ci: cut over to Forgejo (add forgejo ci + publish, retire gitea workflows)

Adds .forgejo/workflows/ci.yml (black/flake8/pytest) and publish-python-package.yml
(twine → forgejo PyPI), modeled on issue-core. Removes the frozen-gitea ci.yml and
publish workflows. CUST-WP-0059 T02-T04.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.custodian-brief.md

@@ -1,18 +1,29 @@
 <!-- custodian-brief: generated by fix-consistency — do not edit manually -->
 # Custodian Brief — kaizen-agentic
 
-**Domain:** infotech
-**Last synced:** 2026-07-03 16:44 UTC
+**Domain:** agents
+**Last synced:** 2026-07-16 08:35 UTC
 **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
 
 ## Active Workstreams
 
-*(none — repo may need first-session setup)*
+### Forward-deployed agency: engagements, Kai ledger, host-operator pilot
+Progress: 1/11 done  |  workplan_id: `70f7afb1-78f1-4e3b-8437-48840b5b58cc`
+
+**Open tasks:**
+- · Accept open decisions  `d624072d`
+- · host-operator Role package  `407eae88`
+- · Phase 1 engagement layout + pilot record  `c90fd780`
+- · Bound agent definition  `e48f0ec3`
+- · Ramp checklists  `3c166660`
+- · Kai ledger (Phase 1)  `16e90a62`
+- · CLI engagement group  `52f7d872`
+- … and 3 more open tasks
 
 ---
 ## MCP Orientation (when available)
 
 If the state-hub MCP server is reachable, call:
-`get_domain_summary("infotech")`
+`get_domain_summary("agents")`
 This provides richer cross-domain context.
 If the MCP call fails, use this file as your orientation source.

.forgejo/workflows/ci.yml

@@ -0,0 +1,40 @@
+name: ci
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  workflow_dispatch:
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Fetch source archive
+        env:
+          REF: ${{ github.sha }}
+        run: |
+          set -eu
+          mkdir -p repo
+          wget -qO /tmp/repo.tar.gz \
+            "https://forgejo.coulomb.social/${GITHUB_REPOSITORY}/archive/${REF}.tar.gz"
+          tar xzf /tmp/repo.tar.gz -C repo --strip-components=1
+
+      - name: Install package and dev tools
+        working-directory: repo
+        run: |
+          python3 -m pip install --upgrade pip
+          python3 -m pip install -e ".[dev]"
+
+      - name: Format check (black)
+        working-directory: repo
+        run: black --check src tests
+
+      - name: Lint (flake8)
+        working-directory: repo
+        run: flake8 src/ --max-line-length=100
+
+      - name: Run tests
+        working-directory: repo
+        run: pytest tests/ -q --ignore=tests/test_cli_error_handling.py

.forgejo/workflows/publish-python-package.yml

@@ -0,0 +1,41 @@
+name: Publish Python package
+
+on:
+  push:
+    tags:
+      - "v*"
+  workflow_dispatch:
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Fetch source archive
+        env:
+          REF: ${{ github.sha }}
+        run: |
+          set -eu
+          mkdir -p buildctx
+          wget -qO /tmp/repo.tar.gz \
+            "https://forgejo.coulomb.social/${GITHUB_REPOSITORY}/archive/${REF}.tar.gz"
+          tar xzf /tmp/repo.tar.gz -C buildctx --strip-components=1
+
+      - name: Set up Python
+        run: |
+          python3 -m pip install --upgrade pip build twine
+
+      - name: Build and validate distributions
+        working-directory: buildctx
+        run: |
+          python3 -m build
+          python3 -m twine check dist/*
+
+      - name: Upload to Forgejo PyPI
+        working-directory: buildctx
+        env:
+          TWINE_USERNAME: ${{ secrets.FORGEJO_PYPI_USER }}
+          TWINE_PASSWORD: ${{ secrets.FORGEJO_PYPI_TOKEN }}
+        run: >-
+          python3 -m twine upload
+          --repository-url https://forgejo.coulomb.social/api/packages/coulomb/pypi
+          dist/*

.gitea/workflows/ci.yml

@@ -1,38 +0,0 @@
-name: ci
-
-on:
-  push:
-    branches: [main]
-  pull_request:
-    branches: [main]
-
-jobs:
-  test:
-    runs-on: haskelseed
-    steps:
-      - name: Check out source
-        env:
-          PACKAGE_TOKEN: ${{ secrets.PACKAGE_TOKEN }}
-        run: |
-          git clone --depth 1 \
-            "https://tegwick:${PACKAGE_TOKEN}@gitea.coulomb.social/coulomb/kaizen-agentic.git" \
-            repo
-          cd repo
-          git checkout "${{ gitea.sha }}"
-
-      - name: Install package and dev tools
-        run: |
-          cd repo
-          python3 -m ensurepip --upgrade 2>/dev/null || \
-            curl -sS https://bootstrap.pypa.io/get-pip.py -o /tmp/get-pip.py && python3 /tmp/get-pip.py
-          python3 -m pip install --upgrade pip
-          python3 -m pip install -e ".[dev]"
-
-      - name: Format check (black)
-        run: cd repo && black --check src tests
-
-      - name: Lint (flake8)
-        run: cd repo && flake8 src/ --max-line-length=100
-
-      - name: Run tests
-        run: cd repo && pytest tests/ -q --ignore=tests/test_cli_error_handling.py

