RAPPS-WP-0019: plan product-neutral forge object names

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 276069@bnt-lap001
Assistant-Session: 2e192b3d-b3e8-4403-94d4-d55a2c8b476c

WORK-RECORDS.md

@@ -16,6 +16,7 @@
 | workplan | RAPPS-WP-0016 | active | — | workplans/RAPPS-WP-0016-forgejo-netkingdom-login.md |
 | workplan | RAPPS-WP-0017 | finished | — | workplans/RAPPS-WP-0017-reuse-private-reader-release.md |
 | workplan | RAPPS-WP-0018 | active | — | workplans/RAPPS-WP-0018-wave2-resource-right-sizing.md |
+| workplan | RAPPS-WP-0019 | active | — | workplans/RAPPS-WP-0019-product-neutral-forge-object-names.md |
 | task | RAPPS-WP-0001-T01 | done | — | workplans/RAPPS-WP-0001-cnpg-backup-scheduledbackup-coverage.md |
 | task | RAPPS-WP-0001-T02 | done | — | workplans/RAPPS-WP-0001-cnpg-backup-scheduledbackup-coverage.md |
 | task | RAPPS-WP-0001-T03 | done | — | workplans/RAPPS-WP-0001-cnpg-backup-scheduledbackup-coverage.md |
@@ -53,3 +54,8 @@
 | task | RAPPS-WP-0017-T02 | done | — | workplans/RAPPS-WP-0017-reuse-private-reader-release.md |
 | task | RAPPS-WP-0017-T03 | done | — | workplans/RAPPS-WP-0017-reuse-private-reader-release.md |
 | task | RAPPS-WP-0018-T01 | wait | — | workplans/RAPPS-WP-0018-wave2-resource-right-sizing.md |
+| task | RAPPS-WP-0019-T01 | todo | — | workplans/RAPPS-WP-0019-product-neutral-forge-object-names.md |
+| task | RAPPS-WP-0019-T02 | todo | — | workplans/RAPPS-WP-0019-product-neutral-forge-object-names.md |
+| task | RAPPS-WP-0019-T03 | todo | — | workplans/RAPPS-WP-0019-product-neutral-forge-object-names.md |
+| task | RAPPS-WP-0019-T04 | todo | — | workplans/RAPPS-WP-0019-product-neutral-forge-object-names.md |
+| task | RAPPS-WP-0019-T05 | todo | — | workplans/RAPPS-WP-0019-product-neutral-forge-object-names.md |

