gitea-stewardship-ledger/README.md

# Gitea Stewardship Ledger

Inventory started: 2026-05-20

## Stewardship Status

- Gitea account: `drjones`
- Gitea host: `https://gitea.thetempleofdoom.com`
- Local workspace: `/Volumes/sanD/dev_shit`
- Public repos found through Gitea API: 32
- Additional private repos found through MCP / created this pass: `my-loves-calendar`, `c5-jacked`, plus 26 local-only project placeholders created in the second pass.
- Top-level local folders inspected: 44
- Top-level local folders with README after this pass: 44

## Completed This Pass

| Scope | Action |
|------|--------|
| `C5 JACKED/` | Added missing parent `README.md`; created private Gitea placeholder `drjones/c5-jacked`. |
| Empty Gitea repos | Added README landing pages with common `## Stewardship Status` section. |
| Empty Gitea repo wikis | Created `Home` wiki pages with the same stewardship framing. |
| Duplicate candidates | Marked `4-way-handshake-2` and `4-way-handshake-3` as duplicate candidates of `4-way-handshake`. |
| Local-only project roots | Created private README/wiki placeholders for every maintainable no-origin project root. |
| Scratch/vendor roots | Declined to create Gitea repos for scratch folders and vendor binary bundles. |
| Local-only pushes | Pushed maintainable local-only project roots to their private Gitea repos. |
| Push hygiene | Removed generated `sdkconfig`, `.pio` dependency/build trees, and raw firmware binaries from pushed Git history heads. |

## Push Pass: 2026-05-20

Pushed these local roots to private Gitea `main` branches:

`MAYHEM`, `ai-girlfriend`, `autogpt`, `bw16`, `bw16 raper`, `clams av gui`, `discords`, `discored raper`, `docker`, `esp32c5`, `evil bw 16`, `evil cardputer`, `hacking scripts and tools`, `iceman_webui`, `meetme bot`, `meshtastic`, `n8n god`, `p4 chatbot 83125`, `p4 pannel`, `p4-bridge`, `pn532 esp32`, `s3 ai friend`, `s3 cam mini`, `s3nfc`, `secret firmware finaly here`, `tinder bot`.

### Push Cleanup Decisions

| Repo | Cleanup |
|------|---------|
| `p4-gemini-chatbot` | Removed generated `p4_gemini_chat/sdkconfig` from Git and ignored future `sdkconfig` files. |
| `pn532-esp32-scanner` | Removed `.pio/` dependency/build tree and ignored PlatformIO output. |
| `s3-ai-friend-firmware` | Removed `merged-binary.bin`; firmware binaries belong in releases with SHA256 provenance. |
| `secret-firmware-drop` | Removed `merged-binary.bin`; firmware binaries belong in releases with SHA256 provenance. |

### Embedded Git Checkouts

Several parent workspaces contain nested Git repositories. This pass recorded those nested projects as gitlinks instead of absorbing third-party histories into parent repos. That preserves structure without silently vendoring upstream repos. The next stewardship pass should either convert them to proper submodules with URLs or mirror selected nested repos into dedicated Gitea repositories.

## Empty Gitea Repos Initialized

| Repo | README | Wiki |
|------|--------|------|
| `4-way-handshake` | initialized | `Home` initialized |
| `4-way-handshake-2` | initialized | `Home` initialized |
| `4-way-handshake-3` | initialized | `Home` initialized |
| `carding-git-easyCarding` | initialized | `Home` initialized |
| `car-fob-killer` | initialized | `Home` initialized |
| `jammerremix` | initialized | `Home` initialized |
| `pn532final` | initialized | `Home` initialized |
| `wifi--killer` | initialized | `Home` initialized |

## Private Placeholder Created

| Repo | Source | README | Wiki |
|------|--------|--------|------|
| `c5-jacked` | `C5 JACKED/` parent workspace | initialized | `Home` initialized |

