AGENTS.md

@@ -16,15 +16,6 @@
 - The testing suite, onboarding, and mutation E2E commands must target `Maidn` fixture sources.
 - `test-org-2` is disposable execution state only. It may host temporary delivery branches and resources, but it is never a fixture source or test-suite owner.
 
-## Delivery Ownership
-
-- Application repositories are build inputs only; do not add or update active
-  `.tekton/` or `.maidn/` delivery resources in them.
-- The cluster repository owns Pipelines, Tasks, triggers, and runtime secret
-  access. The manifests repository owns image tags and promotion state.
-- Flux chart sources must use only the protected `maidn/platform-<app>` branch,
-  never an application `main` or `maidn/delivery-*` branch.
-
 ## Required Checks
 
 - Before each commit: inspect `git status --short`, `git diff --check`, and `git log --oneline -10`.

README.md

@@ -1,15 +1,26 @@
 ## Commands
 
-- `cicd-tool repo init` is a legacy GitHub workflow and is not used for new Forgejo/GitOps platform onboarding.
+go mod init github.com/Pingu-Studio/MaidnCLI
+go get -u github.com/spf13/cobra@latest
+go get golang.org/x/term
+go mod tidy
+go get gopkg.in/yaml.v3
+
+in powershell run
+```powershell
+go install github.com/go-delve/delve/cmd/dlv@latest
+dlv version
+```
+## Commands
+
+- `cicd-tool repo init --org <org> --flux-repo <repo>` creates the manifests and Flux repos
 - `cicd-tool bootstrap` runs a shorter Forgejo-first wizard, asks for a Forgejo PAT, asks where local repos should be cloned, discovers Proxmox nodes/storage/networks, retries without losing entered answers when discovery fails, shows the latest Talos version, derives the standardized Talos factory URL, schematic, and required extensions automatically from the chosen version, writes `terraform.tfvars`, stages Talos images on Proxmox, and can execute Terraform, Talos bootstrap, and Flux bootstrap
 - `cicd-tool bootstrap --config maidn-bootstrap.yaml` skips the wizard and uses the saved config
-- `cicd-tool bootstrap init --config <private-config> --organization <new-org> --create-organization` locks an isolated workspace, initializes Forgejo repositories, then runs the non-destructive bootstrap reconcile lifecycle. Use `--mode=rebuild --yes` only for an authorized rebuild.
+- `maidn bootstrap init --config <private-config> --organization <new-org> --create-organization --enable-delivery` locks an isolated workspace, initializes the Forgejo repositories, then runs the non-destructive bootstrap reconcile lifecycle; use `--mode=rebuild --yes` for an authorized rebuild. Delivery scaffolding requires `--enable-delivery`.
-- `cicd-tool app onboard --config <private-config> --from <app-checkout>` is being migrated to central delivery ownership. Do not use the source-owned implementation for new applications; see `docs/architecture/delivery-ownership.md`.
+- `maidn app onboard --config <private-config> --from <app-checkout>` validates a clean configured checkout and adds its `.tekton` delivery contract.
 - `cicd-tool e2e` runs bounded, read-only Flux, ExternalSecret, PipelineRun, preview, and promotion-PR checks with JSON output. See `docs/e2e.md`.
 
 See `docs/operations.md` for the authorized operating and verification runbook.
-See `docs/architecture/delivery-ownership.md` for the developer and platform
-ownership boundary.
 App authors: see `docs/delivery-feedback.md` for preview feedback and the scoped Forgejo token contract.
 
 ## Forgejo setup

cmd/bootstrap.go

@@ -34,7 +34,6 @@ var bootstrapMergeBootstrapPR bool
 var bootstrapManageNetworkBridges bool
 var bootstrapEnableDelivery bool
 var bootstrapDestroyDemocraticCSIStorage bool
-var bootstrapRefreshTemplateRevisions bool
 
 var upsertOperationalSecret = bootstrap.UpsertOperationalSecret
 var readOperationalSecrets = bootstrap.ReadOperationalSecrets
@@ -69,16 +68,9 @@ func init() {
 	bootstrapCmd.Flags().BoolVar(&bootstrapManageNetworkBridges, "manage-network-bridges", false, "Persist Terraform management for existing Talos network bridges")
 	bootstrapCmd.Flags().BoolVar(&bootstrapEnableDelivery, "enable-delivery", false, "Resolve delivery defaults and reconcile the configured app delivery source")
 	bootstrapCmd.Flags().BoolVar(&bootstrapDestroyDemocraticCSIStorage, "destroy-democratic-csi-storage", false, "Delete only TrueNAS datasets under this cluster's configured Democratic CSI parent during rebuild")
-	bootstrapCmd.Flags().BoolVar(&bootstrapRefreshTemplateRevisions, "refresh-template-revisions", false, "Refresh existing template revision locks from configured branch heads during reconcile")
 }
 
 func runBootstrap(cmd *cobra.Command, args []string) error {
-	if err := validateTemplateRevisionRefresh(bootstrapRefreshTemplateRevisions, bootstrap.Mode(bootstrapMode), cmd != nil && cmd.Flags().Changed("mode")); err != nil {
-		return err
-	}
-	if bootstrapRefreshTemplateRevisions && (bootstrapProvisionAppSecretIdentities || bootstrapCreateForgejoRegistryToken || bootstrapCreateForgejoDeliveryStatusToken || bootstrapRotateWebhookAuthorization || bootstrapInitializeOpenBao || bootstrapMergeBootstrapPR) {
-		return errors.New("--refresh-template-revisions is available only for the bootstrap lifecycle")
-	}
 	var cfg config.Config
 	var err error
 	if bootstrapProvisionAppSecretIdentities {
@@ -254,17 +246,10 @@ func runBootstrap(cmd *cobra.Command, args []string) error {
 		}
 	}
 
