chore(branding): plan and execute the Marka public identity cutover

[absolutepraya]

Goal

Complete the Marka public-identity cutover for this fork's actively operated web/self-host distribution surfaces: canonical domain, GitHub repository identity, GHCR images, repository/documentation references, deployment configuration, and web discovery metadata.

This issue intentionally does not expand into renaming/publishing browser-extension stores, mobile stores, npm/SDK packages, or MCP distribution identities. Those surfaces should only be audited here for accidental coupling or breakage and handled separately later if desired.

Relationship

• Parent product identity: feat: rebrand the fork with a one-word product identity #10
• Repository and documentation coherence: docs: establish coherent documentation and assistant context #11
• Fork-owned landing site: feat(landing): establish a fork-owned Marka landing site #25
• Fork-owned documentation site: docs: publish fork-owned Marka documentation at docs.marka.abhipraya.dev #26
• Deferred internal machine-facing identifier migration: Rename remaining internal Karakeep identifiers to Marka #35

Approved target identity

• Public repository: absolutepraya/marka
• Canonical application origin: https://marka.abhipraya.dev
• Canonical GHCR images: ghcr.io/absolutepraya/marka:web-main and ghcr.io/absolutepraya/marka:workers-main
• Existing ghcr.io/absolutepraya/karakeep images are not a compatibility target. Stop publishing new tags there after cutover; historical images may remain.
• keep.abhipraya.dev should eventually become a permanent redirect to marka.abhipraya.dev, preserving path and query string, after the new origin is fully verified.
• Existing internal compatibility identifiers such as KARAKEEP_*, @karakeep/*, persisted paths, Compose service names, Docker network names, export/protocol identifiers, etc. remain unchanged in this cutover and are deferred to Rename remaining internal Karakeep identifiers to Marka #35.

Scope

Domain and application origin

• Provision and validate marka.abhipraya.dev before retiring the old origin.
• Update canonical application URL/origin configuration and every origin-dependent public URL generated by the app.
• Audit and update authentication callbacks, allowed origins/CORS, cookies/session behavior, webhooks, RSS, API/OpenAPI examples, canonical URLs, and other hostname-dependent behavior where applicable.
• Verify direct authentication and application behavior on the new hostname before enabling the legacy-host redirect.
• After successful validation, configure keep.abhipraya.dev as a permanent redirect to the equivalent path/query on marka.abhipraya.dev.

GitHub repository identity

• Rename absolutepraya/karakeep to absolutepraya/marka at the controlled cutover point.
• Prepare repository-controlled reference changes before the rename where practical, then finish/apply them after the rename.
• Update local/operator Git remotes to the new repository URL.
• Audit and update current-tree repository references, raw GitHub URLs, badges, issue/PR templates, repository metadata, homepage, description, topics, social preview, Actions/configuration references, GitHub Pages/settings where applicable, and other active repository links.
• Do not rewrite Git history or historical issues/PRs/comments solely to erase the old repository name. Update active content only where an old reference would mislead current work.
• Do not create a replacement repository at the old absolutepraya/karakeep path; preserve GitHub's rename redirects.

GHCR and deployment

• Hard-switch publishing from ghcr.io/absolutepraya/karakeep to ghcr.io/absolutepraya/marka.
• Do not dual-publish legacy Karakeep image tags.
• Ensure and verify both Marka web-main and workers-main images exist before pointing production at them.
• Update the personal VPS production Compose, Watchtower update path, guided installer defaults, deployment docs, and all other active fork-owned references to use the Marka GHCR path.
• Historical Karakeep GHCR images may remain available, but no new tags should be published there after cutover.

Discovery metadata and current public presentation

• Align active web page titles, title templates, descriptions, Open Graph/Twitter metadata, structured data, manifests, favicons/social cards, canonical URLs, and current fork-owned documentation metadata with Marka where applicable.
• Ensure newly generated public/share/RSS URLs use marka.abhipraya.dev after cutover.
• Keep internal Karakeep-compatible machine identifiers out of scope per Rename remaining internal Karakeep identifiers to Marka #35.

Explicitly deferred distribution surfaces

Do not turn this issue into an app-store/package-distribution migration. Browser extension, mobile app, npm/SDK package, and MCP distribution identities are out of scope for rename/publishing changes in #27.

Only audit them for dependencies on repository URLs, public hostnames, GHCR paths, or other values changed by this cutover. Record follow-up work separately if required.

