docs: standardize gitea pac cicd architecture

.agents/skills/unidesk-cicd/SKILL.md

@@ -19,6 +19,7 @@ bun scripts/cli.ts platform-infra gitea mirror status --target JD01
 bun scripts/cli.ts platform-infra gitea mirror webhook status --target JD01
 bun scripts/cli.ts platform-infra gitea mirror webhook test --target JD01 --repo unidesk-master --confirm
 bun scripts/cli.ts platform-infra pipelines-as-code status --target JD01
+bun scripts/cli.ts platform-infra pipelines-as-code status --target JD01 --consumer hwlab-jd01-v03
 bun scripts/cli.ts platform-infra pipelines-as-code history --target JD01 --limit 10
 bun scripts/cli.ts platform-infra pipelines-as-code history --target JD01 --id <pipelinerun>
 bun scripts/cli.ts cicd branch-follower status
@@ -30,6 +31,7 @@ bun scripts/cli.ts cicd branch-follower debug-step --follower web-probe-sentinel
 - PR monitor 与自动合并: [references/pr-monitor.md](references/pr-monitor.md)。
 - Tekton/Argo、node-scoped runtime lane、D601 infra bootstrap: [references/control-plane.md](references/control-plane.md)。
 - HWLAB/AgentRun git-mirror source authority 与 flush: [references/git-mirror.md](references/git-mirror.md)。
+- JD01 Gitea mirror + Pipelines-as-Code 正式架构、三 consumer 覆盖矩阵和旧入口处置: [references/gitea-pac.md](references/gitea-pac.md)。
 - AgentRun/HWLAB env reuse 机制、证据解释和 PaC status/history 观察口径: [references/env-reuse.md](references/env-reuse.md)。
 - Secret、observability、platform-infra、CI tools image、PipelineRun 清理和 rollout 补记: [references/platform-ops.md](references/platform-ops.md)。
 - AgentRun YAML-only lane、v0.1 兼容入口和 AgentRun git-mirror: [references/agentrun.md](references/agentrun.md)。
@@ -38,9 +40,10 @@ bun scripts/cli.ts cicd branch-follower debug-step --follower web-probe-sentinel
 ## P0 边界
 
 - CI/CD、GitOps、rollout、PipelineRun、Argo、git-mirror 和 AgentRun 部署必须走受控 CLI；不要用裸 `kubectl`、`argo`、`tkn`、`curl` 当正式控制入口。
-- CI/CD source authority 只能来自 YAML 声明的 Kubernetes 托管 source authority：legacy lane 使用 k8s git-mirror snapshot，迁移 lane 使用 Gitea controlled mirror + immutable snapshot ref。受控命令先在 k8s 内同步/创建不可变 `refs/unidesk/snapshots/.../<commit>` stage ref；build/status/publish 只消费该 snapshot，host worktree、本地 `git fetch/pull`、可变 branch ref 或 Pipeline 内直连 GitHub 都不能作为 authoritative source。
+- CI/CD source authority 只能来自 YAML 声明的 Kubernetes 托管 source authority：legacy lane 使用 k8s git-mirror snapshot，JD01 migrated lane 使用 Gitea controlled mirror + immutable snapshot ref + Pipelines-as-Code。受控命令先在 k8s 内同步/创建不可变 `refs/unidesk/snapshots/.../<commit>` stage ref；build/status/publish 只消费该 snapshot，host worktree、本地 `git fetch/pull`、可变 branch ref 或 Pipeline 内直连 GitHub 都不能作为 authoritative source。
+- JD01 `agentrun-jd01-v02`、`sentinel-jd01-v03`、`hwlab-jd01-v03` 的正式 CI/CD closeout 入口是 `platform-infra pipelines-as-code status|history --target JD01`。`cicd branch-follower` 和 `cicd gitea-actions-poc` 对这三者只保留历史/迁移只读用途，不得作为当前交付判断入口。
 - GitHub/Git 相关 egress 必须走 YAML-first host proxy/sourceRef：branch-follower controller 读 `config/cicd-branch-followers.yaml#controller.source.githubSsh`，runtime legacy git-mirror 读 owning lane/control-plane YAML 的 host proxy 和 `githubTransport`，Gitea/PaC 迁移 lane 读 `config/platform-infra/gitea.yaml` 与 `config/platform-infra/pipelines-as-code.yaml`；禁止依赖未声明 host env、trans proxy、裸直连 GitHub 或 CLI 输出解析。
-- Gitea 迁移 lane 的 GitHub -> Gitea 自动同步必须用 `platform-infra gitea mirror webhook apply|status|test`。该路径是单向同步，只更新 Gitea branch 和 immutable snapshot ref；不得引入 Gitea -> GitHub 回写、轮询 fallback 或第二套状态存储。
+- Gitea/PaC lane 的 GitHub -> Gitea 自动同步必须用 `platform-infra gitea mirror webhook apply|status|test`。该路径是单向同步，只更新 Gitea branch 和 immutable snapshot ref；不得引入 Gitea -> GitHub 回写、轮询 fallback、Gitea Actions/act_runner fallback 或第二套状态存储。
 - Gitea webhook/FRPC/Caddy 变更的 closeout 必须看受控 CLI 的 rollout/status/test 证据；Secret 或 ConfigMap apply 成功不等于 connector Pod 已加载新 proxy/path。
 - `cicd branch-follower` 的自动跟随全过程不得读取或挂载 host worktree、target dev dir、`.worktree/*` 或 local git checkout；controller pod/一次性 reconcile Job 只能用 k8s git-mirror cache、Tekton PipelineRun、Argo Application、runtime workload 和 EmptyDir 执行，状态以 K8s ConfigMap/Lease 承载的 native observation 为准，不得解析下游 CLI 输出。
 - k8s 运行面从拉取已构建镜像开始必须 0 Docker；CI 构建面可以使用 YAML 声明的原生构建工具，但不得把 Docker socket、Docker daemon 或 host Docker 带入运行面。
@@ -68,6 +71,7 @@ bun scripts/cli.ts cicd branch-follower debug-step --follower web-probe-sentinel
 - 手动触发、定点 PipelineRun/source commit、RBAC/Pipeline/Argo、node-scoped runtime lane：读 [references/control-plane.md](references/control-plane.md)。
 - git-mirror source authority 或 flush：读 [references/git-mirror.md](references/git-mirror.md)。
 - AgentRun/HWLAB env reuse、`IMAGE_STATUS=reused`、`ENV_REUSE=hit`、`skipped,skip=<n>` 或 PaC history/status 解释：读 [references/env-reuse.md](references/env-reuse.md)。
+- JD01 三运行面 Gitea+PaC 覆盖、旧 branch-follower/Gitea Actions POC 处置和 closeout 顺序：读 [references/gitea-pac.md](references/gitea-pac.md)。
 - Secret、observability、CI tools image、PipelineRun/PV 清理：读 [references/platform-ops.md](references/platform-ops.md)。
 - AgentRun v0.1 或 YAML-only lane 部署：读 [references/agentrun.md](references/agentrun.md)。
 - 三运行面 branch follower 自动跟随、`apply/status/run-once/events/logs`：读 [references/branch-follower.md](references/branch-follower.md)。

