2026-06-04 01:34:33 +02:00
# Forgejo Migration Inventory
Date: 2026-06-04
Workplan: RAIL-HO-WP-0005
Task: RAIL-HO-WP-0005-T01
## Scope
This is the first-pass inventory for migrating the current Gitea installation
to Forgejo on railiance01. It captures facts that were safe to verify from
public Gitea API metadata, State Hub repo records, and Kubernetes object
metadata. It deliberately does not dump Helm values, Kubernetes Secrets, user
tokens, deploy keys, SMTP credentials, or other secret-bearing configuration.
## Current Gitea Runtime
- Public URL: `http://gitea.coulomb.social`
- API URL checked: `http://92.205.130.254:32166/api/v1`
- Kubernetes namespace: `default`
- Helm release: `gitea`
- Chart/app observed by Helm metadata: `gitea-12.5.0` , app `1.25.4`
- Workload image observed from Kubernetes metadata: `docker.gitea.com/gitea:1.25.4-rootless`
- Main service: `gitea` , NodePort `3000:32166/TCP`
- SSH service: `gitea-ssh-nodeport` , NodePort `22:30022/TCP`
- Ingress: `gitea.coulomb.social` , class `traefik` , address `92.205.130.254` , ports `80,443`
- Gitea pod status observed: `1/1 Running`
## Current Storage
Gitea-related PVCs observed in namespace `default` :
| PVC | Size | StorageClass | Age | Migration classification |
| --- | ---: | --- | --- | --- |
| `gitea-shared-storage` | 10Gi | `local-path` | 276d | Must migrate or restore; contains Git/app shared state. |
| `data-gitea-postgresql-ha-postgresql-0` | 10Gi | `local-path` | 276d | Legacy bundled PostgreSQL data; preserve until final cutover rollback expires. |
| `data-gitea-postgresql-ha-postgresql-1` | 10Gi | `local-path` | 276d | Legacy bundled PostgreSQL data; preserve until final cutover rollback expires. |
| `data-gitea-postgresql-ha-postgresql-2` | 10Gi | `local-path` | 276d | Legacy bundled PostgreSQL data; preserve until final cutover rollback expires. |
| `valkey-data-gitea-valkey-cluster-0` | 8Gi | `local-path` | 276d | Cache/session data; likely disposable, confirm before cutover. |
| `valkey-data-gitea-valkey-cluster-1` | 8Gi | `local-path` | 276d | Cache/session data; likely disposable, confirm before cutover. |
| `valkey-data-gitea-valkey-cluster-2` | 8Gi | `local-path` | 276d | Cache/session data; likely disposable, confirm before cutover. |
Related platform services already available:
| Service | Namespace | Status |
| --- | --- | --- |
| `gitea-db` CNPG cluster | `databases` | Healthy, 1/1 ready |
| `apps-pg` CNPG cluster | `databases` | Healthy, 1/1 ready |
| `valkey` Helm release | `platform` | Deployed |
| `openbao` Helm release | `openbao` | Deployed |
## Public Repository Inventory
The public `coulomb` organization API exposed 49 repositories. All visible repos
are public, use `main` as default branch, and have code enabled.