## Private Placeholders Created In Second Pass

| Gitea Repo | Local Source | Keeper Decision |
|-----------|--------------|-----------------|
| `mayhem` | `MAYHEM/` | Private parent workspace. |
| `ai-girlfriend` | `ai-girlfriend/` | Private firmware workspace; scrub API/Wi-Fi secrets before full upload. |
| `bw16` | `bw16/` | Private parent index for BW16 control-panel work. |
| `bw16-research` | `bw16 raper/` | Canonical clean slug; retire old local name later. |
| `clams-av-gui` | `clams av gui/` | Private desktop app parent workspace. |
| `discord-automation-workspace` | `discords/` | Private bot workspace; scrub tokens/logs before source upload. |
| `discord-tooling-collection` | `discored raper/` | Canonical clean slug; keep private. |
| `docker-compose-scratchpad` | `docker/` | Private until compose services and env handling are real. |
| `esp32c5-workspace` | `esp32c5/` | Parent index; do not push ESP-IDF vendor trees by accident. |
| `evil-bw16-orchestrator` | `evil bw 16/` | Private lab firmware workspace. |
| `evil-cardputer` | `evil cardputer/` | Private parent index. |
| `security-scripts-tools` | `hacking scripts and tools/` | Private until every child directory is classified by ownership/license/scope. |
| `iceman-webui` | `iceman_webui/` | Private parent index. |
| `meetme-bot-workspace` | `meetme bot/` | Private; never publish user/session data. |
| `meshtastic-workspace` | `meshtastic/` | Private parent index; do not mirror upstream wholesale without local patches. |
| `n8n-workspace` | `n8n god/` | Private; workflow exports must be scrubbed. |
| `p4-gemini-chatbot` | `p4 chatbot 83125/` | Private app firmware workspace; exclude copied toolchains. |
| `p4-voice-panel` | `p4 pannel/` | Canonical typo-fixed slug; rename local folder later. |
| `p4-bridge` | `p4-bridge/` | Private app source placeholder; exclude SD card/vendor/binary artifacts. |
| `pn532-esp32-scanner` | `pn532 esp32/` | Private NFC scanner workspace; no card dumps or keys. |
| `s3-ai-friend-firmware` | `s3 ai friend/` | Private firmware artifact repo; binaries belong in releases with hashes. |
| `s3-cam-mini` | `s3 cam mini/` | Private camera firmware workspace. |
| `s3nfc` | `s3nfc/` | Private parent index for nested PlatformIO work. |
| `secret-firmware-drop` | `secret firmware finaly here/` | Private firmware artifact repo; releases need provenance. |
| `autogpt-workspace` | `autogpt/` | Private lightweight placeholder. |
| `tinder-bot-workspace` | `tinder bot/` | Private placeholder; no platform credentials or private user data. |

## Declined Repo Creation

| Local Folder | Reason |
|-------------|--------|
| `New folder/` | Scratch placeholder with no project identity. |
| `New folder (2)/` | Scratch placeholder with no project identity. |
| `cursor projects/` | Empty holder for miscellaneous workspaces; not a maintainable repo yet. |
| `platform-tools/` | Vendor binary bundle; should be installed from Android SDK source or attached to releases with provenance, not owned as source. |

## Duplicate Candidates

| Group | Current Finding | Keeper Decision |
|------|-----------------|-----------------|
| `4-way-handshake`, `4-way-handshake-2`, `4-way-handshake-3` | Same import description; all were empty before README initialization. | `4-way-handshake` is canonical. `4-way-handshake-2` and `4-way-handshake-3` are duplicates to archive/delete when repo-management access is available. |

## Local Project Remote Classes

### Local Git Repos With No Origin

These are not linked to any remote through `origin`:

`MAYHEM`, `New folder`, `New folder (2)`, `ai-girlfriend`, `autogpt`, `bw16`, `bw16 raper`, `clams av gui`, `cursor projects`, `discords`, `discored raper`, `docker`, `esp32c5`, `evil bw 16`, `evil cardputer`, `hacking scripts and tools`, `iceman_webui`, `meetme bot`, `meshtastic`, `n8n god`, `p4 chatbot 83125`, `p4 pannel`, `p4-bridge`, `platform-tools`, `pn532 esp32`, `s3 ai friend`, `s3 cam mini`, `s3nfc`, `secret firmware finaly here`, `tinder bot`.

