Record T02 package scope decision (Option C) on WP-0005

OCI plus npm and generic at launch; PyPI/Go/Maven/Helm as inventory proves.
T07 scope updated; T02 backup and cutover decisions remain open.

workplans/RAIL-HO-WP-0005-forgejo-production-migration.md

@@ -8,7 +8,7 @@ status: active
 owner: railiance
 topic_slug: railiance
 created: "2026-05-03"
-updated: "2026-07-08"
+updated: "2026-07-09"
 state_hub_workstream_id: "84e17675-0d15-4268-a8bd-540124d37018"
 ---
 
@@ -64,8 +64,9 @@ change is made there.
    mailboxes (operator-provisioned domain/subdomains). Sender mailbox TBD
    (`forgejo@coulomb.social`); SPF/DKIM via IONOS zone. T06 SMTP delivery
    verified 2026-07-08.
-3. Package registry scope: container images only at first, or also generic,
-   npm, PyPI, Go, Maven, and Helm packages.
+3. ~~Package registry scope~~ **DECIDED 2026-07-08 (Option C):** OCI + **npm** +
+   generic at launch; PyPI, Go, Maven, Helm as inventory or consumer need proves.
+   Record: `the-custodian/docs/forgejo-production-decisions.md` § Package scope.
 4. ~~Actions runner model~~ **DECIDED 2026-07-03:** in-cluster long-lived runner
    Deployment with DinD sidecar on railiance01 (`ADR-004`). Interim coulombcore
    host runner retired after cutover.
@@ -181,19 +182,19 @@ state_hub_task_id: "f88115bf-4f99-49ef-a415-0b23750141b3"
 
 Decide the production choices listed in "Key Decisions to Confirm".
 
-**Partial (2026-07-07):** hostname, exposure, deployment pattern, live deploy,
-in-cluster runner model (`ADR-004`), and **SMTP provider (IONOS)** decided.
-Cutover mode **leaning** staged per-repo (glas-harness pilot). Remaining
-operator decisions: package scope beyond OCI,
-backup target, final cutover confirmation. See
+**Partial (2026-07-09):** hostname, exposure, deployment pattern, live deploy,
+in-cluster runner model (`ADR-004`), **SMTP (IONOS, T06 done)**, and **package
+scope (Option C: OCI + npm + generic)** decided. Cutover mode **leaning** staged
+per-repo (glas-harness pilot). Remaining operator decisions: backup target,
+final cutover confirmation. See
 `the-custodian/docs/forgejo-production-decisions.md`.
 
 Expected output:
 
 - A short decision record in this workplan or a dedicated ADR.
 - Hostname and exposure model. ✓ hostname; exposure follows railiance01 Traefik
-- SMTP provider and sender identity.
-- Package registry scope.
+- SMTP provider and sender identity. ✓
+- Package registry scope. ✓ Option C (OCI + npm + generic; others as needed)
 - Actions runner isolation model.
 - Backup target, retention, encryption, and restore cadence.
 - Cutover strategy and rollback window.
@@ -329,11 +330,15 @@ state_hub_task_id: "9578f672-e2b8-43a3-8419-5f86f8871326"
 
 Enable Forgejo packages for Railiance's near-term build and deployment needs.
 
+**Scope decided (T02, 2026-07-08):** Option C — multi-ecosystem registry.
+
 Initial package types:
 
-- Container registry for State Hub and future app images.
-- Generic packages for release artifacts.
-- Additional package types only after the inventory proves they are needed.
+- **OCI** container registry (proven; tier 0–3).
+- **npm** — launch requirement; publish/pull + CI template (T07).
+- **Generic** packages for release artifacts.
+- **PyPI, Go, Maven, Helm** — enable per repo when T01 inventory or consumer
+  need proves it; not a default big-bang.
 
 Acceptance:
 
@@ -346,8 +351,8 @@ Acceptance:
 images built and pulled on railiance01: `forgejo-actions-probe`, `key-cape`
 (`crictl pull forgejo.coulomb.social/coulomb/key-cape:latest` succeeded).
 Tier-3 `state-hub` images built and deployed (`main-f9f0091`, `latest` on
-railiance01, 2026-07-06). Remaining: document retention; include packages in
-scheduled backup automation (T09).
+railiance01, 2026-07-06). Remaining: **npm** publish/pull hardening, retention
+docs for all enabled types; include full package tree in scheduled backups (T09).
 
 **Done when:** tier-2 gate is fully satisfied (✓) and tier-3 production images
 follow the same pattern after explicit approval. **Tier-2 gate met; tier-3
@@ -570,7 +575,7 @@ T03 isolated probe: CANCELLED (superseded by T05 + in-production pilots)
 **Current focus (2026-07-07):** T08 **done**; T10 tiers 0–2.5 **complete**, tier-3
 `state-hub` cutover **in progress** (phase 5 stabilization). T09 restore drill
 **passed** but scheduled backups + backup target still open. T02 backup-target
-and package-scope decisions remain operator-gated. T11 partial: `state-hub` primary
+and cutover-mode confirmation remain operator-gated. T11 partial: `state-hub` primary
 on railiance01; ~57 State Hub repos still point at Gitea remotes.
 Do not retire coulombcore `state-hub` until phase 5 closeout and operator
 signoff (`CUST-WP-0054-T05`).