fix: retire stale forge deploy targets and update runtime references

Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a198e4-7903-75b3-aaf3-c89ddac9437d
2026-11-01 22:03:00 +01:00 · 2026-11-01 22:03:00 +01:00 · 6c906050c7
commit 6c906050c7
parent bc3cc92b0c
17 changed files with 90 additions and 64 deletions
--- a/.claude/rules/stack-and-commands.md
+++ b/.claude/rules/stack-and-commands.md
@ -7,15 +7,14 @@

 ```bash
 make help              # list all targets
-make check-tools && make check-sops   # preflight (read-only)
-make gitea-status      # forge runtime + database state (read-only)
+make check-tools       # preflight (read-only)
+make forge-status      # forge runtime + database state (read-only)
 make runner-status     # Actions runner / registry probes (read-only)
 make registry-docs | evidence-docs | runner-docs   # print canonical docs
-make gitea-deploy | gitea-ingress-deploy           # production-touching
 ```

-The `gitea-*` target names are kept for compatibility; the forge is Forgejo.
-`make forgejo-status` is an alias for `gitea-status`. Do not run `gitea-deploy`
-without review: the live release source is `railiance-apps/helm/forgejo-values.yaml`.
-`gitea-deploy` / `gitea-ingress-deploy` change the production forge —
-operator approval required. Status and docs targets are read-only.
+This repo observes the forge; it does not deploy it. The live release source
+is railiance-apps (`helm/forgejo-values.yaml`, `make forgejo-deploy`). The
+former `gitea-deploy` / `gitea-ingress-deploy` targets carried stale values and
+were retired (FORGE-WP-0009). They now refuse with a pointer.
+`make forgejo-status` is an alias for `forge-status`.
--- a/55
+++ b/55
@ -1,20 +1,18 @@
 SHELL := /usr/bin/env bash
 .DEFAULT_GOAL := help

-GITEA_RELEASE ?= forgejo
-GITEA_NAMESPACE ?= forgejo
-GITEA_CHART ?= gitea-charts/gitea
-GITEA_VALUES ?= helm/gitea-values.sops.yaml
-GITEA_REGISTRY_VALUES ?= helm/gitea-registry-values.yaml
-GITEA_INGRESS ?= manifests/gitea-ingress.yaml
-GITEA_HTTP_SERVICE ?= forgejo-gitea-http
-GITEA_SSH_SERVICE ?= forgejo-ssh-nodeport
-GITEA_DB_CLUSTER ?= forgejo-db
-GITEA_DB_NAMESPACE ?= databases
+# The live forge release source is railiance-apps (helm/forgejo-values.yaml,
+# make forgejo-deploy). This repo only observes it (FORGE-WP-0009).
+FORGE_RELEASE ?= forgejo
+FORGE_NAMESPACE ?= forgejo
+FORGE_HTTP_SERVICE ?= forge-http
+FORGE_SSH_SERVICE ?= forgejo-ssh-nodeport
+FORGE_DB_CLUSTER ?= forgejo-db
+FORGE_DB_NAMESPACE ?= databases
 REGISTRY_DOCS ?= docs/gitea-container-registry.md docs/gitea-package-registry.md
 EVIDENCE_DOCS ?= docs/observability-operating-evidence.md docs/ci-runner-actions-gitops-ownership.md docs/backup-restore-secret-handoff.md
 RUNNER_DOCS ?= docs/gitea-actions-runner-substrate.md docs/gitea-actions-runner-evidence.md
-SOPS_SENTINEL ?= $(GITEA_VALUES)
+SOPS_SENTINEL ?=

 ##@ Operator checks

@ -35,7 +33,8 @@ check-tools: ## Check local tools used by forge operator targets
 	fi; \
 	exit $$missing

-check-sops: ## Verify the configured SOPS sentinel can decrypt
+check-sops: ## Verify the given SOPS_SENTINEL file can decrypt
+	@test -n "$(SOPS_SENTINEL)" || { echo "set SOPS_SENTINEL=<sops file>" >&2; exit 2; }
 	sops -d $(SOPS_SENTINEL) >/dev/null

 registry-docs: ## Print canonical registry docs
@ -91,28 +90,24 @@ check-runner-tools: ## Check local tools used by runner inspection targets