-	runner := bootstrap.Runner{Config: cfg, Mode: bootstrap.Mode(bootstrapMode), ConfirmRebuild: bootstrapYes, RegisterWebhook: bootstrapRegisterWebhook, EnableDelivery: bootstrapEnableDelivery, DestroyDemocraticCSIStorage: bootstrapDestroyDemocraticCSIStorage, RefreshTemplateRevisions: bootstrapRefreshTemplateRevisions}
+	runner := bootstrap.Runner{Config: cfg, Mode: bootstrap.Mode(bootstrapMode), ConfirmRebuild: bootstrapYes, RegisterWebhook: bootstrapRegisterWebhook, EnableDelivery: bootstrapEnableDelivery, DestroyDemocraticCSIStorage: bootstrapDestroyDemocraticCSIStorage}
 	return runner.Run()
 }
 
-func validateTemplateRevisionRefresh(refresh bool, mode bootstrap.Mode, modeExplicit bool) error {
-	if refresh && (!modeExplicit || mode != bootstrap.Reconcile) {
-		return errors.New("--refresh-template-revisions requires --mode=reconcile")
-	}
-	return nil
-}
-
 func seedForgejoOperationalCredentials(cfg config.Config) error {
 	if err := upsertOperationalSecret(cfg.SOPS.OperationalSecretsPath, cfg.SOPS.AgeKeyPath, "cicd/forgejo", "username", cfg.Git.Username); err != nil {
 		return fmt.Errorf("save Forgejo username for webhook registration: %w", err)

cmd/bootstrap_test.go

@@ -5,31 +5,9 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/Pingu-Studio/MaidnCLI/internal/bootstrap"
 	"github.com/Pingu-Studio/MaidnCLI/internal/config"
 )
 
-func TestValidateTemplateRevisionRefreshRequiresExplicitReconcileMode(t *testing.T) {
-	tests := []struct {
-		name         string
-		mode         bootstrap.Mode
-		modeExplicit bool
-		wantErr      bool
-	}{
-		{name: "reconcile", mode: bootstrap.Reconcile, modeExplicit: true},
-		{name: "rebuild", mode: bootstrap.Rebuild, modeExplicit: true, wantErr: true},
-		{name: "missing mode", mode: bootstrap.Reconcile, wantErr: true},
-	}
-	for _, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-			err := validateTemplateRevisionRefresh(true, test.mode, test.modeExplicit)
-			if (err != nil) != test.wantErr {
-				t.Fatalf("validateTemplateRevisionRefresh() error = %v, wantErr %t", err, test.wantErr)
-			}
-		})
-	}
-}
-
 func TestCreateForgejoRegistryTokenRequiresConfig(t *testing.T) {
 	originalConfigPath, originalCreate := bootstrapConfigPath, bootstrapCreateForgejoRegistryToken
 	defer func() {

cmd/e2e_mutate.go

@@ -23,7 +23,7 @@ var e2eMutateCmd = &cobra.Command{
 func init() {
 	rootCmd.AddCommand(e2eMutateCmd)
 	e2eMutateCmd.Flags().StringVar(&e2eMutateForgejoURL, "forgejo-url", "", "Credential-free Forgejo base URL")
-	e2eMutateCmd.Flags().StringVar(&e2eMutateOwner, "owner", "", "Fixture Forgejo owner (must be Maidn)")
+	e2eMutateCmd.Flags().StringVar(&e2eMutateOwner, "owner", "", "Fixture Forgejo owner (must be test-org-2)")
 	e2eMutateCmd.Flags().StringVar(&e2eMutateRepo, "repo", "", "Fixture Forgejo repository (must start maidn-e2e-)")
 	e2eMutateCmd.Flags().StringVar(&e2eMutateBranch, "branch", "", "Fixture Forgejo branch (must start maidn-e2e-)")
 	e2eMutateCmd.Flags().StringVar(&e2eMutateSHA, "sha", "", "Full Git object ID for the fixture branch")

cmd/e2e_mutate_test.go

@@ -35,7 +35,7 @@ func TestE2EMutateCommandWiringUsesOnlyTokenReferences(t *testing.T) {
 	}
 	fake := &commandMutationHTTP{}
 	e2eMutator = func() e2emutate.Mutator { return e2emutate.Mutator{HTTP: fake} }
-	e2eMutateForgejoURL, e2eMutateOwner = "https://git.example.test", "Maidn"
+	e2eMutateForgejoURL, e2eMutateOwner = "https://git.example.test", "test-org-2"
 	e2eMutateRepo, e2eMutateBranch = "maidn-e2e-repo", "maidn-e2e-branch"
 	e2eMutateSHA = "0123456789abcdef0123456789abcdef01234567"
 	e2eMutateTokenEnv, e2eMutateTokenFile, e2eMutateOpenPR = "E2E_MUTATE_TEST_TOKEN", "", false

cmd/fresh.go

@@ -9,7 +9,7 @@ import (
 )
 
 var freshConfigPath, freshOrganization, onboardConfigPath, onboardFrom string
-var onboardAppName, onboardAppRepoURL, onboardImageRepository, onboardBuildStrategy, onboardBuildOutputDirectory, onboardBuildConfiguration string
+var onboardAppName, onboardAppRepoURL, onboardImageRepository string
 var freshCreateOrganization, freshEnableDelivery, freshYes bool
 var freshMode string
 
@@ -32,7 +32,7 @@ var appCmd = &cobra.Command{
 
 var appOnboardCmd = &cobra.Command{
 	Use:   "onboard",
-	Short: "Validate an application checkout and add its centrally-owned delivery contract.",
+	Short: "Validate an application checkout and add its source-owned delivery contract.",
 	RunE:  runAppOnboard,
 }
 