.agents/skills/unidesk-cicd/references/branch-follower.md

@@ -2,11 +2,16 @@
 
 SPEC: PJ2026-01060703 CI/CD branch follower draft-2026-07-03-p0-branch-follower
 
+## Retired Scope
+
+For JD01 `agentrun-jd01-v02`, `sentinel-jd01-v03` and `hwlab-jd01-v03`, branch-follower is retired as a delivery authority. The current architecture is Gitea mirror + Pipelines-as-Code + Tekton + Argo; use [gitea-pac.md](gitea-pac.md) for closeout commands and coverage.
+
+The commands below remain historical/migration diagnostics. They must not be used to decide current delivery success for the three migrated JD01 consumers.
+
 ## Entrypoints
 
 ```bash
 bun scripts/cli.ts cicd branch-follower plan
-bun scripts/cli.ts cicd branch-follower apply --confirm --wait
 bun scripts/cli.ts cicd branch-follower status
 bun scripts/cli.ts cicd branch-follower status --live
 bun scripts/cli.ts cicd branch-follower run-once --all --dry-run
@@ -21,7 +26,7 @@ bun scripts/cli.ts cicd branch-follower logs --follower <id>
 bun scripts/cli.ts cicd branch-follower gate --follower hwlab-jd01-v03 --gate control-plane-refresh --source-commit <sha> --confirm --json
 ```
 
-`apply --confirm --wait` is the one-command deploy/update entry for the K8s controller. `status` is the default intermediate-state query. `status --live` and local `run-once` submit a bounded K8s reconcile Job; the Job performs all source, Tekton, Argo and runtime reads inside the cluster and may write only the compact state summary. `events` and `logs` are read-only drill-downs for the same Kubernetes-native state. `run-once --confirm --wait` is the manual one-command trigger and closeout path.
+Historically, `apply --confirm --wait` deployed the K8s controller and `run-once --confirm --wait` was the manual trigger and closeout path. For the migrated JD01 consumers this is no longer the formal delivery path. `status`, `events`, `logs` and `debug-step` are retained only to inspect or retire old state.
 
 `debug-step` is the required single-step troubleshooting entry before changing branch-follower code for repeated CI/CD convergence issues. It runs in a bounded target-side Job when called from the operator host, and uses the same controller modules as the real flow:
 
@@ -105,11 +110,11 @@ Timeout, TTL, retry/backoff, reconcile interval and end-to-end budget values mus
 
 ## First Followers
 
-- `hwlab-jd01-v03`: follows `pikasTech/HWLAB@v0.3`, adapter `hwlab-node-runtime`, native trigger `Tekton PipelineRun -> Argo Application closeout -> runtime Deployment sourceCommit readiness`.
-- `agentrun-jd01-v02`: historical first follower only. This lane has migrated to Gitea webhook -> Pipelines-as-Code -> Tekton -> GitOps/Argo -> runtime readiness; do not re-enable branch-follower, act_runner or custom trigger fallback for it. Current operation lives in `config/platform-infra/gitea.yaml`, `config/platform-infra/pipelines-as-code.yaml` and [agentrun.md](agentrun.md).
+- `hwlab-jd01-v03`: historical follower only. This lane has migrated to Gitea webhook -> Pipelines-as-Code consumer `hwlab-jd01-v03` -> Tekton -> GitOps/Argo -> runtime readiness; do not re-enable branch-follower, Gitea Actions, act_runner or custom trigger fallback for it.
+- `agentrun-jd01-v02`: historical first follower only. This lane has migrated to Gitea webhook -> Pipelines-as-Code -> Tekton -> GitOps/Argo -> runtime readiness; do not re-enable branch-follower, act_runner or custom trigger fallback for it. Current operation lives in `config/platform-infra/gitea.yaml`, `config/platform-infra/pipelines-as-code.yaml`, [gitea-pac.md](gitea-pac.md) and [agentrun.md](agentrun.md).
 - `web-probe-sentinel-master`: historical follower only. This lane has migrated to Gitea webhook -> Pipelines-as-Code consumer `sentinel-jd01-v03` -> Tekton publish -> GitOps/Argo -> runtime readiness; do not re-enable branch-follower, Gitea Actions, act_runner or custom fallback for it.
 
-These entries describe the initial production set and migration history. HWLAB still runs on JD01 through branch-follower unless YAML changes; AgentRun JD01 v0.2 and Web 哨兵 JD01 now use the PaC/Gitea path.
+These entries describe the initial production set and migration history. Current JD01 closeout for all three consumers uses the PaC/Gitea path.
 