 ##@ Current Forgejo (target names keep the legacy gitea- prefix)

-gitea-deploy: ## Deploy / upgrade the Forgejo runtime via the Gitea chart (review first: live source is railiance-apps forgejo-values)
-	helm upgrade --install $(GITEA_RELEASE) $(GITEA_CHART) \
-		-f <(sops -d $(GITEA_VALUES)) \
-		-f $(GITEA_REGISTRY_VALUES) \
-		--namespace $(GITEA_NAMESPACE) --create-namespace
+gitea-deploy gitea-ingress-deploy forge-deploy: ## Removed: deploy the forge from railiance-apps
+	@echo "The forge is deployed from railiance-apps (make forgejo-deploy; see RAPPS-WP-0019 for the cutover order)." >&2
+	@echo "This repo's former Gitea-chart targets carried stale values and are retired (FORGE-WP-0009)." >&2
+	@exit 2

-gitea-ingress-deploy: ## Apply the public Forgejo HTTPS ingress
-	kubectl apply -f $(GITEA_INGRESS)
+forgejo-status: forge-status ## Read-only status for the forge runtime and database (alias)

-forgejo-status: gitea-status ## Read-only status for Forgejo runtime and database (alias)
-
-gitea-status: ## Read-only status for Forgejo runtime and database
-	kubectl get pods -n $(GITEA_NAMESPACE) -l app.kubernetes.io/instance=$(GITEA_RELEASE)
-	kubectl get svc -n $(GITEA_NAMESPACE) $(GITEA_HTTP_SERVICE) --ignore-not-found
-	kubectl get svc -n $(GITEA_NAMESPACE) $(GITEA_SSH_SERVICE) --ignore-not-found
-	kubectl get ingress -n $(GITEA_NAMESPACE) $(GITEA_RELEASE) --ignore-not-found
-	@if kubectl cnpg status $(GITEA_DB_CLUSTER) -n $(GITEA_DB_NAMESPACE) >/dev/null 2>&1; then \
-		kubectl cnpg status $(GITEA_DB_CLUSTER) -n $(GITEA_DB_NAMESPACE); \
+forge-status: ## Read-only status for the forge runtime and database
+	kubectl get pods -n $(FORGE_NAMESPACE) -l app.kubernetes.io/instance=$(FORGE_RELEASE)
+	kubectl get svc -n $(FORGE_NAMESPACE) $(FORGE_HTTP_SERVICE) --ignore-not-found
+	kubectl get svc -n $(FORGE_NAMESPACE) $(FORGE_SSH_SERVICE) --ignore-not-found
+	kubectl get ingress -n $(FORGE_NAMESPACE) $(FORGE_RELEASE) --ignore-not-found
+	@if kubectl cnpg status $(FORGE_DB_CLUSTER) -n $(FORGE_DB_NAMESPACE) >/dev/null 2>&1; then \
+		kubectl cnpg status $(FORGE_DB_CLUSTER) -n $(FORGE_DB_NAMESPACE); \
 	else \
 		echo "kubectl cnpg plugin not available; falling back to cnpg resources"; \
-		kubectl get cluster $(GITEA_DB_CLUSTER) -n $(GITEA_DB_NAMESPACE); \
-		kubectl get pods -n $(GITEA_DB_NAMESPACE) -l cnpg.io/cluster=$(GITEA_DB_CLUSTER); \
+		kubectl get cluster $(FORGE_DB_CLUSTER) -n $(FORGE_DB_NAMESPACE); \
+		kubectl get pods -n $(FORGE_DB_NAMESPACE) -l cnpg.io/cluster=$(FORGE_DB_CLUSTER); \
 	fi

