EPIC: break CoreScope out of the Kpa-clawbot fork network #158

OKI-Mesh/CoreScope is still a fork of Kpa-clawbot/CoreScope. Owner decision 2026-10-03: break the link now that the final upstream sync (#152) has landed.

Current state [api: 2026-10-03]

Our commits are served from upstream's namespace today. Both of the merges made on 2026-10-02 resolve through the parent:

GET repos/Kpa-clawbot/CoreScope/commits/66aa4c5  -> 200   (the #152 sync merge)
GET repos/Kpa-clawbot/CoreScope/commits/ff5e338  -> 200   (the #151 merge)

That is how fork networks work: members share object storage, so any commit we push is reachable by SHA under any repo in the network, including the 67-member upstream. It is not a leak of private data - this repo is public - but it does mean our history is addressable from a namespace we do not control.

Why now

#152 was explicitly "Syncing upstream one last time before we cut the fork and start to seperate." That sync is merged. The reason to keep the link is gone, and keeping it carries two live costs:

1. The Sync fork button still exists. Upstream has modified .squad/, AGENTS.md, docs/agents/, .github/agents/ and .github/instructions/ as recently as 2026-09-17. Once EPIC: prune and own the imported AI agent surface (143 files, ~17.2k lines) #144 deletes those paths, a future sync produces delete/modify conflicts on exactly the files we removed, and the natural-looking resolution restores the whole imported agent surface. Detaching is the only thing that removes the button.
2. Upstream changes can still arrive by accident. bug: upstream sync moved the Carto key to a new config field, breaking map tiles (dev now, prod on next deploy) #156 is what an unreviewed upstream change costs: a config field rename that broke map tiles and would have broken prod on its next deploy.

Constraint: there is no API for this

GitHub exposes no REST endpoint to leave a fork network or change a parent. Verified against the repos API reference 2026-10-03. The detach is Settings -> General -> Danger Zone -> Leave fork network, and it is an owner action. Everything else in this Epic is automatable.

Prior correction on the record: an earlier session claimed this required GitHub Support. It does not - it is self-serve.

Children

1. DIAGNOSE - what the fork link exposes, what detaching changes, and what could break.
2. Pre-detach snapshot of everything that could be lost, captured as data.
3. The detach itself (owner).
4. Post-detach verification against the snapshot.
5. How we track upstream after the link is gone.

Done when

fork is false, our commit SHAs 404 under Kpa-clawbot/CoreScope, every ruleset / runner / variable / label / board link from the pre-detach snapshot is still present and working, CI is green on master, and there is a written, agreed way to pull a future upstream change without a fork link.