| Repository | Issues | Wiki | Releases | Packages | Actions | Open issues | Updated |
| --- | --- | --- | --- | --- | --- | ---: | --- |
| `coulomb/artifact-store` | yes | yes | yes | yes | yes | 0 | 2026-05-18 |
| `coulomb/audit-core` | yes | yes | yes | yes | yes | 0 | 2026-06-01 |
| `coulomb/binect-chrome` | yes | yes | yes | yes | yes | 2 | 2026-01-16 |
| `coulomb/binect-js` | yes | yes | yes | yes | yes | 0 | 2026-01-16 |
| `coulomb/can-you-assist` | yes | yes | yes | yes | yes | 0 | 2026-05-28 |
| `coulomb/citation-engine` | yes | yes | yes | yes | yes | 0 | 2026-05-24 |
| `coulomb/citation-evidence` | yes | yes | yes | yes | yes | 0 | 2026-05-26 |
| `coulomb/citation-work` | yes | yes | yes | yes | yes | 0 | 2026-05-25 |
| `coulomb/coordination-engine` | yes | yes | yes | yes | yes | 0 | 2026-06-01 |
| `coulomb/direkt-vermittlung-de` | yes | yes | yes | yes | yes | 0 | 2025-12-01 |
| `coulomb/domain-tree` | yes | yes | yes | yes | yes | 0 | 2026-05-18 |
| `coulomb/email-connect` | yes | yes | yes | yes | yes | 0 | 2026-06-02 |
| `coulomb/evidence-anchor` | yes | yes | yes | yes | yes | 0 | 2026-05-24 |
| `coulomb/evidence-binder` | yes | yes | yes | yes | yes | 0 | 2026-05-24 |
| `coulomb/evidence-source` | yes | yes | yes | yes | yes | 0 | 2026-05-24 |
| `coulomb/flex-auth` | yes | yes | yes | yes | yes | 0 | 2026-05-22 |
| `coulomb/guide-board` | yes | yes | yes | yes | yes | 0 | 2026-05-18 |
| `coulomb/helix-forge` | yes | yes | yes | yes | yes | 0 | 2026-05-22 |
| `coulomb/info-tech-canon` | yes | yes | yes | yes | yes | 0 | 2026-05-27 |
| `coulomb/infospace-bench` | yes | yes | yes | yes | yes | 0 | 2026-05-20 |
| `coulomb/issue-core` | yes | yes | yes | no | yes | 0 | 2026-05-23 |
| `coulomb/kaizen-agentic` | yes | yes | yes | no | yes | 4 | 2026-03-24 |
| `coulomb/key-cape` | yes | yes | yes | yes | yes | 0 | 2026-06-01 |
| `coulomb/kontextual-engine` | yes | yes | yes | yes | yes | 0 | 2026-05-18 |
| `coulomb/llm-connect` | yes | yes | yes | yes | yes | 0 | 2026-06-03 |
| `coulomb/marki-docx` | yes | yes | yes | yes | yes | 0 | 2026-03-18 |
| `coulomb/markitect-filter` | yes | yes | yes | yes | yes | 0 | 2026-05-18 |
| `coulomb/markitect-main` | yes | yes | yes | no | yes | 60 | 2026-05-23 |
| `coulomb/markitect-quarkdown` | yes | yes | yes | yes | yes | 0 | 2026-05-18 |
| `coulomb/markitect-tool` | yes | yes | yes | yes | yes | 0 | 2026-05-18 |
| `coulomb/open-cmis-tck` | yes | yes | yes | yes | yes | 0 | 2026-05-18 |
| `coulomb/open-reuse` | yes | yes | yes | yes | yes | 0 | 2026-05-18 |
| `coulomb/ops-bridge` | yes | yes | yes | yes | yes | 0 | 2026-05-18 |
| `coulomb/ops-warden` | yes | yes | yes | yes | yes | 0 | 2026-05-18 |
| `coulomb/phase-memory` | yes | yes | yes | yes | yes | 0 | 2026-05-19 |
| `coulomb/polycode-sim` | yes | yes | yes | no | yes | 0 | 2025-10-30 |
| `coulomb/railiance-fabric` | yes | yes | yes | yes | yes | 0 | 2026-06-03 |
| `coulomb/ralph-workplan` | yes | yes | yes | yes | yes | 0 | 2026-03-16 |
| `coulomb/repo-scoping` | yes | yes | yes | yes | yes | 0 | 2026-05-18 |
| `coulomb/repo-seed` | yes | yes | yes | no | no | 0 | 2025-11-18 |
| `coulomb/shard-wiki` | yes | yes | yes | yes | yes | 0 | 2026-05-15 |
| `coulomb/state-hub` | yes | yes | yes | yes | yes | 0 | 2026-06-03 |
| `coulomb/tele-mcp` | yes | yes | yes | yes | yes | 0 | 2025-09-07 |
| `coulomb/testdrive-jsui` | yes | yes | yes | no | yes | 0 | 2025-12-17 |
| `coulomb/the-custodian` | yes | yes | yes | yes | yes | 0 | 2026-06-03 |