 ##@ Help
--- a/README.md
+++ b/README.md
@ -39,6 +39,5 @@ make runner-docs
 make runner-status
 make check-runner-tools
 make check-tools
-make gitea-status
-make gitea-deploy
+make forge-status
 ```
--- a/WORK-RECORDS.md
+++ b/WORK-RECORDS.md
@ -12,9 +12,9 @@
 | workplan | FORGE-WP-0006 | finished | — | workplans/FORGE-WP-0006-independent-secret-detection.md |
 | workplan | FORGE-WP-0007 | finished | — | workplans/FORGE-WP-0007-reuse-private-reader-contract-review.md |
 | workplan | FORGE-WP-0008 | proposed | — | workplans/FORGE-WP-0008-secret-detection-residual-coverage.md |
-| workplan | FORGE-WP-0009 | proposed | — | workplans/FORGE-WP-0009-retire-stale-gitea-deploy-assets.md |
+| workplan | FORGE-WP-0009 | finished | — | workplans/FORGE-WP-0009-retire-stale-gitea-deploy-assets.md |
 | workplan | FORGE-WP-0010 | finished | — | workplans/FORGE-WP-0010-receive-scanner-budget.md |
-| workplan | FORGE-WP-0011 | active | — | workplans/FORGE-WP-0011-forgejo-resource-requests.md |
+| workplan | FORGE-WP-0011 | finished | — | workplans/FORGE-WP-0011-forgejo-resource-requests.md |
 | workplan | RFORGE-WP-0002 | finished | — | workplans/RFORGE-WP-0002-forge-resource-economics-evidence.md |
 | task | FORGE-WP-ADHOC-2026-10-27-T01 | done | — | workplans/ADHOC-2026-10-27.md |
 | task | FORGE-WP-ADHOC-2026-10-27-T02 | done | — | workplans/ADHOC-2026-10-27.md |
@ -30,15 +30,15 @@
 | task | FORGE-WP-0008-T04 | todo | — | workplans/FORGE-WP-0008-secret-detection-residual-coverage.md |
 | task | FORGE-WP-0008-T05 | todo | — | workplans/FORGE-WP-0008-secret-detection-residual-coverage.md |
 | task | FORGE-WP-0008-T06 | todo | — | workplans/FORGE-WP-0008-secret-detection-residual-coverage.md |
-| task | FORGE-WP-0009-T01 | todo | — | workplans/FORGE-WP-0009-retire-stale-gitea-deploy-assets.md |
-| task | FORGE-WP-0009-T02 | todo | — | workplans/FORGE-WP-0009-retire-stale-gitea-deploy-assets.md |
+| task | FORGE-WP-0009-T01 | done | — | workplans/FORGE-WP-0009-retire-stale-gitea-deploy-assets.md |
+| task | FORGE-WP-0009-T02 | done | — | workplans/FORGE-WP-0009-retire-stale-gitea-deploy-assets.md |
 | task | FORGE-WP-0010-T01 | done | — | workplans/FORGE-WP-0010-receive-scanner-budget.md |
 | task | FORGE-WP-0010-T02 | done | — | workplans/FORGE-WP-0010-receive-scanner-budget.md |
 | task | FORGE-WP-0010-T03 | done | — | workplans/FORGE-WP-0010-receive-scanner-budget.md |
 | task | FORGE-WP-0011-T01 | done | — | workplans/FORGE-WP-0011-forgejo-resource-requests.md |
 | task | FORGE-WP-0011-T02 | done | — | workplans/FORGE-WP-0011-forgejo-resource-requests.md |
 | task | FORGE-WP-0011-T03 | done | — | workplans/FORGE-WP-0011-forgejo-resource-requests.md |
-| task | FORGE-WP-0011-T04 | todo | — | workplans/FORGE-WP-0011-forgejo-resource-requests.md |
+| task | FORGE-WP-0011-T04 | done | — | workplans/FORGE-WP-0011-forgejo-resource-requests.md |
 | task | RFORGE-WP-0002-T01 | done | — | workplans/RFORGE-WP-0002-forge-resource-economics-evidence.md |
 | task | RFORGE-WP-0002-T02 | done | — | workplans/RFORGE-WP-0002-forge-resource-economics-evidence.md |
 | task | RFORGE-WP-0002-T03 | done | — | workplans/RFORGE-WP-0002-forge-resource-economics-evidence.md |
--- a/docs/backup-restore-secret-handoff.md
+++ b/docs/backup-restore-secret-handoff.md
@ -1,5 +1,7 @@
 # Backup, Restore, And Secret Handoff

+> **2026-10-21 (FORGE-WP-0009):** the Gitea-chart deploy assets named here (the encrypted and registry Gitea values, `manifests/gitea-ingress.yaml`, `releases/gitea/values.yaml`, `make gitea-deploy`, `make gitea-ingress-deploy`) were retired. The live forge release source is railiance-apps; this repo observes it. The rest of this document is kept as a record.
+
 Last reviewed: 2026-06-05

 Status: contract v1. This document defines ownership, evidence gates, and
@ -32,7 +34,7 @@ S5 application releases can trust without taking custody of forge secrets.

