/skills/develop-maple/SKILL.md

@@ -5,7 +5,7 @@ description: Develop and debug ordinary non-Agent-Mode Maple features and fixes
 
 # Develop Maple
 
-Work from the `OpenSecretCloud/Maple` repository root. Treat `justfile`, `frontend/package.json`, `flake.nix`, `scripts/ci/`, and `.github/workflows/` as the command sources of truth. Check them again when they disagree with prose documentation.
+Work from the `MaplePrivacyLabs/Maple` repository root. Treat `justfile`, `frontend/package.json`, `flake.nix`, `scripts/ci/`, and `.github/workflows/` as the command sources of truth. Check them again when they disagree with prose documentation.
 
 ## Route Specialized Work
 

.agents/skills/develop-opensecret-sdk/SKILL.md

@@ -5,7 +5,7 @@ description: Develop and review the OpenSecret TypeScript/React and Rust SDKs un
 
 # Develop the OpenSecret SDK
 
-Work from `OpenSecretCloud/Maple/sdk`. Read the repository-root `AGENTS.md`,
+Work from `MaplePrivacyLabs/Maple/sdk`. Read the repository-root `AGENTS.md`,
 `sdk/README.md`, the affected implementation and tests, and the root
 `.github/workflows/sdk-*.yml` files relevant to the change.
 

.agents/skills/release-maple/SKILL.md

@@ -33,13 +33,30 @@ commit, external effect, and authority provided by the user.
   and repairs minor, major, and `latest` aliases without rebuilding an existing
   exact image. Version `0.3.3` is the explicit unbackfilled migration baseline.
   The container remains separately versioned at
-  `ghcr.io/opensecretcloud/maple-proxy`.
+  `ghcr.io/mapleprivacylabs/maple-proxy`.
 - GitHub Release creation does not itself submit the release IPA or AAB to
   Apple App Store review or Google Play.
 
 Never push or merge `master`, create a release, retry a workflow, upload to a
 store, submit for review, or alter a rollout merely to see whether it works.
 
+## Repository-transfer checkpoint
+
+After the transfer to `MaplePrivacyLabs/Maple`, merge the prepared canonical
+repository metadata before creating a new release. Keep the existing updater
+Worker serving its deployed metadata until the first normal new-org release.
+Do not manually republish retained v3.3.10 updater metadata: its asset URLs use
+`OpenSecretCloud/Maple`, while the publisher and new Worker correctly require
+the current canonical owner. The next release generates new-owner URLs without
+changing the legacy updater fallback compiled into existing clients.
+
+The first eligible proxy container publication creates
+`ghcr.io/mapleprivacylabs/maple-proxy`. GitHub creates new packages privately;
+make that package public in its settings, retain Maple Actions write access,
+and rerun only the proxy publisher if anonymous verification stops there. Do
+not create another release, change proxy versions, or overwrite exact tags to
+repair package visibility. Existing old-namespace images receive no updates.
+
 ## Prepare the version
 
 1. Prepare the bump on a clean focused branch based on current `origin/master`;
@@ -50,7 +67,7 @@ store, submit for review, or alter a rollout merely to see whether it works.
    git fetch origin master
    git merge-base --is-ancestor origin/master HEAD
    current_version="$(nix develop --no-update-lock-file .#ci -c just get-version | tail -n 1)"
-   released_version="$(gh api repos/OpenSecretCloud/Maple/releases/latest --jq '.tag_name | ltrimstr("v")')"
+   released_version="$(gh api repos/MaplePrivacyLabs/Maple/releases/latest --jq '.tag_name | ltrimstr("v")')"
    printf 'current=%s released=%s\n' "$current_version" "$released_version"
    ```
 
@@ -112,7 +129,7 @@ crates.io or GHCR publish.
 Preview GitHub's generated notes:
 
 ```bash
-gh api --method POST repos/OpenSecretCloud/Maple/releases/generate-notes \
+gh api --method POST repos/MaplePrivacyLabs/Maple/releases/generate-notes \
   -f tag_name="$tag" \
   -f target_commitish="$head_sha" \
   -f previous_tag_name="$previous_tag" | jq -r '.name, .body'
@@ -134,7 +151,7 @@ Create the GitHub Release exactly once. This creates the tag in the same flow:
 
