Update WP-0005: T07 done, tier-2.5 hub remote_url patched

Mark package registry task complete after npm probe; document hub drift
resolution for six tier-2.5 repos and current backup gate status.

workplans/RAIL-HO-WP-0005-forgejo-production-migration.md

@@ -8,7 +8,7 @@ status: active
 owner: railiance
 topic_slug: railiance
 created: "2026-05-03"
-updated: "2026-07-10"
+updated: "2026-07-08"
 state_hub_workstream_id: "84e17675-0d15-4268-a8bd-540124d37018"
 ---
 
@@ -165,10 +165,11 @@ Minimum inventory:
 Forgejo before cutover and classifies each migration item as automatic,
 manual, unsupported, or explicitly out of scope.
 
-**Gap (2026-07-07):** Forgejo org snapshot and tier column added in inventory
-addendum (13 repos on Forgejo; 49 on Gitea per 2026-06 pass). Authenticated
-Gitea admin inventory (users, teams, deploy keys, tokens, webhooks, LFS) still
-pending before T11 wave for remaining production repos.
+**Gap (2026-07-07):** Forgejo org snapshot refreshed (14 repos; `ops-warden` tier-3).
+Forgejo admin inventory captured (2 users, 1 team, 0 org hooks). Authenticated
+**Gitea** admin inventory (users, teams, deploy keys, tokens, webhooks, LFS)
+still blocked — no Gitea admin PAT on workstation. Hub drift: 7 Forgejo repos
+still register Gitea `remote_url` in State Hub.
 
 ---
 
@@ -248,12 +249,14 @@ Minimum scope:
   packages, Actions artifacts, and logs.
 - Restore runbook for database and blob/package data.
 
-**Partial (2026-07-04):** `forgejo-db` CNPG cluster healthy on railiance01
-(`make forgejo-db-status` → Cluster in healthy state). SOPS secret path and
-network policies in `railiance-platform`. **Backup target decided (Option A, Nextcloud).** **Automation (2026-07-10):**
-`railiance-platform` `make forgejo-backup` / `docs/forgejo-backup.md` — daily
-`forgejo dump` + `pg_dump` → age → Nextcloud `forgejo/`. Remaining: operator
-cron on workstation, 7-day success gate, restore drill from Nextcloud artifact.
+**Partial (2026-07-07):** `forgejo-db` CNPG cluster healthy on railiance01.
+SOPS secret path and network policies in `railiance-platform`. **Backup target
+decided (Option A, Nextcloud).** **Automation:** `railiance-platform`
+`make forgejo-backup` / `docs/forgejo-backup.md` — daily `forgejo dump` +
+`pg_dump` → age → Nextcloud `forgejo/`. **First production backup succeeded
+2026-07-07** (~686M dump + 2.1M pg_dump uploaded). Daily cron installed
+(02:15 UTC). Remaining: 7-day success gate (1/7), restore drill from Nextcloud
+artifact (not `/tmp/forgejo-drill/`).
 
 **Done when:** platform dependencies can be deployed and restored without the
 Forgejo app running.
@@ -264,7 +267,7 @@ Forgejo app running.
 
 ```task
 id: RAIL-HO-WP-0005-T05
-status: progress
+status: done
 priority: high
 state_hub_task_id: "11540ba4-d31c-4f64-836b-c6de69107aa4"
 ```
@@ -280,11 +283,15 @@ Minimum scope:
 - Health/status targets in the Makefile.
 - Migration-safe configuration for coexistence with Gitea during the cutover.
 
-**Partial (2026-07-04):** `railiance-apps` deploy live — HTTPS smoke pass,
+**Partial (2026-07-07):** `railiance-apps` deploy live — HTTPS smoke pass,
 ingress + TLS, SSH NodePort `30022`, Actions enabled, `coulomb` org,
-`railiance01-build-01` runner (ADR-004). Git push/pull via HTTPS and
-`forgejo-remote` SSH proven. Remaining: SOPS hardening for all secrets,
-operator user accounts beyond `forgejo_admin`.
+in-cluster runner (ADR-004). Git push/pull via HTTPS and `forgejo-remote` SSH
+proven as operator `tegwick` (not `forgejo_admin`). Mailer via OpenBao/ESO.
+`make forgejo-verify` T05 acceptance: **10 pass / 0 fail** (2026-07-07).
+`make forgejo-operator-bootstrap` idempotent. Security: `INSTALL_LOCK`,
+`COOKIE_SECURE`, `DISABLE_REGISTRATION`. Runner registration SOPS captured
+2026-07-08 (`helm/forgejo-runner-registration.sops.yaml`; `make
+forgejo-secrets-check` pass).
 
 **Done when:** Forgejo runs on railiance01 against production platform
 services and can serve login, git clone/push, package registry, and admin
@@ -331,7 +338,7 @@ edits, and the operator has a documented emergency path.
 
 ```task
 id: RAIL-HO-WP-0005-T07
-status: todo
+status: done
 priority: high
 state_hub_task_id: "9578f672-e2b8-43a3-8419-5f86f8871326"
 ```
@@ -355,12 +362,12 @@ Acceptance:
 - Retention and cleanup expectations are documented.
 - Package data is included in backup and restore drills.
 
