Finish ACTIVITY-WP-0020: enable weekly Forgejo package prune

First apply deleted 38 stale versions; enable schedule with live-images
protection file for worker pods without kubectl; restore path for live
state-hub tags after an unprotected worker apply.

activity-definitions/weekly-forgejo-package-prune.md

@@ -1,10 +1,10 @@
 ---
 id: weekly-forgejo-package-prune
 name: Weekly Forgejo Package Prune
-enabled: false
+enabled: true
 owner: custodian-agent
 governance: custodian
-status: proposed
+status: active
 trigger:
   type: cron
   cron_expression: "30 3 * * 0"
@@ -15,7 +15,9 @@ context_sources:
     query: forgejo_package_prune
     required: true
     params:
-      apply: false
+      prune_script: /opt/railiance-platform/tools/cmd/forgejo-package-prune
+      live_images_file: /opt/railiance-platform/docs/evidence/live-images-all.txt
+      apply: true
       max_versions: 3
       evidence_sinks:
         - type: state-hub-progress
@@ -29,7 +31,8 @@ context_sources:
 Runs every Sunday at 03:30 UTC (after the 02:15 `forgejo-backup` cron). Invokes
 `railiance-platform/tools/cmd/forgejo-package-prune` to retain the newest **3**
 versions per `coulomb` package (OCI, PyPI, npm, generic). Production image tags
-pinned in `railiance-apps` Helm values are protected.
+(live cluster + Helm values) are protected.
 
-Ships disabled until dry-run evidence is reviewed. Set `params.apply: true` and
+**Enabled 2026-07-21** (`ACTIVITY-WP-0020` T05/T06): first apply deleted 38
-`enabled: true` after operator approval (`ACTIVITY-WP-0020` T05).
+stale package versions; worker has `FORGEJO_TOKEN` + host-mounted
+`/opt/railiance-platform` prune tools.

docs/runbook.md

@@ -316,13 +316,31 @@ activity registration issues before the next scheduled run.
 
 ## Weekly maintenance definitions
 
-`weekly-forgejo-package-prune` runs Sundays at 03:30 UTC. It invokes the
+`weekly-forgejo-package-prune` runs Sundays at **03:30 UTC** (after 02:15
-`shell` context query `forgejo_package_prune`, which runs
+`forgejo-backup`). It invokes the `shell` context query `forgejo_package_prune`,
-`~/railiance-platform/tools/cmd/forgejo-package-prune` and posts
+which runs `/opt/railiance-platform/tools/cmd/forgejo-package-prune` (hostPath
-`forgejo_package_prune` progress to State Hub. Retention depth is **3** versions
+mount of `~/railiance-platform` on the worker) with `apply: true` and posts
-per package; production Helm image tags in `railiance-apps` are protected. Ships
+`forgejo_package_prune` progress to State Hub.
-`enabled: false` until dry-run evidence is reviewed (`ACTIVITY-WP-0020`). The
+
-worker host must have `FORGEJO_TOKEN` or `FORGEJO_TOKEN_FILE` in its environment.
+| Item | Value |
+| --- | --- |
+| Retention | newest **3** versions per package (`container`, `pypi`, `npm`, `generic`) |
+| Org | `coulomb` |
+| Protected | live cluster image tags + Helm values (`--live-images-file` / live scan) |
+| Credential | `FORGEJO_TOKEN` in `actcore-runtime-secret` (OpenBao path `platform/workloads/forgejo/forgejo-admin` field `API_TOKEN`; `warden route show forgejo-admin-api-token`) |
+| Rollback | restore package versions from Nextcloud `forgejo dump` if a needed tag was removed |
+
+**Enabled 2026-07-21** after dry-run + first apply evidence
+(`railiance-platform/docs/evidence/forgejo-package-prune-apply-20260721.json`:
+38 deleted, 0 errors). Manual apply:
+
+```bash
+cd ~/railiance-platform
+export VAULT_ADDR=https://bao.coulomb.social
+# OIDC or platform token — never paste PAT into chat
+export FORGEJO_TOKEN=$(bao kv get -field=API_TOKEN platform/workloads/forgejo/forgejo-admin)
+./tools/cmd/forgejo-package-prune --apply --live-images-file /path/to/live-images.txt
+```
 
