# Repo rename: GOTT.Apollo becomes GOTT.Sibyla (naming shift Phase R)

2026-09-08. Closes decision **N3** of `apollo-naming-shift-prompt-260902.md`, which kept the repo
folder and the GitLab project called Apollo "for now, later or never" while Phases 1-4, L and D
renamed everything else. Apollo is the gateway agent — the Hermes instance that reads email,
WhatsApp and the other channels — and only that. The platform is Sibyla, and now so is its
repository.

Nothing in this phase changes behaviour. The code-level rename was finished on 2026-09-02/03; what
was left was the folder, the GitLab project, the legacy stack's retirement, and the handful of
places that spell the old folder out in full.

## What changed

### GitLab

| Project | id | Before | After |
|---|---|---|---|
| Legacy stack | 84070939 | `gottsolutions.dev/sibyla/GOTT.Sibyla` | `gottsolutions.dev/sibyla/gott-sibyla-legacy`, name `GOTT.Sibyla.Legacy`, **archived** |
| This platform | 85818737 | `gottsolutions.dev/sibyla/gott-apollo` | `gottsolutions.dev/sibyla/GOTT.Sibyla`, name `GOTT.Sibyla` |

Order matters: GitLab holds one project per path in a namespace, so the legacy had to move first.
The freed path was then claimed successfully — GitLab dropped the redirect route it leaves behind a
rename, so no fallback was needed. The legacy project was archived only **after** the path claim
succeeded, so a failure could have been reversed without an unarchive.

The rename was cheap because both projects were bare git hosting: no open issues or merge requests,
no CI/CD variables, no environments, no webhooks, no deploy keys, no container-registry images, and
no `.gitlab-ci.yml` in this repository at all (free-tier policy, discovery 12). The group itself is
still named `sibyla` and was not touched.

**A hazard found and fixed in passing.** After the two renames both working copies' `origin`
pointed at `…/sibyla/GOTT.Sibyla.git` — the legacy clone was aliased onto the *new* project, and a
push from that folder would have sent legacy history into this repository. The legacy clone now
points at `…/sibyla/gott-sibyla-legacy.git`, which is archived and therefore read-only.

### The legacy source, under `legacy/`

`git archive` of two refs, so no build output travels with them: `main` at `940ee49`, and
`maintenance/deployed-2026-08-10` at `1b8cd55` — the deployed hotfix line whose six commits never
reached `main` and which a tree of `main` alone would have lost. The four local stashes, which
existed only on the machine holding the legacy working copy, are exported as patches with the base
commit each applies onto.

The database dump committed in `940ee49` is deliberately **not** here: 580 KB of real production
data does not belong in a reference archive. Its README and metadata sidecar stay so the removal
documents itself, and the dump remains in the archived GitLab project.

The archived project stays authoritative — it keeps the commit history, the pipeline records and
the dump. `legacy/README.md` carries the provenance, the checksums and the restore pointers.

### Stored paths that named the folder

Eleven lines and one stored row. Everything else that still says Apollo says it on purpose.

- `local/provision-production.ps1` — **the dangerous one.** Its legacy block renames an IIS site to
  `Sibyla.Legacy.*` when the site's physical path matches a marker, and the Docs marker was the
  bare string `GOTT.Sibyla\`. Now that *this* repository is the folder called `GOTT.Sibyla`, that
  marker matches our own docs path: run unchanged after the rename it would have demoted the live
  `Sibyla.Docs` site. The marker is now `GOTT.Sibyla.Legacy\`, and a `$root` guard skips any site
  served out of this working copy, so no future marker can reach the same mistake.
- `local/deploy/Prepare-Deploy.ps1` — `$MainRepo` and `$Candidate` defaults.
- Absolute paths in `EvidenceSecretScanTests.cs`, `RequestRulesV2Tests.cs`, `validators.v2.json`,
  the `d2`/`e2` probes, and the two golden reserve-key SQL scripts.
- Migration `20260908151342_RepoFolderRename` — the `sibyla` AI project's `primary_folder` and its
  description. N6 forbids rewriting applied history, so this is a new migration rather than an edit
  to `20260901132338_AiProjects`, modelled on `SibylaPlatformNames`, which carried `preview_target`
  the same way in Phase 3 and noted that only that one path followed *because N3 was keeping the
  folder*. It is guarded with `strpos`, not `LIKE`: PostgreSQL reads a backslash in a LIKE pattern
  as an escape character, so the obvious pattern would have matched no Windows path at all.