@@ -50,13 +50,10 @@ func init() {
 	rootCmd.AddCommand(appCmd)
 	appCmd.AddCommand(appOnboardCmd)
 	appOnboardCmd.Flags().StringVar(&onboardConfigPath, "config", "", "Path to private bootstrap config YAML")
-	appOnboardCmd.Flags().StringVar(&onboardFrom, "from", "", "Clean application checkout to validate")
+	appOnboardCmd.Flags().StringVar(&onboardFrom, "from", "", "Clean application checkout to scaffold")
 	appOnboardCmd.Flags().StringVar(&onboardAppName, "app-name", "", "Application name override")
 	appOnboardCmd.Flags().StringVar(&onboardAppRepoURL, "app-repo-url", "", "Application repository URL override")
 	appOnboardCmd.Flags().StringVar(&onboardImageRepository, "image-repository", "", "OCI image repository override")
-	appOnboardCmd.Flags().StringVar(&onboardBuildStrategy, "build-strategy", "", "Build strategy override: static or runtime")
-	appOnboardCmd.Flags().StringVar(&onboardBuildOutputDirectory, "build-output-directory", "", "Static build output directory override")
-	appOnboardCmd.Flags().StringVar(&onboardBuildConfiguration, "build-configuration", "", "Static build configuration override")
 	_ = appOnboardCmd.MarkFlagRequired("config")
 	_ = appOnboardCmd.MarkFlagRequired("from")
 }
@@ -90,15 +87,6 @@ func runAppOnboard(_ *cobra.Command, _ []string) error {
 	if onboardImageRepository != "" {
 		cfg.Delivery.ImageRepository = onboardImageRepository
 	}
-	if onboardBuildStrategy != "" {
-		cfg.Delivery.BuildStrategy = onboardBuildStrategy
-	}
-	if onboardBuildOutputDirectory != "" {
-		cfg.Delivery.BuildOutputDirectory = onboardBuildOutputDirectory
-	}
-	if onboardBuildConfiguration != "" {
-		cfg.Delivery.BuildConfiguration = onboardBuildConfiguration
-	}
 	cfg, err = resolveAppOnboarding(cfg)
 	if err != nil {
 		return err

cmd/fresh_test.go

@@ -65,11 +65,11 @@ func TestBootstrapInitAppliesFluxDefaultsBeforeFreshValidation(t *testing.T) {
 func TestAppOnboardValidatesConfigBeforeExternalWork(t *testing.T) {
 	originalConfig, originalResolve, originalOnboard := loadAppOnboardConfig, resolveAppOnboarding, onboardApp
 	originalConfigPath, originalFrom := onboardConfigPath, onboardFrom
-	originalName, originalRepo, originalImage, originalBuildStrategy, originalBuildOutput, originalBuildConfiguration := onboardAppName, onboardAppRepoURL, onboardImageRepository, onboardBuildStrategy, onboardBuildOutputDirectory, onboardBuildConfiguration
+	originalName, originalRepo, originalImage := onboardAppName, onboardAppRepoURL, onboardImageRepository
 	t.Cleanup(func() {
 		loadAppOnboardConfig, resolveAppOnboarding, onboardApp = originalConfig, originalResolve, originalOnboard
 		onboardConfigPath, onboardFrom = originalConfigPath, originalFrom
-		onboardAppName, onboardAppRepoURL, onboardImageRepository, onboardBuildStrategy, onboardBuildOutputDirectory, onboardBuildConfiguration = originalName, originalRepo, originalImage, originalBuildStrategy, originalBuildOutput, originalBuildConfiguration
+		onboardAppName, onboardAppRepoURL, onboardImageRepository = originalName, originalRepo, originalImage
 	})
 	loadAppOnboardConfig = func(string) (config.Config, error) { return config.Config{}, nil }
 	resolveAppOnboarding = func(config.Config) (config.Config, error) { return config.Config{}, errors.New("incomplete delivery") }
@@ -78,7 +78,7 @@ func TestAppOnboardValidatesConfigBeforeExternalWork(t *testing.T) {
 		return nil
 	}
 	onboardConfigPath, onboardFrom = "private.yaml", "app-checkout"
-	onboardAppName, onboardAppRepoURL, onboardImageRepository, onboardBuildStrategy, onboardBuildOutputDirectory, onboardBuildConfiguration = "", "", "", "", "", ""
+	onboardAppName, onboardAppRepoURL, onboardImageRepository = "", "", ""
 	if err := runAppOnboard(nil, nil); err == nil {
 		t.Fatal("onboarding accepted invalid configuration")
 	}
@@ -87,25 +87,25 @@ func TestAppOnboardValidatesConfigBeforeExternalWork(t *testing.T) {
 func TestAppOnboardPassesOnlyValidatedConfigAndCheckout(t *testing.T) {
 	originalConfig, originalResolve, originalOnboard := loadAppOnboardConfig, resolveAppOnboarding, onboardApp
 	originalConfigPath, originalFrom := onboardConfigPath, onboardFrom
-	originalName, originalRepo, originalImage, originalBuildStrategy, originalBuildOutput, originalBuildConfiguration := onboardAppName, onboardAppRepoURL, onboardImageRepository, onboardBuildStrategy, onboardBuildOutputDirectory, onboardBuildConfiguration
+	originalName, originalRepo, originalImage := onboardAppName, onboardAppRepoURL, onboardImageRepository
 	t.Cleanup(func() {
 		loadAppOnboardConfig, resolveAppOnboarding, onboardApp = originalConfig, originalResolve, originalOnboard
 		onboardConfigPath, onboardFrom = originalConfigPath, originalFrom
-		onboardAppName, onboardAppRepoURL, onboardImageRepository, onboardBuildStrategy, onboardBuildOutputDirectory, onboardBuildConfiguration = originalName, originalRepo, originalImage, originalBuildStrategy, originalBuildOutput, originalBuildConfiguration
+		onboardAppName, onboardAppRepoURL, onboardImageRepository = originalName, originalRepo, originalImage
 	})
 	cfg := config.Config{Delivery: config.DeliveryConfig{AppRepoURL: "https://git.example.test/new-org/app.git", AppRepoRef: "main"}}
 	loadAppOnboardConfig = func(string) (config.Config, error) { return cfg, nil }
 	resolveAppOnboarding = func(got config.Config) (config.Config, error) { return got, nil }
 	calls := 0
 	onboardApp = func(got config.Config, checkout string) error {
-		if checkout != "app-checkout" || got.Delivery.AppName != "fixture" || got.Delivery.AppRepoURL != "https://git.example.test/new-org/fixture.git" || got.Delivery.ImageRepository != "registry.example.test/new-org/fixture" || got.Delivery.BuildStrategy != "runtime" || got.Delivery.BuildOutputDirectory != "dist/fixture" || got.Delivery.BuildConfiguration != "ci" {
+		if checkout != "app-checkout" || got.Delivery.AppName != "fixture" || got.Delivery.AppRepoURL != "https://git.example.test/new-org/fixture.git" || got.Delivery.ImageRepository != "registry.example.test/new-org/fixture" {
 			t.Fatal("onboarding used the wrong checkout or config")
 		}
 		calls++
 		return nil
 	}
 	onboardConfigPath, onboardFrom = "private.yaml", "app-checkout"
-	onboardAppName, onboardAppRepoURL, onboardImageRepository, onboardBuildStrategy, onboardBuildOutputDirectory, onboardBuildConfiguration = "fixture", "https://git.example.test/new-org/fixture.git", "registry.example.test/new-org/fixture", "runtime", "dist/fixture", "ci"
+	onboardAppName, onboardAppRepoURL, onboardImageRepository = "fixture", "https://git.example.test/new-org/fixture.git", "registry.example.test/new-org/fixture"
 	if err := runAppOnboard(nil, nil); err != nil || calls != 1 {
 		t.Fatalf("runAppOnboard() = %v, calls = %d", err, calls)
 	}

