Advance WP-0005 T01/T10: Gitea inventory and hub drift cleared

Record partial Gitea org inventory, 40-repo migration gap, and patch
ops-warden hub remote_url so all Forgejo-hosted registrations align.

docs/forgejo-migration-inventory.md

@@ -234,6 +234,95 @@ Remaining T01 gaps: authenticated Gitea admin inventory (users, teams, deploy
 keys, tokens, webhooks, LFS, attachments) and classification of the ~36 Gitea
 repos not yet mirrored to Forgejo.
 
+## Addendum (2026-07-07) — refresh and Forgejo admin snapshot
+
+### Forgejo org (14 repos)
+
+Public API `GET /api/v1/orgs/coulomb/repos` on `forgejo.coulomb.social`:
+
+| Repo | Tier | Notes |
+| --- | ---: | --- |
+| `forgejo-actions-probe` | 0 | Disposable runner/OCI probe |
+| `glas-harness` | 1 | Git+SSH+CI pilot |
+| `key-cape` | 2 | Image CI + `crictl pull` on railiance01 |
+| `railiance-enablement` | 2.5 | S4 workflow templates |
+| `railiance-infra` | 2.5 | Stack promotion |
+| `railiance-apps` | 2.5 | Stack promotion |
+| `railiance-platform` | 2.5 | Stack promotion |
+| `railiance-cluster` | 2.5 | Stack promotion |
+| `state-hub` | 3 | Primary hub cutover 2026-07-06 (`CUST-WP-0054-T05`) |
+| `issue-core` | 3 | Production service repo on Forgejo |
+| `activity-core` | 3 | Production coordination repo on Forgejo |
+| `hub-core` | 3 | On Forgejo; hub `remote_url` may still reference Gitea |
+| `core-hub` | 3 | On Forgejo; hub `remote_url` may still reference Gitea |
+| `ops-warden` | 3 | Tier-3 promotion 2026-07-07; hub `remote_url` still Gitea |
+
+Gitea public org count unchanged at **50** repos (2026-07-07).
+
+### State Hub `remote_url` cross-check (2026-07-07)
+
+| Category | Count | Slugs |
+| --- | ---: | --- |
+| Forgejo remotes | 5 | `activity-core`, `core-hub`, `hub-core`, `issue-core`, `state-hub` |
+| Gitea remotes | 58 | (majority of registered repos) |
+| No remote URL | 12 | includes `railiance-bootstrap` alias |
+
+**Hub drift** — on Forgejo but State Hub still points at Gitea:
+
+`key-cape`, `ops-warden`, `railiance-apps`, `railiance-cluster`,
+`railiance-enablement`, `railiance-infra`, `railiance-platform`
+
+Update `remote_url` during tier-3 promotion (T10/T11), not before backup gate.
+
+### Forgejo admin inventory (authenticated API)
+
+Captured with operator Forgejo token (not secret-bearing values):
+
+| Item | Count / state |
+| --- | --- |
+| Users | 2: `forgejo_admin` (admin), `tegwick` (admin) |
+| Org teams | 1: `Owners` |
+| Org webhooks | 0 |
+| Operator SSH keys (`tegwick`) | 1 |
+| Sample repo (`state-hub`) deploy keys | 0 |
+| Sample repo (`state-hub`) webhooks | 0 |
+| LFS | Disabled on Forgejo (dump logs: "LFS not enabled") |
+
+### Gitea inventory (authenticated partial, 2026-07-08)
+
+Workstation token (`~/.railiance_gitea.conf`) has org/repo scopes but **not**
+`read:admin` / `read:user` — site-wide user list and SSH key inventory blocked.
+
+| Item | Count / state |
+| --- | --- |
+| Org repos | 50 |
+| Org members | 2: `tegwick`, `bubble-reader` |
+| Org teams | 2: `Owners`, `Readers` |
+| Org webhooks | 0 |
+| Sample deploy keys (`state-hub`, `issue-core`, `ops-warden`, `llm-connect`) | 0 each |
+| Sample repo webhooks (same set) | 0 each |
+| LFS | Not surveyed repo-by-repo; Forgejo side disabled |
+
+**Gap:** mint Gitea PAT with `read:admin` for full user/token/deploy-key sweep
+before T11 wave for remaining ~40 repos.
+
+### Migration gap (2026-07-08)
+
+| Metric | Value |
+| --- | ---: |
+| Gitea `coulomb` repos | 50 |
+| Forgejo `coulomb` repos | 16 |
+| On Gitea only (not mirrored to Forgejo) | 40 |
+
+Examples not yet on Forgejo: `llm-connect`, `the-custodian`, `flex-auth`,
+`ops-bridge`, `markitect-main`, `inter-hub`, `ihp-railiance-probe`, …
+
+### State Hub `remote_url` (2026-07-08)
+
+All Forgejo-hosted registered repos now point at `forgejo-remote` (12 hub
+remotes including tier-2.5 stack, tier-3 services, `ops-warden`). Remaining
+52 registered repos still use `gitea-remote`.
+
 ## Addendum (2026-07-04) — migration ladder and new repos
 
