transfer-decisions

Prompt file imported from dasbury-esri/classic-storymaps-viewer-pages (.github/prompts/transfer-decisions.prompt.md). Copyright stays with the author.

Ownership Transfer Decisions

Recorded 2026-10-17 by Claude from David's instructions. Reconciled 2026-10-22 with the safeguards in the companion converter repository's plan, which were checked against GitHub's documentation. This file supersedes every statement in STATUS.md, the resolution plan and the provenance audit that makes retained-content rights a gate for the repository transfer. Those documents remain the evidence record; their transfer gates do not. This public copy covers the viewer only.

Order: the converter transfers first and must be accepted before any step below starts.

Owner Decisions

The transfer changes who owns the repository, not what is public. The viewer is already public and served by Pages, so every open rights question is exactly as open before the move as after it.

Verified State, 2026-10-22

Recorded by Claude. Each item names its evidence; re-check before acting.

GitHub verification is held by one account at a time, so the verification handoff is already complete. Because the domain is verified by davidasbury, no other account can bind it while it serves a 404. Keep the davidasbury challenge record permanently.

What Gates What

The transfer exception covers revision 1ce19fd6532950b8333e49da4eca7cd009ed9195 only, not whatever main happens to be. Its changes since the previous live deploy (9910cd3, 2026-10-14; replaced on 2026-10-22 by d05c215, which serves 1ce19fd's content) are tracking documents, notice tooling and attribution, the Ionicons license, and the removal of eight unused fonts. Any other revision needs a scoped diff review and owner approval before it uses this exception. One exception: a descendant qualifies without additional content review only after git merge-base --is-ancestor 1ce19fd6532950b8333e49da4eca7cd009ed9195 <revision> succeeds and git diff --name-only 1ce19fd6532950b8333e49da4eca7cd009ed9195 <revision> lists only paths under session-logs/ or .github/prompts/, or exactly STATUS.md. Run both checks in this repository; a failed command is not an empty, passing diff. Resolve and record the selected full commit SHA before dispatch, whether it is the original revision, a qualifying descendant or a separately reviewed and owner-approved revision. The build never reads the allowed documentation paths. Note that docs/licenses/ is read by the notice staging, so changes there need review.

Owner Answer Sheet (Gates the Next Public Release Only)

Ask these as one message, and record each answer under its exact paths and hashes. Do not start new audits; refresh the inventory only for a selected release candidate.

1. Four Tailcoat and four Basic Fontello font files: keep (owner accepts the documented risk) / replace with Font Awesome or Ionicons glyphs, after the owner approves how they look.
2. Unresolved archive images and other candidates with no recorded basis: keep under their existing runtime and archive basis unless a specific file is flagged / continue tracing.

Viewer Transfer Steps

Agents do not change GitHub, Cloudflare or ArcGIS settings; the owner does. Authorized documentation commits and read-only checks are separate. Record results and unknowns in an attributed session log. Never record tokens, private keys, recovery codes or credential-bearing URLs.

1. Snapshot (agent-collected; the owner approves the comparison):

   • Settings baseline: Copilot runs transfer-baseline.sh on the work Mac, with gh signed in as an admin of the repository. Every call is read-only. Save the output under .github/prompts/baselines/ and commit it with [skip ci]; on 2026-10-22, two baseline commits without it deployed Pages:

     bash .github/prompts/transfer-baseline.sh dasbury-esri/classic-storymaps-viewer-pages > .github/prompts/baselines/viewer-before.txt

     It covers refs, branch protection and rulesets in full, collaborators, deploy-key fingerprints, webhook hostnames, Actions permissions, secret and variable names, the SITE_BASE_PATH value, environments and their deployment branch policies, Pages, and runs that could still publish. It never prints secret values, private keys, webhook URL credentials, paths or queries, or deploy-key titles. Each result is one of:

     • output or (none): settled;
     • NONE (404): GitHub says none is configured;
     • NOT AVAILABLE: the plan can't have the feature here;
     • UNKNOWN: not settled. Re-run as an admin, or the owner looks in Settings.

   • Owner-only item: installed GitHub Apps can't be listed with a user token. The owner notes the app names under Settings → GitHub Apps.

   • Also record: a known-good deploy that can be restored, and the Cloudflare apex and www records with their TTL, proxy mode and TLS settings, plus any CAA records. Mark anything unavailable as unknown.

   • Complete when the before file has no UNKNOWN lines, or the owner accepts each remaining one in the session log. Do not treat the dated "Verified State" table as a fresh snapshot.

   • Before baseline collected, 2026-10-22 21:24 PDT, by the owner as an admin: baselines/viewer-before.txt, with no UNKNOWN lines. Still open: the installed GitHub Apps (owner), the Cloudflare records, and a known-good deploy. d05c215 is a candidate but has been checked by HTTP status only.