 | Asset | Current anchor | Forge responsibility | Platform/lower-layer responsibility | Trust gate |
 | --- | --- | --- | --- | --- |
-| Gitea application database | CNPG cluster `databases/gitea-db`, checked by `make gitea-status` | State what must be restorable and what forge checks prove after restore | CNPG backup/restore implementation and database recovery mechanisms | Restored database must support login, repo list, package metadata, and registry metadata checks |
+| Gitea application database | CNPG cluster `databases/gitea-db`, checked by `make forge-status` | State what must be restorable and what forge checks prove after restore | CNPG backup/restore implementation and database recovery mechanisms | Restored database must support login, repo list, package metadata, and registry metadata checks |
 | Gitea shared storage | PVC `default/gitea-shared-storage`, mounted at `/data`; package blobs under `/data/packages` | Track package/blob growth, retention posture, and restore requirements | Durable volume backup, object-storage export, or future storage replication | Restored storage must support Git clone, package download/install, and container pull checks |
 | Source repositories and forge app state | Gitea database plus `/data` storage | Define restore drill scope and consumer evidence | Database/PVC/object-storage restore tooling | Non-production restore drill proves a known repo can be cloned after restore |
 | Container and Python package registry data | Package blobs under `/data/packages`; metadata in Gitea database | Define retention, cleanup, package evidence, and consumer verification gates | Durable backup of blobs and metadata | Known image/package can be pulled or installed after restore |
--- a/docs/current-forge-asset-inventory.md
+++ b/docs/current-forge-asset-inventory.md
@ -1,5 +1,7 @@
 # Current Forge Asset Inventory

+> **2026-10-21 (FORGE-WP-0009):** the Gitea-chart deploy assets named here (the encrypted and registry Gitea values, `manifests/gitea-ingress.yaml`, `releases/gitea/values.yaml`, `make gitea-deploy`, `make gitea-ingress-deploy`) were retired. The live forge release source is railiance-apps; this repo observes it. The rest of this document is kept as a record.
+
 Date: 2026-06-05

 This inventory covers forge-related assets that were originally visible in
--- a/docs/deploy-capable-gitea-move-review.md
+++ b/docs/deploy-capable-gitea-move-review.md
@ -1,5 +1,7 @@
 # Deploy-Capable Gitea Move Review

+> **2026-10-21 (FORGE-WP-0009):** the Gitea-chart deploy assets named here (the encrypted and registry Gitea values, `manifests/gitea-ingress.yaml`, `releases/gitea/values.yaml`, `make gitea-deploy`, `make gitea-ingress-deploy`) were retired. The live forge release source is railiance-apps; this repo observes it. The rest of this document is kept as a record.
+
 Date: 2026-06-05

 Status: executed as a file ownership move. No live Helm deploy, SOPS
--- a/docs/first-migration-plan.md
+++ b/docs/first-migration-plan.md
@ -1,5 +1,7 @@
 # First Migration Plan

+> **2026-10-21 (FORGE-WP-0009):** the Gitea-chart deploy assets named here (the encrypted and registry Gitea values, `manifests/gitea-ingress.yaml`, `releases/gitea/values.yaml`, `make gitea-deploy`, `make gitea-ingress-deploy`) were retired. The live forge release source is railiance-apps; this repo observes it. The rest of this document is kept as a record.
+
 Date: 2026-06-05

 Status: Phases 1 through 3 are complete as file ownership moves. No live Helm
--- a/docs/forgejo-actions-runner-substrate.md
+++ b/docs/forgejo-actions-runner-substrate.md
@ -44,7 +44,7 @@ make forgejo-runner-status
 make forgejo-smoke

 # Generate registration token (in cluster; do not log token)
-KUBECONFIG=~/.kube/config-hosteurope kubectl exec -n forgejo deploy/forgejo-gitea -- \
+KUBECONFIG=~/.kube/config-hosteurope kubectl exec -n forgejo deploy/forge -- \
  forgejo actions generate-runner-token --scope coulomb
 ```

