Adoption phase 5: decommission the AspireLdapAdmin repository

[joshmakestuff]

Final phase; starts once this repo is the source of truth for the admin app.

Issue re-filing rule

Only issues about what the tool should become come over: scope, features, product direction. Issues that were fixes, modifications, or reviews of the old codebase do not — that code is not being maintained, so its defect and review backlog is void. When unsure, do not re-file.

• Re-file the surviving AspireLdapAdmin issues here (individually judged against the rule above — no bulk transfer).
• Move relevant docs and security guidance here.
• Ensure release workflow covers the embedded admin payload (one release for hosting library, client library, and payload; the admin has no independent version).
• Point the AspireLdapAdmin README at this repo.
• Archive the AspireLdapAdmin repository.

[joshmakestuff]

Issue-transfer audit complete (2026-08-09). All 18 open AspireLdapAdmin issues dispositioned per the rule (product-direction re-files; fixes/modifications/reviews of the old codebase are void):

Re-filed (2): old #60 → #94 (bind-identity password guard); old #57 → #95 (search sorting/pagination).

Folded into #83 as spec notes (5): old #62 (stale-response race), #58 (deep link selects tree row), #56 (row clickable), #55 (DN suffix display), #52 (copy DN). See the #83 comment.

Void (11):

• Old-code fixes/docs/hygiene: Report meaningful first-party coverage and add cross-platform test witnesses #64 (1 MiB cap docs), Refactor the hosting builder implementation into focused internal components #63 (docs drift), Define a reproducible update policy for the bundled OpenLDAP image #59 (stray screenshots), Bump the dotnet-and-aspire group with 1 update #50 (header gap), Tests: remove environmental flakiness and leaked background/temp resources #44 (flaky test).
• Obsolete by the Fluent-first rebuild: Test-infra consolidation: shared AppHost fixture, docker container scope, readiness liveness #54 (convert hand-rolled UI), Spike: syncprov as change-notification support (subscribe to a query/filter) #53 (app.css fingerprinting).
• Lessons already encoded in the fluent-ui skill / workspace method.md / Adoption phase 4: rebuild the admin UI Fluent-first #83 requirements: Tests: exercise consumer-facing client and typed-seeding APIs, no new container starts (#42) #49 (dark mode unreviewed), Tests: make security and privacy assertions mutation-resistant (#43) #48 (no UI test coverage).
• Architecture removed the failure class: Make the typed OpenLdapOverlay API reject invalid states early #61 (transient API failures — the UI calls services in-process).
• Superseded: fix: resolve all 14 findings from the adversarial code review #15 (roadmap → workspace decisions + this repo's Roadmap (never closes) #86).

Remaining #84 work when this phase executes: close the 18 old issues (link this disposition), move docs/security guidance, release-workflow check for the embedded payload, README pointer, archive.

[joshmakestuff]

Complete (2026-08-09). All 18 old issues closed against the disposition table above; the old repo's SECURITY.md described the superseded login/Basic-auth model — its still-true doctrine (dev-time tool, loopback threat model) already lives in this repo and the workspace decisions, so nothing migrated verbatim. Release workflow verified: publish is gated on the clean-consumer job, which proves the packed payload end-to-end. Old README replaced with a pointer here; unpushed work (incl. a final WIP commit) pushed for the record; repository archived.