docs(forgejo): prepare W8 final preflight packet #512

Merged

pdurlej merged 1 commit from codex/w8-forgejo-final-preflight into main

2026-05-26 23:06:19 +02:00

codex commented

2026-05-26 22:30:19 +02:00

Collaborator

Canary status: missing — fire canary 3+3 manually before merge

Canary Context Pack

Product story

Forgejo is the platform workbench. If it breaks, issues, PRs, Actions, packages, agent review, and merge flow all become harder to repair. W8.final needs a precise preflight packet before any future upgrade.

What changed

Created state/cycle/W8-forgejo-final-preflight.md and updated state/roadmap/forgejo-upgrade-plan.md with the accepted packet pointer, current/candidate version evidence, and expanded package/review/API smoke requirements.

Why it changed

The current repo-known Forgejo image is 15.0.1, while Codeberg now shows 15.0.2 as the current 15.x stable release. The release includes security and workbench-relevant fixes, but it touches exactly the systems the platform depends on, so this remains W8.final preflight only.

Files touched

state/cycle/W8-forgejo-final-preflight.md
state/roadmap/forgejo-upgrade-plan.md

Relevant context

#389 W8 coordination lane
#508 issue body
modules/forgejo/module.yaml
modules/forgejo/runbook.md
ADR-0022 source/artifact boundaries
Codeberg Forgejo release/package metadata

Runtime evidence

No runtime mutation. No RS2000 live DB/config reads. No compose/env/workflow/branch-protection changes. Read-only upstream checks only.

Known constraints

This PR is class/security-sensitive because Forgejo owns the workbench, package registry, runner trust, PR/review path, and agent merge flow. Merge of this PR is not runtime approval.

Explicit out-of-scope

Upgrading Forgejo
Restarting Forgejo
Running backups/restores
Changing runners, workflows, branch protection, PAT scopes, package registry permissions, or compose/env

Requested decision

Approve/merge this preflight packet so Forgejo remains explicitly W8.final and future runtime work has a concrete checklist.

Merge blockers

Any language implying runtime approval today
Missing backup-before or rollback scope
Missing Actions/package/PR-review smoke coverage
Any live secret/runtime mutation

Spec sources read

state/cycle/W8-module-upgrade-prep.md — W8.final scope and stop conditions
state/roadmap/forgejo-upgrade-plan.md — existing Forgejo upgrade plan
state/roadmap/current-platform-roadmap.md — milestone 09 / W8 mapping
modules/forgejo/module.yaml — current repo-known image and risk shape
modules/forgejo/runbook.md — recovery/runbook baseline
decisions/0022-module-source-and-release-boundaries.md — update boundary policy
Codeberg Forgejo releases API and package metadata — current candidate evidence

Test plan

PYTHONPATH=control-plane python3 -m platformctl.cli validate all --json → exitCode 0

Closes #508

Canary status: missing — fire canary 3+3 manually before merge ## Canary Context Pack ### Product story Forgejo is the platform workbench. If it breaks, issues, PRs, Actions, packages, agent review, and merge flow all become harder to repair. W8.final needs a precise preflight packet before any future upgrade. ### What changed Created `state/cycle/W8-forgejo-final-preflight.md` and updated `state/roadmap/forgejo-upgrade-plan.md` with the accepted packet pointer, current/candidate version evidence, and expanded package/review/API smoke requirements. ### Why it changed The current repo-known Forgejo image is `15.0.1`, while Codeberg now shows `15.0.2` as the current 15.x stable release. The release includes security and workbench-relevant fixes, but it touches exactly the systems the platform depends on, so this remains W8.final preflight only. ### Files touched - `state/cycle/W8-forgejo-final-preflight.md` - `state/roadmap/forgejo-upgrade-plan.md` ### Relevant context - #389 W8 coordination lane - #508 issue body - `modules/forgejo/module.yaml` - `modules/forgejo/runbook.md` - ADR-0022 source/artifact boundaries - Codeberg Forgejo release/package metadata ### Runtime evidence No runtime mutation. No RS2000 live DB/config reads. No compose/env/workflow/branch-protection changes. Read-only upstream checks only. ### Known constraints This PR is `class/security-sensitive` because Forgejo owns the workbench, package registry, runner trust, PR/review path, and agent merge flow. Merge of this PR is not runtime approval. ### Explicit out-of-scope - Upgrading Forgejo - Restarting Forgejo - Running backups/restores - Changing runners, workflows, branch protection, PAT scopes, package registry permissions, or compose/env ### Requested decision Approve/merge this preflight packet so Forgejo remains explicitly W8.final and future runtime work has a concrete checklist. ### Merge blockers - Any language implying runtime approval today - Missing backup-before or rollback scope - Missing Actions/package/PR-review smoke coverage - Any live secret/runtime mutation ## Spec sources read - `state/cycle/W8-module-upgrade-prep.md` — W8.final scope and stop conditions - `state/roadmap/forgejo-upgrade-plan.md` — existing Forgejo upgrade plan - `state/roadmap/current-platform-roadmap.md` — milestone 09 / W8 mapping - `modules/forgejo/module.yaml` — current repo-known image and risk shape - `modules/forgejo/runbook.md` — recovery/runbook baseline - `decisions/0022-module-source-and-release-boundaries.md` — update boundary policy - Codeberg Forgejo releases API and package metadata — current candidate evidence ## Test plan - `PYTHONPATH=control-plane python3 -m platformctl.cli validate all --json` → exitCode 0 Closes #508

codex added 1 commit

2026-05-26 22:30:19 +02:00

docs(forgejo): prepare W8 final preflight packet

base-is-main / guard (pull_request) Successful in 1s

Details

canary-required / collect-diff (pull_request) Successful in 4s

Details

patchwarden-client-dry-run / collect-diff (pull_request) Successful in 4s

Details

patchwarden-pr-sanity / collect-diff (pull_request) Successful in 4s

Details

canary-required / canary (pull_request) Has been skipped