 ## Reuse And Mirror Contract
 

.agents/skills/unidesk-cicd/references/gitea-pac.md

@@ -0,0 +1,43 @@
+# Gitea + Pipelines-as-Code
+
+JD01 migrated CI/CD uses one formal path:
+
+```text
+GitHub push -> Gitea controlled mirror -> Pipelines-as-Code Repository webhook -> Tekton PipelineRun -> GitOps/Argo -> k8s runtime
+```
+
+Do not add Gitea Actions, `act_runner`, branch-follower, host worktree, direct GitHub-in-Pipeline, or custom script fallback for the migrated JD01 consumers. Gitea Actions material under `config/cicd-gitea-actions-poc.yaml` is archived read-only POC context only.
+
+## Source Of Truth
+
+- Gitea source authority, GitHub webhook bridge, public exposure and source snapshots: `config/platform-infra/gitea.yaml`.
+- PaC controller, Repository CRs, consumer parameters, Tekton pipeline names and Argo applications: `config/platform-infra/pipelines-as-code.yaml`.
+- Historical snapshot prefixes containing `gitea-actions` are retained only for existing refs. They do not mean Gitea Actions is the active trigger architecture.
+
+## Coverage Matrix
+
+| Consumer | Source | PaC namespace | Pipeline | Argo application | Status |
+|---|---|---|---|---|---|
+| `agentrun-jd01-v02` | `pikasTech/agentrun@v0.2` | `agentrun-ci` | `agentrun-jd01-v02-ci-image-publish` | `agentrun-jd01-v02` | `platform-infra pipelines-as-code status --target JD01 --consumer agentrun-jd01-v02` |
+| `sentinel-jd01-v03` | `pikasTech/unidesk@master` | `devops-infra` | `hwlab-web-probe-sentinel-jd01-pac` | `hwlab-web-probe-sentinel-jd01` | `platform-infra pipelines-as-code status --target JD01 --consumer sentinel-jd01-v03` |
+| `hwlab-jd01-v03` | `pikasTech/HWLAB@v0.3` | `hwlab-ci` | `hwlab-jd01-v03-ci-image-publish` | `hwlab-node-v03` | `platform-infra pipelines-as-code status --target JD01 --consumer hwlab-jd01-v03` |
+
+Use `bun scripts/cli.ts platform-infra pipelines-as-code history --target JD01 --limit 10` for all-consumer trigger, timing and reuse audit. It must read live Gitea Repository CR plus Tekton PipelineRun/TaskRun objects on JD01, aggregate on the target side, and print `READ_ERRORS`.
+
+## Closeout Order
+
+1. `bun scripts/cli.ts platform-infra gitea mirror status --target JD01`
+2. `bun scripts/cli.ts platform-infra gitea mirror webhook status --target JD01`
+3. `bun scripts/cli.ts platform-infra pipelines-as-code status --target JD01 --consumer <id>`
+4. `bun scripts/cli.ts platform-infra pipelines-as-code history --target JD01 --consumer <id> --limit 10`
+5. For ambiguous rows, drill into the PipelineRun with `bun scripts/cli.ts platform-infra pipelines-as-code history --target JD01 --id <pipelinerun>`.
+
+Do not use `cicd branch-follower status` to decide whether the three migrated JD01 consumers are current. It is historical/migration-only and may contain stale state from before PaC cutover.
+
+## Reuse Interpretation
+
+- AgentRun `IMAGE_STATUS=reused` means the image build was skipped or registry artifact was reused for the same env identity.
+- Sentinel `ENV_REUSE=hit` means dependency reuse was available; `cache=hit` is separate BuildKit evidence.
+- HWLAB `skipped,skip=<n>` means service-level artifact planning skipped reusable builds; inspect the PipelineRun detail when deciding which service changed.
+
+Missing reuse text is not proof of a failed reuse path. Check the consumer type and PipelineRun detail first.

