docs: standardize gitea pac cicd architecture

scripts/src/cicd-branch-follower.ts

@@ -572,9 +572,11 @@ function buildPlan(registry: BranchFollowerRegistry, options: ParsedOptions): Re
     },
     followers,
     next: {
-      apply: "bun scripts/cli.ts cicd branch-follower apply --confirm --wait",
-      status: "bun scripts/cli.ts cicd branch-follower status",
-      dryRun: "bun scripts/cli.ts cicd branch-follower run-once --all --dry-run",
+      pacStatus: "bun scripts/cli.ts platform-infra pipelines-as-code status --target JD01",
+      pacHistory: "bun scripts/cli.ts platform-infra pipelines-as-code history --target JD01 --limit 10",
+      legacyApply: "bun scripts/cli.ts cicd branch-follower apply --confirm --wait",
+      legacyStatus: "bun scripts/cli.ts cicd branch-follower status",
+      legacyDryRun: "bun scripts/cli.ts cicd branch-follower run-once --all --dry-run",
     },
   };
 }
@@ -654,9 +656,11 @@ async function buildStatus(registry: BranchFollowerRegistry, options: ParsedOpti
     errors: k8s.errors,
     warnings: k8s.warnings,
     next: {
-      apply: "bun scripts/cli.ts cicd branch-follower apply --confirm --wait",
+      pacStatus: "bun scripts/cli.ts platform-infra pipelines-as-code status --target JD01",
+      pacHistory: "bun scripts/cli.ts platform-infra pipelines-as-code history --target JD01 --limit 10",
+      legacyApply: "bun scripts/cli.ts cicd branch-follower apply --confirm --wait",
       liveStatus: "bun scripts/cli.ts cicd branch-follower status --live",
-      dryRun: "bun scripts/cli.ts cicd branch-follower run-once --all --dry-run",
+      legacyDryRun: "bun scripts/cli.ts cicd branch-follower run-once --all --dry-run",
     },
   };
 }

scripts/src/cicd-gitea-actions-poc.ts

@@ -1,5 +1,5 @@
-// SPEC: GH-1548 Gitea mirror/Actions visibility and controlled Docker builder POC.
-// Responsibility: read-only YAML-first plan/status for the proposed CI/CD governance split.
+// SPEC: GH-1548/GH-1560 archived Gitea Actions POC.
+// Responsibility: read-only historical plan/status for the retired Gitea Actions POC.
 import { existsSync, readFileSync } from "node:fs";
 import { isAbsolute } from "node:path";
 import { rootPath, type UniDeskConfig } from "./config";
@@ -29,6 +29,8 @@ interface LoadedPoc {
 export function cicdGiteaActionsPocHelp(): unknown {
   return {
     command: "cicd gitea-actions-poc plan|status",
+    archived: true,
+    replacement: "bun scripts/cli.ts platform-infra pipelines-as-code status --target JD01",
     output: "text by default; use --json, --raw, or -o json|yaml for machine output",
     usage: [
       "bun scripts/cli.ts cicd gitea-actions-poc plan",
@@ -36,8 +38,8 @@ export function cicdGiteaActionsPocHelp(): unknown {
       "bun scripts/cli.ts cicd gitea-actions-poc plan --target agentrun-jd01-v02",
     ],
     config: DEFAULT_CONFIG_PATH,
-    issue: "https://github.com/pikasTech/unidesk/issues/1548",
-    description: "Read-only P1/P2 plan for replacing branch-follower responsibilities with Gitea mirror, Gitea Actions visibility, controlled Docker/BuildKit builder plane, existing Tekton, existing Argo CD, and bounded UniDesk status while preserving env reuse.",
+    issue: "https://github.com/pikasTech/unidesk/issues/1560",
+    description: "Archived read-only POC. JD01 production CI/CD uses Gitea mirror -> Pipelines-as-Code -> Tekton -> Argo/k8s runtime; do not use Gitea Actions or act_runner as a fallback.",
   };
 }
 