| `coulomb/timeline-svg` | yes | yes | yes | yes | yes | 0 | 2026-01-23 |
| `coulomb/user-engine` | yes | yes | yes | yes | yes | 0 | 2026-06-03 |
| `coulomb/vantage-point` | yes | yes | yes | yes | yes | 0 | 2026-05-15 |
| `coulomb/vergabe-teilnahme` | yes | yes | yes | yes | yes | 0 | 2026-05-23 |
## State Hub Registration Cross-Check
Matched to State Hub repo records:
- `artifact-store`
- `can-you-assist`
- `citation-engine`
- `citation-evidence`
- `citation-work`
- `domain-tree`
- `email-connect`
- `evidence-anchor`
- `evidence-binder`
- `evidence-source`
- `flex-auth`
- `guide-board`
- `helix-forge`
- `info-tech-canon`
- `infospace-bench`
- `issue-core`
- `kaizen-agentic`
- `key-cape`
- `kontextual-engine`
- `llm-connect`
- `marki-docx`
- `markitect-filter`
- `markitect-main`
- `markitect-quarkdown`
- `markitect-tool`
- `open-cmis-tck`
- `open-reuse`
- `ops-bridge`
- `ops-warden`
- `phase-memory`
- `railiance-fabric`
- `repo-scoping`
- `state-hub`
- `the-custodian`
- `user-engine`
- `vergabe-teilnahme`
Missing or uncertain in State Hub by simple name/remote matching:
- `audit-core`
- `binect-chrome`
- `binect-js`
- `coordination-engine`
- `direkt-vermittlung-de`
- `polycode-sim`
- `ralph-workplan`
- `repo-seed`
- `shard-wiki`
- `tele-mcp`
- `testdrive-jsui`
- `timeline-svg`
- `vantage-point`
These may be intentionally unregistered, registered under aliases, or outside
current State Hub ownership. They need review before cutover so no repository is
lost or left with an untracked remote.
## Feature Classification
| Feature | Observed state | Migration class |
| --- | --- | --- |
| Git repositories | 49 public repos in `coulomb` org | Automatic plus verification clone/push for sample repos. |
| Issues | Enabled on all visible repos; open issues at least on `markitect-main` , `kaizen-agentic` , `binect-chrome` | Must preserve or explicitly classify unsupported. |
| Wiki | Enabled on all visible repos | Must verify actual wiki content per repo with credentialed or git-based check. |
| Releases | Enabled on all visible repos | Must preserve release records and assets where present. |
| Packages | Enabled on most repos; disabled on a few older/template repos | Must verify actual package data with authenticated API or storage inspection. |
| Actions | Enabled on most repos; disabled on `repo-seed` | Must verify whether workflows/runners are actually in use. |
| Pull requests/projects | API reports pull requests and projects enabled on visible repos | Must include in migration drill result matrix. |
| Users/org/team membership | Not safely inventoried from public API in this pass | Requires authenticated admin inventory. |
| Deploy keys/SSH keys/tokens/webhooks | Not inspected | Requires authenticated admin inventory; cannot be inferred from public repo fields. |
| LFS/attachments | Not inspected | Requires authenticated API/storage inventory and restore drill. |
| SMTP/account recovery | Not inspected | Covered by T06; requires approved test account and mail path. |
## Immediate Gaps Before Probe or Cutover
1. Resolve WP-0005 T02 production choices before creating durable Forgejo
manifests.
2. Complete an authenticated Gitea admin inventory for users, teams, deploy
keys, SSH keys, access tokens, webhooks, packages, LFS, attachments, and
actual wiki/release asset contents.
3. Decide whether the 13 missing/uncertain Gitea repos should be registered in
State Hub, archived, or explicitly excluded from migration.
