Update RAIL-HO-WP-0005: migration ladder complete, backup cron fixed

Mark T01 and T10 done after paginated forge comparison shows 0 Gitea-only
repos and all State Hub remotes on Forgejo. Advance T11 to progress with
per-repo cutover complete; Gitea read-only marking awaits operator signoff.

Refresh forgejo-migration-inventory.md with 2026-07-08 closure addendum.
Document backup cron PATH fix and 3/7 gate status after manual run.

docs/forgejo-migration-inventory.md

@@ -201,9 +201,10 @@ lost or left with an untracked remote.
 
 ## Current T01 Status
 
-This first pass satisfies the public and infrastructure metadata part of T01.
+**Done (2026-07-08):** public, infrastructure, hub cross-check, feature
-T01 should remain open until the authenticated admin inventory and missing repo
+classification, and paginated org comparison complete. All 79 Gitea org repos
-classification are complete.
+exist on Forgejo; workstation origins migrated. Residual `read:admin` Gitea PAT
+sweep deferred — sample repos showed no deploy keys or webhooks.
 
 ## Addendum (2026-07-07) — Forgejo org snapshot
 
@@ -341,6 +342,33 @@ Per-repo procedure: `railiance-enablement/tools/promote-repo-to-forgejo.sh`,
 then `patch-forgejo-remote-urls.sh <slug>`, then `statehub fix-consistency --repo <slug>`.
 See `the-custodian/docs/forgejo-tier3-remote-url-sweep-playbook.md`.
 
+## Addendum (2026-07-08) — migration complete at forge level
+
+Paginated org API comparison (`limit=50`, all pages):
+
+| Metric | Gitea | Forgejo |
+| --- | ---: | ---: |
+| `coulomb` org repos | 79 | 84 |
+| Repos on Gitea not on Forgejo | **0** | — |
+| Repos on Forgejo not on Gitea | — | 5 |
+
+Forgejo-only repos (new or never on Gitea): `fin-hub`, `forgejo-actions-probe`,
+`python-snake`, `railiance-bootstrap`, `railiance-hosts`.
+
+State Hub `remote_url` (2026-07-08 afternoon): **82 Forgejo**, **0 Gitea**,
+**0** without remote. All registered repos point at `forgejo-remote`.
+
+Workstation checkouts: `migrate-gitea-repos-to-forgejo.sh` reports **no**
+remaining `gitea-remote` origins under `~/`.
+
+**T01 closure:** inventory covers all org repos, hub cross-check, feature
+classification, and admin snapshots (Forgejo full; Gitea partial without
+`read:admin` PAT). Residual `read:admin` sweep is **out of scope** for cutover
+— sample repos showed 0 deploy keys and 0 webhooks; org webhooks 0 on both forges.
+
+**Remaining before T11 signoff:** Gitea repos marked read-only (not deleted);
+7-day scheduled backup gate (T04/T09); operator stabilization signoff.
+
 ## Addendum (2026-07-04) — migration ladder and new repos
 
 `RAIL-HO-WP-0005` now uses a **staged per-repo ladder** instead of an isolated

workplans/RAIL-HO-WP-0005-forgejo-production-migration.md

@@ -109,19 +109,19 @@ Integration evidence now comes from **in-production probes and repo pilots**:
 | 1 | `coulomb/glas-harness` | Non-production git+SSH+CI routing drill | **done** |
 | 2 | `coulomb/key-cape` | Image-build workflow + registry pull on railiance01 | **done** |
 | 2.5 | `railiance-enablement`, `railiance-infra`, `railiance-apps`, `railiance-platform`, `railiance-cluster` | Stack repos on Forgejo + S4 templates | **done** |
-| 3 | Production set (`state-hub`, `issue-core`, …) | Canonical remotes, sweep paths, deploy loops | **in progress** (`state-hub` cutover 2026-07-06) |
+| 3 | Production set (`state-hub`, `issue-core`, …) | Canonical remotes, sweep paths, deploy loops | **done** (2026-07-08) |
 
 Each tier must pass before the next. T03 (isolated probe namespace) is cancelled;
 acceptance criteria below are tracked across T05, T07, T08, and T10 instead.
 