workplans/RAPPS-WP-0019-product-neutral-forge-object-names.md

@@ -0,0 +1,137 @@
+---
+id: RAPPS-WP-0019
+type: workplan
+title: "Product-neutral forge object names (forgejo-gitea-* → forge-*)"
+domain: infotech
+repo: railiance-apps
+status: active
+flavor: refactoring
+owner: railiance-apps
+created: "2026-10-21"
+updated: "2026-10-21"
+related: [FORGE-WP-0011, CUST-WP-0071]
+---
+
+# Product-neutral forge object names
+
+Founder decision, 2026-10-21: the legacy "gitea" terminology should leave live
+objects. The upstream Helm chart is called `gitea`, so the Forgejo objects were
+named `forgejo-gitea*` and the pods were labelled `app.kubernetes.io/name: gitea`.
+The founder also preferred the product-neutral word **forge**.
+
+**Scope:** object names and pod labels:
+- Deployment `forge`;
+- Services `forge-http` and `forge-ssh`;
+- chart Secrets `forge*`;
+- pod label `app.kubernetes.io/name: forge`.
+
+**Out of scope, kept on purpose:**
+- the data volume `gitea-shared-storage` (renaming needs a data copy);
+- the container names `gitea`/`configure-gitea` (hard-coded in the chart);
+- the Helm release, the namespace `forgejo` and the host `forgejo.coulomb.social`.
+  Changing these is a separate, later decision.
+
+Leftovers from the coulombcore Gitea era (`railiance-bootstrap`/`railiance-cluster`
+`gitea-ssh-nodeport.yaml`, `railiance-forge/manifests/gitea-ingress.yaml`, `gitea-db`)
+are not live. They are listed for cleanup in T05.
+
+## Stage A: decouple the consumer NetworkPolicies
+
+```task
+id: RAPPS-WP-0019-T01
+status: todo
+priority: high
+```
+
+core-hub, issue-core and sbom-nexus allow egress to the forge by selecting
+`app.kubernetes.io/instance: forgejo` plus `app.kubernetes.io/name: gitea`. Drop the
+`name` label. `instance=forgejo` still selects only the forge server pod (the
+runner has no instance label), and it stays valid before and after the rename.
+
+Diffs against live (2026-10-21) show exactly that one line per consumer:
+
+| Consumer | Source | Deploy path |
+|---|---|---|
+| core-hub | rapp-core-hub `helm/core-hub/templates/networkpolicy.yaml` | `make deploy` (Helm; the full release diff is only this line) |
+| sbom-nexus | rapp-sbom-nexus `manifests/runtime.yaml` | server-side apply of the rendered `sbom-nexus-runtime` NetworkPolicy with field manager `rapp-sbom-nexus` |
+| issue-core | rapp-issue-core `manifests/30-runtime.yaml` | push, pin the new revision in railiance-platform `argocd/railiance01/applications/issue-core.application.yaml`, manual ArgoCD sync (no other manifest change since `186c817`) |
+
+Verify: each consumer still reaches `http://forgejo-gitea-http.forgejo.svc:3000`.
+
+## Stage B: cutover (attended, about 3 minutes of forge downtime)
+
+```task
+id: RAPPS-WP-0019-T02
+status: todo
+priority: high
+depends_on: [RAPPS-WP-0019-T01]
+```
+
+Source: `helm/forgejo-values.yaml` (`fullnameOverride: forge`, `nameOverride: forge`,
+explicit `persistence.claimName: gitea-shared-storage`),
+`manifests/forgejo-ingress.yaml` (backend `forge-http`),
+`manifests/forgejo-ssh-nodeport.yaml` (selector `forge`),
+`manifests/forgejo-compat-http-service.yaml` (temporary alias).
+
+1. Pre-check: no running Actions job. Record Helm revision 10 and Deployment revision 15.
+2. `kubectl -n forgejo scale deployment/forgejo-gitea --replicas=0` and wait until
+   no forge pod is left. Helm creates the new Deployment before it deletes the old
+   one, so this prevents two pods mounting one volume.
+3. Founder: the final `helm upgrade --install forgejo gitea-charts/gitea` step of
+   `make forgejo-deploy`, the same command as on 2026-10-21. Do not run
+   `make forgejo-deploy` itself: its `eso-deploy` dependency would upgrade ESO.
+4. Apply the Ingress, the SSH NodePort and the compatibility Service manifests.
+5. Verify:
+   - Deployment `forge` is Ready and the old `forgejo-gitea*` objects are gone;
+   - `/api/healthz` returns 200;
+   - `git ls-remote` works over HTTPS and over SSH port 30022;
+   - the sign-in source is unchanged and the redirect still uses S256 PKCE;
+   - core-hub, issue-core and sbom-nexus reach the forge;
+   - the runner still polls.
+
+Rollback:
+1. `kubectl -n forgejo scale deployment/forge --replicas=0`.
+2. `helm rollback forgejo 10`, the known-good revision from 2026-10-21. **Never use revision 9.**
+3. Re-apply the previous Ingress and NodePort manifests from git, and delete the
+   compatibility Service.
+
+## Stage C: consumers move to forge-http, then remove the alias
+
+```task
+id: RAPPS-WP-0019-T03
+status: todo
+priority: medium
+depends_on: [RAPPS-WP-0019-T02]
+```
+
+Change the in-cluster URLs `forgejo-gitea-http.forgejo.svc` to `forge-http.forgejo.svc`:
+- rapp-core-hub `helm/core-hub/values.yaml` (`forgejoBaseURL`);
+- rapp-issue-core `manifests/10-config.yaml`;
+- rapp-sbom-nexus `manifests/runtime.yaml`.
+
+Deploy each through its own path. When no consumer uses the old name, delete
+`manifests/forgejo-compat-http-service.yaml` and the live Service.
+
+## Tooling and docs wording
+
+```task
+id: RAPPS-WP-0019-T04
+status: todo
+priority: low
+depends_on: [RAPPS-WP-0019-T02]
+```
+
+railiance-forge `Makefile` (`GITEA_HTTP_SERVICE`) and
+`tools/observe_forge_resources.py` (`deploy/forgejo-gitea`); runbooks and docs that
+name `forgejo-gitea`. Prefer "forge" wherever the concrete product is not meant.
+
+## Retire Gitea-era leftovers
+
+```task
+id: RAPPS-WP-0019-T05
+status: todo
+priority: low
+```
+
+Review and remove or archive the non-live Gitea-era manifests named above, once
+their owners confirm.