.agents/skills/unidesk-cicd/references/platform-ops.md

@@ -46,7 +46,7 @@ bun scripts/cli.ts platform-infra wechat-archive plan|apply|status|validate|pull
 bun scripts/cli.ts platform-infra wechat-archive wcf-host-status|collector-plan|collector-apply|collector-status
 ```
 
-`platform-infra` 是 UniDesk 运维的平台基础设施控制面；新增平台服务优先进入该命名空间或对应 YAML 声明目标，旧 `devops-infra` 只作为渐进迁移来源。Sub2API 日常部署、Codex pool、FRP 暴露、master `~/.codex` 配置、验收和排障统一使用 `$unidesk-sub2api`。Gitea mirror 和 Pipelines-as-Code 是迁移后的 CI source/trigger 平台服务，source-of-truth 分别是 `config/platform-infra/gitea.yaml` 和 `config/platform-infra/pipelines-as-code.yaml`；PaC status 是 migrated lane closeout 入口，PaC history 是触发/耗时/env reuse 审计入口，默认输出必须包含 `READ_ERRORS` 并在目标 node 聚合，不能把读取失败或 namespace 过大误报为空表成功。不用 Gitea Actions、act_runner、branch-follower 或自维护脚本兜底。`agentrun-jd01-v02` 是默认 consumer；哨兵使用 `--consumer sentinel-jd01-v03` 查看 PaC/Tekton/Argo/env reuse 证据。WeChat archive 是 platform-infra 的 YAML-first 工作流入口；只读 collector 的副本、镜像、WCF host、端口和版本 pin 都以 YAML 为准。
+`platform-infra` 是 UniDesk 运维的平台基础设施控制面；新增平台服务优先进入该命名空间或对应 YAML 声明目标，旧 `devops-infra` 只作为渐进迁移来源。Sub2API 日常部署、Codex pool、FRP 暴露、master `~/.codex` 配置、验收和排障统一使用 `$unidesk-sub2api`。Gitea mirror 和 Pipelines-as-Code 是 JD01 migrated CI source/trigger 平台服务，source-of-truth 分别是 `config/platform-infra/gitea.yaml` 和 `config/platform-infra/pipelines-as-code.yaml`；正式架构和三 consumer 矩阵见 [gitea-pac.md](gitea-pac.md)。PaC status 是 migrated lane closeout 入口，PaC history 是触发/耗时/env reuse 审计入口，默认输出必须包含 `READ_ERRORS` 并在目标 node 聚合，不能把读取失败或 namespace 过大误报为空表成功。不用 Gitea Actions、act_runner、branch-follower 或自维护脚本兜底。`agentrun-jd01-v02` 是默认 consumer；哨兵使用 `--consumer sentinel-jd01-v03`，HWLAB 使用 `--consumer hwlab-jd01-v03` 查看 PaC/Tekton/Argo/env reuse 证据。WeChat archive 是 platform-infra 的 YAML-first 工作流入口；只读 collector 的副本、镜像、WCF host、端口和版本 pin 都以 YAML 为准。
 
 ## CI Tools Image
 

config/cicd-branch-followers.yaml

@@ -66,9 +66,9 @@ followers:
       repository: pikasTech/HWLAB
       branch: v0.3
       branchRef: config/hwlab-node-lanes.yaml#lanes.v03.sourceBranch
-      authorityRef: config/platform-infra/gitea.yaml#sourceAuthority.repositories.hwlab-jd01-v03
+      authorityRef: config/platform-infra/gitea.yaml#sourceAuthority.repositories
       snapshotPrefix: refs/unidesk/snapshots/gitea-actions/hwlab-node-runtime/v0.3
-      snapshotRef: config/platform-infra/gitea.yaml#sourceAuthority.repositories.hwlab-jd01-v03.snapshot.prefix
+      snapshotRef: config/platform-infra/gitea.yaml#sourceAuthority.repositories
     target:
       node: JD01
       lane: v03

config/cicd-gitea-actions-poc.yaml

@@ -1,16 +1,18 @@
-# SPEC: GH-1548 Gitea mirror/Actions visibility and controlled Docker builder POC
+# SPEC: GH-1548 archived Gitea Actions POC; GH-1560 active path is Gitea mirror + Pipelines-as-Code.
 apiVersion: unidesk.pikapython.com/v1alpha1
 kind: CicdGiteaActionsPoc
 metadata:
   id: gitea-actions-builder-poc
   owner: UniDesk
   issue: https://github.com/pikasTech/unidesk/issues/1548
-  specRef: GH-1548
-  version: draft-2026-07-05-p0-gitea-actions-builder-poc
+  specRef: GH-1548/GH-1560
+  version: archived-2026-07-06-gitea-actions-poc
+  status: archived-readonly
+  replacement: config/platform-infra/pipelines-as-code.yaml
 
 spec:
   scope:
-    phase: p1-spec-p2-poc
+    phase: archived-readonly
     productionFollowerReplacement: false
     rolloutEnabled: false
     rolloutMode: diagnostic-only
@@ -19,12 +21,14 @@ spec:
 
   migration:
     issue: https://github.com/pikasTech/unidesk/issues/1549
-    primaryEntrypoint: bun scripts/cli.ts cicd gitea-actions-poc plan
-    replacementTarget: gitea-actions-driven-cicd
+    activeCloseoutIssue: https://github.com/pikasTech/unidesk/issues/1560
+    primaryEntrypoint: bun scripts/cli.ts platform-infra pipelines-as-code status --target JD01
+    replacementTarget: gitea-pac-driven-cicd
+    archivedEntrypoint: bun scripts/cli.ts cicd gitea-actions-poc plan
     branchFollower:
       status: deprecated
       mode: migration-only
-      reason: self-maintained branch observation and controller state machine are being replaced by Gitea mirror and Gitea Actions.
+      reason: self-maintained branch observation and controller state machine have been replaced for JD01 consumers by Gitea mirror and Pipelines-as-Code.
       allowedDuringMigration:
         - read-only-status
         - debug-migration-evidence

config/platform-infra/gitea.yaml

@@ -4,23 +4,27 @@ kind: platform-infra-gitea
 metadata:
   id: gitea-internal-mirror
   owner: unidesk
-  spec: GH-1548/GH-1550
+  spec: GH-1548/GH-1550/GH-1560
   relatedIssues:
     - 1548
     - 1549
     - 1550
     - 1557
+    - 1560
 
 defaults:
   targetId: JD01
 
 migration:
-  role: gitea-actions-driven-cicd-source-authority
+  role: gitea-pac-cicd-source-authority
   replaces: branch-follower-self-maintained-branch-observer
   parentConfigRef: config/cicd-gitea-actions-poc.yaml#spec.sourceAuthority.giteaMirror
+  archivedPocRef: config/cicd-gitea-actions-poc.yaml
+  activePacConfigRef: config/platform-infra/pipelines-as-code.yaml
   envReusePolicy: preserve-existing-runtime-env-reuse
   buildPlane: controlled-docker-or-buildkit-outside-runtime
   runtimePlane: k3s-gitea-service-zero-docker
+  activeTriggerPath: gitea-webhook-to-pipelines-as-code-to-tekton-to-argo
 
 sourceAuthority:
   enabled: true
@@ -113,6 +117,7 @@ sourceAuthority:
         branch: jd01-v0.2-gitops
         flushDisposition: retained-for-gitops-flush
       snapshot:
+        naming: historical-gitea-actions-prefix-retained-for-existing-refs
         prefix: refs/unidesk/snapshots/gitea-actions/agentrun-v0.2
       legacyGitMirror:
         readUrl: http://git-mirror-http.devops-infra.svc.cluster.local:8080/pikasTech/agentrun.git
@@ -134,6 +139,7 @@ sourceAuthority:
         branch: master
         flushDisposition: not-a-gitops-branch
       snapshot:
+        naming: historical-gitea-actions-prefix-retained-for-existing-refs
         prefix: refs/unidesk/snapshots/gitea-actions/unidesk-master
       legacyGitMirror:
         readUrl: http://git-mirror-http.devops-infra.svc.cluster.local:8080/pikasTech/unidesk.git
@@ -155,6 +161,7 @@ sourceAuthority:
         branch: v0.3-gitops
         flushDisposition: retained-for-gitops-flush
       snapshot:
+        naming: historical-gitea-actions-prefix-retained-for-existing-refs
         prefix: refs/unidesk/snapshots/gitea-actions/hwlab-node-runtime/v0.3
       legacyGitMirror:
         readUrl: http://git-mirror-http.devops-infra.svc.cluster.local:8080/pikasTech/HWLAB.git
@@ -165,7 +172,7 @@ targets:
   - id: JD01
     route: JD01:k3s
     namespace: devops-infra
-    role: active-poc
+    role: active-source-authority
     enabled: true
     createNamespace: true