### Kept on purpose

The glossary's frozen identifiers are untouched, because changing them breaks stored data,
credentials or frozen oracles: the `Global\GOTT.Apollo.Deployment.v1` mutex and the six oracles that
pin it; the `D:\ApolloData\*` roots (including the AI session working folders
`D:\ApolloData\work\<licence>\<session>\<agent>`, which hang off the data root and have nothing to
do with the repository); `DataProtection.SetApplicationName("Apollo")` and purpose
`Apollo.CredentialStore.v1`; the `apollo_ai_reader` role; the code-ledger issuer `apollo` and
`SourceSystem = "apollo"`; the Nextcloud `Apollo/{company}` prefix; IdP clients `apollo-web` and
`apollo-worker`; the `apollo-channel-intake` and `apollo-email-intake` plugins; the dated
`docs/apollo-*.md` filenames; and every applied migration.

The `GOTT.SibylaX` and `XGOTT.Sibyla` entries in `validators.v2.json` also stay — they are boundary
cases proving the path check is not a naive substring match.

## Run record — completed 2026-09-08

What actually blocked the renames was not an editor or a file watcher, which is where the first
session looked. Two things held the working copies open:

- **IIS.** `Sibyla.Legacy.Docs` served straight out of `GOTT.Sibyla\docs` and `Sibyla.Docs` out of
  `GOTT.Apollo\docs`, so `w3wp.exe` held both folders. Killing sessions never helped; each rename
  needed its app pool stopped, and the site's `physicalPath` repointed before the pool restarted.
- **An Explorer window** left open on `GOTT.Apollo\local\secrets`. One window is enough to fail the
  whole rename with a sharing violation. It was closed through the shell's window list rather than
  by killing `explorer.exe`.

Two Claude sessions were killed chasing a wrong diagnosis before the real holders were found by
enumerating process working directories and then the system handle table. Reach for the handle
table first next time: it named the culprit immediately and read nothing but kernel state.

1. Folders renamed in order — `GOTT.Sibyla` → `GOTT.Sibyla.Legacy`, `GOTT.Apollo` → `GOTT.Sibyla`,
   `GOTT.Apollo-worktrees` → `GOTT.Sibyla-worktrees`. Both docs sites repointed; both serve 200.
2. `git worktree repair` run over all **8** worktrees; `git worktree list` and `git status` clean in
   each.
3. Claude project directories renamed in the required order. The current slug carries its 17
   memories (`argus-extraction-v1`, `sibyla-production-deployment`, `apollo-naming-shift`, …) and
   `…-GOTT-Sibyla-Legacy` its 9. No index merged.
4. Branch merged into `main` — no conflict, `README.md` included. `dotnet build` clean, 0 warnings.
5. `20260908151342_RepoFolderRename` applied to **Preview**. Exactly one `aiproj` row changed:
   `sibyla`'s `primary_folder` and `description`; the other three untouched.
6. Check-only run of `provision-production.ps1`: the `$root` guard skips the live `Sibyla.Docs`, and
   neither `Sibyla.Web` nor `Sibyla.Api` matches its marker. The block cannot demote the live site.

7. `20260908151342_RepoFolderRename` applied to **Main** as well, on the owner's instruction, so the
   two databases are level. One `aiproj` row changed there too, the same one.
8. `local\test.ps1` green: 1047 passed, 3 skipped, 0 failed — `PreviewParityTests` included.

9. The eight worktrees were then **removed**, on the owner's instruction. None was needed: six sat
   at commits already in `main`, `apollo-extraction-spec` on a branch since merged, and
   `apollo-deploy-candidate` at the tip of `hotfix/uploads-refresh`. Every commit stays reachable
   from a branch on the origin, and `Prepare-Deploy.ps1` recreates a candidate on demand.

   Two things went with them. `apollo-deploy-candidate` sat on that script's default `-Candidate`
   path, and it refuses to start when the destination exists — the next default deploy prep would
   have thrown `candidate already exists`. And each worktree carried the **pre-fix**
   `provision-production.ps1`, marker `GOTT.Sibyla\` and no `$root` guard: run from one of them it
   would have renamed the live `Sibyla.Docs` onto the already-taken name `Sibyla.Legacy.Docs`. That
   copy is the one hazard a grep for "Apollo" can never find, because the old script never says it.

Nothing is outstanding.