 ```bash
 gh release create "$tag" \
-  --repo OpenSecretCloud/Maple \
+  --repo MaplePrivacyLabs/Maple \
   --target "$head_sha" \
   --title "$tag" \
   --notes-file "$notes_file"
@@ -148,12 +165,12 @@ release and workflow resolve to `head_sha`.
 Find and watch the new `Release` run:
 
 ```bash
-gh run list --repo OpenSecretCloud/Maple --workflow Release --event release \
+gh run list --repo MaplePrivacyLabs/Maple --workflow Release --event release \
   --commit "$head_sha" --limit 10 \
   --json databaseId,displayTitle,headSha,status,conclusion,url
 
 gh run watch RELEASE_RUN_ID \
-  --repo OpenSecretCloud/Maple --exit-status --compact
+  --repo MaplePrivacyLabs/Maple --exit-status --compact
 ```
 
 Stay with every platform build, signature/canonical proof, artifact upload,
@@ -166,17 +183,17 @@ After `Release` succeeds, inspect the two required publication handoffs. Do
 not rerun the core Release to repair either sibling:
 
 ```bash
-gh run list --repo OpenSecretCloud/Maple --workflow 'Publish updater metadata' \
+gh run list --repo MaplePrivacyLabs/Maple --workflow 'Publish updater metadata' \
   --commit "$head_sha" --limit 10 \
   --json databaseId,status,conclusion,headSha,createdAt,url
 
 pages_workflow='Promote Pages production'
-pages_enabled="$(gh variable list --repo OpenSecretCloud/Maple --json name,value \
+pages_enabled="$(gh variable list --repo MaplePrivacyLabs/Maple --json name,value \
   --jq '.[] | select(.name == "MAPLE_PAGES_PRODUCTION_ENABLED") | .value')" || exit 1
 if [ "$pages_enabled" = true ]; then
   pages_workflow='Publish Pages'
 fi
-gh run list --repo OpenSecretCloud/Maple --workflow "$pages_workflow" \
+gh run list --repo MaplePrivacyLabs/Maple --workflow "$pages_workflow" \
   --limit 10 \
   --json databaseId,status,conclusion,headSha,createdAt,url
 ```
@@ -192,7 +209,7 @@ the unbackfilled `0.3.3` baseline. Retry it with manual dispatch; never create a
 proxy tag or Release and never rerun the core Release to repair it:
 
 ```bash
-gh run list --repo OpenSecretCloud/Maple --workflow 'Publish proxy container' \
+gh run list --repo MaplePrivacyLabs/Maple --workflow 'Publish proxy container' \
   --limit 10 \
   --json databaseId,status,conclusion,headSha,createdAt,url
 ```
@@ -209,14 +226,14 @@ Report and repair sibling failures without altering completed release artifacts.
 Confirm the production ref in either mode:
 
 ```bash
-pages_sha="$(gh api repos/OpenSecretCloud/Maple/git/ref/heads/pages-production --jq .object.sha)"
+pages_sha="$(gh api repos/MaplePrivacyLabs/Maple/git/ref/heads/pages-production --jq .object.sha)"
 [[ "$pages_sha" == "$head_sha" ]]
 ```
 
 In legacy mode only, inspect Cloudflare's exact-commit check:
 
 ```bash
-gh api "repos/OpenSecretCloud/Maple/commits/$head_sha/check-runs" --jq '
+gh api "repos/MaplePrivacyLabs/Maple/commits/$head_sha/check-runs" --jq '
   [.check_runs[]
    | select(.name == "Cloudflare Pages")
    | select(.app.name == "Cloudflare Workers and Pages")
@@ -240,13 +257,13 @@ recreate a Release or rerun the core release merely to repair Pages.
 On failure, read the failed logs before acting:
 
 ```bash
-gh run view RELEASE_RUN_ID --repo OpenSecretCloud/Maple --log-failed
+gh run view RELEASE_RUN_ID --repo MaplePrivacyLabs/Maple --log-failed
 ```
 
 Retry only a terminal failure proven to be transient infrastructure trouble:
 
 ```bash
-gh run rerun RELEASE_RUN_ID --repo OpenSecretCloud/Maple --failed
+gh run rerun RELEASE_RUN_ID --repo MaplePrivacyLabs/Maple --failed
 ```
 
 Do not classify version/proof mismatches, deterministic builds, signing
@@ -258,11 +275,11 @@ or recreate a published release without separate explicit direction.
 Verify the published release and its assets:
 