### Local Git Repos With GitHub Origin

These are online somewhere, but not connected to Gitea by `origin`:

`Bruce`, `ESP32-BlueJammer`, `FINALROUND AI`, `Flipper`, `JAM`, `copy-of-local-network-dashboard`, `cursor-windsurf-ai-bypass`, `digital ghost`, `esp32cPN532`, `evil orchestrator`, `spyderfoot`.

## Upload Policy

- Visibility: private by default for unfinished firmware, security tooling, binaries, and bot projects.
- Naming: normalize to lowercase hyphenated slugs; clean up offensive, typo-heavy, or throwaway folder labels at the Gitea boundary.
- Scope: README/wiki placeholders first; full source upload only after secret scan, binary policy, and license classification.
- Fork handling: GitHub-origin projects stay upstream checkouts unless local patches justify private mirrors.
- Duplicates: keep one canonical repo; mark extras for archive/delete.

## Forge Polish Pass: 2026-05-20

Applied a standard stewardship layer across all 58 Gitea repositories owned by `drjones`.

### Repository Files

Every repo now has:

- `SECURITY.md`
- `CHANGELOG.md`
- `CONTRIBUTING.md`
- `CODEOWNERS`
- `LICENSE_STATUS.md`
- `.gitea/PULL_REQUEST_TEMPLATE.md`
- `.gitea/ISSUE_TEMPLATE/bug_report.md`
- `.gitea/ISSUE_TEMPLATE/docs_task.md`
- `.gitea/ISSUE_TEMPLATE/release_checklist.md`

Keeper decision: do not add blanket `LICENSE` files until each repo's actual ownership and upstream license status is confirmed. `LICENSE_STATUS.md` is the controlling placeholder for that work.

### Wiki Coverage

Every repo now has a wiki with:

- `Home`
- `Setup`
- `Operations`
- `Security`
- `Releases`
- `Provenance`
- `Hardware` for firmware/hardware-oriented repos, otherwise `Architecture`

The temporary setup test page on `gitea-stewardship-ledger` was replaced with the real setup page.

### Labels

Every repo now has the standard issue label set:

`bug`, `docs`, `hardware`, `firmware`, `security`, `needs-triage`, `blocked`, `duplicate`, `upstream`, `release-ready`, `provenance`.

### Descriptions

Empty or import-placeholder descriptions were replaced with concise stewardship descriptions. Hand-written descriptions were preserved.

### Verification

Independent API audit completed after the write pass:

- Repositories audited: 58
- Required files: 9/9 present on every repo
- Required labels: 11/11 present on every repo
- Required wiki pages: 7/7 present on every repo
- Audit failures: 0

One classification mismatch was repaired during verification: `evil-cardputer` now has the expected `Hardware` wiki page.

## Operational Readiness Pass: 2026-05-20

Applied the next non-destructive readiness layer across all 58 Gitea repositories.

### Readiness Files

Every repo now has:

- `.editorconfig`
- `.gitattributes`
- `docs/ROADMAP.md`
- `docs/MAINTENANCE.md`
- `docs/RELEASE_PROCESS.md`
- `docs/PROVENANCE_CHECKLIST.md`
- `docs/SECURITY_REVIEW.md`
- `docs/PROJECT_HANDOFF.md`

Keeper decision: these files establish the operating surface for every repo without pretending the project-specific facts are already known. Custom existing files were preserved; the pass only created missing files or updated known stewardship-standard files.

