docs: close classification publisher handoff

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a053ff-1d6f-7fe2-ac1c-a6eb40a42a0c

docs/evidence/RMGR-WP-0013-live-conformance-2026-09-01.md

@@ -3,9 +3,9 @@
 ## Scope
 
 This evidence covers the Repo Manager classification publisher and hub-core's
-frozen `helixforge.repository-classification-projection` 1.0.0 consumer. It is
-a live source/conformance proof from the workstation checkout fleet, not a
-production deployment claim.
+frozen `helixforge.repository-classification-projection` 1.0.0 consumer. It
+includes both the original workstation conformance proof and the production
+Forgejo-backed deployment on railiance01.
 
 ## Registrar bootstrap
 
@@ -54,11 +54,20 @@ no database or private persistence model was shared.
 - Hub-core focused tests cover cursor/token HTTP transport plus all frozen
   repository-navigation contract and ingestion behaviors
 
-## Remaining production gate
+## Forgejo-backed production deployment
 
-The code and cross-repository transport are ready. Production still needs an
-explicit placement/network decision because hub-core runs in the public Core
-Hub cluster while the authoritative checkout registry is host-local to the
-Repo Manager worker. No broad host-path mount or implicit State Hub dependency
-was introduced to hide that boundary. `RMGR-WP-0013-T05` remains waiting for
-that deployment handoff; `HUB-WP-0006-T06` must not switch traffic before it.
+- Helm release `core-hub`, namespace `core-hub`, revision **24**
+- Repo Manager image digest:
+  `sha256:a78fa953815b7abe78afb63ce43a29da9f09f609ace9aad2aeb98a746544e849`
+- hub-core image digest:
+  `sha256:6f9a0318349221a6db4e958383791f5bc9398c0df7bef4c8118d8a16b9ec6e4d`
+- Source: private in-cluster Forgejo Service, no checkout mount or State Hub
+  runtime dependency
+- Full anonymous scan: **3.45 seconds**, **114 accepted**, **9 bounded private
+  source errors**
+- Live verification: passed through the admitted hub-core candidate to
+  publisher NetworkPolicy path
+
+The residual production gate is recorded as `RAPPCOREHUB-WP-0003-T04`: mount a
+dedicated Forgejo identity scoped exactly `read:repository`, prove all 123
+repositories error-free, and only then enable `publisher.connectCandidate`.