the-custodian/docs/near-term-production-service-lanes-status.md

# Near-Term Production Service Lanes Status

Updated: 2026-06-30

## Purpose

Track `CUST-WP-0051-T05`: finish or park near-term production service lanes
before starting larger migrations.

## Lane Board

| Lane | Current state | Next action |
| --- | --- | --- |
| `issue-wp-0003` | issue-core is live through ArgoCD; image `0.2.1`, Service port `8765`, ExternalSecret Ready, authenticated smoke created Gitea issue `175`. | Do not flip activity-core blindly. First inject `ISSUE_CORE_API_KEY` into `actcore-runtime-secret` through route `activity-core-issue-sink`; then set activity-core `ISSUE_CORE_URL` to port `8765`, set `ISSUE_SINK_TYPE=rest`, restart/sync, and run one safe emission smoke. |
| `rail-ho-wp-0005` | Forgejo migration remains pre-implementation. Inventory is in progress; production decisions, SMTP/email recovery, cutover, and legacy retirement are human-gated. | Resolve T02 production decisions first, then build the disposable Forgejo probe. Do not start production cutover before promotion lifecycle, email recovery, package registry, Actions, backup/restore, and migration drill pass. |
| `artifact-store-wp-0007` | D7.1 is done. The dated MinIO/fork/object-store landscape assessment chose a compatibility-profile lane rather than a direct MaxIO fork. D7.2 is in progress with an opt-in live MinIO pytest harness and manual smoke docs; no secret value was read or recorded. | Run the D7.2 harness against an approved MinIO-compatible endpoint and capture health/round-trip/multipart evidence. Route D7.3 STS credential vending through identity/platform custody before changing artifact-store credential behavior. |
| `secrets-wp-0003` | Active. The whynot-design real npm publish pilot has a canonical decision and source-side runbook, but real publication still waits on Gitea bot/package-token provisioning, OpenBao custody, ops-warden route confirmation, and a coordinated whynot-design version bump. | Keep parked until the operator/Gitea/OpenBao gates are ready; do not request or record token values. The next safe non-secret action is route-confirmation evidence from ops-warden. |
| `staged-promotion-lifecycle` | Finished. Lifecycle spec, app contract, overlay scaffold, Stage 1 runner, canary template, deploy/observe tooling, promote/rollback tooling, and onboarding guide are done. | Use the finished promotion gates as prerequisites for Forgejo/source-forge and storage production work. |

## Credential And Operator Routing

`activity-core -> issue-core` REST emission uses route catalog id
`activity-core-issue-sink`.

Route lookup on 2026-06-27:

- owner: `activity-core + issue-core`
- ops-warden executes: no
- status: active
- next action: follow `ops-warden/wiki/playbooks/activity-core-issue-sink.md#worker-checklist`

No secret value was read or written. The required non-secret evidence is:

- `actcore-runtime-secret` has an `ISSUE_CORE_API_KEY` data key;
- activity-core worker consumes `ISSUE_CORE_URL=http://issue-core.issue-core.svc.cluster.local:8765`;
- `ISSUE_SINK_TYPE=rest`;
- one known-safe activity-core emission returns issue-core HTTP 201 and creates
  a Gitea issue.

## Pickup Order

1. Close the issue-core handoff gate because the service is already healthy and
   only activity-core live emission remains.
2. Treat staged-promotion as complete; use it as the gate model before
   Forgejo cutover work accelerates.
3. Run artifact-store D7.2 live evidence against an approved MinIO-compatible
   endpoint, with D7.3 routed to identity/platform custody if STS vending is
   not artifact-store-owned.
4. Keep `secrets-wp-0003` parked behind Gitea bot/token, OpenBao custody,
   ops-warden route confirmation, and coordinated whynot-design version bump.
5. Keep Forgejo production cutover parked behind explicit T02 decisions and the
   staged-promotion/backup/email/package/action gates.