.gitea/workflows/publish-python-package.yml

@@ -1,41 +0,0 @@
-name: Publish Python package
-
-on:
-  push:
-    tags:
-      - "v*"
-  workflow_dispatch:
-
-jobs:
-  publish:
-    runs-on: haskelseed
-    steps:
-      - name: Check out source
-        env:
-          PACKAGE_USER: ${{ secrets.PACKAGE_USER }}
-          PACKAGE_TOKEN: ${{ secrets.PACKAGE_TOKEN }}
-        run: |
-          git clone --depth 1 \
-            "https://${PACKAGE_USER}:${PACKAGE_TOKEN}@gitea.coulomb.social/coulomb/kaizen-agentic.git" \
-            repo
-          cd repo
-          git checkout "${{ gitea.sha }}"
-
-      - name: Build and publish
-        env:
-          TWINE_USERNAME: ${{ secrets.PACKAGE_USER }}
-          TWINE_PASSWORD: ${{ secrets.PACKAGE_TOKEN }}
-          PYTHON_KEYRING_BACKEND: keyring.backends.null.Keyring
-        run: |
-          cd repo
-          python3 -m venv .build-venv
-          . .build-venv/bin/activate
-          python -m pip install --upgrade pip build twine
-          python -m build
-          python -m twine check dist/*
-          python -m twine upload \
-            --username "${TWINE_USERNAME}" \
-            --password "${TWINE_PASSWORD}" \
-            --non-interactive \
-            --repository-url https://gitea.coulomb.social/api/packages/coulomb/pypi \
-            dist/*

workplans/kaizen-agentic-WP-0009-forward-deployed-agency.md

@@ -47,6 +47,7 @@ tasks:
   - id: T11
     status: todo
     title: Absorb pilot friction; ADR for engagement convention; docs cross-links
+state_hub_workstream_id: "70f7afb1-78f1-4e3b-8437-48840b5b58cc"
 ---
 
 # KAIZEN-WP-0009 — Forward-Deployed Agency
@@ -97,6 +98,7 @@ Client request → quote (Kai) → fund → staff Role → ramp-up → operate
 id: KAIZEN-WP-0009-T01
 status: done
 priority: high
+state_hub_task_id: "a9440a09-00fb-4668-94a7-f02ae14031d2"
 ```
 
 Delivered 2026-07-16:
@@ -111,6 +113,7 @@ Delivered 2026-07-16:
 id: KAIZEN-WP-0009-T02
 status: todo
 priority: high
+state_hub_task_id: "d624072d-1939-40f0-bfa2-498a24673b4c"
 ```
 
 Resolve architecture open questions with sponsor:
@@ -129,6 +132,7 @@ architecture sections into ADR-007.
 id: KAIZEN-WP-0009-T03
 status: todo
 priority: high
+state_hub_task_id: "407eae88-a3fe-4da9-80eb-ea92828fd488"
 ```
 
 Add supplier Role scaffold per architecture §5.1:
@@ -144,6 +148,7 @@ Add supplier Role scaffold per architecture §5.1:
 id: KAIZEN-WP-0009-T04
 status: todo
 priority: high
+state_hub_task_id: "c90fd780-982f-48ea-a017-2eee44f2e8c7"
 ```
 
 Create file-based engagement tree for pilot (location per T02 decision), including:
@@ -160,6 +165,7 @@ Document the path in architecture §11 if it differs from the draft proposal.
 id: KAIZEN-WP-0009-T05
 status: todo
 priority: high
+state_hub_task_id: "e48f0ec3-4258-4650-8c92-eb25e4dca755"
 ```
 
 Materialise engagement-bound agent definition from sys-medic + binding appendix
@@ -172,6 +178,7 @@ ships, sys-medic + appendix is acceptable; migrate to host-operator when T03 lan
 id: KAIZEN-WP-0009-T06
 status: todo
 priority: medium
+state_hub_task_id: "3c166660-b4b8-49fc-9dcb-c47e7d676792"
 ```
 
 Author ramp-up (RU-01…RU-08) and ramp-down (RD-01…RD-07) checklists with
@@ -183,6 +190,7 @@ evidence paths matching architecture §7. Link from ENGAGEMENT.yaml.
 id: KAIZEN-WP-0009-T07
 status: todo
 priority: medium
+state_hub_task_id: "16e90a62-973b-4cc8-ac36-87bfad52e538"
 ```
 
 - `commercial/ledger.jsonl` schema per architecture §10
@@ -195,6 +203,7 @@ priority: medium
 id: KAIZEN-WP-0009-T08
 status: todo
 priority: medium
+state_hub_task_id: "52f7d872-1087-4890-9439-8d6c704351fd"
 ```
 
 Implement `kaizen-agentic engagement` subcommands (Phase 2 of architecture):
@@ -211,6 +220,7 @@ Tests for schema validate and checklist status.
 id: KAIZEN-WP-0009-T09
 status: todo
 priority: medium
+state_hub_task_id: "82ac0b5a-0309-4912-93bf-f05bee2abbc2"
 ```
 
 - `engagement prepare` bundles definition + vault + protocols + access plan
@@ -223,6 +233,7 @@ priority: medium
 id: KAIZEN-WP-0009-T10
 status: todo
 priority: high
+state_hub_task_id: "6b21da0d-7ba5-4c64-92cb-9237cf71a102"
 ```
 
 Execute architecture §11 ramp-up runbook against railiance01 (observe-class
@@ -237,6 +248,7 @@ Evidence: baseline file, first health report, checklist marks, ledger entries.
 id: KAIZEN-WP-0009-T11
 status: todo
 priority: low
+state_hub_task_id: "f212949d-de22-46de-9ae0-63fc21e2701f"
 ```
 
 - Supplier notes → playbook / architecture v0.2