-**Partial (2026-07-07):** OCI registry live (`/v2/` auth challenge). Tier-0/2
-images built and pulled on railiance01: `forgejo-actions-probe`, `key-cape`
-(`crictl pull forgejo.coulomb.social/coulomb/key-cape:latest` succeeded).
-Tier-3 `state-hub` images built and deployed (`main-f9f0091`, `latest` on
-railiance01, 2026-07-06). Remaining: **npm** publish/pull hardening, retention
-docs for all enabled types; include full package tree in scheduled backups (T09).
+**Partial (2026-07-08):** OCI registry live (`/v2/` auth challenge). Tier-0/2
+images built and pulled on railiance01. Tier-3 `state-hub` images proven.
+**npm (2026-07-08):** `@coulomb/forgejo-npm-probe@0.0.1` publish + install
+verified; `make forgejo-npm-smoke`; docs `railiance-apps/docs/forgejo-package-registry.md`;
+CI template `railiance-enablement/workflows/npm-publish.yaml`. Retention documented;
+package tree included in scheduled `forgejo dump` (T09).
 
 **Done when:** tier-2 gate is fully satisfied (✓) and tier-3 production images
 follow the same pattern after explicit approval. **Tier-2 gate met; tier-3
@@ -443,11 +450,11 @@ Acceptance:
 post-restore API checks: health 200, `coulomb/glas-harness` and
 `coulomb/key-cape` on `main`, 3 org repos visible. Evidence:
 `docs/forgejo-restore-drill-evidence.md`. Assets: `infra/forgejo-restore-drill/`,
-`tools/forgejo-restore-drill.sh`. **Target decided (T02 Option A).** **Tooling (2026-07-10):** `railiance-platform`
-`tools/cmd/forgejo-backup` + Makefile targets (`forgejo-backup`,
-`forgejo-backup-dry-run`, `forgejo-backup-status`). Verified dump stream ~670M
-(13 repos). Remaining: install daily cron, 7 consecutive successes, quarterly
-restore drill from Nextcloud download (not `/tmp/forgejo-drill/`).
+`tools/forgejo-restore-drill.sh`. **Target decided (T02 Option A).** **Tooling (2026-07-07):** `railiance-platform` `tools/cmd/forgejo-backup` +
+Makefile targets. Fixed websocket EOF on large dumps (use `kubectl cp` after
+in-pod dump). **First scheduled-path backup:** 20260707T180844Z (~686M, 14 repos).
+Daily cron installed (02:15 UTC). Remaining: 7 consecutive successes (1/7),
+quarterly restore drill from Nextcloud download (not `/tmp/forgejo-drill/`).
 
 **Done when:** a fresh backup restores to a working isolated Forgejo instance
 with repository, package, and user recovery checks passing **and** scheduled
@@ -496,12 +503,16 @@ tier 2.5 section.
 rewire, sweep checkout migration on railiance01); phase 5 stabilization window
 open through 2026-07-09. Evidence:
 `the-custodian/docs/state-hub-railiance01-cutover-phase{1,2,4,5}-2026-07-06.md`.
-Forgejo also hosts `issue-core`, `activity-core`, `hub-core`, `core-hub` (13
-org repos total as of 2026-07-07).
+Forgejo also hosts `issue-core`, `activity-core`, `hub-core`, `core-hub`,
+`ops-warden` (14 org repos as of 2026-07-07).
+
+**Hub drift (2026-07-08):** tier-2.5 `remote_url` patched for 6 registered repos
+(`patch-forgejo-remote-urls.sh --tier-25`). Hub: 11 Forgejo / 52 Gitea remotes.
+`ops-warden` tier-3 on Forgejo — hub patch deferred pending operator approval.
 
 **Remaining:** tier-3 promotion for remaining production repos; scheduled
-backups gate still open (disaster-control); stabilization closeout + operator
-signoff before coulombcore teardown.
+backups 7-day gate (1/7); stabilization closeout + operator signoff before
+coulombcore teardown.
 
 **Done when:** tiers 0–2 pass with written result matrices and no unknown
 critical migration gaps remain for production repos. **Tiers 0–2.5: met.**
@@ -583,14 +594,12 @@ T05+T08 ──► T10 migration ladder ──► T11 production cutover ──
 T03 isolated probe: CANCELLED (superseded by T05 + in-production pilots)
 ```
 
-**Current focus (2026-07-07):** T08 **done**; T10 tiers 0–2.5 **complete**, tier-3
-`state-hub` cutover **in progress** (phase 5 stabilization). T09 restore drill
-**passed**; backup target decided (Option A); T02 **done** (all design decisions).
-Scheduled backup automation still open (T04/T09). Next: tier-3 staged promotions
-(T10/T11) after backup 7-day gate. T11 partial: `state-hub` primary
-on railiance01; ~57 State Hub repos still point at Gitea remotes.
-Do not retire coulombcore `state-hub` until phase 5 closeout and operator
-signoff (`CUST-WP-0054-T05`).
+**Current focus (2026-07-08):** T05/T06/T07/T08 **done**; T10 tiers 0–2.5 **complete**
+(tier-2.5 hub `remote_url` patched). Tier-3 `state-hub` stabilization; backup
+7-day gate **1/7**. Next: backup gate completion, Nextcloud restore drill (T09),
+tier-3 promotions with operator approval (T10/T11). `ops-warden` hub patch
+pending approval. Do not retire coulombcore `state-hub` until phase 5 closeout
+(`CUST-WP-0054-T05`).
 
 **Absorbed by `CUST-WP-0054-T04`:** forge + CI on railiance01; workstation
 build retirement; staged repo promotion before State Hub primary move (T05).