Move in: bring all of GitHub and Vercel into the forge through one trusted flow (inventory → plan → paced copy → verify), read-only toward the sources; clean-up is a separate, later step #6007

Owner, 2026-10-25: "something I've been wanting to do for a while is migrate away from everything. Bring in my GitHub and Vercel, then clear those accounts except for only the repos I want to keep there." Then: "I don't want you deleting anything right now… I just want to have the tools in the forge to do that quickly and easily while trusting it."

Scale (a read-only look by the steward, the same day):

• GitHub: 270 repos.

- Personal: 125 (78 private, 18 forks). - Orgs: ESPO-Engineering 42, trevato-games 65, trevato-dev 23, print-studio 12, QR-io 2, NTP-Intrusion-Detection 1. - About 6.9 GB. The largest are trevato/supabase (1.4 GB, a fork), ESPO-Engineering/CV-Permit-Automation (843 MB), ESPO-Engineering/Rome (427 MB), trevato/minecraft-servers (394 MB) and trevato/tldraw (264 MB, a fork). - 95 untouched since before 2025. - Only 1 is already on the forge.

• Vercel: the saved CLI login on the owner's Mac had expired, so nothing was listed.
• The forge already has: /migrate and POST /api/v1/migrate (after: leave | archive | mirror) and a connected GitHub origin.

Done when: "Move in", one guided flow on the forge you can trust.

1. Connect: GitHub (with every org the account can see; if an org must approve the OAuth app, say so plainly) and Vercel (OAuth or a token, stored as a secret, never shown).
2. Inventory:

- One review table, beautiful and fast (component library #5817). Each row shows: - owner/org, name, private/public, fork, archived - last push, size, branches and tags - linked Vercel project, domains, env var names (never values) - already on the forge? - Filters and groups: forks, stale (more than a year untouched), large (more than 100 MB), by org, has a Vercel project. - Suggested defaults the owner can override: forks → link only, don't copy (keep a pointer to upstream); stale → bring in as archived.

1. Plan: each row gets an action. Bring in (full history, every branch and tag), Bring in archived, Link only, or Skip. Vercel projects get Become a forge app: the build settings, env vars copied into app secrets, and domains listed for a DNS move later. The plan shows the total size against the forge's free disk and refuses a plan that would take the disk past its floor.
2. Run:

- Reads only from GitHub and Vercel. after: leave is forced, and nothing on GitHub or Vercel is archived, changed or deleted by this flow. - Paced: batches with a live progress board, pausable and resumable, retried on transient errors. A disk guard pauses the run if free space nears the floor (the forge never goes down for a migration).

1. Verify every repo: the ref count and every branch and tag tip SHA match the source. LFS objects are present. Size is recorded. The green check is verified, not "copied". A Vercel app is verified by a successful forge build and preview.
2. Then, and only later, a separate "Clean up" flow for the source accounts. It lists only repos that are verified on the forge and not on the keep-list, archives first (reversible) for a waiting period, and deletes only on an explicit, per-batch confirmation by the owner. Not part of this issue's first release.

Trust rules:

• Every step is a fleet op with an audit row.
• Dry run by default.
• Source tokens are used only for reading and never passed through to anything else.
• The inventory is exportable (CSV/JSON).
• A cold-read agent given the review page can say what will happen to each kind of repo.

First pull: the inventory table (GitHub only, read-only) with the "already on the forge" and size columns, and the disk-floor check.

Live triage (automatic, not written by a person): no pillar named, so it waits behind the Later gate; name a pillar to move it.