@@ -385,6 +387,9 @@ function renderPlanHuman(payload: Record<string, unknown>): string {
   return [
     `CI/CD GITEA-ACTIONS POC PLAN (${payload.ok === false ? "blocked" : "ok"})`,
     "",
+    "ARCHIVE NOTICE",
+    "This is historical GH-1548 POC material. Current JD01 CI/CD closeout is platform-infra pipelines-as-code status/history; Gitea Actions and act_runner are not fallback paths.",
+    "",
     table(["TARGET", "SOURCE", "NODE/LANE", "BASELINE", "SNAPSHOT", "TEKTON", "ARGO", "RUNTIME"], arrayRecords(payload.targets).map((target) => [
       target.id,
       `${target.repository ?? "-"}@${target.branch ?? "-"}`,
@@ -428,8 +433,10 @@ function renderPlanHuman(payload: Record<string, unknown>): string {
     errors.length === 0 ? "" : `\nERRORS\n${errors.map((item) => `- ${item}`).join("\n")}`,
     "",
     "NEXT",
-    `status: ${next?.status ?? "-"}`,
-    `existing-follower: ${next?.existingFollowerStatus ?? "-"}`,
+    `pac-status: bun scripts/cli.ts platform-infra pipelines-as-code status --target JD01`,
+    `pac-history: bun scripts/cli.ts platform-infra pipelines-as-code history --target JD01 --limit 10`,
+    `archived-status: ${next?.status ?? "-"}`,
+    `legacy-follower: ${next?.existingFollowerStatus ?? "-"}`,
     `issue: ${next?.pocIssue ?? payload.issue ?? "-"}`,
     "",
   ].filter((line) => line !== "").join("\n");
@@ -443,6 +450,9 @@ function renderStatusHuman(payload: Record<string, unknown>): string {
   return [
     `CI/CD GITEA-ACTIONS POC STATUS (${payload.ok === false ? "blocked" : "declared-only"})`,
     "",
+    "ARCHIVE NOTICE",
+    "This command reads an archived POC spec only. Use platform-infra pipelines-as-code status/history for current JD01 CI/CD evidence.",
+    "",
     `statusSource=${payload.statusSource ?? "-"} mode=${payload.statusMode ?? "-"}`,
     `replacement=${migration?.replacementTarget ?? "-"} branchFollower=${branchFollower?.status ?? "-"}:${branchFollower?.mode ?? "-"}`,
     "",
@@ -460,8 +470,10 @@ function renderStatusHuman(payload: Record<string, unknown>): string {
     errors.length === 0 ? "" : `\nERRORS\n${errors.map((item) => `- ${item}`).join("\n")}`,
     "",
     "NEXT",
-    `plan: ${next?.plan ?? "-"}`,
-    `existing-follower: ${next?.existingFollowerStatus ?? "-"}`,
+    `pac-status: bun scripts/cli.ts platform-infra pipelines-as-code status --target JD01`,
+    `pac-history: bun scripts/cli.ts platform-infra pipelines-as-code history --target JD01 --limit 10`,
+    `archived-plan: ${next?.plan ?? "-"}`,
+    `legacy-follower: ${next?.existingFollowerStatus ?? "-"}`,
     "",
   ].filter((line) => line !== "").join("\n");
 }