   • After step 4, re-run the script against davidasbury/classic-storymaps-viewer-pages and diff the two files. Expected differences:

     • main advanced by commits made after the before run;
     • davidasbury as the admin, with dasbury-esri added as a collaborator;
     • a new deployment branch policies: github-pages section, added to the script after the before run. Its before value, read anonymously on 2026-10-22, was main type=branch.

     The owner approves the diff; anything else stops the cutover for review.

   • Drain the deploy queue: before the transfer, and before any change to Pages or SITE_BASE_PATH, the script's last section must show 0 for every status. The workflow doesn't cancel runs in progress (cancel-in-progress: false), so stopping pushes doesn't drain runs already queued. The owner cancels them or lets them finish, then re-runs the check.

   • Keep validation/batch-d-releases unless the owner approves deleting it.

   • Set a quiet window with a recovery deadline. DNS and certificates can take up to 24 hours.

2. Exact sign-in callbacks:
   • On ArcGIS client 4ZanYdCYK0mWsFLz, list the registered redirect URIs.
   • The catalog builds its redirect from the page's own address (origin plus path), so /viewers/ and /viewers/index.html are different callbacks. Work out every production page that signs in, including runtime-specific ones.
   • Add the exact https://classicstorymaps.com/... callbacks for those pages; do not rely on / alone. Keep the old callbacks until acceptance.
3. Confirm verification: davidasbury still shows classicstorymaps.com as Verified, and its challenge record still resolves. If either has changed, stop.
4. Transfer:
   • Move the repository to davidasbury, keeping its name and public visibility, and accept the invitation. It expires after one day.
   • Compare refs, access and settings with step 1. GitHub keeps deploy keys and secrets, and adds the former owner as a collaborator; review that access.
5. Bind: in Settings → Pages, set the source to GitHub Actions and the custom domain to classicstorymaps.com. Clear SITE_BASE_PATH before the cutover build. Actions deploys ignore publish/CNAME; the Settings field is what binds the domain.
6. DNS check: the apex A records and the www CNAME (to davidasbury.github.io) already match GitHub's documented setup. Re-check them on the authoritative nameservers. Record "no change needed" if they still match, and do not touch unrelated records.
7. Pinned deployment:
   • Select and record the full SHA using "What Gates What," including ancestry and allowed-path checks for a documentation-only descendant. Immediately before dispatch, confirm remote main equals that selected SHA and recheck that no older deployment run is outstanding; otherwise stop.
   • The workflow deploys on every push to main, so push nothing during the cutover.
   • Verify the dispatched run's actual head_sha equals the selected SHA, then independently verify the deployed revision equals it before acceptance. A mismatch triggers owner cancellation or recovery, not an automatic retry or broader release approval.
   • Record the run ID, head_sha, build and link-test results, artifact identity and deployment outcome. Turn on Enforce HTTPS once the certificate is issued.
8. Acceptance, using tools independent of this repository:
   • The apex returns 200 with a valid certificate; www redirects; a path with a query string survives.
   • All eight runtime entry points load visibly with known examples: Map Tour, Swipe, Journal, Series, Cascade, Shortlist, Crowdsource and Basic. A 200 response alone is not enough.
   • The owner tests sign-in, viewing private content, and sign-out (private access is lost afterwards).
   • The conversion integration is still disabled.
   • Record what the old dasbury-esri.github.io URL now returns. GitHub does not redirect Pages URLs after a transfer, so old bookmarks may break.
9. Close: update origin in every clone and the links that name dasbury-esri, in no-deploy documentation commits ([skip ci]). Record the Pages, DNS and sign-in results, the deployed revision and owner acceptance before normal work resumes.

classic-story-search.netlify.app, linked from the launchers, is a separate site and is not part of this transfer.

Recovery

• Triggers: stop on a ref, visibility or access mismatch; failed TLS or sign-in; or an expired quiet window. The owner chooses whether to repair or roll back, and records the choice.
• Restoring service: use the recorded known-good revision, and restore a working combination of Pages binding, SITE_BASE_PATH, sign-in callbacks and DNS.
  • A custom-domain build and a project-path build are not interchangeable.
  • Before falling back to the new owner's default Pages URL, confirm its base path and callbacks.
  • Never leave DNS pointing at an unbound site without verification held.
• Transferring back is possible only if GitHub has not retired the old name. GitHub retires a name when the repository had more than 100 clones or Actions uses in the week before the transfer, or contains a Marketplace action. Check this before relying on it. Never create a placeholder repository under the old name. Transferring back does not restore DNS, verification or sign-in settings.