docs/architecture/delivery-ownership.md

@@ -1,107 +0,0 @@
-# Delivery Ownership
-
-## Status
-
-This is the approved target architecture. Central onboarding is available for
-new applications; existing source-owned registrations remain migration work.
-
-## Trust Boundary
-
-Application repositories are build inputs, not GitOps inputs. A developer can
-change application code on `main`, but cannot change an active Pipeline, Task,
-runtime secret reference, Helm chart, environment value, or promotion policy.
-
-| Concern | Owner | Location |
-| --- | --- | --- |
-| Application code, tests, Dockerfile | Developers | `Maidn/<app>` `main` |
-| Approved charts and environment values | Platform | `Maidn/<app>` `maidn/platform-<app>` |
-| Pipeline, Tasks, triggers, runtime access | Platform | Cluster repository |
-| Image tags, preview ownership, promotion PRs | Platform | Deployment manifests repository |
-| Secret values and policies | Platform | Private config, SOPS operational state, OpenBao |
-
-The protected platform branch may be readable by developers, but only platform
-operators and approved automation may push or merge into it. Flux must track
-only that branch for chart content. Flux must never track an application `main`
-branch or `maidn/delivery-*` branch.
-
-Onboarding requires an existing `maidn/platform-<app>` branch and verifies its
-no-direct-push protection before it opens the central registration PR. It never
-seeds a platform branch from developer-controlled `main`.
-
-## Resource Flow
-
-```mermaid
-flowchart LR
-  App[Application main branch\ncode only]
-  Platform[Protected platform branch\nchart and values]
-  Cluster[Cluster repository\nPipeline, Tasks, secret access]
-  Manifests[Manifests repository\nimage tags and promotion]
-  Flux[Flux]
-  Workload[Preview, staging, production]
-
-  App -->|exact source SHA| Cluster
-  Cluster --> Manifests
-  Platform --> Flux
-  Manifests --> Flux
-  Flux --> Workload
-```
-
-The central Pipeline clones the application repository at the event SHA only to
-build an image. It obtains chart content from the protected platform branch and
-writes only image-tag and promotion state to the manifests repository.
-
-## Prohibited Application Content
-
-Application repositories must not contain active delivery control-plane
-resources:
-
-- `.tekton/` Pipeline or Task resources
-- `.maidn/` Flux, RBAC, SecretStore, or ExternalSecret resources
-- Flux Kustomizations or GitRepositories
-- Kubernetes Secret values, SOPS identities, OpenBao tokens, or kubeconfigs
-
-An application `main` branch may retain a chart as a developer proposal, but it
-has no delivery effect. A platform operator explicitly reviews and copies an
-approved chart and environment values to `maidn/platform-<app>`.
-
-## Approval Sequence
-
-1. A platform operator creates or updates the protected platform branch through
-   a reviewed platform PR.
-2. A platform operator reviews and merges the central cluster registration that
-   renders the Pipeline, Tasks, protected chart source, and runtime references.
-3. Flux applies only the central cluster resources and protected chart branch.
-4. Developers use Forgejo pull requests and pushes to trigger builds; they do
-   not edit deployment control-plane resources.
-5. Production promotion remains a reviewed PR in the manifests repository.
-
-## Migration Rules
-
-Existing source-owned registrations are migrated one application at a time.
-First establish the protected platform package, then merge the central cluster
-registration, then verify Flux and delivery. Remove the legacy source
-GitRepository, Kustomizations, and delivery branch only after the replacement
-is Ready.
-
-The canonical fixtures are migration pilots. `Maidn/maidn-e2e-secret` remains
-disabled until its central replacement is reviewed. Angular and web legacy
-registrations must follow the same migration path.
-
-## Command Status
-
-`cicd-tool bootstrap`, `cicd-tool app`, and `cicd-tool e2e` are the current
-Forgejo and GitOps command families. `cicd-tool repo init` and `cicd-tool vault
-create-*` are legacy GitHub/direct-apply paths and are not part of new platform
-onboarding. They will be deprecated or removed after the central delivery
-migration.
-
-## Acceptance
-
-The architecture is accepted only after a canonical fixture proves all of the
-following with a real Forgejo event:
-
-- pull request preview build, route, and delivery feedback
-- main-to-staging deployment at an immutable image SHA
-- reviewed production promotion PR
-- runtime secret and shared database projection without preview credentials
-- closed-preview cleanup and orphan-cleaner recovery