scripts/src/cicd-help.ts

@@ -5,21 +5,15 @@ export function buildCicdHelp(configPath: string, spec: string): unknown {
   return {
     command: "cicd branch-follower plan|apply|status|run-once|debug-step|cleanup-state|events|logs|taskrun|job|runtime|gate",
     deprecated: true,
-    mode: "migration-only",
-    replacement: "bun scripts/cli.ts cicd gitea-actions-poc plan",
-    issue: "https://github.com/pikasTech/unidesk/issues/1549",
+    mode: "retired-readonly-for-jd01-consumers",
+    replacement: "bun scripts/cli.ts platform-infra pipelines-as-code status --target JD01",
+    issue: "https://github.com/pikasTech/unidesk/issues/1560",
     output: "text by default; use --json, --raw, or -o json|yaml for machine output",
     usage: [
-      "bun scripts/cli.ts cicd branch-follower plan",
-      "bun scripts/cli.ts cicd branch-follower apply --confirm --wait",
       "bun scripts/cli.ts cicd branch-follower status",
       "bun scripts/cli.ts cicd branch-follower status --live",
-      "bun scripts/cli.ts cicd branch-follower run-once --all --dry-run",
-      "bun scripts/cli.ts cicd branch-follower run-once --follower hwlab-jd01-v03 --confirm --wait",
       "bun scripts/cli.ts cicd branch-follower debug-step --follower web-probe-sentinel-master --step controller-source",
       "bun scripts/cli.ts cicd branch-follower debug-step --follower web-probe-sentinel-master --step state-read",
-      "bun scripts/cli.ts cicd branch-follower debug-step --follower web-probe-sentinel-master --step state-write --confirm",
-      "bun scripts/cli.ts cicd branch-follower cleanup-state --follower web-probe-sentinel-master --confirm",
       "bun scripts/cli.ts cicd branch-follower events --follower agentrun-jd01-v02",
       "bun scripts/cli.ts cicd branch-follower logs --follower web-probe-sentinel-master",
       "bun scripts/cli.ts cicd branch-follower taskrun --follower hwlab-jd01-v03 --taskrun runtime-ready --logs-tail 120 --json",
@@ -31,6 +25,12 @@ export function buildCicdHelp(configPath: string, spec: string): unknown {
     ],
     config: configPath,
     spec,
-    description: "Deprecated migration-only branch follower controller. Existing production status/debug remains available during cutover, but new CI/CD replacement work should use Gitea mirror and Gitea Actions.",
+    description: "Retired branch-follower controller surface for the JD01 migrated consumers. Use PaC status/history for current closeout; branch-follower commands remain only for historical state and bounded migration diagnostics.",
+    currentCloseout: [
+      "bun scripts/cli.ts platform-infra gitea mirror status --target JD01",
+      "bun scripts/cli.ts platform-infra gitea mirror webhook status --target JD01",
+      "bun scripts/cli.ts platform-infra pipelines-as-code status --target JD01",
+      "bun scripts/cli.ts platform-infra pipelines-as-code history --target JD01 --limit 10",
+    ],
   };
 }