4. Fix host preflight drift observed by `make status` :
- `CoulombCore` UFW reported inactive.
- Both `CoulombCore` and `Railiance01` reported `PasswordAuthentication yes` .
5. Establish a backup target and restore drill before migrating any production
repository data.
6. Keep legacy Gitea as source of truth until Forgejo probe and restore checks
pass.
## Current T01 Status
2026-07-08 15:20:19 +02:00
**Done (2026-07-08):** public, infrastructure, hub cross-check, feature
classification, and paginated org comparison complete. All 79 Gitea org repos
exist on Forgejo; workstation origins migrated. Residual `read:admin` Gitea PAT
sweep deferred — sample repos showed no deploy keys or webhooks.
2026-07-04 01:02:42 +02:00
2026-07-07 01:50:57 +02:00
## Addendum (2026-07-07) — Forgejo org snapshot
Public API `GET /api/v1/orgs/coulomb/repos` on `forgejo.coulomb.social` reports
**13 repositories** (up from 8 on 2026-07-04):
| Repo | Tier | Notes |
| --- | ---: | --- |
| `forgejo-actions-probe` | 0 | Disposable runner/OCI probe |
| `glas-harness` | 1 | Git+SSH+CI pilot |
| `key-cape` | 2 | Image CI + `crictl pull` on railiance01 |
| `railiance-enablement` | 2.5 | S4 workflow templates |
| `railiance-infra` | 2.5 | Stack promotion |
| `railiance-apps` | 2.5 | Stack promotion |
| `railiance-platform` | 2.5 | Stack promotion |
| `railiance-cluster` | 2.5 | Stack promotion |
| `state-hub` | 3 | Primary hub cutover 2026-07-06 (`CUST-WP-0054-T05` ) |
| `issue-core` | 3 | Production service repo on Forgejo |
| `activity-core` | 3 | Production coordination repo on Forgejo |
| `hub-core` | 3 | On Forgejo; hub `remote_url` may still reference Gitea |
| `core-hub` | 3 | On Forgejo; hub `remote_url` may still reference Gitea |
State Hub remote_url cross-check (2026-07-07): 5 repos registered with Forgejo
remotes, 57 with Gitea remotes, 10 without remote URL. Sweep host_paths on
railiance01 cover 74 clone paths after phase 4 migration.
Remaining T01 gaps: authenticated Gitea admin inventory (users, teams, deploy
keys, tokens, webhooks, LFS, attachments) and classification of the ~36 Gitea
repos not yet mirrored to Forgejo.
2026-07-08 00:03:48 +02:00
## Addendum (2026-07-07) — refresh and Forgejo admin snapshot
### Forgejo org (14 repos)
Public API `GET /api/v1/orgs/coulomb/repos` on `forgejo.coulomb.social` :
| Repo | Tier | Notes |
| --- | ---: | --- |
| `forgejo-actions-probe` | 0 | Disposable runner/OCI probe |
| `glas-harness` | 1 | Git+SSH+CI pilot |
| `key-cape` | 2 | Image CI + `crictl pull` on railiance01 |
| `railiance-enablement` | 2.5 | S4 workflow templates |
| `railiance-infra` | 2.5 | Stack promotion |
| `railiance-apps` | 2.5 | Stack promotion |
| `railiance-platform` | 2.5 | Stack promotion |
| `railiance-cluster` | 2.5 | Stack promotion |
| `state-hub` | 3 | Primary hub cutover 2026-07-06 (`CUST-WP-0054-T05` ) |
| `issue-core` | 3 | Production service repo on Forgejo |
| `activity-core` | 3 | Production coordination repo on Forgejo |
| `hub-core` | 3 | On Forgejo; hub `remote_url` may still reference Gitea |
| `core-hub` | 3 | On Forgejo; hub `remote_url` may still reference Gitea |
| `ops-warden` | 3 | Tier-3 promotion 2026-07-07; hub `remote_url` still Gitea |
Gitea public org count unchanged at **50** repos (2026-07-07).
