Transfer repository to `IntersectMBO` organization

[jpraynaud]

Why

The Mithril repository is moving from the input-output-hk GitHub organization to IntersectMBO. The move must be invisible to end users (SPOs, aggregator operators, library and CLI users, downstream integrators):

• Existing Docker image pulls, GitHub release URLs, git clone URLs, raw verification key URLs, and the https://mithril.network site must keep resolving.
• External contributors must not be forced to re-clone or rewrite their forks.
• Downstream integrators (Catalyst, Daedalus, Hydra, Blockfrost, Dolos, Amaru, Guild Operators, Cardano Foundation) must be notified in advance so they can verify support for repository URL redirection and refresh any pinned references at their next release cycle.

What

Provide a seamless moving of the repository for SPOs, end users and downstream integrators.

How

Mithril team

• T-14
  • Get sign-off from IOG management
  • Schedule D-day meeting (Early June)
  • Publish a dev blog post announcing the moving
• T-10: Send direct transfer announcements to each known downstream user group (the message links to the blog post and includes the new repo URL, new GHCR namespace, new raw vkey URL pattern, and the curl -sSL recommendation)
  • Catalyst
  • Daedalus
  • Hydra
  • Blockfrost
  • Dolos
  • Amaru
  • Cardano Foundation
• T-7
  • If some modifications are required to follow the redirection of Mithril keys, open a PR on cardano-community/guild-operators and ask for review
  • Merge the PR on cardano-community/guild-operators before D-day (if any)
  • Hand the user / role list to the IntersectMBO admin
  • Snapshot gh label list --repo input-output-hk/mithril > labels-snapshot.txt
  • Snapshot Projects 26 and 132 via gh project item-list 26 --owner input-output-hk --format json > project-26-snapshot.json and gh project item-list 132 --owner input-output-hk --format json > project-132-snapshot.json
• T-2
  • Prepare the prepare-for-transfer PR (held un-merged until D-day), replace every input-output-hk/mithril reference with IntersectMBO/mithril, harden curl -s to curl -sSL, point GHCR images at the new namespace
    • mithril-install.sh - Update default GITHUB_ORGANIZATION
    • networks.json (repo root) - Replace all 16 raw.githubusercontent.com/input-output-hk/... URLs (4 networks × 4 artifacts: genesis.vkey, era.vkey, era.addr, ancillary.vkey)
    • .github/workflows/test-client.yml - Change curl -s to curl -sSL on the GENESIS_VERIFICATION_KEY and ANCILLARY_VERIFICATION_KEY capture lines
    • .github/workflows/*.yml and .github/workflows/actions/**/action.yml - Update every ghcr.io/input-output-hk/... reference and any cross-repo dispatch target
    • .github/workflows/backfill-ghcr.yml - Add the new D-day backfill workflow
    • .github/ISSUE_TEMPLATE/config.yaml, bug_report.md, feature_idea.md - Update contact_links and any project-board URLs
    • .github/pull_request_template.md - Update org URLs
    • .github/copilot-instructions.md - Update org references
    • docs/website/docusaurus.config.js - organizationName, editUrl
    • docs/website/root/**/*.md (next docs) - Sed-replace org URLs
    • docs/website/versioned_docs/version-maintained/**/*.md - Sed-replace with manual review for historical accuracy
    • mithril-infra/assets/docker/docker-compose-aggregator-base.yaml
    • mithril-infra/assets/docker/docker-compose-signer-base.yaml
    • mithril-infra/assets/docker/docker-compose-aggregator-p2p-base-override.yaml
    • mithril-infra/assets/docker/docker-compose-signer-p2p-base-no-dmq-override.yaml
    • mithril-infra/env.*.tfvars - Update mithril_genesis_verification_key_url, mithril_era_reader_address_url, mithril_era_reader_verification_key_url, mithril_ancillary_verification_key_url
    • examples/client-cardano-transaction/README.md - Update raw vkey URL, switch curl -s to curl -sSL
    • examples/client-cardano-transaction-v2/README.md - Update raw vkey URL, switch curl -s to curl -sSL
    • examples/client-cardano-database-v2/README.md - Update raw vkey URL, switch curl -s to curl -sSL
    • examples/client-cardano-stake-distribution/README.md - Update raw vkey URL, switch curl -s to curl -sSL
    • examples/client-mithril-stake-distribution/README.md - Update raw vkey URL, switch curl -s to curl -sSL
    • examples/client-cardano-block/README.md - Update raw vkey URL, switch curl -s to curl -sSL
    • README.md - Badges, install instructions, GHCR image pull examples, project description
    • CHANGELOG.md, CONTRIBUTING.md, DEV-ADR.md - Sed-replace org URLs
    • SECURITY.md - Use the SECURITY.md file from the Cardano node repository and link to the current version of the policy at https://github.com/IntersectMBO/Open-Source-Office/tree/main/security-policy-documents
    • CODE-OF-CONDUCT.md - Verify enforcement contact still valid
    • NOTICE - Manual review
    • LICENSE - Manual review
    • mithril-relay/README.md, mithril-stm/README.md, mithril-client-wasm/README.md, mithril-client-wasm/npm/README.md, mithril-client-wasm/ci-test/README.md, demo/protocol-demo/README.md - Sed-replace org URLs
• D-day
  • Announce freeze to contributors
  • Verify the repository, issues, PRs, releases, Pages site landed at IntersectMBO/mithril
  • Verify legacy GHCR packages still listed under input-output-hk
  • Verify labels and milestones intact
  • Verify each Environment landed
  • Merge prepare-for-transfer PR
  • Run backfill-ghcr.yml with the 5 release tags 2617.0, 2603.1, 2543.1-hotfix, 2537.0, 2524.0+ unstable
  • With IOG DevOps, verify Hydra posts a status to a test PR
  • Verify https://mithril.network/doc resolves and that editUrl links point at IntersectMBO
  • Smoke test mithril-install.sh
  • Smoke test client CLI, client WASM
  • Update the transfer dev blog post status
  • Lift merge freeze
• D+1:
  • Create an update PR for developers.cardano.org with IntersectMBO URLs
  • Open a PR on cardano-community/guild-operators with the new repo URL, new GHCR namespace, new raw vkey URL pattern and ask for review
  • Ask for review of the PR
  • Merge the PR
• D+1-D+7
  • Follow up on downstream integrators