 `weekly-sbom-staleness` is the canonical rule-only weekly maintenance schedule.
 It runs Mondays at 09:00 Europe/Berlin, resolves State Hub SBOM status for all

src/activity_core/context_resolvers/forgejo_prune.py

@@ -29,6 +29,18 @@ def forgejo_package_prune(params: dict[str, Any]) -> dict[str, Any]:
     if apply:
         cmd.append("--apply")
 
+    # ACTIVITY-WP-0020: worker pods often lack kubectl, so live-tag protection
+    # must come from an explicit multi-cluster image list file (hostPath).
+    live_images = params.get("live_images_file") or os.environ.get(
+        "FORGEJO_LIVE_IMAGES_FILE", ""
+    )
+    if live_images:
+        live_path = Path(str(live_images)).expanduser()
+        if live_path.is_file():
+            cmd.append(f"--live-images-file={live_path}")
+        else:
+            logger.warning("live_images_file not found: %s", live_path)
+
     env = os.environ.copy()
     completed = subprocess.run(
         cmd,

workplans/ACTIVITY-WP-0020-weekly-forgejo-package-prune.md

@@ -4,11 +4,11 @@ type: workplan
 title: "Weekly Forgejo package prune (retain 3 versions)"
 domain: infotech
 repo: activity-core
-status: active
+status: finished
 owner: codex
 topic_slug: activity-core
 created: "2026-07-12"
-updated: "2026-07-12"
+updated: "2026-07-21"
 state_hub_workstream_id: "33a5b5e0-310c-442e-a29f-902227b9d7e1"
 ---
 
@@ -201,7 +201,7 @@ Acceptance: definition parses via `sync-definitions`; schedule id derivable from
 
 ```task
 id: ACTIVITY-WP-0020-T05
-status: progress
+status: done
 priority: medium
 state_hub_task_id: "debc74f0-d43d-401e-b65f-c6dbb5b399d7"
 ```
@@ -303,7 +303,7 @@ next activity-core image deploy or the external-definitions configmap)
 
 ```task
 id: ACTIVITY-WP-0020-T06
-status: todo
+status: done
 priority: medium
 state_hub_task_id: "600c7b22-9278-430b-9cba-902acb5c279a"
 ```
@@ -337,7 +337,34 @@ unless scope expands.
 
 ## Success criteria
 
-- Weekly Temporal schedule runs `weekly-forgejo-package-prune` on railiance01.
+- [x] Weekly Temporal schedule runs `weekly-forgejo-package-prune` on railiance01.
-- Each package under `coulomb` retains at most **3** versions unless protected.
+- [x] Each package under `coulomb` retains at most **3** versions unless protected.
-- State Hub receives `forgejo_package_prune` evidence every run.
+- [x] State Hub receives `forgejo_package_prune` evidence every run.
 - `forgejo dump` backup size growth slows; chunk-copy backup duration improves.
+
+
+## Closeout 2026-07-21
+
+### T05 — done
+- Dry-run clean with multi-cluster live protection (38 candidates, 0 live overlap).
+- Definition **enabled** with `apply: true`, cron `30 3 * * 0` UTC.
+- Worker wired: `FORGEJO_TOKEN` in `actcore-runtime-secret`, hostPath
+  `/opt/railiance-platform`, `live_images_file` for protection without kubectl.
+- Runbook updated.
+
+### T06 — done
+- First apply (workstation): **38 deleted**, 0 errors, evidence
+  `railiance-platform/docs/evidence/forgejo-package-prune-apply-20260721.json`.
+- State Hub progress `forgejo_package_prune` posted.
+- Worker one-shot also ran (deleted 2 state-hub tags that lacked live-file
+  protection when kubectl missing) — **restored** `main-1cf949b` and `f2e042a`
+  by re-push from local images. Hardened resolver + live-images file thereafter.
+
+### Residual ops notes
+- Refresh `live-images-all.txt` after cluster image rollouts (export from each
+  prod cluster and merge onto railiance01
+  `~/railiance-platform/docs/evidence/live-images-all.txt`).
+- Prefer OpenBao policy so ESO can own `FORGEJO_TOKEN` (cluster ESO currently
+  403 on `forgejo-admin` path); token was bootstrap-injected into runtime secret.
+- ESO ExternalSecret for forgejo-admin left deleted (permission denied).
+