 `RAIL-HO-WP-0005` now uses a **staged per-repo ladder** instead of an isolated

workplans/RAIL-HO-WP-0005-forgejo-production-migration.md

@@ -117,10 +117,11 @@ acceptance criteria below are tracked across T05, T07, T08, and T10 instead.
 Still to prove before T11:
 
 - ~~SMTP/password reset end-to-end (T06).~~ **done** (2026-07-08).
-- Backup and restore in isolated namespace (T09) — **drill passed 2026-07-04**;
+- ~~Backup restore from offsite artifact (T09).~~ **done** (2026-07-08); 7-day
-  scheduled automation pending.
+  scheduled backup gate still counting.
-- Issues/releases/wiki/LFS per inventory classification (T10 matrix).
+- Issues/releases/wiki/LFS per inventory classification (T10 matrix) for ~40
-- Operator SSH identity on Forgejo beyond interim `forgejo_admin` keys (T02/T10).
+  remaining Gitea-only repos.
+- ~~Operator SSH on Forgejo as `tegwick` (T05/T10).~~ **done**.
 
 ## Target Architecture
 
@@ -165,11 +166,11 @@ Minimum inventory:
 Forgejo before cutover and classifies each migration item as automatic,
 manual, unsupported, or explicitly out of scope.
 
-**Gap (2026-07-07):** Forgejo org snapshot refreshed (14 repos; `ops-warden` tier-3).
+**Gap (2026-07-08):** Gitea partial inventory via org API (50 repos, 2 members,
-Forgejo admin inventory captured (2 users, 1 team, 0 org hooks). Authenticated
+2 teams, 0 org hooks; sample deploy keys/hooks zero). Full Gitea user/token sweep
-**Gitea** admin inventory (users, teams, deploy keys, tokens, webhooks, LFS)
+needs PAT with `read:admin`. Migration gap: **40 repos** on Gitea not yet on
-still blocked — no Gitea admin PAT on workstation. Hub drift: 7 Forgejo repos
+Forgejo (16 mirrored). Hub drift for Forgejo-hosted repos **cleared** (incl.
-still register Gitea `remote_url` in State Hub.
+`ops-warden` 2026-07-08).
 
 ---
 
@@ -508,9 +509,8 @@ open through 2026-07-09. Evidence:
 Forgejo also hosts `issue-core`, `activity-core`, `hub-core`, `core-hub`,
 `ops-warden` (14 org repos as of 2026-07-07).
 
-**Hub drift (2026-07-08):** tier-2.5 `remote_url` patched for 6 registered repos
+**Hub drift (2026-07-08):** tier-2.5 + `ops-warden` `remote_url` patched.
-(`patch-forgejo-remote-urls.sh --tier-25`). Hub: 11 Forgejo / 52 Gitea remotes.
+Hub: **12 Forgejo** / 51 Gitea remotes (Forgejo-hosted registered repos aligned).
-`ops-warden` tier-3 on Forgejo — hub patch deferred pending operator approval.
 
 **Remaining:** tier-3 promotion for remaining production repos; scheduled
 backups 7-day gate (1/7); stabilization closeout + operator signoff before