Close issue-core package blocker

SCOPE.md

@@ -133,9 +133,9 @@ lessons into reusable S5 app release patterns.
   docs directly when app releases consume forge artifacts.
 - The final source-of-truth decision for forge ownership is recorded in
   `docs/forge-source-of-truth-decision.md`.
-- The `issue-core` migration is still blocked on publishing `issue-core==0.2.0`
+- The `issue-core` migration blocker is closed: `issue-core==0.2.0` is
-  with package credentials in the `issue-core` repo and refreshing the
+  published to the Gitea PyPI registry, and the `vergabe-teilnahme` lock in its
-  `vergabe-teilnahme` lock in its source repo.
+  source repo resolves it from the registry rather than a sibling checkout.
 - `vergabe-teilnahme` is represented as a local Helm chart plus values,
   ingress, Makefile targets, and an operator runbook.
 - Reusable S5 app onboarding, app data restore handoff, and manifest

docs/vergabe-teilnahme.md

@@ -69,9 +69,8 @@ make vergabe-superuser   # interactive createsuperuser
 ## Promoting a new image tag
 
 1. Build + push from the `vergabe-teilnahme` repo using the portable package
-   path: `issue-core` must resolve from the Gitea PyPI registry, not from a
+   path: `issue-core` resolves from the Gitea PyPI registry, not from a sibling
-   sibling checkout. If `issue-core==0.2.0` is not published yet, keep
+   checkout.
-   `railiance-apps-WP-0004 I03` in `wait`.
 2. Update `image.tag` in `helm/vergabe-teilnahme-values.yaml` to the
    new git SHA.
 3. `make vergabe-deploy` — Helm rolls a new ReplicaSet with

workplans/railiance-apps-WP-0004-app-deployment-improvements.md

@@ -4,7 +4,7 @@ type: workplan
 title: "App deployment improvements (lessons from RAILIANCE-WP-0002)"
 domain: railiance
 repo: railiance-apps
-status: active
+status: finished
 owner: railiance
 topic_slug: railiance
 planning_priority: medium
@@ -20,7 +20,7 @@ This workplan collects concrete follow-ups surfaced while shipping
 independent, and can be picked up in isolation when the next S5 app
 lands or when the next operator onboards. Activated on 2026-05-22;
 local railiance-apps guardrails are implemented, with the package
-publication item blocked on forge-owned Gitea package publish credentials.
+publication item completed through the forge-owned Gitea package registry.
 
 ## I01 — URL-encode DB passwords at Secret-build time
 
@@ -85,7 +85,7 @@ cross-linked it from the `vergabe-teilnahme` runbook.
 
 ```task
 id: RAILIANCE-WP-0004-I03
-status: blocked
+status: done
 priority: medium
 state_hub_task_id: "f412b874-0670-4a4a-89fc-575fe4994646"
 ```
@@ -123,6 +123,14 @@ The final unblock still requires a Gitea package username/token to
 publish `issue-core==0.2.0`; once published, regenerate
 `vergabe-teilnahme/uv.lock` from the registry and mark this task done.
 
+**Completed 2026-06-05.** Published `issue-core==0.2.0` to the Coulomb Gitea
+PyPI registry using an operator token read from `/tmp/gat.tmp` without
+recording the secret value. `railiance-forge` exposed the approved
+`/api/packages` ingress path, the public package-specific simple index returned
+`200`, a clean temporary environment installed `issue-core==0.2.0` from Gitea,
+and `vergabe-teilnahme/uv.lock` was regenerated so it uses the Gitea registry
+instead of `../issue-core`.
+
 ---
 
 ## I04 — Operator onboarding: install the `kubectl cnpg` plugin
@@ -241,9 +249,10 @@ wraps the pattern.
 
 ## Notes
 
-- Items were activated on 2026-05-22. Local railiance-apps pieces are
+- Items were activated on 2026-05-22 and completed on 2026-06-05. I03 closed
-  complete except I03, which is blocked on forge-owned Gitea package publish
+  after `issue-core==0.2.0` was published to the Gitea PyPI registry, the
-  credentials and source-repo release work.
+  package API route was exposed by `railiance-forge`, and the
+  `vergabe-teilnahme` source lock moved off the sibling checkout.
 - I06 is genuinely cross-repo; the others are local to
   `railiance-apps` or its operator workflow.
 - The first three items (I01, I02, I03) are the highest-leverage