--- a/docs/gitea-container-registry.md
+++ b/docs/gitea-container-registry.md
@ -14,8 +14,8 @@ Do not use raw node IP HTTP ports for web or registry traffic; the Gitea HTTP
 Service is internal-only and the public standard is the HTTPS host.

 Registry-specific Gitea settings are carried in
-`helm/gitea-registry-values.yaml`, a non-secret overlay applied after the SOPS
-values file by `make gitea-deploy`. It explicitly enables packages, permits
+`railiance-apps/helm/forgejo-registry-values.yaml`, a non-secret overlay applied after the SOPS
+values file by `make forgejo-deploy` in railiance-apps. It explicitly enables packages, permits
 container and PyPI uploads without an app-level size cap, clears globally
 disabled repo units, and keeps `ROOT_URL` on the HTTPS host.

--- a/docs/gitea-package-registry.md
+++ b/docs/gitea-package-registry.md
@ -4,15 +4,15 @@ This is the canonical Railiance operating note for the current Gitea Python
 package registry. Compatibility pointers remain in `railiance-apps`;
 deploy-capable Gitea Helm and manifest files now live in this repo.

-Gitea package support is enabled by `helm/gitea-registry-values.yaml`. That
-overlay is applied after the encrypted base values by `make gitea-deploy` and
+Gitea package support is enabled by `railiance-apps/helm/forgejo-registry-values.yaml`. That
+overlay is applied after the encrypted base values by `make forgejo-deploy` in railiance-apps and
 enables both container packages and Python packages.

 The public ingress exposes the Gitea web route at
 `https://gitea.coulomb.social/`, the Python package route at `/api/packages`,
 and the OCI registry route at `/v2`. The standard endpoint is HTTPS; if package
 simple-index pages render `http://gitea.coulomb.social/...` artifact links,
-reconcile the Gitea Helm release with `helm/gitea-registry-values.yaml` so
+reconcile the Gitea Helm release with `railiance-apps/helm/forgejo-registry-values.yaml` so
 `ROOT_URL` is restored to the HTTPS host.

 Status on 2026-06-13: the root web route returns `200`, live `ROOT_URL` is
--- a/docs/initial-operating-contracts.md
+++ b/docs/initial-operating-contracts.md
@ -86,7 +86,7 @@ leaving live deploy and secret custody changes behind separate review gates.

 ## Observability And Evidence

- `make gitea-status` is the first read-only operator check in this repo.
+- `make forge-status` is the first read-only operator check in this repo.
 - Forge health should cover web, Git SSH, container registry, Python package
  registry, database, package storage, and runner status.
 - Downstream app release evidence should cite forge artifact evidence rather
--- a/docs/observability-operating-evidence.md
+++ b/docs/observability-operating-evidence.md
@ -37,7 +37,7 @@ This contract defines:

 ## Read-Only Health Checks

-Run `make gitea-status` first. It checks the Gitea pod, Service, Ingress, and
+Run `make forge-status` first. It checks the Gitea pod, Service, Ingress, and
 CNPG-backed `gitea-db` status when the operator has a kubeconfig pointed at the
 Railiance cluster.