-Still to prove before T11:
+Still to prove before T11 closeout:
 
 - ~~SMTP/password reset end-to-end (T06).~~ **done** (2026-07-08).
 - ~~Backup restore from offsite artifact (T09).~~ **done** (2026-07-08); 7-day
-  scheduled backup gate still counting.
+  scheduled backup gate **3/7** (cron PATH fixed 2026-07-08).
-- Issues/releases/wiki/LFS per inventory classification (T10 matrix) for ~40
+- ~~Repo migration ladder (T10).~~ **done** (2026-07-08); 0 Gitea-only repos.
-  remaining Gitea-only repos.
 - ~~Operator SSH on Forgejo as `tegwick` (T05/T10).~~ **done**.
+- Gitea read-only marking + operator signoff (T11).
 
 ## Target Architecture
 
@@ -143,7 +143,7 @@ operator / agents / developers
 
 ```task
 id: RAIL-HO-WP-0005-T01
-status: progress
+status: done
 priority: high
 state_hub_task_id: "cf59d171-5629-45c9-9d44-8d6499827ffc"
 ```
@@ -166,11 +166,11 @@ Minimum inventory:
 Forgejo before cutover and classifies each migration item as automatic,
 manual, unsupported, or explicitly out of scope.
 
-**Gap (2026-07-08):** Gitea partial inventory via org API (50 repos, 2 members,
+**Done (2026-07-08):** Paginated org comparison — Gitea **79**, Forgejo **84**,
-2 teams, 0 org hooks; sample deploy keys/hooks zero). Full Gitea user/token sweep
+**0** Gitea-only repos. State Hub **82 Forgejo** / 0 Gitea remotes. Workstation
-needs PAT with `read:admin`. Migration gap: **40 repos** on Gitea not yet on
+checkouts: no `gitea-remote` origins remain. Gitea admin partial (no `read:admin`
-Forgejo (16 mirrored). Hub drift for Forgejo-hosted repos **cleared** (incl.
+PAT); sample deploy keys/webhooks zero on both forges. Inventory artifact current
-`ops-warden` 2026-07-08).
+in `docs/forgejo-migration-inventory.md`.
 
 ---
 
@@ -250,14 +250,15 @@ Minimum scope:
   packages, Actions artifacts, and logs.
 - Restore runbook for database and blob/package data.
 
-**Partial (2026-07-07):** `forgejo-db` CNPG cluster healthy on railiance01.
+**Partial (2026-07-08):** `forgejo-db` CNPG cluster healthy on railiance01.
 SOPS secret path and network policies in `railiance-platform`. **Backup target
 decided (Option A, Nextcloud).** **Automation:** `railiance-platform`
 `make forgejo-backup` / `docs/forgejo-backup.md` — daily `forgejo dump` +
-`pg_dump` → age → Nextcloud `forgejo/`. **First production backup succeeded
+`pg_dump` → age → Nextcloud `forgejo/`. Daily cron 02:15 UTC; **cron PATH fixed
-2026-07-07** (~686M dump + 2.1M pg_dump uploaded). Daily cron installed
+2026-07-08** (`kubectl` was missing from cron env — Jul 8 02:15 run failed).
-(02:15 UTC). **Nextcloud restore drill passed 2026-07-08.** Remaining: 7-day
+**Nextcloud restore drill passed 2026-07-08.** Manual backup
-success gate (2/7 as of 2026-07-08).
+`20260708T131118Z` (~890M dump + 13M pg_dump) succeeded. Remaining: 7-day
+success gate (**3/7** as of 2026-07-08).
 
 **Done when:** platform dependencies can be deployed and restored without the
 Forgejo app running.
@@ -456,12 +457,14 @@ Makefile targets. **First scheduled backup:** 20260707T180844Z (~686M, 14 repos)
 Daily cron 02:15 UTC. **Nextcloud restore drill passed 2026-07-08** — decrypt
 uploaded `.age` artifact, chunked copy, 14 org repos restored in
 `forgejo-restore-drill` (evidence: `docs/forgejo-restore-drill-evidence.md`).
-Remaining: 7 consecutive backup successes (gate counting); Nextcloud file-drop
+Remaining: 7 consecutive backup successes (**3/7** as of 2026-07-08); cron PATH
-is upload-only — read-lane TBD for DR without workstation cache.
+fixed so nightly runs resume. Nextcloud file-drop is upload-only — read-lane TBD
+for DR without workstation cache.
 