     storageClassName: local-path

config/platform-infra/pipelines-as-code.yaml

@@ -4,11 +4,12 @@ kind: platform-infra-pipelines-as-code
 metadata:
   id: pac-gitea-consumers
   owner: unidesk
-  spec: GH-1552/GH-1555
+  spec: GH-1552/GH-1555/GH-1560
   relatedIssues:
     - 1552
     - 1555
     - 1557
+    - 1560
 
 defaults:
   targetId: JD01
@@ -29,7 +30,7 @@ targets:
   - id: JD01
     route: JD01:k3s
     namespace: agentrun-ci
-    role: active-poc
+    role: active-cicd-trigger-authority
     enabled: true
 
 gitea:
@@ -67,6 +68,7 @@ repositories:
       git_write_url: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikasTech-agentrun.git
       source_branch: v0.2
       gitops_branch: jd01-v0.2-gitops
+      # Historical prefix name retained for existing snapshot refs; active architecture is Gitea + PaC, not Gitea Actions.
       source_snapshot_prefix: refs/unidesk/snapshots/gitea-actions/agentrun-v0.2
       pipeline_name: agentrun-jd01-v02-ci-image-publish
       pipeline_run_prefix: agentrun-jd01-v02-ci
@@ -87,6 +89,7 @@ repositories:
     params:
       git_read_url: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikasTech-unidesk.git
       source_branch: master
+      # Historical prefix name retained for existing snapshot refs; active architecture is Gitea + PaC, not Gitea Actions.
       source_snapshot_prefix: refs/unidesk/snapshots/gitea-actions/unidesk-master
       node: JD01
       lane: v03
@@ -110,6 +113,7 @@ repositories:
       git_write_url: http://git-mirror-write.devops-infra.svc.cluster.local:8080/pikasTech/HWLAB.git
       source_branch: v0.3
       gitops_branch: v0.3-gitops
+      # Historical prefix name retained for existing snapshot refs; active architecture is Gitea + PaC, not Gitea Actions.
       source_snapshot_prefix: refs/unidesk/snapshots/gitea-actions/hwlab-node-runtime/v0.3
       pipeline_name: hwlab-jd01-v03-ci-image-publish
       pipeline_run_prefix: hwlab-jd01-v03-ci-poll

docs/reference/platform-infra.md

@@ -19,9 +19,9 @@
 - Applying Gitea public exposure or webhook sync must roll the affected connector workloads after Secret or ConfigMap changes. A successful Secret apply is not sufficient evidence that `frpc` loaded a new proxy; closeout should use `platform-infra gitea apply` output plus `platform-infra gitea mirror webhook status|test` rather than assuming unchanged connector Pods picked up mounted config.
 - The canonical PaC entrypoints are `bun scripts/cli.ts platform-infra pipelines-as-code plan|apply|status|history|webhook-test --target <node>`. PaC status is the operator-facing closeout surface for migrated CI lanes and must expose webhook count, latest PipelineRun/TaskRun duration, image status, env identity, digest, GitOps commit, Argo revision and runtime provenance without requiring raw `kubectl`, `tkn` or Gitea UI inspection.
 - PaC history is the trigger/timing audit surface for Gitea/PaC-managed lanes. It must query Gitea Repository CR and Tekton PipelineRun/TaskRun live objects on the target node, aggregate there, return Beijing-time display by YAML timezone, expose a detail id for drill-down, and report read errors explicitly; a large namespace or unreadable target object must never be rendered as a successful empty table.
-- `config/platform-infra/pipelines-as-code.yaml` may declare multiple repositories and consumers. `agentrun-jd01-v02` is the default consumer; Web 哨兵 uses `--consumer sentinel-jd01-v03`. Consumer-scoped status must not mix PipelineRuns or env reuse evidence across repositories.
+- `config/platform-infra/pipelines-as-code.yaml` may declare multiple repositories and consumers. JD01 currently has `agentrun-jd01-v02`, `sentinel-jd01-v03` and `hwlab-jd01-v03`; use `history --target JD01` for all-consumer audit and `status --target JD01 --consumer <id>` for consumer-scoped closeout. Consumer-scoped status must not mix PipelineRuns or env reuse evidence across repositories.
 - Public Gitea UI may use the YAML-declared HTTPS hostname, but k8s-internal consumers must use the ClusterIP service URL from YAML. Internal CI/Argo/runtime reads must not loop through public DNS/Caddy/FRP, and migrated lanes must not fall back to legacy git-mirror read URLs when the commit exists only in Gitea.
-- A PaC-migrated lane must keep a single trigger path: Gitea webhook -> Pipelines-as-Code -> Tekton -> GitOps/Argo -> k8s runtime. Do not add Gitea Actions, `act_runner`, branch-follower or custom script fallback unless a later issue explicitly changes the architecture.
+- A PaC-migrated lane must keep a single trigger path: Gitea webhook -> Pipelines-as-Code -> Tekton -> GitOps/Argo -> k8s runtime. Do not add Gitea Actions, `act_runner`, branch-follower or custom script fallback unless a later issue explicitly changes the architecture. `config/cicd-gitea-actions-poc.yaml` is archived POC context only; snapshot refs that still contain `gitea-actions` are historical names retained for compatibility, not evidence that Gitea Actions is active.
 - k8s runtime remains Docker-free from the point it pulls already built images. CI build steps may use YAML-declared native build tooling, but Docker socket/daemon access must not become part of the runtime plane.
 
 ## Secret Distribution Boundary

scripts/src/cicd-branch-follower.ts

@@ -572,9 +572,11 @@ function buildPlan(registry: BranchFollowerRegistry, options: ParsedOptions): Re
     },
     followers,
     next: {
-      apply: "bun scripts/cli.ts cicd branch-follower apply --confirm --wait",
-      status: "bun scripts/cli.ts cicd branch-follower status",
-      dryRun: "bun scripts/cli.ts cicd branch-follower run-once --all --dry-run",
+      pacStatus: "bun scripts/cli.ts platform-infra pipelines-as-code status --target JD01",
+      pacHistory: "bun scripts/cli.ts platform-infra pipelines-as-code history --target JD01 --limit 10",
+      legacyApply: "bun scripts/cli.ts cicd branch-follower apply --confirm --wait",
+      legacyStatus: "bun scripts/cli.ts cicd branch-follower status",
+      legacyDryRun: "bun scripts/cli.ts cicd branch-follower run-once --all --dry-run",
     },
   };
 }
@@ -654,9 +656,11 @@ async function buildStatus(registry: BranchFollowerRegistry, options: ParsedOpti
     errors: k8s.errors,
     warnings: k8s.warnings,
     next: {
-      apply: "bun scripts/cli.ts cicd branch-follower apply --confirm --wait",
+      pacStatus: "bun scripts/cli.ts platform-infra pipelines-as-code status --target JD01",
+      pacHistory: "bun scripts/cli.ts platform-infra pipelines-as-code history --target JD01 --limit 10",
+      legacyApply: "bun scripts/cli.ts cicd branch-follower apply --confirm --wait",
       liveStatus: "bun scripts/cli.ts cicd branch-follower status --live",