 ```bash
-gh release view "$tag" --repo OpenSecretCloud/Maple \
+gh release view "$tag" --repo MaplePrivacyLabs/Maple \
   --json tagName,name,isDraft,isPrerelease,publishedAt,targetCommitish,url,assets
 
 mkdir -p artifacts
-gh release download "$tag" --repo OpenSecretCloud/Maple --dir artifacts
+gh release download "$tag" --repo MaplePrivacyLabs/Maple --dir artifacts
 nix develop --no-update-lock-file .#ci -c \
   ./scripts/ci/verify-release-artifacts.sh artifacts proxy
 ```
@@ -303,7 +320,7 @@ trigger a release retry, or be reported as a Maple release failure. Inspect it
 only when Zapstore status is specifically useful:
 
 ```bash
-gh run list --repo OpenSecretCloud/Maple --workflow 'Publish to Zapstore' \
+gh run list --repo MaplePrivacyLabs/Maple --workflow 'Publish to Zapstore' \
   --commit "$head_sha" --limit 10 \
   --json databaseId,status,conclusion,headSha,createdAt,url
 ```

.agents/skills/release-maple/scripts/preflight.sh

@@ -1,8 +1,8 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-readonly expected_repo="OpenSecretCloud/Maple"
-readonly remote_url="https://github.com/OpenSecretCloud/Maple.git"
+readonly expected_repo="MaplePrivacyLabs/Maple"
+readonly remote_url="https://github.com/MaplePrivacyLabs/Maple.git"
 
 fail() {
   printf 'release preflight: %s\n' "$*" >&2

.github/workflows/proxy-publish.yml

@@ -18,21 +18,28 @@ concurrency:
 
 env:
   REGISTRY: ghcr.io
-  IMAGE_NAME: opensecretcloud/maple-proxy
+  IMAGE_NAME: mapleprivacylabs/maple-proxy
   UNBACKFILLED_PROXY_BASELINE: 0.3.3
 
 jobs:
   prepare:
     name: Validate proxy publication
     if: >-
-      (github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/master') ||
+      github.repository == 'MaplePrivacyLabs/Maple' &&
+      github.repository_id == '923138240' &&
+      github.repository_owner_id == '322649754' &&
+      github.ref == 'refs/heads/master' &&
+      ((github.event_name == 'workflow_dispatch') ||
       (github.event_name == 'workflow_run' &&
         github.event.workflow_run.conclusion == 'success' &&
         github.event.workflow_run.event == 'release' &&
         github.event.workflow_run.path == '.github/workflows/release.yml' &&
-        github.event.workflow_run.head_repository.full_name == github.repository)
+        github.event.workflow_run.head_repository.full_name == github.repository))
     runs-on: ubuntu-latest
     timeout-minutes: 10
+    permissions:
+      contents: read
+      packages: read
     outputs:
       publish: ${{ steps.plan.outputs.publish }}
       reconcile: ${{ steps.plan.outputs.reconcile }}
@@ -157,13 +164,9 @@ jobs:
             esac
           fi
 
-          registry_token="$(
-            curl --fail --silent --show-error \
-              "https://${REGISTRY}/token?scope=repository:${IMAGE_NAME}:pull" | jq -er '.token'
-          )"
-          curl --fail --silent --show-error \
-            --header "Authorization: Bearer ${registry_token}" \
-            "https://${REGISTRY}/v2/${IMAGE_NAME}/tags/list?n=10000" \
+          # Only authenticated package metadata can confirm initial creation.
+          # Anonymous denial/network errors must never mean an empty registry.
+          python3 -I scripts/ci/proxy_registry_inventory.py \
             >"${RUNNER_TEMP}/proxy-tags.json"
 
           plan="${RUNNER_TEMP}/proxy-publish-plan"
@@ -452,6 +455,10 @@ jobs:
           }
 
           assert_release_is_current
+          # GitHub creates a new container package as private. An operator must
+          # make it public before anonymous verification or alias publication.
+          # This workflow never changes package visibility on the user's behalf.