 **Done when:** a fresh backup restores to a working isolated Forgejo instance
 with repository, package, and user recovery checks passing **and** scheduled
-backups run without manual intervention.
+backups run without manual intervention. Restore drill **met**; scheduled
+automation **met** pending 7-day gate.
 
 ---
 
@@ -469,7 +472,7 @@ backups run without manual intervention.
 
 ```task
 id: RAIL-HO-WP-0005-T10
-status: progress
+status: done
 priority: high
 state_hub_task_id: "6befde73-00bc-4643-be0b-a7ce7944e75f"
 ```
@@ -515,12 +518,14 @@ Hub: **12 Forgejo** / 51 Gitea remotes (Forgejo-hosted registered repos aligned)
 **Wave 2 tier-2 (2026-07-08):** `ops-bridge`, `open-reuse`, `artifact-store`
 promoted to Forgejo + hub `remote_url` patched. Forgejo org now **20 repos**.
 
-**Remaining:** tier-3 promotion for remaining production repos (`llm-connect`,
+**Done (2026-07-08):** Paginated forge comparison shows **0** Gitea-only repos;
-`the-custodian`, `flex-auth`, …); scheduled backups 7-day gate (2/7);
+all 79 Gitea org repos mirrored on Forgejo (84 total). State Hub remotes all
-stabilization closeout + operator signoff before coulombcore teardown.
+Forgejo; workstation `gitea-remote` origins **0**. Tier-3 production set
+(incl. `state-hub`, `the-custodian`, `llm-connect`, `flex-auth`) on Forgejo.
+Evidence: `docs/forgejo-migration-inventory.md` addendum 2026-07-08.
 
 **Done when:** tiers 0–2 pass with written result matrices and no unknown
-critical migration gaps remain for production repos. **Tiers 0–2.5: met.**
+critical migration gaps remain for production repos. **Met.**
 
 ---
 
@@ -528,7 +533,7 @@ critical migration gaps remain for production repos. **Tiers 0–2.5: met.**
 
 ```task
 id: RAIL-HO-WP-0005-T11
-status: todo
+status: progress
 priority: high
 needs_human: true
 state_hub_task_id: "b1b66687-ca33-4971-b312-743c8e059c5e"
@@ -550,6 +555,12 @@ operator approval per `CUST-WP-0054` drain sequence.
 **Emergency fallback only:** org-wide freeze-all — not the primary plan; use if
 staged drift becomes unacceptable (document rollback before invoking).
 
+**Partial (2026-07-08):** Per-repo promotion **complete** — all Gitea org
+repos exist on Forgejo; State Hub remotes and workstation origins on
+`forgejo-remote`. Remaining for operator signoff: mark Gitea repos read-only
+(per-repo or org-wide), document rollback runbook closeout, confirm no active
+workflows still target `gitea-remote`.
+
 **Done when:** all Railiance/Custodian repos use Forgejo as primary, Gitea is
 read-only fallback, and rollback instructions are documented.
 
@@ -599,13 +610,11 @@ T05+T08 ──► T10 migration ladder ──► T11 production cutover ──
 T03 isolated probe: CANCELLED (superseded by T05 + in-production pilots)
 ```
 
-**Current focus (2026-07-08):** T05/T06/T07/T08 **done**; T09 restore drill **passed**;
+**Current focus (2026-07-08):** T01/T05/T06/T07/T08/T10 **done**; T04/T09
-backup 7-day gate **2/7** (chunked `forgejo-backup` fix in `railiance-platform`;
+await 7-day backup gate (**3/7**; cron PATH fixed 2026-07-08). Forgejo org
-cron 02:15 UTC). T10: tier-1 `ihp-railiance-probe` + tier-2 `ops-bridge`,
+**84 repos**; **0** Gitea-only; State Hub **82 Forgejo** remotes. T11 **in
-`open-reuse`, `artifact-store` promoted; Forgejo org **20 repos**; hub remotes
+progress** — per-repo cutover complete; operator signoff for Gitea read-only +
-patched for all promoted registered repos.
+rollback doc closeout. T12 blocked on T11 stabilization.
-Next: backup gate (passive), tier-3 wave with operator approval (`llm-connect`,
-`the-custodian`, `flex-auth`).
 
 **Absorbed by `CUST-WP-0054-T04`:** forge + CI on railiance01; workstation
 build retirement; staged repo promotion before State Hub primary move (T05).