docs/delivery-feedback.md

@@ -1,11 +1,10 @@
 # Delivery feedback
 
-The central cluster registration owns the Tekton tasks that update one marked
+`maidn app onboard` adds source-owned Tekton tasks that update one marked
-Forgejo pull-request comment. Application repositories do not carry active
+Forgejo pull-request comment. The comment contains only the verified preview
-delivery Tasks. The comment contains only the verified preview URL, a redacted
+URL, a redacted task-status summary, and the PipelineRun name. Set the optional
-task-status summary, and the PipelineRun name. Set the optional
+`delivery.tektonDashboardUrl` to a credential-free HTTPS Tekton Dashboard
-`delivery.tektonDashboardUrl` to a credential-free HTTPS Tekton Dashboard origin
+origin to add a PipelineRun link.
-to add a PipelineRun link.
 
 Before enabling delivery feedback, create the separate Forgejo token with
 `bootstrap --config <private-bootstrap-config> --create-forgejo-delivery-status-token`.
@@ -18,6 +17,5 @@ Forgejo API responses.
 Preview and staging feedback waits up to ten minutes for the app Deployment
 and HTTPRoute, then performs a bounded HTTPS check. A production event reports
 the manifest-repository promotion PR; it does not claim a production deploy.
-The protected `maidn/platform-<app>` chart must name both resources after
+The chart must name both resources after `delivery.appName`; the HTTPRoute's
-`delivery.appName`; the HTTPRoute's first hostname must be the public HTTPS
+first hostname must be the public HTTPS preview/staging URL.
-preview/staging URL.

docs/e2e.md

@@ -29,10 +29,3 @@ Build the portable OCI runner with `docker build -t maidn-e2e-runner .`.
 Mount the kubeconfig and optional token file read-only; ensure they are readable
 by the image's non-root user. The build context excludes known secret-bearing
 bootstrap inputs.
-
-## Fixture Boundary
-
-Use `cicd-tool e2e-mutate` only with canonical `Maidn/maidn-e2e-*` fixtures.
-The test runner must prove preview, staging, production promotion, runtime
-secret/database access, preview cleanup, and orphan cleanup against central
-delivery resources. It must not mutate `test-org-2` as a fixture source.

docs/operations.md

@@ -23,80 +23,31 @@ new template revisions intentionally, use a new empty `workspaceDir` (and a
 fresh `cloneParent` when it is configured separately) and keep the prior
 secret-bearing workspace intact for recovery.
 
-## Standard Delivery Workflow
+## Platform Initialization And App Onboarding
 
-Open and merge reviewed platform-source PRs before reconciling. When a merged
+Initialize the shared delivery platform before onboarding any application. This
-template source must replace an existing revision lock, run the refresh by
-itself. It creates migration PRs; review and merge them, then rerun normal
-reconciliation:
-
-```powershell
-go run . bootstrap --config <private-bootstrap-config> --mode=reconcile --refresh-template-revisions
-go run . bootstrap --config <private-bootstrap-config> --mode=reconcile
-```
-
-Initialize the shared delivery platform before onboarding an application. This
 creates the Gateway, Tekton, and Tekton Triggers platform resources using
-`tekton.<cluster-domain>` and the configured Forgejo owner:
+`tekton.<cluster-domain>` and the configured Forgejo owner; it does not render
+an application Pipeline or register an application webhook:
 
 ```powershell
-go run . bootstrap init --config <private-bootstrap-config> --organization <owner> --create-organization
+bootstrap init --config <private-bootstrap-config> --organization <owner> --create-organization
 ```
 
-The source-owned onboarding implementation is retired. Central onboarding
+Import a clean checkout into the configured owner with a separate command. The
-creates a reviewed cluster registration only; it never writes `.tekton` or
+checkout may originate in another Forgejo organization, but `delivery.appRepoUrl`
-`.maidn` resources to an application repository. Before merging that
+must target `<owner>/<app>.git` and its current branch must be
-registration, a platform operator must create the corresponding
+`delivery.appRepoRef`:
-`maidn/platform-<app>` package through a reviewed platform PR; onboarding
-verifies its existence and enforces its protection. See [Delivery
-Ownership](architecture/delivery-ownership.md) for the approved architecture
-and migration rules.
-
-The onboarding command uses a clean checkout on `delivery.appRepoRef`.
-The app repository URL must be the canonical source owner, such as
-`Maidn/<app>.git`; `test-org-2` is execution state only. Per-app static build
-values remain command-line overrides rather than private defaults:
 
 ```powershell
-go run . app onboard --config <private-bootstrap-config> --from <clean-checkout> `
+app onboard --config <private-bootstrap-config> --from <clean-checkout>
-  --app-name <app> --app-repo-url https://<forgejo>/Maidn/<app>.git `
-  --image-repository <registry>/<owner>/<app> --build-strategy static `
-  --build-output-directory <output-directory> --build-configuration <configuration>
 ```
 
