WP-0005 T04/T09: note forgejo-backup automation in railiance-platform

Makefile targets and operator doc landed; cron and 7-day gate remain.

docs/forgejo-restore-drill-evidence.md

@@ -70,8 +70,8 @@ Script exit marker: `restore-drill-complete`
   (`kubectl cnpg` plugin absent on workstation).
 - **Encryption at rest:** dump stored locally on workstation for drill only; no
   approved backup target wired.
-- **Automation:** `forgejo dump` is manual; T04/T09 still need cron/operator
+- **Automation:** use `railiance-platform` `make forgejo-backup` (see
-  schedule and retention policy (T02 decision).
+  `docs/forgejo-backup.md`); operator cron still required for daily schedule.
 - **Re-run hygiene:** concurrent or repeat runs require `DRILL_CLEAN=1` to wipe
   `forgejo-restore-drill` before import (SQL import is not idempotent).
 

workplans/RAIL-HO-WP-0005-forgejo-production-migration.md

@@ -8,7 +8,7 @@ status: active
 owner: railiance
 topic_slug: railiance
 created: "2026-05-03"
-updated: "2026-07-09"
+updated: "2026-07-10"
 state_hub_workstream_id: "84e17675-0d15-4268-a8bd-540124d37018"
 ---
 
@@ -231,7 +231,7 @@ T10 (repo migration drill).
 
 ```task
 id: RAIL-HO-WP-0005-T04
-status: todo
+status: progress
 priority: high
 state_hub_task_id: "28b351fe-bfbe-4a8b-bbfa-1b148e69f8e0"
 ```
@@ -250,9 +250,10 @@ Minimum scope:
 
 **Partial (2026-07-04):** `forgejo-db` CNPG cluster healthy on railiance01
 (`make forgejo-db-status` → Cluster in healthy state). SOPS secret path and
-network policies in `railiance-platform`. **Backup target decided (Option A,
+network policies in `railiance-platform`. **Backup target decided (Option A, Nextcloud).** **Automation (2026-07-10):**
-Nextcloud).** Remaining: implement scheduled `forgejo-backup` + `pg_dump` upload
+`railiance-platform` `make forgejo-backup` / `docs/forgejo-backup.md` — daily
-in `railiance-platform`; blob restore drill from automated artifact (T09).
+`forgejo dump` + `pg_dump` → age → Nextcloud `forgejo/`. Remaining: operator
+cron on workstation, 7-day success gate, restore drill from Nextcloud artifact.
 
 **Done when:** platform dependencies can be deployed and restored without the
 Forgejo app running.
@@ -442,10 +443,11 @@ Acceptance:
 post-restore API checks: health 200, `coulomb/glas-harness` and
 `coulomb/key-cape` on `main`, 3 org repos visible. Evidence:
 `docs/forgejo-restore-drill-evidence.md`. Assets: `infra/forgejo-restore-drill/`,
-`tools/forgejo-restore-drill.sh`. **Target decided (T02 Option A: Nextcloud +
+`tools/forgejo-restore-drill.sh`. **Target decided (T02 Option A).** **Tooling (2026-07-10):** `railiance-platform`
-age).** Remaining: daily cron (`forgejo dump` + `pg_dump`), upload, retention
+`tools/cmd/forgejo-backup` + Makefile targets (`forgejo-backup`,
-prune, 7-day success gate before tier-3 promotions; quarterly restore drill
+`forgejo-backup-dry-run`, `forgejo-backup-status`). Verified dump stream ~670M
-from Nextcloud artifact.
+(13 repos). Remaining: install daily cron, 7 consecutive successes, quarterly
+restore drill from Nextcloud download (not `/tmp/forgejo-drill/`).
 
 **Done when:** a fresh backup restores to a working isolated Forgejo instance
 with repository, package, and user recovery checks passing **and** scheduled