Decide whether to make the workspace repo public

[ExtraToast]

What to build

Making workspace public removes ~1,880 billable minutes/month — its CI, its project shim, its submodule sync and its governance audit all become free — in a single settings change. It is by a wide margin the cheapest minute reduction available in the estate.

This is an owner decision, not an implementation task. The engineering work is nil; the judgement is whether the disclosure is acceptable.

What becomes public:

• The names of every private repo in the org, via .gitmodules
• CLAUDE.md, docs/decisions/, specs/ — the estate's architecture, its recovery runbooks, its known failure modes
• scripts/ — bootstrap, sync, audit and node-label tooling

What argues for it: the repo builds, releases and deploys nothing (ADR-0001); pinned SHAs are a snapshot, not a contract. It holds no credentials, and it already gitleaks its full history on every pull request — so the "does it contain secrets" question has a continuously-verified answer rather than an assumed one.

What argues against it: the docs describe the topology of a live homelab, including how to recover it. That is not a credential, but it is reconnaissance, and it is the kind of disclosure that is irreversible once indexed.

Before flipping, confirm the leak scan actually passes on a full-history run today rather than trusting that it has been green — and note that making a repo public exposes its entire git history, not merely its current tree.

Acceptance criteria

• A decision is recorded either way, with reasoning, in docs/decisions/
• If flipping: a full-history gitleaks run passes immediately beforehand
• If flipping: the exposure of private repo names via .gitmodules is explicitly accepted
• If flipping: private-repo Actions spend is confirmed to drop by the expected amount
• If not flipping: this issue is closed with the reasoning, so it is not re-litigated next time the cap is hit

Blocked by

• None — can start immediately.