+          python3 -I scripts/ci/proxy_registry_inventory.py --require-public >/dev/null
           image="${REGISTRY}/${IMAGE_NAME}"
           source_digest_dir=""
           if [ "${PUBLISHED_NOW}" = "true" ]; then

frontend/src-tauri/Cargo.toml

@@ -4,7 +4,7 @@ version = "3.3.11"
 description = "Maple AI"
 authors = ["tony@trymaple.ai"]
 license = "MIT"
-repository = "https://github.com/OpenSecretCloud/Maple"
+repository = "https://github.com/MaplePrivacyLabs/Maple"
 edition = "2021"
 rust-version = "1.94.1"
 

frontend/src/routes/proof.tsx

@@ -612,7 +612,7 @@ function Verify() {
           <p className="text-sm text-[hsl(var(--marketing-text-muted))] text-center mt-8">
             Both our{" "}
             <a
-              href="https://github.com/OpenSecretCloud/Maple"
+              href="https://github.com/MaplePrivacyLabs/Maple"
               target="_blank"
               rel="noopener noreferrer"
               className="text-foreground hover:text-foreground/80 underline"
@@ -665,7 +665,7 @@ function Verify() {
           <p className="text-sm text-[hsl(var(--marketing-text-muted))] text-center mt-8">
             Our code is open source:{" "}
             <a
-              href="https://github.com/OpenSecretCloud/Maple"
+              href="https://github.com/MaplePrivacyLabs/Maple"
               target="_blank"
               rel="noopener noreferrer"
               className="text-foreground hover:text-foreground/80 underline"

frontend/src/utils/githubRelease.test.ts

@@ -12,13 +12,13 @@ import {
 
 describe("repository metadata", () => {
   test("builds the current Maple GitHub URLs from the shared repository identity", () => {
-    expect(GITHUB_REPOSITORY).toBe("OpenSecretCloud/Maple");
-    expect(GITHUB_REPOSITORY_URL).toBe("https://github.com/OpenSecretCloud/Maple");
+    expect(GITHUB_REPOSITORY).toBe("MaplePrivacyLabs/Maple");
+    expect(GITHUB_REPOSITORY_URL).toBe("https://github.com/MaplePrivacyLabs/Maple");
     expect(GITHUB_RELEASES_API_URL).toBe(
-      "https://api.github.com/repos/OpenSecretCloud/Maple/releases/latest"
+      "https://api.github.com/repos/MaplePrivacyLabs/Maple/releases/latest"
     );
     expect(GITHUB_RELEASES_LATEST_URL).toBe(
-      "https://github.com/OpenSecretCloud/Maple/releases/latest"
+      "https://github.com/MaplePrivacyLabs/Maple/releases/latest"
     );
   });
 });
@@ -117,7 +117,7 @@ describe("getLatestDownloadInfo", () => {
           tag_name: "v9.9.9",
           name: "v9.9.9",
           published_at: "2026-08-23T00:00:00Z",
-          html_url: "https://github.com/OpenSecretCloud/Maple/releases/tag/v9.9.9",
+          html_url: "https://github.com/MaplePrivacyLabs/Maple/releases/tag/v9.9.9",
           assets: [
             {
               name: "Maple_9.9.9_universal.dmg",
@@ -144,7 +144,7 @@ describe("getLatestDownloadInfo", () => {
         linuxRpm: GITHUB_RELEASES_LATEST_URL,
         androidApk: GITHUB_RELEASES_LATEST_URL
       },
-      releaseUrl: "https://github.com/OpenSecretCloud/Maple/releases/tag/v9.9.9"
+      releaseUrl: "https://github.com/MaplePrivacyLabs/Maple/releases/tag/v9.9.9"
     });
   });
 

proxy/Cargo.toml

@@ -5,8 +5,8 @@ edition = "2021"
 authors = ["OpenSecret"]
 description = "Lightweight OpenAI-compatible proxy server for Maple/OpenSecret TEE infrastructure"
 license = "MIT"
-repository = "https://github.com/OpenSecretCloud/Maple"
-homepage = "https://github.com/OpenSecretCloud/Maple/tree/master/proxy"
+repository = "https://github.com/MaplePrivacyLabs/Maple"
+homepage = "https://github.com/MaplePrivacyLabs/Maple/tree/master/proxy"
 keywords = ["openai", "proxy", "tee", "opensecret", "maple"]
 categories = ["web-programming::http-server", "api-bindings"]
 include = [