scripts/src/cicd-render.ts

@@ -53,8 +53,8 @@ function renderPlanHuman(payload: Record<string, unknown>): string {
     `CI/CD BRANCH-FOLLOWER PLAN (${payload.ok === false ? "blocked" : "ok"})`,
     "",
     "DEPRECATION",
-    "branch-follower=migration-only replacement=\"bun scripts/cli.ts cicd gitea-actions-poc plan\" issue=https://github.com/pikasTech/unidesk/issues/1549",
-    "Do not add new branch-follower controller-loop features; use the Gitea Actions driven path from #1548/#1549.",
+    "branch-follower=retired-for-jd01-consumers replacement=\"bun scripts/cli.ts platform-infra pipelines-as-code status --target JD01\" issue=https://github.com/pikasTech/unidesk/issues/1560",
+    "Do not use branch-follower or Gitea Actions as the current delivery path for JD01 AgentRun, sentinel, or HWLAB v0.3; use Gitea mirror + Pipelines-as-Code.",
     "",
     table(["FOLLOWER", "ENABLED", "ADAPTER", "SOURCE", "TARGET", "BUDGET", "REFS", "CHECKS"], rows),
     "",
@@ -62,9 +62,11 @@ function renderPlanHuman(payload: Record<string, unknown>): string {
     `hostWorktreeAuthority=${payload.hostWorktreeAuthority === true ? "true" : "false"} mode=${asOptionalRecord(payload.sourceAuthority)?.mode ?? "-"} resolver=${asOptionalRecord(payload.sourceAuthority)?.resolver ?? "-"}`,
     "",
     "NEXT",
-    `apply: ${next?.apply ?? "-"}`,
-    `status: ${next?.status ?? "-"}`,
-    `dry-run: ${next?.dryRun ?? "-"}`,
+    `pac-status: ${next?.pacStatus ?? "bun scripts/cli.ts platform-infra pipelines-as-code status --target JD01"}`,
+    `pac-history: ${next?.pacHistory ?? "bun scripts/cli.ts platform-infra pipelines-as-code history --target JD01 --limit 10"}`,
+    `legacy-apply: ${next?.legacyApply ?? "-"}`,
+    `legacy-status: ${next?.legacyStatus ?? next?.status ?? "-"}`,
+    `legacy-dry-run: ${next?.legacyDryRun ?? next?.dryRun ?? "-"}`,
     "",
   ].join("\n");
 }
@@ -124,6 +126,9 @@ function renderStatusHuman(payload: Record<string, unknown>, _options: ParsedOpt
   return [
     `CI/CD BRANCH-FOLLOWER STATUS (${payload.ok === false ? "degraded" : "ok"})`,
     "",
+    "RETIREMENT",
+    "This status is historical/migration-only for JD01 migrated consumers. Current closeout: bun scripts/cli.ts platform-infra pipelines-as-code status --target JD01; audit: bun scripts/cli.ts platform-infra pipelines-as-code history --target JD01 --limit 10",
+    "",
     table(
       ["CTRL_NS", "ROUTE", "DEPLOY", "READY", "PODS", "PODS_READ", "STATE_CM", "LEASE"],
       [[controller?.namespace ?? "-", controller?.route ?? "-", controller?.deploymentName ?? "-", `${controller?.availableReplicas ?? 0}/${controller?.replicas ?? 0}`, controller?.pods ?? "-", controller?.podsReadStatus ?? "-", controller?.stateConfigMapPresent === true ? "present" : "missing", controller?.leaseHolder ?? "-"]],
@@ -141,8 +146,10 @@ function renderStatusHuman(payload: Record<string, unknown>, _options: ParsedOpt
     errors.length === 0 ? "" : `\nERRORS\n${errors.map((item) => `- ${item}`).join("\n")}`,
     "",
     "NEXT",
-    `live-status: ${next?.liveStatus ?? "-"}`,
-    `dry-run: ${next?.dryRun ?? "-"}`,
+    `pac-status: bun scripts/cli.ts platform-infra pipelines-as-code status --target JD01`,
+    `pac-history: bun scripts/cli.ts platform-infra pipelines-as-code history --target JD01 --limit 10`,
+    `legacy-live-status: ${next?.liveStatus ?? "-"}`,
+    `legacy-dry-run: ${next?.legacyDryRun ?? next?.dryRun ?? "-"}`,
     "",
   ].filter((line) => line !== "").join("\n");
 }

scripts/src/cicd.ts

@@ -1,4 +1,4 @@
-// SPEC: PJ2026-01060703 CI/CD branch follower and GH-1548 Gitea Actions POC.
+// SPEC: PJ2026-01060703 CI/CD branch follower and GH-1548/GH-1560 Gitea PaC migration.
 // Responsibility: thin CI/CD top-level route entry; subcommand logic lives in responsibility modules.
 import type { UniDeskConfig } from "./config";
 import { renderMachine } from "./cicd-render";
@@ -11,10 +11,13 @@ export function cicdHelp(): unknown {
     command: "cicd gitea-actions-poc|branch-follower",
     output: "text by default for subcommands; top-level help is json",
     migration: {
-      issue: "https://github.com/pikasTech/unidesk/issues/1549",
-      primary: "cicd gitea-actions-poc",
+      issue: "https://github.com/pikasTech/unidesk/issues/1560",
+      primary: "platform-infra pipelines-as-code",
+      primaryStatus: "bun scripts/cli.ts platform-infra pipelines-as-code status --target JD01",
+      primaryHistory: "bun scripts/cli.ts platform-infra pipelines-as-code history --target JD01 --limit 10",
+      archived: "cicd gitea-actions-poc",
       deprecated: "cicd branch-follower",
-      note: "New CI/CD replacement work should use the Gitea Actions driven path; branch-follower is migration-only.",
+      note: "JD01 CI/CD source/trigger authority is Gitea mirror -> Pipelines-as-Code -> Tekton -> Argo/k8s runtime. Gitea Actions POC and branch-follower are historical or migration-only surfaces.",
     },
     subcommands: [
       cicdGiteaActionsPocHelp(),

scripts/src/platform-infra-gitea.ts

@@ -292,7 +292,7 @@ export function giteaHelp(): Record<string, unknown> {
       "bun scripts/cli.ts platform-infra gitea mirror sync --target JD01 --confirm",
       "bun scripts/cli.ts platform-infra gitea mirror status --target JD01 [--full|--raw]",
     ],
-    boundary: "Gitea is installed as an internal ClusterIP source-authority service for GH-1548/GH-1549/GH-1550; mirror source-authority takeover precedes Actions/CI integration.",
+    boundary: "Gitea is installed as an internal ClusterIP source-authority service for GH-1560; CI trigger authority is Pipelines-as-Code, not Gitea Actions.",
   };
 }
 