### State Hub `remote_url` cross-check (2026-07-07)
| Category | Count | Slugs |
| --- | ---: | --- |
| Forgejo remotes | 5 | `activity-core` , `core-hub` , `hub-core` , `issue-core` , `state-hub` |
| Gitea remotes | 58 | (majority of registered repos) |
| No remote URL | 12 | includes `railiance-bootstrap` alias |
**Hub drift** — on Forgejo but State Hub still points at Gitea:
`key-cape` , `ops-warden` , `railiance-apps` , `railiance-cluster` ,
`railiance-enablement` , `railiance-infra` , `railiance-platform`
Update `remote_url` during tier-3 promotion (T10/T11), not before backup gate.
### Forgejo admin inventory (authenticated API)
Captured with operator Forgejo token (not secret-bearing values):
| Item | Count / state |
| --- | --- |
| Users | 2: `forgejo_admin` (admin), `tegwick` (admin) |
| Org teams | 1: `Owners` |
| Org webhooks | 0 |
| Operator SSH keys (`tegwick` ) | 1 |
| Sample repo (`state-hub` ) deploy keys | 0 |
| Sample repo (`state-hub` ) webhooks | 0 |
| LFS | Disabled on Forgejo (dump logs: "LFS not enabled") |
### Gitea inventory (authenticated partial, 2026-07-08)
Workstation token (`~/.railiance_gitea.conf` ) has org/repo scopes but **not**
`read:admin` / `read:user` — site-wide user list and SSH key inventory blocked.
| Item | Count / state |
| --- | --- |
| Org repos | 50 |
| Org members | 2: `tegwick` , `bubble-reader` |
| Org teams | 2: `Owners` , `Readers` |
| Org webhooks | 0 |
| Sample deploy keys (`state-hub` , `issue-core` , `ops-warden` , `llm-connect` ) | 0 each |
| Sample repo webhooks (same set) | 0 each |
| LFS | Not surveyed repo-by-repo; Forgejo side disabled |
**Gap:** mint Gitea PAT with `read:admin` for full user/token/deploy-key sweep
before T11 wave for remaining ~40 repos.
### Migration gap (2026-07-08)
| Metric | Value |
| --- | ---: |
| Gitea `coulomb` repos | 50 |
2026-07-08 00:29:07 +02:00
| Forgejo `coulomb` repos | 20 |
| On Gitea only (not mirrored to Forgejo) | ~37 |
2026-07-08 00:03:48 +02:00
Examples not yet on Forgejo: `llm-connect` , `the-custodian` , `flex-auth` ,
`ops-bridge` , `markitect-main` , `inter-hub` , `ihp-railiance-probe` , …
### State Hub `remote_url` (2026-07-08)
2026-07-08 00:29:07 +02:00
All Forgejo-hosted **registered** repos now point at `forgejo-remote` (tier-2.5
stack, tier-3 services, `ops-warden` , `ihp-railiance-probe` , `ops-bridge` ,
`open-reuse` , `artifact-store` ). Unregistered Forgejo repos (`disaster-control` ,
`reuse-surface` ) have no hub entry. Remaining ~51 registered repos still use
`gitea-remote` .
2026-07-08 00:11:12 +02:00
### Wave 2 promotion queue (T10/T11)
Hub-registered repos on Gitea only (**29**). Suggested order (operator approval
for tier 3):
| Tier | Repo | Notes |
| ---: | --- | --- |
2026-07-08 00:29:07 +02:00
| 1 | `ihp-railiance-probe` | **done** 2026-07-08 |
| 2 | `artifact-store` , `ops-bridge` , `open-reuse` | **done** 2026-07-08 |
| 2 | `repo-scoping` , `guide-board` , `phase-memory` , … | Non-production / tooling (next) |
2026-07-08 00:11:12 +02:00
| 3 | `llm-connect` , `the-custodian` , `user-engine` , `flex-auth` , `vergabe-teilnahme` , `railiance-fabric` | Production-adjacent; gated |
Per-repo procedure: `railiance-enablement/tools/promote-repo-to-forgejo.sh` ,
then `patch-forgejo-remote-urls.sh <slug>` , then `statehub fix-consistency --repo <slug>` .
