RAPPS-WP-0019: stage A and B applied; forge objects renamed

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 276069@bnt-lap001
Assistant-Session: 2e192b3d-b3e8-4403-94d4-d55a2c8b476c

WORK-RECORDS.md

@@ -54,8 +54,8 @@
 | task | RAPPS-WP-0017-T02 | done | — | workplans/RAPPS-WP-0017-reuse-private-reader-release.md |
 | task | RAPPS-WP-0017-T03 | done | — | workplans/RAPPS-WP-0017-reuse-private-reader-release.md |
 | task | RAPPS-WP-0018-T01 | wait | — | workplans/RAPPS-WP-0018-wave2-resource-right-sizing.md |
-| task | RAPPS-WP-0019-T01 | todo | — | workplans/RAPPS-WP-0019-product-neutral-forge-object-names.md |
-| task | RAPPS-WP-0019-T02 | todo | — | workplans/RAPPS-WP-0019-product-neutral-forge-object-names.md |
+| task | RAPPS-WP-0019-T01 | done | — | workplans/RAPPS-WP-0019-product-neutral-forge-object-names.md |
+| task | RAPPS-WP-0019-T02 | done | — | workplans/RAPPS-WP-0019-product-neutral-forge-object-names.md |
 | task | RAPPS-WP-0019-T03 | todo | — | workplans/RAPPS-WP-0019-product-neutral-forge-object-names.md |
 | task | RAPPS-WP-0019-T04 | todo | — | workplans/RAPPS-WP-0019-product-neutral-forge-object-names.md |
 | task | RAPPS-WP-0019-T05 | todo | — | workplans/RAPPS-WP-0019-product-neutral-forge-object-names.md |

workplans/RAPPS-WP-0019-product-neutral-forge-object-names.md

@@ -39,7 +39,7 @@ are not live. They are listed for cleanup in T05.
 
 ```task
 id: RAPPS-WP-0019-T01
-status: todo
+status: done
 priority: high
 ```
 
@@ -62,7 +62,7 @@ Verify: each consumer still reaches `http://forgejo-gitea-http.forgejo.svc:3000`
 
 ```task
 id: RAPPS-WP-0019-T02
-status: todo
+status: done
 priority: high
 depends_on: [RAPPS-WP-0019-T01]
 ```
@@ -135,3 +135,25 @@ priority: low
 
 Review and remove or archive the non-live Gitea-era manifests named above, once
 their owners confirm.
+
+## Stage A applied — 2026-10-21
+
+Each consumer now selects the forge by `app.kubernetes.io/instance: forgejo` only:
+- core-hub: `make deploy`, Helm revision 32;
+- sbom-nexus: server-side apply with field manager `rapp-sbom-nexus`;
+- issue-core: rapp-issue-core b60c194, pinned in railiance-platform 2c5d3b3, then the root app and issue-core synced manually. The root app needed a hard refresh first because ArgoCD served a cached `main`.
+
+Before the change, every full render diffed against live showed only the one label line. Afterwards all three reached the forge (healthz 200).
+
+`make argocd-pin-drift` in railiance-platform cannot read live Applications: its ssh hop cannot read the k3s kubeconfig. That is the same issue as RCLUSTER-WP-0020-T04.
+
+## Stage B cutover — 2026-10-21 21:24Z
+
+The founder ran the attended cutover script. It checked the node, waited until the runner was idle, scaled `forgejo-gitea` to 0, waited for no running forge pod, ran the Helm upgrade, then applied the Ingress, the SSH NodePort and the compatibility Service. Results:
+- Helm revision 11: Deployment `forge` 1/1; Services `forge-http` and `forge-ssh`; pod label `app.kubernetes.io/name: forge`.
+- The same data volume (`gitea-shared-storage`) is mounted.
+- The old `forgejo-gitea*` objects are gone, including the pod that had been in ContainerStatusUnknown for 66 days.
+- Checks: API 11.0.3; HTTPS `git ls-remote`; SSH through the NodePort (`forgejo-remote` alias, fetch ok); sign-in source unchanged (ID 1 `netkingdom`); redirect with S256, HTTPS callback and a single scope list; core-hub, issue-core and sbom-nexus answer healthz 200 on both `forgejo-gitea-http` (alias) and `forge-http`; no runner errors.
+- Downtime was about 3 minutes.
+
+Rollback reference: scale `forge` to 0, then `helm rollback forgejo 10`, then the previous Ingress and NodePort manifests from git.