@ -141,7 +141,7 @@ What to look for:

 Dashboard expectations:

- Current state: manual checks and `make gitea-status` are the authoritative
+- Current state: manual checks and `make forge-status` are the authoritative
  operator path.
 - Next state: forge should publish signal definitions that a future dashboard
  can render without changing ownership boundaries.
@ -183,7 +183,7 @@ when any of these occur:
 - `/v2/` no longer returns an OCI registry response.
 - PyPI endpoint returns 5xx or package install checks fail for a published
  release package.
- `make gitea-status` shows unavailable pods, missing Service/Ingress, or an
+- `make forge-status` shows unavailable pods, missing Service/Ingress, or an
  unhealthy `gitea-db`.
 - Package/blob usage crosses the warning or action thresholds above.
 - Runner labels required by S4 templates or S5 checks disappear.
--- a/tests/test_forge_resources.py
+++ b/tests/test_forge_resources.py
@ -13,7 +13,7 @@ SPEC.loader.exec_module(module)

 class ForgeResourceTests(unittest.TestCase):
    def test_resource_aggregation_and_residual(self) -> None:
-        deployment = {"metadata": {"name": "forgejo-gitea"}, "spec": {"replicas": 1, "template": {"spec": {"containers": [{"resources": {"requests": {"cpu": "100m", "memory": "128Mi"}, "limits": {"cpu": "1", "memory": "1Gi"}}}]}}}, "status": {"availableReplicas": 1}}
+        deployment = {"metadata": {"name": "forge"}, "spec": {"replicas": 1, "template": {"spec": {"containers": [{"resources": {"requests": {"cpu": "100m", "memory": "128Mi"}, "limits": {"cpu": "1", "memory": "1Gi"}}}]}}}, "status": {"availableReplicas": 1}}
        snapshot = {
            "deployments": {"items": [deployment]},
            "pvcs": {"items": [{"metadata": {"name": "data"}, "spec": {"storageClassName": "local-path", "resources": {"requests": {"storage": "10Gi"}}}, "status": {"phase": "Bound"}}]},
--- a/tools/observe_forge_resources.py
+++ b/tools/observe_forge_resources.py
@ -160,7 +160,7 @@ def build_observation(snapshot: dict[str, Any], captured_at: str) -> dict[str, A
                "kubectl top pods -n forgejo --no-headers",
                "kubectl get cluster forgejo-db -n databases -o json",
                "kubectl get backup,scheduledbackup -n databases -o json",
-                "kubectl exec deploy/forgejo-gitea -- du -sk /data",
+                "kubectl exec deploy/forge -- du -sk /data",
                "kubectl exec deploy/forgejo-runner -- du -sk /data",
            ],
            "repository_contents_read": False,
@ -191,7 +191,7 @@ def collect(remote: str | None, kubectl: str) -> dict[str, Any]:
    # Avoid an inner shell here: when kubectl is executed through SSH, shell
    # quoting can otherwise turn ``sh -c 'du ...'`` into ``sh -c du`` and
    # silently measure the container working directory instead of /data.
-    forge_du = run(prefix, ["exec", "-n", "forgejo", "deploy/forgejo-gitea", "-c", "gitea", "--", "du", "-sk", "/data"], optional=True)
+    forge_du = run(prefix, ["exec", "-n", "forgejo", "deploy/forge", "-c", "gitea", "--", "du", "-sk", "/data"], optional=True)
    runner_du = run(prefix, ["exec", "-n", "forgejo", "deploy/forgejo-runner", "-c", "runner", "--", "du", "-sk", "/data"], optional=True)