IOG admin (input-output-hk, releasing party)

• T-7
  • Confirm the four legacy mithril-* packages will remain Public
• D-day
  • Perform Transfer ownership of the repository to IntersectMBO
  • Transfer GitHub Project 26 to IntersectMBO
  • Transfer GitHub Project 132 to IntersectMBO
• Forever after: Do not delete or transfer the legacy mithril-* packages and do not change their visibility to Private

IntersectMBO admin (receiving party)

• T-7
  • Invite each user from the validated list to the IntersectMBO org
• T-1
  • Confirm all listed users have accepted org invites
• D-day
  • Confirm transfer landed
• D+1
  • Confirm each maintainer can push, open PRs, run workflows

IOG DevOps / SRE (Hydra operator)

• D-day
  • Edit the Hydra jobset (input-output-hk/mithril -> IntersectMBO/mithril), trigger a re-evaluation
  • Confirm a test PR on IntersectMBO/mithril receives Hydra status checks within 10 minutes

DNS owner (mithril.network)

• D-day
  • Flip the CNAME from input-output-hk.github.io to IntersectMBO.github.io

Mithril engineering team (writers)

• T-7
  • Accept the IntersectMBO org invite
• T-1 (end of day)
  • Stop merging to main, rebase any open PR against the frozen main
• D-day
  • Treat main as read-only between 09:00 and 17:00 CEST, do not push, do not force-push
  • Update local clone: git remote set-url origin git@github.com:IntersectMBO/mithril.git

External contributors (forks)

• After D-day
  • Update origin remote: git remote set-url origin git@github.com:IntersectMBO/mithril.git

SPOs running Mithril signers

• T-7 verification (mandatory): if your integration fetches the era from their raw GitHub URL at each startup
  • Confirm confirm retrieval still works for era.vkey
  • If your HTTP client does NOT follow redirects, switch your pinned URLs to IntersectMBO
• At next planned upgrade
  • Switch era.vkey URLs to IntersectMBO (if your integration fetches the era from their raw GitHub URL at each startup)
  • Switch the image reference to ghcr.io/IntersectMBO/mithril-signer:<tag> (or mithril-aggregator:<tag>) (digest is byte-identical for already-released tags, new releases publish only to the new namespace)

Client users (library and CLI)

• D+1 verification (mandatory): if your integration fetches the genesis / ancillary verification keys from their raw GitHub URL at each startup
  • Confirm confirm retrieval still works for genesis.vkey and ancillary.vkey
  • If your HTTP client does NOT follow redirects, switch your pinned URLs to IntersectMBO
• At next release
  • Switch genesis.vkey and ancillary.vkey URLs to IntersectMBO (if your integration fetches the era from their raw GitHub URL at each startup)
  • If your build artifact bundles a pinned networks.json, refresh it from https://raw.githubusercontent.com/IntersectMBO/mithril/main/networks.json

Downstream integrators

Catalyst

• T-10
  • Support redirect for verification keys (if not already the case)
• At next release
  • Refresh any pinned networks.json, raw vkey URL, or Docker image reference in build pipeline

Daedalus

• T-10
  • Support redirect for verification keys (if not already the case)
• At next release
  • Refresh any pinned networks.json, raw vkey URL, or Docker image reference in build pipeline

Hydra

• T-10
  • Support redirect for verification keys (if not already the case)
• At next release
  • Refresh any pinned networks.json, raw vkey URL, or Docker image reference in build pipeline

Blockfrost

• T-10
  • Support redirect for verification keys (if not already the case)
• At next release
  • Refresh any pinned networks.json, raw vkey URL, or Docker image reference in build pipeline

Dolos

• T-10
  • Support redirect for verification keys (if not already the case)
• At next release
  • Refresh any pinned networks.json, raw vkey URL, or Docker image reference in build pipeline

Amaru

• T-10
  • Support redirect for verification keys (if not already the case)
• At next release
  • Refresh any pinned networks.json, raw vkey URL, or Docker image reference in build pipeline

Cardano Foundation

• T-10
  • Support redirect for verification keys (if not already the case)
• At next release
  • Refresh any pinned networks.json, raw vkey URL, or Docker image reference in build pipeline