-      dryRun: "bun scripts/cli.ts cicd branch-follower run-once --all --dry-run",
+      legacyDryRun: "bun scripts/cli.ts cicd branch-follower run-once --all --dry-run",
     },
   };
 }

scripts/src/cicd-gitea-actions-poc.ts

@@ -1,5 +1,5 @@
-// SPEC: GH-1548 Gitea mirror/Actions visibility and controlled Docker builder POC.
-// Responsibility: read-only YAML-first plan/status for the proposed CI/CD governance split.
+// SPEC: GH-1548/GH-1560 archived Gitea Actions POC.
+// Responsibility: read-only historical plan/status for the retired Gitea Actions POC.
 import { existsSync, readFileSync } from "node:fs";
 import { isAbsolute } from "node:path";
 import { rootPath, type UniDeskConfig } from "./config";
@@ -29,6 +29,8 @@ interface LoadedPoc {
 export function cicdGiteaActionsPocHelp(): unknown {
   return {
     command: "cicd gitea-actions-poc plan|status",
+    archived: true,
+    replacement: "bun scripts/cli.ts platform-infra pipelines-as-code status --target JD01",
     output: "text by default; use --json, --raw, or -o json|yaml for machine output",
     usage: [
       "bun scripts/cli.ts cicd gitea-actions-poc plan",
@@ -36,8 +38,8 @@ export function cicdGiteaActionsPocHelp(): unknown {
       "bun scripts/cli.ts cicd gitea-actions-poc plan --target agentrun-jd01-v02",
     ],
     config: DEFAULT_CONFIG_PATH,
-    issue: "https://github.com/pikasTech/unidesk/issues/1548",
-    description: "Read-only P1/P2 plan for replacing branch-follower responsibilities with Gitea mirror, Gitea Actions visibility, controlled Docker/BuildKit builder plane, existing Tekton, existing Argo CD, and bounded UniDesk status while preserving env reuse.",
+    issue: "https://github.com/pikasTech/unidesk/issues/1560",
+    description: "Archived read-only POC. JD01 production CI/CD uses Gitea mirror -> Pipelines-as-Code -> Tekton -> Argo/k8s runtime; do not use Gitea Actions or act_runner as a fallback.",
   };
 }
 
@@ -385,6 +387,9 @@ function renderPlanHuman(payload: Record<string, unknown>): string {
   return [
     `CI/CD GITEA-ACTIONS POC PLAN (${payload.ok === false ? "blocked" : "ok"})`,
     "",
+    "ARCHIVE NOTICE",
+    "This is historical GH-1548 POC material. Current JD01 CI/CD closeout is platform-infra pipelines-as-code status/history; Gitea Actions and act_runner are not fallback paths.",
+    "",
     table(["TARGET", "SOURCE", "NODE/LANE", "BASELINE", "SNAPSHOT", "TEKTON", "ARGO", "RUNTIME"], arrayRecords(payload.targets).map((target) => [
       target.id,
       `${target.repository ?? "-"}@${target.branch ?? "-"}`,
@@ -428,8 +433,10 @@ function renderPlanHuman(payload: Record<string, unknown>): string {
     errors.length === 0 ? "" : `\nERRORS\n${errors.map((item) => `- ${item}`).join("\n")}`,
     "",
     "NEXT",
-    `status: ${next?.status ?? "-"}`,
-    `existing-follower: ${next?.existingFollowerStatus ?? "-"}`,
+    `pac-status: bun scripts/cli.ts platform-infra pipelines-as-code status --target JD01`,
+    `pac-history: bun scripts/cli.ts platform-infra pipelines-as-code history --target JD01 --limit 10`,
+    `archived-status: ${next?.status ?? "-"}`,
+    `legacy-follower: ${next?.existingFollowerStatus ?? "-"}`,
     `issue: ${next?.pocIssue ?? payload.issue ?? "-"}`,
     "",
   ].filter((line) => line !== "").join("\n");
@@ -443,6 +450,9 @@ function renderStatusHuman(payload: Record<string, unknown>): string {
   return [
     `CI/CD GITEA-ACTIONS POC STATUS (${payload.ok === false ? "blocked" : "declared-only"})`,
     "",
+    "ARCHIVE NOTICE",
+    "This command reads an archived POC spec only. Use platform-infra pipelines-as-code status/history for current JD01 CI/CD evidence.",
+    "",
     `statusSource=${payload.statusSource ?? "-"} mode=${payload.statusMode ?? "-"}`,
     `replacement=${migration?.replacementTarget ?? "-"} branchFollower=${branchFollower?.status ?? "-"}:${branchFollower?.mode ?? "-"}`,
     "",
@@ -460,8 +470,10 @@ function renderStatusHuman(payload: Record<string, unknown>): string {
     errors.length === 0 ? "" : `\nERRORS\n${errors.map((item) => `- ${item}`).join("\n")}`,
     "",
     "NEXT",
-    `plan: ${next?.plan ?? "-"}`,
-    `existing-follower: ${next?.existingFollowerStatus ?? "-"}`,
+    `pac-status: bun scripts/cli.ts platform-infra pipelines-as-code status --target JD01`,
+    `pac-history: bun scripts/cli.ts platform-infra pipelines-as-code history --target JD01 --limit 10`,
+    `archived-plan: ${next?.plan ?? "-"}`,
+    `legacy-follower: ${next?.existingFollowerStatus ?? "-"}`,
     "",
   ].filter((line) => line !== "").join("\n");
 }

scripts/src/cicd-help.ts

@@ -5,21 +5,15 @@ export function buildCicdHelp(configPath: string, spec: string): unknown {
   return {
     command: "cicd branch-follower plan|apply|status|run-once|debug-step|cleanup-state|events|logs|taskrun|job|runtime|gate",
     deprecated: true,
-    mode: "migration-only",
-    replacement: "bun scripts/cli.ts cicd gitea-actions-poc plan",
-    issue: "https://github.com/pikasTech/unidesk/issues/1549",
+    mode: "retired-readonly-for-jd01-consumers",
+    replacement: "bun scripts/cli.ts platform-infra pipelines-as-code status --target JD01",
+    issue: "https://github.com/pikasTech/unidesk/issues/1560",
     output: "text by default; use --json, --raw, or -o json|yaml for machine output",
     usage: [
-      "bun scripts/cli.ts cicd branch-follower plan",
-      "bun scripts/cli.ts cicd branch-follower apply --confirm --wait",
       "bun scripts/cli.ts cicd branch-follower status",
       "bun scripts/cli.ts cicd branch-follower status --live",
-      "bun scripts/cli.ts cicd branch-follower run-once --all --dry-run",
-      "bun scripts/cli.ts cicd branch-follower run-once --follower hwlab-jd01-v03 --confirm --wait",
       "bun scripts/cli.ts cicd branch-follower debug-step --follower web-probe-sentinel-master --step controller-source",
       "bun scripts/cli.ts cicd branch-follower debug-step --follower web-probe-sentinel-master --step state-read",
-      "bun scripts/cli.ts cicd branch-follower debug-step --follower web-probe-sentinel-master --step state-write --confirm",
-      "bun scripts/cli.ts cicd branch-follower cleanup-state --follower web-probe-sentinel-master --confirm",
       "bun scripts/cli.ts cicd branch-follower events --follower agentrun-jd01-v02",
       "bun scripts/cli.ts cicd branch-follower logs --follower web-probe-sentinel-master",
       "bun scripts/cli.ts cicd branch-follower taskrun --follower hwlab-jd01-v03 --taskrun runtime-ready --logs-tail 120 --json",
@@ -31,6 +25,12 @@ export function buildCicdHelp(configPath: string, spec: string): unknown {
     ],
     config: configPath,
     spec,