### Milestones

Every repo now has four operational milestones:

- `Triage`
- `Provenance Review`
- `First Verified Release`
- `Maintenance`

### Issues

Every repo now has one `Stewardship Readiness Checklist` issue. The issue is the maintainer-facing queue for replacing generic stewardship notes with project-specific facts, completing security review, resolving license status, and preparing a verified release.

### Topics

Every repo now has searchable readiness topics:

- `stewarded`
- `readiness`
- one project-class topic: `hardware`, `automation`, or `software`
- `firmware` where the repo is hardware/firmware-oriented
- `private-workspace` where the repo is private

### Verification

Independent API audit completed after the readiness pass:

- Repositories audited: 58
- Readiness files: 8/8 present on every repo
- Operational milestones: 4/4 present on every repo
- Readiness issue: present on every repo
- Required topics: present on every repo
- Audit failures: 0

## Detailed Wiki Pass: 2026-05-20

Read each Gitea repository individually using the repository tree, mapped local project source where available, README files, and common manifest/build signals. Rewrote the wiki layer with project-specific evidence rather than generic stewardship text.

### Pages Updated

Every repo now has detailed content for:

- `Home`
- `Setup`
- `Operations`
- `Security`
- `Releases`
- `Provenance`
- `Hardware` for hardware/firmware-oriented repos or `Architecture` for software/automation repos

Every repo also now has:

- `Project Inventory`

### Detail Sources

The wiki pass inspected:

- Gitea repository description, visibility, default branch, language, and topics
- Gitea repository file tree
- mapped local source directories where available
- README headings and summary content
- `package.json`
- `requirements*.txt`
- `platformio.ini`
- `CMakeLists.txt`
- `Dockerfile`
- `docker-compose*.yml`
- Arduino `.ino` sketches

### Content Added

The generated wiki pages now include:

- project purpose and classification
- evidence reviewed
- local source mapping, when known
- setup signals and setup gaps
- architecture or hardware interpretation
- visible project file inventory
- directory and file-type concentration
- maintainer operations workflow
- security risk profile
- release gates
- provenance requirements and unknowns

Keeper decision: when a repo only contains stewardship files or placeholder content, the wiki says so directly. No fake setup commands, fake architecture, or fake release readiness were invented.

### Safety Boundary

Security-sensitive repositories were documented for authorized lab, defensive, research, and maintenance use only. The wiki pass did not add operational misuse instructions.

### API Repair

The first detailed wiki write used the wrong Gitea wiki content field and produced blank wiki file contents. This was detected by cloning a wiki repository directly and repaired by rerunning the pass with `content_base64`.

### Verification

Independent verification completed after the repair:

- Repositories audited: 58
- Required detailed wiki pages: present on every repo
- `Project Inventory`: present on every repo
- `Home` pages: non-empty and contain detailed evidence markers on every repo
- `Project Inventory` pages: non-empty and contain file/build signal sections on every repo
- Audit failures: 0

## Deep Audit And Remediation Pass: 2026-05-20

Ran a current-head deep audit across all 58 Gitea repositories plus mapped local project roots.

### Audit Outputs

- Local raw JSON: `.stewardship-audit-2026-05-20/deep-audit.json`
- Local triage report: `GITEA_DEEP_AUDIT_TRIAGE_2026-05-20.md`

### Findings

- Initial high-confidence credential findings: 7 across 3 repos
- High-confidence credential findings after remediation: 0
- Generic secret-like findings still requiring manual review: 389 across 26 repos
- Repos with release-blocking binary/archive artifacts: 9
- Release-blocking binary/archive artifacts: 227
- Repos with nested Git checkouts or gitlinks found: 18
- Final license files added: 0

