# Upstream-harvest ledger for this template repo.
#
# Records every harvest candidate the loop has seen, so it is never re-proposed.
# Lives at .github/harvest-ledger.yml in the template repo. Curated by humans +
# appended by the generalize-pattern skill / harvest workflow.
#
# status:               proposed | ported | declined
#   proposed  - a harvest PR is open for this candidate
#   ported    - the harvest PR was merged (pattern now in the template)
#   declined  - the harvest PR was closed unmerged (do not re-propose)
# confidence:           single | corroborated
# corroboration_count:  number of distinct client repos that converged on this
# sources:              org/repo#pr (or ref) for each corroborating client
# intent:               one-line description of the change
# reason:               required for declined entries — why it was rejected
#
# Dedup rule: detect-upstream-candidates skips any id with status ported|declined,
# and any id that already has an open harvest/<id> PR.

entries:
  - id: cap-drop-all-services
    status: ported
    confidence: corroborated
    corroboration_count: 2
    sources:
      - example-org/data-orchestration#41
      - another-org/airflow-orchestration#88
    intent: drop all Linux capabilities on Airflow compose services

  - id: readonly-rootfs
    status: declined
    confidence: single
    corroboration_count: 1
    sources:
      - example-org/data-orchestration#41
    intent: enforce read-only root filesystem on service containers
    reason: breaks the dbt container's runtime temp writes; needs per-service tmpfs first