-For a runtime build, set `--build-strategy runtime`; static-only output options
+Onboarding copies the current branch to the target repository, replaces only
-remain harmless. Central onboarding creates the reviewed cluster-registration
+the two Maidn-generated `.tekton` files, protects the production branch, and
-change after the platform package exists. The cluster repository owns
+auto-merges the app delivery and cluster registration PRs. The registration is
-`base/tekton/apps/<app>.yaml`; the application repository remains a build input
+stored in `base/tekton/apps/<app>.yaml` in the configured cluster repository;
-only. The generic EventListener dispatches by Forgejo repository name.
+the generic EventListener dispatches by the Forgejo repository name.
-
-Existing source-owned registrations are migrated in separate reviewed cluster
-repository PRs. Never overwrite an unmanaged registration.
-
-After Flux reports the app Kustomization Ready, use Forgejo's hook test endpoint
-against a non-`main` ref and inspect the resulting PipelineRun. The command and
-read-only checks are in [Webhook Smoke Test](#webhook-smoke-test).
-
-### Shared Services And Add-ons
-
-Environment databases are platform-owned shared services. Staging workloads use
-the CNPG-generated `staging-postgres-app` Secret and production workloads use
-`production-postgres-app`; applications must not declare their own CNPG Cluster
-by default. Shared credentials are appropriate only for the shared environment
-database. Use a dedicated service only when isolation, lifecycle, or storage
-requirements demand it.
-
-The cluster repository owns reviewed dedicated resources and runtime secret
-access. Application repositories must not carry active `.maidn` resources.
-Runtime references never contain credential values. Preview namespaces do not
-receive staging or production runtime credentials; preview-safe configuration is
-defined in the protected platform chart branch.
-
-Declare runtime secret access in the private configuration and run normal
-bootstrap reconciliation to create its policy and role. Set values only with
-`app secret set` using stdin, `--file`, or `--generate`; provision the scoped
-E2E identity with `bootstrap --provision-app-secret-identities --e2e-app <app>`
-only when a probe needs it. See [secret-grants.md](secret-grants.md).
 
 `delivery.productionBranch` is the application production branch. A production
 delivery PR targets the configured generic

internal/assets/templates/delivery-pipeline.yaml.tmpl

@@ -27,6 +27,10 @@ spec:
     - name: environment
     - name: pr-number
       default: ""
+    - name: app-url
+      default: ""
+    - name: app-revision
+      default: ""
     - name: forgejo-base-url
       default: ""
     - name: forgejo-owner
@@ -53,6 +57,10 @@ spec:
           value: $(params.environment)
         - name: PR_NUMBER
           value: $(params.pr-number)
+        - name: APP_URL
+          value: $(params.app-url)
+        - name: APP_REVISION
+          value: $(params.app-revision)
         - name: FORGEJO_BASE_URL
           value: $(params.forgejo-base-url)
         - name: FORGEJO_OWNER
@@ -94,6 +102,8 @@ spec:
         cd /tmp/manifests
         if [ "$ENVIRONMENT" = preview ]; then
           valid_pr_number "$PR_NUMBER"
+          valid_url "$APP_URL"
+          valid_revision "$APP_REVISION"
           app_dir="apps/previews/$APP_NAME-pr-$PR_NUMBER"
           marker="$app_dir/ownership.yaml"
           if [ -e "$app_dir" ]; then
@@ -119,7 +129,12 @@ spec:
         EOF
             cmp -s "$expected_marker" "$marker" || fail
           fi
+          git clone "$APP_URL" /tmp/app
+          git -C /tmp/app checkout "$APP_REVISION"
+          [ -f /tmp/app/preview/values.yaml ] || fail
           mkdir -p "$app_dir"
+          cp /tmp/app/preview/values.yaml "$app_dir/values.yaml"
+          sed -i "s/PLACEHOLDER_PR/$PR_NUMBER/g" "$app_dir/values.yaml"
           cat > "$marker" <<EOF
         apiVersion: v1
         kind: ConfigMap
@@ -154,20 +169,14 @@ spec:
           chart:
             spec:
               chart: ./charts/$APP_NAME
-              reconcileStrategy: Revision
               sourceRef:
                 kind: GitRepository
                 name: $APP_NAME
                 namespace: flux-system
-              valuesFiles:
-                - ./charts/$APP_NAME/values.yaml
-                - ./preview/values.yaml
           values:
             image:
               repository: $IMAGE
               tag: $TAG
-            gateway:
-              hostname: $APP_NAME-pr-$PR_NUMBER.{{ .ClusterDomain }}
         EOF
           cat > "$app_dir/kustomization.yaml" <<EOF
         apiVersion: kustomize.config.k8s.io/v1beta1
@@ -203,14 +212,10 @@ spec:
           chart:
             spec:
               chart: ./charts/$APP_NAME
-              reconcileStrategy: Revision
               sourceRef:
                 kind: GitRepository
                 name: $APP_NAME
                 namespace: flux-system
-              valuesFiles:
-                - ./charts/$APP_NAME/values.yaml
-                - ./staging/values.yaml
           values:
             image:
               repository: $IMAGE
@@ -254,14 +259,10 @@ spec:
           chart:
             spec:
               chart: ./charts/$APP_NAME
-              reconcileStrategy: Revision
               sourceRef:
                 kind: GitRepository
                 name: $APP_NAME
                 namespace: flux-system
-              valuesFiles:
-                - ./charts/$APP_NAME/values.yaml
-                - ./production/values.yaml
           values:
             image:
               repository: $IMAGE
@@ -634,7 +635,7 @@ spec:
           operator: notin
           values: [closed]
       taskRef:
-        name: {{ if eq .BuildStrategy "static" }}maidn-node-static-image{{ else }}maidn-node-runtime-image{{ end }}
+        name: maidn-node-static-image
       params:
         - name: url
           value: {{ quote .AppRepoURL }}
@@ -642,12 +643,10 @@ spec:
           value: $(params.git-revision)
         - name: image
           value: $(params.image)
-{{ if eq .BuildStrategy "static" }}
         - name: output-directory
           value: {{ quote .BuildOutputDirectory }}
         - name: build-configuration
           value: {{ quote .BuildConfiguration }}
-{{ end }}
     - name: update-preview
       runAfter: [build-layer]
       when:
@@ -676,6 +675,10 @@ spec:
           value: preview
         - name: pr-number
           value: $(params.pr-number)
+        - name: app-url
+          value: {{ quote .AppRepoURL }}
+        - name: app-revision
+          value: $(params.git-revision)
     - name: update-staging
       runAfter: [build-layer]
       when:

