Record haskelseed runner smoke state

docs/gitea-actions-runner-evidence.md

@@ -80,6 +80,8 @@ Observed on 2026-06-07:
 | registration labels after activation | `self-hosted:host`, `haskelseed:host`, `linux:host`, `linux_amd64:host`, `x86_64:host`, `container-build:host`, `registry-publish:host` |
 | ephemeral | `false` |
 | runner backup | `/root/.runner.bak-20260607225905` |
+| smoke workflow run | `forge-runner-smoke.yaml #1`, run `/coulomb/railiance-forge/actions/runs/1`, commit `19ee47fe82` |
+| smoke workflow status | `Waiting`, duration `0s` as of 2026-06-08 00:40 Europe/Berlin |
 
 Activation evidence:
 
@@ -147,10 +149,27 @@ done
 Record only image names, tags, digests, and status. Do not record registry
 tokens.
 
+Haskelseed inventory on 2026-06-08:
+
+| Tag | Result |
+| --- | --- |
+| `91037a4` | `manifest unknown` |
+| `ae9e497` | `manifest unknown` |
+| `fa96fb8` | `manifest unknown` |
+| `7cc3173` | `manifest unknown` |
+| `latest` | `manifest unknown` |
+
+This means the blocked inter-hub workflow did not publish the expected image
+tags to the current Gitea registry path.
+
 ## Smoke Evidence Slot
 
 No smoke job has passed yet. Current haskelseed registration labels now match
-the proposed first compatibility contract.
+the proposed first compatibility contract, and Gitea created run
+`forge-runner-smoke.yaml #1`, but the run is still `Waiting` at `0s`.
+
+The next gate needs authenticated Gitea Actions UI/API inspection to determine
+whether the waiting run needs approval, rerun, or runner assignment repair.
 
 Expected evidence after `.gitea/workflows/forge-runner-smoke.yaml` passes:
 

docs/gitea-actions-runner-substrate.md

@@ -239,6 +239,9 @@ on the approved runner and the result is recorded in
   registered as `haskelseed`. On 2026-06-07 the OpenRC service was installed
   from `runner/act-runner-haskelseed.openrc.example`, labels were updated to the
   first compatibility contract, and the runner daemon declared successfully.
+- Gitea created `forge-runner-smoke.yaml #1` for commit `19ee47fe82`, but the
+  run is still `Waiting`; authenticated Gitea Actions inspection is needed to
+  decide whether this is approval, scheduling, or runner scope.
 - `skopeo` is not installed in this environment, so registry tag inspection must
   run from a host with `skopeo` or use an approved equivalent.
 - Local `make check-tools` still lacks `kubectl`, `helm`, and `sops`; those are

tools/gitea-runner-status.sh

@@ -82,6 +82,18 @@ if have ssh; then
       grep -nE "\"(uuid|name|address|labels|ephemeral)\"" /root/.runner || true
       sed -n "8,20p" /root/.runner 2>/dev/null || true
     fi
+    if command -v bash >/dev/null 2>&1; then
+      echo "login_shell_tools:"
+      bash -lc '"'"'
+        for tool in skopeo helm kubectl nix git curl; do
+          if command -v "$tool" >/dev/null 2>&1; then
+            printf "ok: %s -> %s\n" "$tool" "$(command -v "$tool")"
+          else
+            printf "missing: %s\n" "$tool"
+          fi
+        done
+      '"'"'
+    fi
   ' 2>&1 || echo "runner host probe failed for ${RUNNER_HOST}"
 else
   echo "ssh missing; skipping runner host probe"

workplans/FORGE-WP-0003-actions-runner-substrate.md

@@ -58,7 +58,7 @@ messages that created the blocker are marked read.
 
 ```task
 id: FORGE-WP-0003-T02
-status: wait
+status: done
 priority: high
 state_hub_task_id: "87181d63-049e-4a2b-a5e3-bf16763246d7"
 ```
@@ -97,6 +97,14 @@ service from `runner/act-runner-haskelseed.openrc.example`, and started
 declared successfully with labels `self-hosted`, `haskelseed`, `linux`,
 `linux_amd64`, `x86_64`, `container-build`, and `registry-publish`.
 
+**2026-06-08:** Completed current-state inventory. Gitea created
+`forge-runner-smoke.yaml #1` for commit `19ee47fe82`, but the run remains
+`Waiting` with duration `0s`. Haskelseed login shell has the deploy tools needed
+by inter-hub (`skopeo`, `helm`, `kubectl`, `nix`, `git`, `curl`). Registry
+inspection from haskelseed shows inter-hub tags `91037a4`, `ae9e497`,
+`fa96fb8`, `7cc3173`, and `latest` are all `manifest unknown`, confirming the
+blocked inter-hub workflow did not publish those images.
+
 ---
 
 ## T03 - Decide runner placement, labels, and capacity rules
@@ -194,6 +202,10 @@ until an approved runner is registered and visible to Gitea.
 execution is still pending until the workflow exists in the remote Gitea repo
 and is dispatched or triggered.
 
+**2026-06-08:** The workflow exists in Gitea and run `#1` was created from the
+push, but it is still `Waiting`. This task now waits on authenticated Gitea
+Actions inspection to approve, rerun, or diagnose runner assignment.
+
 ---
 
 ## T06 - Unblock the inter-hub deployment path