Document state-hub tier-3 Forgejo promotion (CUST-WP-0054-T04)

docs/forgejo-repo-migration-pilot-glas-harness.md

@@ -143,14 +143,25 @@ Template docs: `railiance-enablement/docs/forgejo-actions-workflow-templates.md`
 Operator SSH (2026-07-04): user `tegwick` on Forgejo (admin, `coulomb` Owners
 team); workstation key moved from `forgejo_admin` to `tegwick`.
 
-## Not ready for state-hub yet
+## Tier 3 — state-hub + hub-core (2026-07-06)
 
-Before `state-hub`, the ladder still needs:
+Production repos promoted with operator approval for tier-3 start.
 
-- [x] Operator/user SSH identity on Forgejo (`tegwick` + workstation key)
+| Repo | Forgejo | `origin` | CI | Hub `remote_url` | Notes |
-- [x] Reusable workflow templates in `railiance-enablement` (incl. multi-repo / `hub-core` context template)
+| --- | --- | --- | --- | --- | --- |
-- [x] State Hub `remote_url` + sweep checkout path update playbook —
+| `hub-core` | yes | `forgejo-remote` | `ci-smoke` green | `forgejo-remote:coulomb/hub-core.git` | Dependency for state-hub image |
-  `docs/forgejo-tier3-remote-url-sweep-playbook.md` (execute per repo on promotion)
+| `state-hub` | yes | `forgejo-remote` | `ci-smoke` + `build-and-push` green @ `f9f0091` | `forgejo-remote:coulomb/state-hub.git` | Multi-repo image vendors `hub-core` into `Dockerfile.ci` at build time (runner has no buildx) |
+
+Workflow lessons (state-hub `image.yaml`):
+
+- Forgejo `/archive/{full_sha}.tar.gz` can hang — use **short SHA** for primary repo.
+- Extra repos (`hub-core`) must fetch from **`main`**, not the primary commit SHA.
+- `container-build` runner DinD is **legacy docker** — no `--build-context`; vendor
+  `hub-core` into `buildctx/_hub_core_src/` and `sed` → `Dockerfile.ci`.
+
+Remaining before tier-3 complete:
+
+- [ ] `core-hub`, `issue-core`, `activity-core` promotion
 - [ ] Gitea read-only mirror or push-disable policy for repos after cutover
 - [ ] Scheduled Forgejo backups (disaster-control track; restore drill passed)
 

workplans/CUST-WP-0054-workstation-independence-and-fleet-realignment.md

@@ -10,7 +10,7 @@ topic_slug: custodian
 planning_priority: high
 planning_order: 54
 created: "2026-07-03"
-updated: "2026-07-03"
+updated: "2026-07-06"
 state_hub_workstream_id: "8a828444-dd49-4d7b-a2d1-9952b5bc929d"
 ---
 
@@ -185,8 +185,12 @@ disabled. Org Actions secrets (`REGISTRY_USER`, `REGISTRY_TOKEN`) set.
 DinD; `actions/checkout@v4` not used — git clone in job). **Pilot (2026-07-03):**
 `coulomb/glas-harness` migrated to Forgejo (`origin=forgejo-remote`); CI smoke
 host+container green — see `docs/forgejo-repo-migration-pilot-glas-harness.md`.
-Remaining: promote more repos using pilot routing; then production set
+**Tier 3 partial (2026-07-06):** `coulomb/state-hub` + dependency `coulomb/hub-core`
-(state-hub, core-hub, issue-core, activity-core); release with workstation off.
+promoted to Forgejo (`origin=forgejo-remote`); hub `remote_url` patched;
+`ci-smoke` + `build-and-push` green @ `f9f0091`; `crictl pull` on railiance01
+ok. Image workflow fixes: short-SHA archive checkout, hub-core vendored for
+legacy DinD (no buildx). Remaining tier 3: `core-hub`, `issue-core`,
+`activity-core`; Gitea read-only org policy; scheduled Forgejo backups.
 
 ## Task: State Hub production home on railiance01