Preflight and backup

• Inventory active public URLs, repository references, GHCR references, OAuth/auth callbacks, CORS/origin settings, webhooks, RSS/API endpoints, automated deployment dependencies, and current GitHub-side repository settings.
• Before production changes, create a fresh production backup and download/store it on the local MacBook used to run the migration.
• Include the persistent /data state and the current deployment configuration needed for recovery/reference, including Compose, environment/config files, reverse-proxy configuration, and current image/tag/digest information as applicable.
• Never commit or print secrets. Verify the local backup is present/readable before proceeding.
• A short controlled maintenance window is acceptable. Do not add complexity solely to achieve zero downtime.

Cutover principles

• Configure and verify dependencies before switching consumers to them. In particular, Marka GHCR images must exist before production Compose changes, and marka.abhipraya.dev must work directly before the old hostname redirects.
• Use explicit checkpoints and fail fast when a prerequisite is not satisfied.
• This migration does not require a designed rollback procedure. If an issue is found during cutover, stop at the checkpoint, diagnose it, and move forward with a fix.
• Do not perform database/schema migrations or rewrite persisted application data solely for branding. Any broader internal/data identity migration belongs in Rename remaining internal Karakeep identifiers to Marka #35.

Required production validation

Validate all applicable behavior after cutover, including:

• DNS and valid HTTPS for marka.abhipraya.dev
• web, workers, Meilisearch, renderer/crawler, and configured AI functionality
• login, logout, and session persistence
• bookmark library load plus create/edit/delete of a test bookmark
• search and background processing
• public-list access and current public-list UI behavior
• RSS/feed behavior and generated share/public URLs
• Marka GHCR web-main and workers-main availability
• production actually running the Marka images
• Watchtower continuing to follow the new image path
• keep.abhipraya.dev redirect preserving path/query once enabled
• old GitHub repository URLs redirecting after rename
• fresh clone and normal Git operations using absolutepraya/marka
• current repository/docs links no longer pointing at obsolete active identities

Guardrails

• Do not perform the external cutover until the exact implementation plan/spec is complete and approved.
• Preserve production data and stored assets throughout the transition.
• Do not expose .env contents or other secrets.
• Keep changes focused on the public identity cutover. Internal machine-facing renames belong in Rename remaining internal Karakeep identifiers to Marka #35.
• Do not close this issue automatically after implementation; report validation evidence and leave final closure to the repository owner unless explicitly instructed otherwise.

Acceptance criteria

• absolutepraya/marka is the canonical repository and active repository references/remotes are updated.
• CI publishes the paired Marka GHCR web/workers images and no longer publishes new fork images under absolutepraya/karakeep.
• Production uses the Marka GHCR images and the automated Watchtower path remains functional.
• https://marka.abhipraya.dev is the canonical working application origin with authentication and core functionality verified.
• Newly generated public/share/RSS URLs use the Marka origin.
• keep.abhipraya.dev redirects to the equivalent Marka path/query once the new origin is verified.
• Current public discovery metadata and repository/documentation identity are coherent with Marka.
• A verified pre-cutover production backup is stored locally on the migration MacBook.
• Browser/mobile/npm/SDK/MCP surfaces were audited for coupling but not expanded into distribution migrations.
• Internal machine-facing Karakeep identifiers remain unchanged and are tracked separately by Rename remaining internal Karakeep identifiers to Marka #35.
• Production validation evidence is recorded before considering the cutover complete.

[absolutepraya]

Public cutover evidence

Completed through merged PRs #43 and #44, followed by live VPS validation:

• Canonical repository: https://github.com/absolutepraya/marka
• Canonical origin: https://marka.abhipraya.dev
• GHCR web image: ghcr.io/absolutepraya/marka:web-main
• GHCR workers image: ghcr.io/absolutepraya/marka:workers-main
• Verified image index digests:
  • web: sha256:dbae0f855f9a1657352e177495a43db0d7d1c27a8a7c598845d606a138a67efb
  • workers: sha256:cd24f21aa4918babd13dce6216babb95889f6443d24c60f662e42c35279637d4
• VPS anonymous pulls matched both recorded digests.
• Production now runs the Marka web/workers images under the preserved karakeep Compose project and volumes.
• NEXTAUTH_URL is https://marka.abhipraya.dev.
• https://marka.abhipraya.dev/api/health returns HTTP 200.
• keep.abhipraya.dev returns a permanent 308 redirect with path/query preservation.
• Watchtower is healthy and running.
• Recovery snapshot: /home/praya/.hermes/backups/marka-migration-20260818T034233Z

The VPS operator-facing paths and Hermes skill names were also migrated to Marka while compatibility identifiers remain preserved. #25 and #26 remain intentionally deferred. Internal broad identifier renaming is not planned; the earlier #35 issue records that decision.