@@ -587,7 +587,7 @@ function validateConfig(gitea: GiteaConfig): void {
   if (!/^docker\.gitea\.com\/gitea$/u.test(gitea.app.image.repository)) throw new Error(`${configLabel}.app.image.repository must use the official Gitea image registry`);
   if (!/-rootless$/u.test(gitea.app.image.tag)) throw new Error(`${configLabel}.app.image.tag must use a rootless Gitea image`);
   if (gitea.app.service.type !== "ClusterIP") throw new Error(`${configLabel}.app.service.type must stay ClusterIP`);
-  if (!gitea.app.actions.enabled) throw new Error(`${configLabel}.app.actions.enabled must be true for GH-1548/GH-1549`);
+  if (!gitea.app.actions.enabled) throw new Error(`${configLabel}.app.actions.enabled must stay explicit while Gitea is the source-authority service`);
   if (!gitea.app.registration.disabled) throw new Error(`${configLabel}.app.registration.disabled must be true for the internal POC service`);
   if (gitea.app.probes.healthPath !== gitea.validation.healthPath) throw new Error(`${configLabel}.app.probes.healthPath must match validation.healthPath`);
   if (gitea.app.server.rootUrl !== gitea.app.publicExposure.publicBaseUrl.replace(/\/?$/u, "/")) throw new Error(`${configLabel}.app.server.rootUrl must match app.publicExposure.publicBaseUrl for the Web UI`);
@@ -1294,11 +1294,11 @@ function remoteScript(action: "apply" | "status" | "validate" | "mirror-bootstra
 function policyChecks(gitea: GiteaConfig, target: GiteaTarget, manifest: string): Array<Record<string, unknown>> {
   return [
     { name: "yaml-source-of-truth", ok: true, detail: "Gitea target, namespace, image, storage, ports and probes are read from config/platform-infra/gitea.yaml." },
-    { name: "gh-1548-service-contract", ok: target.namespace === "devops-infra" && gitea.app.serviceName === "gitea-http", detail: "The service matches config/cicd-gitea-actions-poc.yaml sourceAuthority.giteaMirror." },
+    { name: "gitea-pac-service-contract", ok: target.namespace === "devops-infra" && gitea.app.serviceName === "gitea-http", detail: "The service matches the active Gitea source authority consumed by config/platform-infra/pipelines-as-code.yaml." },
     { name: "cluster-internal-only", ok: !/^\s*type:\s*(NodePort|LoadBalancer)\s*$/mu.test(manifest) && !/^\s*kind:\s*Ingress\s*$/mu.test(manifest), detail: "Gitea is ClusterIP-only for the POC." },
     { name: "runtime-zero-docker", ok: !manifest.includes("/var/run/docker.sock") && !/^\s*hostPath:\s*$/mu.test(manifest), detail: "Runtime Gitea does not mount Docker socket or hostPath." },
     { name: "rootless-image", ok: /-rootless$/u.test(gitea.app.image.tag), detail: "The runtime image is Gitea rootless." },
-    { name: "actions-enabled", ok: gitea.app.actions.enabled, detail: "Gitea Actions is enabled; runner registration is a later controlled stage." },
+    { name: "actions-not-trigger-authority", ok: gitea.app.actions.enabled, detail: "Gitea may expose its built-in Actions capability, but JD01 CI/CD trigger authority is Pipelines-as-Code, not act_runner." },
     { name: "env-reuse-preserved", ok: gitea.migration.envReusePolicy === "preserve-existing-runtime-env-reuse", detail: "This install does not replace the existing env reuse path or runtime deployment." },
   ];
 }
@@ -1852,7 +1852,7 @@ function renderPlan(result: Record<string, unknown>): RenderedCliResult {
     `  status: ${stringValue(next.status)}`,
     `  validate: ${stringValue(next.validate)}`,
     "",
-    "Boundary: Gitea is internal ClusterIP source authority for GH-1548/GH-1549; runner and mirror repo bootstrap are separate controlled stages.",
+    "Boundary: Gitea is internal ClusterIP source authority for GH-1560; CI trigger authority is Pipelines-as-Code, not Gitea Actions/act_runner.",
     "Disclosure: Secret values are not printed; this stage does not create runner credentials.",
   ]);
 }