-    description: "Deprecated migration-only branch follower controller. Existing production status/debug remains available during cutover, but new CI/CD replacement work should use Gitea mirror and Gitea Actions.",
+    description: "Retired branch-follower controller surface for the JD01 migrated consumers. Use PaC status/history for current closeout; branch-follower commands remain only for historical state and bounded migration diagnostics.",
+    currentCloseout: [
+      "bun scripts/cli.ts platform-infra gitea mirror status --target JD01",
+      "bun scripts/cli.ts platform-infra gitea mirror webhook status --target JD01",
+      "bun scripts/cli.ts platform-infra pipelines-as-code status --target JD01",
+      "bun scripts/cli.ts platform-infra pipelines-as-code history --target JD01 --limit 10",
+    ],
   };
 }

scripts/src/cicd-render.ts

@@ -53,8 +53,8 @@ function renderPlanHuman(payload: Record<string, unknown>): string {
     `CI/CD BRANCH-FOLLOWER PLAN (${payload.ok === false ? "blocked" : "ok"})`,
     "",
     "DEPRECATION",
-    "branch-follower=migration-only replacement=\"bun scripts/cli.ts cicd gitea-actions-poc plan\" issue=https://github.com/pikasTech/unidesk/issues/1549",
-    "Do not add new branch-follower controller-loop features; use the Gitea Actions driven path from #1548/#1549.",
+    "branch-follower=retired-for-jd01-consumers replacement=\"bun scripts/cli.ts platform-infra pipelines-as-code status --target JD01\" issue=https://github.com/pikasTech/unidesk/issues/1560",
+    "Do not use branch-follower or Gitea Actions as the current delivery path for JD01 AgentRun, sentinel, or HWLAB v0.3; use Gitea mirror + Pipelines-as-Code.",
     "",
     table(["FOLLOWER", "ENABLED", "ADAPTER", "SOURCE", "TARGET", "BUDGET", "REFS", "CHECKS"], rows),
     "",
@@ -62,9 +62,11 @@ function renderPlanHuman(payload: Record<string, unknown>): string {
     `hostWorktreeAuthority=${payload.hostWorktreeAuthority === true ? "true" : "false"} mode=${asOptionalRecord(payload.sourceAuthority)?.mode ?? "-"} resolver=${asOptionalRecord(payload.sourceAuthority)?.resolver ?? "-"}`,
     "",
     "NEXT",
-    `apply: ${next?.apply ?? "-"}`,
-    `status: ${next?.status ?? "-"}`,
-    `dry-run: ${next?.dryRun ?? "-"}`,
+    `pac-status: ${next?.pacStatus ?? "bun scripts/cli.ts platform-infra pipelines-as-code status --target JD01"}`,
+    `pac-history: ${next?.pacHistory ?? "bun scripts/cli.ts platform-infra pipelines-as-code history --target JD01 --limit 10"}`,
+    `legacy-apply: ${next?.legacyApply ?? "-"}`,
+    `legacy-status: ${next?.legacyStatus ?? next?.status ?? "-"}`,
+    `legacy-dry-run: ${next?.legacyDryRun ?? next?.dryRun ?? "-"}`,
     "",
   ].join("\n");
 }
@@ -124,6 +126,9 @@ function renderStatusHuman(payload: Record<string, unknown>, _options: ParsedOpt
   return [
     `CI/CD BRANCH-FOLLOWER STATUS (${payload.ok === false ? "degraded" : "ok"})`,
     "",
+    "RETIREMENT",
+    "This status is historical/migration-only for JD01 migrated consumers. Current closeout: bun scripts/cli.ts platform-infra pipelines-as-code status --target JD01; audit: bun scripts/cli.ts platform-infra pipelines-as-code history --target JD01 --limit 10",
+    "",
     table(
       ["CTRL_NS", "ROUTE", "DEPLOY", "READY", "PODS", "PODS_READ", "STATE_CM", "LEASE"],
       [[controller?.namespace ?? "-", controller?.route ?? "-", controller?.deploymentName ?? "-", `${controller?.availableReplicas ?? 0}/${controller?.replicas ?? 0}`, controller?.pods ?? "-", controller?.podsReadStatus ?? "-", controller?.stateConfigMapPresent === true ? "present" : "missing", controller?.leaseHolder ?? "-"]],
@@ -141,8 +146,10 @@ function renderStatusHuman(payload: Record<string, unknown>, _options: ParsedOpt
     errors.length === 0 ? "" : `\nERRORS\n${errors.map((item) => `- ${item}`).join("\n")}`,
     "",
     "NEXT",
-    `live-status: ${next?.liveStatus ?? "-"}`,
-    `dry-run: ${next?.dryRun ?? "-"}`,
+    `pac-status: bun scripts/cli.ts platform-infra pipelines-as-code status --target JD01`,
+    `pac-history: bun scripts/cli.ts platform-infra pipelines-as-code history --target JD01 --limit 10`,
+    `legacy-live-status: ${next?.liveStatus ?? "-"}`,
+    `legacy-dry-run: ${next?.legacyDryRun ?? next?.dryRun ?? "-"}`,
     "",
   ].filter((line) => line !== "").join("\n");
 }

scripts/src/cicd.ts

@@ -1,4 +1,4 @@
-// SPEC: PJ2026-01060703 CI/CD branch follower and GH-1548 Gitea Actions POC.
+// SPEC: PJ2026-01060703 CI/CD branch follower and GH-1548/GH-1560 Gitea PaC migration.
 // Responsibility: thin CI/CD top-level route entry; subcommand logic lives in responsibility modules.
 import type { UniDeskConfig } from "./config";
 import { renderMachine } from "./cicd-render";
@@ -11,10 +11,13 @@ export function cicdHelp(): unknown {
     command: "cicd gitea-actions-poc|branch-follower",
     output: "text by default for subcommands; top-level help is json",
     migration: {
-      issue: "https://github.com/pikasTech/unidesk/issues/1549",
-      primary: "cicd gitea-actions-poc",
+      issue: "https://github.com/pikasTech/unidesk/issues/1560",
+      primary: "platform-infra pipelines-as-code",
+      primaryStatus: "bun scripts/cli.ts platform-infra pipelines-as-code status --target JD01",
+      primaryHistory: "bun scripts/cli.ts platform-infra pipelines-as-code history --target JD01 --limit 10",
+      archived: "cicd gitea-actions-poc",
       deprecated: "cicd branch-follower",
-      note: "New CI/CD replacement work should use the Gitea Actions driven path; branch-follower is migration-only.",
+      note: "JD01 CI/CD source/trigger authority is Gitea mirror -> Pipelines-as-Code -> Tekton -> Argo/k8s runtime. Gitea Actions POC and branch-follower are historical or migration-only surfaces.",
     },
     subcommands: [
       cicdGiteaActionsPocHelp(),

scripts/src/platform-infra-gitea.ts

@@ -292,7 +292,7 @@ export function giteaHelp(): Record<string, unknown> {
       "bun scripts/cli.ts platform-infra gitea mirror sync --target JD01 --confirm",
       "bun scripts/cli.ts platform-infra gitea mirror status --target JD01 [--full|--raw]",
     ],
-    boundary: "Gitea is installed as an internal ClusterIP source-authority service for GH-1548/GH-1549/GH-1550; mirror source-authority takeover precedes Actions/CI integration.",
+    boundary: "Gitea is installed as an internal ClusterIP source-authority service for GH-1560; CI trigger authority is Pipelines-as-Code, not Gitea Actions.",
   };
 }
 
@@ -587,7 +587,7 @@ function validateConfig(gitea: GiteaConfig): void {
   if (!/^docker\.gitea\.com\/gitea$/u.test(gitea.app.image.repository)) throw new Error(`${configLabel}.app.image.repository must use the official Gitea image registry`);
   if (!/-rootless$/u.test(gitea.app.image.tag)) throw new Error(`${configLabel}.app.image.tag must use a rootless Gitea image`);