internal/bootstrap/bootstrap.go

@@ -49,7 +49,6 @@ type Runner struct {
 	SkipDeliveryScaffolding     bool
 	AutoMergeBootstrapMigration bool
 	DestroyDemocraticCSIStorage bool
-	RefreshTemplateRevisions    bool
 }
 
 type operationalSecrets struct {
@@ -174,15 +173,6 @@ func (r Runner) Run() error {
 		}
 		r.Config = resolvedDelivery
 	}
-	if r.Mode, err = resolveLifecycleMode(r.Mode, r.ConfirmRebuild); err != nil {
-		return err
-	}
-	if r.RefreshTemplateRevisions && r.Mode != Reconcile {
-		return errors.New("--refresh-template-revisions requires --mode=reconcile")
-	}
-	if r.DestroyDemocraticCSIStorage && r.Mode != Rebuild {
-		return errors.New("--destroy-democratic-csi-storage requires --mode=rebuild --yes")
-	}
 	if err := preflight(r.Config); err != nil {
 		return fmt.Errorf("preflight: %w", err)
 	}
@@ -197,12 +187,13 @@ func (r Runner) Run() error {
 			return errors.New("SOPS recoveryRecipient is required")
 		}
 	}
-	if r.RegisterWebhook {
+	if r.Mode, err = resolveLifecycleMode(r.Mode, r.ConfirmRebuild); err != nil {
-		if r.RefreshTemplateRevisions {
-			if err := RefreshTemplateRevisions(r.Config); err != nil {
 		return err
 	}
+	if r.DestroyDemocraticCSIStorage && r.Mode != Rebuild {
+		return errors.New("--destroy-democratic-csi-storage requires --mode=rebuild --yes")
 	}
+	if r.RegisterWebhook {
 		return r.reconcileWebhook(filepath.Join(r.Config.Git.CloneParent, r.Config.Talos.RepoDirName, r.Config.Talos.GeneratedDir))
 	}
 	if r.Config.SOPS.RecoveryIdentityPath == "" || r.Config.SOPS.RecoveryBundlePath == "" {
@@ -215,15 +206,9 @@ func (r Runner) Run() error {
 		return fmt.Errorf("preflight OpenBao recovery bundle: %w", err)
 	}
 	workspace := r.Config.WorkspaceDir
-	if r.RefreshTemplateRevisions {
-		if err := RefreshTemplateRevisions(r.Config); err != nil {
-			return err
-		}
-	} else {
 	if err := EnsureTemplateRevisions(r.Config); err != nil {
 		return err
 	}
-	}
 	catalogManager := forgejo.NewRepoManager(r.Config.Git.BaseURL, r.Config.Git.Token, r.Config.Git.Owner, r.Config.Git.Username, "", "", r.Config.Templates.TektonCatalogRepoRef, "")
 	if _, err := catalogManager.EnsureRepositoryCopy(r.Config.Flux.TektonCatalogRepo, "User-managed Tekton pipeline catalog", r.Config.Templates.TektonCatalogRepoURL); err != nil {
 		return fmt.Errorf("initialize Tekton catalog repository: %w", err)
@@ -624,7 +609,6 @@ type appDeliveryTemplateConfig struct {
 	AppRepoRef           string
 	ProductionBranch     string
 	ImageRepository      string
-	BuildStrategy        string
 	BuildOutputDirectory string
 	BuildConfiguration   string
 	ForgejoBaseURL       string
@@ -632,18 +616,68 @@ type appDeliveryTemplateConfig struct {
 	ManifestsURL         string
 	ManifestsRepo        string
 	ManifestsBranch      string
-	ClusterDomain        string
 }
 
 var deliveryAppName = regexp.MustCompile(`^[a-z0-9]([a-z0-9-]{0,45}[a-z0-9])?$`)
 