### Remediation Applied

- Redacted local Discord Google API keys and Discord token files in mapped nested workspaces.
- Redacted embedded Wi-Fi credentials and Google API key in `p4-voice-panel`, committed, rebased onto the Gitea head, and pushed.
- Fixed invalid `.gitattributes` comment syntax across all 58 repos.
- Archived duplicate repos `4-way-handshake-2` and `4-way-handshake-3`; canonical repo is `4-way-handshake`.
- Added `.gitmodules` metadata for known nested gitlinks in 13 repos:
  `bw16`, `clams-av-gui`, `discord-automation-workspace`, `discord-tooling-collection`, `docker-compose-scratchpad`, `esp32c5-workspace`, `evil-cardputer`, `iceman-webui`, `mayhem`, `meetme-bot-workspace`, `meshtastic-workspace`, `s3nfc`, `security-scripts-tools`.

### Still Blocked

- `c5-project` gitlink `esp32-wifi-penetration-tool` has no confirmed source URL.
- `car-key-killer` gitlink `cypher-pulse` has no confirmed source URL.
- Licenses remain unresolved because the audit did not prove authorship/upstream license status sufficiently to add final `LICENSE` files.
- Generic secret-like findings need manual review before verified releases.
- Binary/archive artifacts need removal, release-asset migration, or provenance documentation before verified releases.

### Keeper Decision

Do not create verified releases or enable branch protection yet. Real CI and branch rules should follow after the remaining secret review, license/provenance resolution, and binary artifact cleanup.

## Placeholder And Junk Cleanup: 2026-05-20

After review, the forge still had too much scaffolding and too many placeholder shells. Cleanup actions:

- Archived 13 public repos that had no real project files beyond stewardship/README shell content:
  `4-way-handshake`, `4-way-handshake-2`, `4-way-handshake-3`, `MONEYTOOLS`, `brute-rat`, `capture-kali`, `car-fob-killer`, `carding-git-easyCarding`, `dead-rat`, `jammerremix`, `nrf24-jammer-2.4ghz-boosted`, `pn532final`, `wifi--killer`.
- Removed tracked macOS AppleDouble sidecar files and clangd `.cache` index files from:
  `ai-girlfriend`, `esp32c5-workspace`, `nfc-pn532-warlord`, `p4-bridge`, `p4-gemini-chatbot`.
- Added ignore rules for `._*` and clangd cache paths in the same cleaned repos.
- Verified the affected remotes no longer track those sidecar/cache files.

Keeper decision: inactive shells should be archived, not polished. Real work now belongs on repos with source, manifests, or confirmed local project content.

## Repo-by-Repo Maintainer Decisions: 2026-05-20

Replaced the broad readiness checklist language with repo-specific maintainer decisions for every active repository.

### Outputs

- Local action report: `GITEA_REPO_ACTION_PLAN_2026-05-20.md`
- Ledger report path: `reports/GITEA_REPO_ACTION_PLAN_2026-05-20.md`
- Active readiness issues corrected: 45
- Archived shell repos skipped: 13
- High-confidence credential findings after remediation: 0

### Decision Rules Applied

- Archived repos remain archived when they contain no real project source beyond stewardship scaffolding.
- Active repos are marked by their current blocking condition: license unresolved, artifact provenance, generic secret-review findings, or nested Git source gaps.
- Readiness issues now point to concrete next moves: review generic secret-like findings, resolve license/provenance, migrate binary artifacts to verified releases, or confirm nested Git source URLs.
- Placeholder status was not expanded further. The pass replaced it with repo-specific blocker counts and maintainer actions.

### Still Blocked

- Final `LICENSE` files remain blocked until ownership and upstream source licenses are proven per repo.
- Generic secret-like findings remain in 26 repos and need line-by-line review before release work.
- Release-blocking binary/archive artifacts remain in 9 repos and need either removal, release-asset migration, or provenance notes.
- Two nested Git links still lack confirmed source URLs: `c5-project/esp32-wifi-penetration-tool` and `car-key-killer/cypher-pulse`.

Keeper decision: the next useful pass is not more scaffolding. It is targeted cleanup against the action report: secrets review first, then artifact provenance, then license resolution, then real per-project CI.