   if (gitea.app.service.type !== "ClusterIP") throw new Error(`${configLabel}.app.service.type must stay ClusterIP`);
-  if (!gitea.app.actions.enabled) throw new Error(`${configLabel}.app.actions.enabled must be true for GH-1548/GH-1549`);
+  if (!gitea.app.actions.enabled) throw new Error(`${configLabel}.app.actions.enabled must stay explicit while Gitea is the source-authority service`);
   if (!gitea.app.registration.disabled) throw new Error(`${configLabel}.app.registration.disabled must be true for the internal POC service`);
   if (gitea.app.probes.healthPath !== gitea.validation.healthPath) throw new Error(`${configLabel}.app.probes.healthPath must match validation.healthPath`);
   if (gitea.app.server.rootUrl !== gitea.app.publicExposure.publicBaseUrl.replace(/\/?$/u, "/")) throw new Error(`${configLabel}.app.server.rootUrl must match app.publicExposure.publicBaseUrl for the Web UI`);
@@ -1294,11 +1294,11 @@ function remoteScript(action: "apply" | "status" | "validate" | "mirror-bootstra
 function policyChecks(gitea: GiteaConfig, target: GiteaTarget, manifest: string): Array<Record<string, unknown>> {
   return [
     { name: "yaml-source-of-truth", ok: true, detail: "Gitea target, namespace, image, storage, ports and probes are read from config/platform-infra/gitea.yaml." },
-    { name: "gh-1548-service-contract", ok: target.namespace === "devops-infra" && gitea.app.serviceName === "gitea-http", detail: "The service matches config/cicd-gitea-actions-poc.yaml sourceAuthority.giteaMirror." },
+    { name: "gitea-pac-service-contract", ok: target.namespace === "devops-infra" && gitea.app.serviceName === "gitea-http", detail: "The service matches the active Gitea source authority consumed by config/platform-infra/pipelines-as-code.yaml." },
     { name: "cluster-internal-only", ok: !/^\s*type:\s*(NodePort|LoadBalancer)\s*$/mu.test(manifest) && !/^\s*kind:\s*Ingress\s*$/mu.test(manifest), detail: "Gitea is ClusterIP-only for the POC." },
     { name: "runtime-zero-docker", ok: !manifest.includes("/var/run/docker.sock") && !/^\s*hostPath:\s*$/mu.test(manifest), detail: "Runtime Gitea does not mount Docker socket or hostPath." },
     { name: "rootless-image", ok: /-rootless$/u.test(gitea.app.image.tag), detail: "The runtime image is Gitea rootless." },
-    { name: "actions-enabled", ok: gitea.app.actions.enabled, detail: "Gitea Actions is enabled; runner registration is a later controlled stage." },
+    { name: "actions-not-trigger-authority", ok: gitea.app.actions.enabled, detail: "Gitea may expose its built-in Actions capability, but JD01 CI/CD trigger authority is Pipelines-as-Code, not act_runner." },
     { name: "env-reuse-preserved", ok: gitea.migration.envReusePolicy === "preserve-existing-runtime-env-reuse", detail: "This install does not replace the existing env reuse path or runtime deployment." },
   ];
 }
@@ -1852,7 +1852,7 @@ function renderPlan(result: Record<string, unknown>): RenderedCliResult {
     `  status: ${stringValue(next.status)}`,
     `  validate: ${stringValue(next.validate)}`,
     "",
-    "Boundary: Gitea is internal ClusterIP source authority for GH-1548/GH-1549; runner and mirror repo bootstrap are separate controlled stages.",
+    "Boundary: Gitea is internal ClusterIP source authority for GH-1560; CI trigger authority is Pipelines-as-Code, not Gitea Actions/act_runner.",
     "Disclosure: Secret values are not printed; this stage does not create runner credentials.",
   ]);
 }

scripts/src/platform-infra-pipelines-as-code.ts

@@ -406,6 +406,7 @@ async function status(config: UniDeskConfig, options: CommonOptions): Promise<Re
     target: targetSummary(target),
     config: compactConfigSummary(pac, consumer, repository),
     consumer,
+    coverage: consumerCoverage(pac, target.id),
     summary,
     remote: parsed === null ? compactCapture(result, { full: true }) : options.raw || options.full ? parsed : summary,
     next: nextCommands(target.id, consumer.id, pac.defaults.consumerId),
@@ -694,6 +695,22 @@ function repositorySummary(repository: PacRepository): Record<string, unknown> {
   };
 }
 
+function consumerCoverage(pac: PacConfig, targetId: string): Record<string, unknown>[] {
+  return pac.consumers.map((consumer) => {
+    const repository = resolveRepository(pac, consumer.repositoryRef);
+    const suffix = consumerSuffix(consumer.id, pac.defaults.consumerId);
+    return {
+      consumer: consumer.id,
+      source: `${repository.owner}/${repository.repo}@${repository.params.source_branch ?? "-"}`,
+      namespace: consumer.namespace,
+      pipeline: consumer.pipeline,
+      argoApplication: consumer.argoApplication,
+      statusCommand: `bun scripts/cli.ts platform-infra pipelines-as-code status --target ${targetId}${suffix}`,
+      historyCommand: `bun scripts/cli.ts platform-infra pipelines-as-code history --target ${targetId}${suffix}`,
+    };
+  });
+}
+
 function consumerSuffix(consumerId: string, defaultConsumerId: string): string {
   return consumerId === defaultConsumerId ? "" : ` --consumer ${consumerId}`;
 }
@@ -759,12 +776,18 @@ function renderApply(result: Record<string, unknown>): RenderedCliResult {
 function renderStatus(result: Record<string, unknown>): RenderedCliResult {
   const summary = record(result.summary);
   const consumer = record(result.consumer);
+  const coverage = arrayRecords(result.coverage);
   const latest = record(summary.latestPipelineRun);
   const taskRuns = arrayRecords(summary.taskRuns);
   const artifact = record(summary.artifact);
   const argo = record(summary.argo);
   const lines = [
     "PLATFORM-INFRA PIPELINES-AS-CODE STATUS",
+    ...(coverage.length === 0 ? [] : [
+      "COVERAGE",
+      ...table(["CONSUMER", "SOURCE", "NAMESPACE", "PIPELINE", "ARGO_APP"], coverage.map((item) => [stringValue(item.consumer), stringValue(item.source), stringValue(item.namespace), stringValue(item.pipeline), stringValue(item.argoApplication)])),
+      "",
+    ]),
     ...table(["CONSUMER", "READY", "CRD", "CONTROLLER", "WEBHOOKS", "REPOSITORY"], [[stringValue(consumer.id), boolText(summary.ready), boolText(summary.crdPresent), stringValue(summary.controllerReady), stringValue(summary.webhookCount), compactLine(stringValue(summary.repositoryCondition))]]),
     "",
     "LATEST PIPELINERUN",
@@ -781,6 +804,7 @@ function renderStatus(result: Record<string, unknown>): RenderedCliResult {
     "",
     "NEXT",
     `  full: ${stringValue(record(result.next).status)} --full`,
+    `  all-history: ${stringValue(record(result.next).history).replace(/ --consumer [^ ]+/u, "")} --limit 10`,
   ];
   return rendered(result, "platform-infra pipelines-as-code status", lines);
 }