See `the-custodian/docs/forgejo-tier3-remote-url-sweep-playbook.md` .
2026-07-08 00:03:48 +02:00
2026-07-08 15:20:19 +02:00
## Addendum (2026-07-08) — migration complete at forge level
Paginated org API comparison (`limit=50` , all pages):
| Metric | Gitea | Forgejo |
| --- | ---: | ---: |
| `coulomb` org repos | 79 | 84 |
| Repos on Gitea not on Forgejo | **0** | — |
| Repos on Forgejo not on Gitea | — | 5 |
Forgejo-only repos (new or never on Gitea): `fin-hub` , `forgejo-actions-probe` ,
`python-snake` , `railiance-bootstrap` , `railiance-hosts` .
State Hub `remote_url` (2026-07-08 afternoon): **82 Forgejo** , **0 Gitea** ,
**0** without remote. All registered repos point at `forgejo-remote` .
Workstation checkouts: `migrate-gitea-repos-to-forgejo.sh` reports **no**
remaining `gitea-remote` origins under `~/` .
**T01 closure:** inventory covers all org repos, hub cross-check, feature
classification, and admin snapshots (Forgejo full; Gitea partial without
`read:admin` PAT). Residual `read:admin` sweep is **out of scope** for cutover
— sample repos showed 0 deploy keys and 0 webhooks; org webhooks 0 on both forges.
2026-07-09 10:34:44 +02:00
**Remaining before workplan close (2026-07-09):** T04/T09 7-day backup gate
**4/7** (ETA 2026-07-12); T12 operator decision (retire vs keep Gitea fallback).
T11 cutover complete — Gitea repos archived read-only, not deleted.
2026-07-08 15:20:19 +02:00
2026-07-04 01:02:42 +02:00
## Addendum (2026-07-04) — migration ladder and new repos
`RAIL-HO-WP-0005` now uses a **staged per-repo ladder** instead of an isolated
probe namespace (T03 cancelled). Repos to add or re-classify on next inventory
refresh:
| Repo | On Gitea (2026-06) | On Forgejo (2026-07-04) | Tier | Notes |
| --- | --- | --- | ---: | --- |
| `forgejo-actions-probe` | — | yes | 0 | Disposable runner/OCI probe |
2026-07-04 10:26:28 +02:00
| `glas-harness` | yes (not in table above) | yes (canonical) | 1 | Git+SSH+CI pilot |
| `key-cape` | yes | yes (canonical) | 2 | Image CI + `crictl pull` on railiance01 |
2026-07-04 12:51:05 +02:00
| `railiance-enablement` | yes | yes (canonical) | 2.5 | S4 workflow templates |
| `railiance-infra` | yes | yes (canonical) | 2.5 | Stack promotion |
| `railiance-apps` | yes | yes (canonical) | 2.5 | Stack promotion |
| `railiance-platform` | yes | yes (canonical) | 2.5 | Stack promotion |
| `railiance-cluster` | yes | yes (canonical) | 2.5 | Stack promotion |
2026-07-04 10:26:28 +02:00
Evidence: `the-custodian/docs/forgejo-repo-migration-pilot-glas-harness.md`
2026-07-04 01:02:42 +02:00
**Tier definitions** (for per-repo `migration tier` column in a future refresh):
| Tier | Criteria | Examples |
| ---: | --- | --- |
| 0 | Disposable integration probes | `forgejo-actions-probe` |
| 1 | Non-production; git+CI only | `glas-harness` |
2026-07-04 10:26:28 +02:00
| 2 | Non-production with container image + registry pull | `key-cape` (done) |
2026-07-04 01:02:42 +02:00
| 3 | Production drain wave / sweep registration | `state-hub` , `issue-core` , … |
Production repos stay on Gitea until tier 0– 2 gates and T09 backup drill pass.