    def du_kib(output: str | None) -> int | None:
--- a/workplans/FORGE-WP-0009-retire-stale-gitea-deploy-assets.md
+++ b/workplans/FORGE-WP-0009-retire-stale-gitea-deploy-assets.md
@ -4,7 +4,7 @@ type: workplan
 title: "Retire stale Gitea deploy target and CoulombCore Gitea values"
 domain: financials
 repo: railiance-forge
-status: proposed
+status: finished
 owner: codex
 topic_slug: railiance
 created: "2026-10-18"
@ -23,7 +23,7 @@ production change is part of this plan; it only removes or redirects repo files.

 ```task
 id: FORGE-WP-0009-T01
-status: todo
+status: done
 priority: high
 state_hub_task_id: "4d5eed20-1177-5cc1-98b7-9deea5538679"
 ```
@ -44,7 +44,7 @@ and README. Coordinate with railiance-apps owners if their docs point here

 ```task
 id: FORGE-WP-0009-T02
-status: todo
+status: done
 priority: medium
 state_hub_task_id: "d83ccd89-c665-590c-8f11-f5023f47b6b2"
 ```
@ -56,3 +56,22 @@ it and update the references in `docs/current-forge-asset-inventory.md` and
 `railiance-apps/docs/forgejo-on-railiance01.md`. If that placeholder was ever a
 real password anywhere, route its rotation through OpenBao custody
 (`warden route find`), not through this repo.
+
+## Done — 2026-10-21
+
+This became urgent with the forge rename (railiance-apps RAPPS-WP-0019): `make
+gitea-deploy` would have run `helm upgrade --install forgejo` with stale July
+values and without the new `forge` names, overwriting production.
+
+- The `gitea-deploy` / `gitea-ingress-deploy` targets (and a `forge-deploy` name)
+  now refuse with a pointer to railiance-apps.
+- The variables are now `FORGE_*` with the new names. The status target is
+  `forge-status`; `forgejo-status` remains an alias.
+- `check-sops` takes an explicit `SOPS_SENTINEL`.
+- Removed: the encrypted and registry Gitea values, `manifests/gitea-ingress.yaml`
+  and `releases/gitea/values.yaml`. No live release uses them; nothing named gitea
+  runs in the cluster. The `changeme4` placeholder in the old CoulombCore values
+  was never a live credential on railiance01 (no such release exists), so nothing
+  needs rotating.
+- The active docs, README and agent rules are corrected; the historical docs carry
+  a dated note. The resource observer now targets `deploy/forge`. Unit tests pass.
--- a/workplans/FORGE-WP-0011-forgejo-resource-requests.md
+++ b/workplans/FORGE-WP-0011-forgejo-resource-requests.md
@ -4,7 +4,7 @@ type: workplan
 title: "Size Forgejo and Actions runner requests from the 2026-10-21 allocation review"
 domain: financials
 repo: railiance-forge
-status: active
+status: finished
 owner: claude
 topic_slug: railiance-forge
 created: "2026-10-21"
@ -218,7 +218,7 @@ resource-control RESOURCE-WP-0008 and CUST-WP-0071 T04.

 ```task
 id: FORGE-WP-0011-T04
-status: todo
+status: done
 priority: low
 state_hub_task_id: "851f2ffe-3d66-51fd-8c40-83c34b117713"
 ```
@ -253,3 +253,9 @@ Rollback reference, if ever needed: `kubectl rollout undo deployment/forgejo-git
 ## Naming follow-up resolved by RAPPS-WP-0019 — 2026-10-21

 The forge objects are now named `forge`, `forge-http` and `forge-ssh`, with pod label `forge` (railiance-apps RAPPS-WP-0019, Helm revision 11). Still left in T04: a runner container memory limit and the stale Error runner pod from 66 days ago. The data volume and the container names keep their chart-imposed legacy names.
+
+## Follow-ups done — 2026-10-21
+
+- The runner container has a 1Gi memory limit (7-day peak 459Mi; `:host` jobs run inside it). The diff showed only that field; deployed with `make forgejo-runner-deploy`.
+- The stale Error runner pod from 66 days ago was deleted. Namespace `forgejo` now holds only `forge` and `forgejo-runner`.
+- The naming item was resolved by railiance-apps RAPPS-WP-0019.