scripts/src/platform-infra-pipelines-as-code.ts

@@ -406,6 +406,7 @@ async function status(config: UniDeskConfig, options: CommonOptions): Promise<Re
     target: targetSummary(target),
     config: compactConfigSummary(pac, consumer, repository),
     consumer,
+    coverage: consumerCoverage(pac, target.id),
     summary,
     remote: parsed === null ? compactCapture(result, { full: true }) : options.raw || options.full ? parsed : summary,
     next: nextCommands(target.id, consumer.id, pac.defaults.consumerId),
@@ -694,6 +695,22 @@ function repositorySummary(repository: PacRepository): Record<string, unknown> {
   };
 }
 
+function consumerCoverage(pac: PacConfig, targetId: string): Record<string, unknown>[] {
+  return pac.consumers.map((consumer) => {
+    const repository = resolveRepository(pac, consumer.repositoryRef);
+    const suffix = consumerSuffix(consumer.id, pac.defaults.consumerId);
+    return {
+      consumer: consumer.id,
+      source: `${repository.owner}/${repository.repo}@${repository.params.source_branch ?? "-"}`,
+      namespace: consumer.namespace,
+      pipeline: consumer.pipeline,
+      argoApplication: consumer.argoApplication,
+      statusCommand: `bun scripts/cli.ts platform-infra pipelines-as-code status --target ${targetId}${suffix}`,
+      historyCommand: `bun scripts/cli.ts platform-infra pipelines-as-code history --target ${targetId}${suffix}`,
+    };
+  });
+}
+
 function consumerSuffix(consumerId: string, defaultConsumerId: string): string {
   return consumerId === defaultConsumerId ? "" : ` --consumer ${consumerId}`;
 }
@@ -759,12 +776,18 @@ function renderApply(result: Record<string, unknown>): RenderedCliResult {
 function renderStatus(result: Record<string, unknown>): RenderedCliResult {
   const summary = record(result.summary);
   const consumer = record(result.consumer);
+  const coverage = arrayRecords(result.coverage);
   const latest = record(summary.latestPipelineRun);
   const taskRuns = arrayRecords(summary.taskRuns);
   const artifact = record(summary.artifact);
   const argo = record(summary.argo);
   const lines = [
     "PLATFORM-INFRA PIPELINES-AS-CODE STATUS",
+    ...(coverage.length === 0 ? [] : [
+      "COVERAGE",
+      ...table(["CONSUMER", "SOURCE", "NAMESPACE", "PIPELINE", "ARGO_APP"], coverage.map((item) => [stringValue(item.consumer), stringValue(item.source), stringValue(item.namespace), stringValue(item.pipeline), stringValue(item.argoApplication)])),
+      "",
+    ]),
     ...table(["CONSUMER", "READY", "CRD", "CONTROLLER", "WEBHOOKS", "REPOSITORY"], [[stringValue(consumer.id), boolText(summary.ready), boolText(summary.crdPresent), stringValue(summary.controllerReady), stringValue(summary.webhookCount), compactLine(stringValue(summary.repositoryCondition))]]),
     "",
     "LATEST PIPELINERUN",
@@ -781,6 +804,7 @@ function renderStatus(result: Record<string, unknown>): RenderedCliResult {
     "",
     "NEXT",
     `  full: ${stringValue(record(result.next).status)} --full`,
+    `  all-history: ${stringValue(record(result.next).history).replace(/ --consumer [^ ]+/u, "")} --limit 10`,
   ];
   return rendered(result, "platform-infra pipelines-as-code status", lines);
 }