+// GenerateAppDelivery writes the source-owned Tekton delivery contract for an app checkout.
+func GenerateAppDelivery(dir string, cfg config.Config) error {
+	if err := config.ValidateDelivery(cfg); err != nil {
+		return err
+	}
+	content, err := renderAppDelivery(cfg)
+	if err != nil {
+		return err
+	}
+	files := map[string][]byte{
+		"kustomization.yaml": []byte("apiVersion: kustomize.config.k8s.io/v1beta1\nkind: Kustomization\nresources:\n  - pipeline.yaml\n"),
+		"pipeline.yaml":      content,
+	}
+	target := filepath.Join(dir, ".tekton")
+	info, err := os.Lstat(target)
+	if err == nil {
+		if info.Mode()&os.ModeSymlink != 0 || !info.IsDir() {
+			return errors.New("app delivery .tekton path must be a directory")
+		}
+		entries, err := os.ReadDir(target)
+		if err != nil {
+			return err
+		}
+		if len(entries) != len(files) {
+			return errors.New("app delivery .tekton contains unmanaged files")
+		}
+		for name, content := range files {
+			file := filepath.Join(target, name)
+			fileInfo, err := os.Lstat(file)
+			if err != nil || fileInfo.Mode()&os.ModeSymlink != 0 || !fileInfo.Mode().IsRegular() {
+				return errors.New("app delivery .tekton contains unmanaged files")
+			}
+			if err := os.WriteFile(file, content, 0644); err != nil {
+				return err
+			}
+		}
+		return nil
+	}
+	if !os.IsNotExist(err) {
+		return err
+	}
+	temporary, err := os.MkdirTemp(dir, ".maidn-tekton-")
+	if err != nil {
+		return err
+	}
+	defer os.RemoveAll(temporary)
+	for name, content := range files {
+		if err := os.WriteFile(filepath.Join(temporary, name), content, 0644); err != nil {
+			return err
+		}
+	}
+	return os.Rename(temporary, target)
+}
+
 func renderAppDelivery(cfg config.Config) ([]byte, error) {
 	if !deliveryAppName.MatchString(cfg.Delivery.AppName) {
 		return nil, errors.New("delivery appName must be a lowercase DNS label")
 	}
-	if cfg.Delivery.BuildStrategy != "static" && cfg.Delivery.BuildStrategy != "runtime" {
-		return nil, errors.New("delivery buildStrategy must be static or runtime")
-	}
 	appRepository, err := deliveryRepository(cfg.Git.BaseURL, cfg.Delivery.AppRepoURL)
 	if err != nil {
 		return nil, err
@@ -655,10 +689,10 @@ func renderAppDelivery(cfg config.Config) ([]byte, error) {
 	values := appDeliveryTemplateConfig{
 		AppName: cfg.Delivery.AppName, AppRepository: appRepository, AppRepoURL: cfg.Delivery.AppRepoURL,
 		AppRepoRef: cfg.Delivery.AppRepoRef, ProductionBranch: cfg.Delivery.ProductionBranch, ImageRepository: cfg.Delivery.ImageRepository,
-		BuildStrategy: cfg.Delivery.BuildStrategy, BuildOutputDirectory: cfg.Delivery.BuildOutputDirectory, BuildConfiguration: cfg.Delivery.BuildConfiguration,
+		BuildOutputDirectory: cfg.Delivery.BuildOutputDirectory, BuildConfiguration: cfg.Delivery.BuildConfiguration,
-		ForgejoBaseURL: origin, ForgejoOwner: cfg.Git.Owner, ManifestsURL: forgejo.CloneURL(origin, cfg.Git.Owner, cfg.Flux.ManifestsRepo), ManifestsRepo: cfg.Flux.ManifestsRepo, ManifestsBranch: cfg.Flux.Branch, ClusterDomain: cfg.Flux.ClusterDomain,
+		ForgejoBaseURL: origin, ForgejoOwner: cfg.Git.Owner, ManifestsURL: forgejo.CloneURL(origin, cfg.Git.Owner, cfg.Flux.ManifestsRepo), ManifestsRepo: cfg.Flux.ManifestsRepo, ManifestsBranch: cfg.Flux.Branch,
 	}
-	for name, value := range map[string]string{"appRepository": values.AppRepository, "appRepoUrl": values.AppRepoURL, "appRepoRef": values.AppRepoRef, "productionBranch": values.ProductionBranch, "imageRepository": values.ImageRepository, "buildOutputDirectory": values.BuildOutputDirectory, "buildConfiguration": values.BuildConfiguration, "forgejoBaseUrl": values.ForgejoBaseURL, "forgejoOwner": values.ForgejoOwner, "manifestsUrl": values.ManifestsURL, "manifestsRepo": values.ManifestsRepo, "manifestsBranch": values.ManifestsBranch, "clusterDomain": values.ClusterDomain} {
+	for name, value := range map[string]string{"appRepository": values.AppRepository, "appRepoUrl": values.AppRepoURL, "appRepoRef": values.AppRepoRef, "productionBranch": values.ProductionBranch, "imageRepository": values.ImageRepository, "buildOutputDirectory": values.BuildOutputDirectory, "buildConfiguration": values.BuildConfiguration, "forgejoBaseUrl": values.ForgejoBaseURL, "forgejoOwner": values.ForgejoOwner, "manifestsUrl": values.ManifestsURL, "manifestsRepo": values.ManifestsRepo, "manifestsBranch": values.ManifestsBranch} {
 		if value == "" || strings.ContainsAny(value, "\r\n") || config.RedactURL(value) != value {
 			return nil, fmt.Errorf("delivery %s cannot be empty or contain credentials", name)
 		}
@@ -1685,42 +1719,6 @@ func EnsureTemplateRevisions(cfg config.Config) error {
 	return ensureTemplateRevisions(cfg.WorkspaceDir, cfg)
 }
 
-// RefreshTemplateRevisions replaces an existing template lock with configured ref heads.
-func RefreshTemplateRevisions(cfg config.Config) error {
-	return refreshTemplateRevisions(cfg.WorkspaceDir, cfg)
-}
-
-func refreshTemplateRevisions(workspace string, cfg config.Config) error {
-	lockPath := filepath.Join(workspace, "maidn-template-revisions.yaml")
-	lock, err := readTemplateRevisionLock(lockPath)
-	if err != nil {
-		if os.IsNotExist(err) {
-			return errors.New("template revision lock does not exist; run bootstrap without --refresh-template-revisions first")
-		}
-		return errors.New("template revision lock is invalid")
-	}
-	checkouts := []templateCheckout{
-		{Dir: filepath.Join(workspace, "maidn-cicd-cluster-template"), Repository: cfg.Templates.CICDRepoURL, Ref: cfg.Templates.CICDRepoRef},
-		{Dir: filepath.Join(workspace, "cicd-deployment-manifests-template"), Repository: cfg.Templates.ManifestsRepoURL, Ref: cfg.Templates.ManifestsRepoRef},
-		{Dir: filepath.Join(cfg.Git.CloneParent, cfg.Talos.RepoDirName), Repository: cfg.Templates.TalosRepoURL, Ref: cfg.Templates.TalosRepoRef, GeneratedDir: cfg.Talos.GeneratedDir},
-	}
-	revisions := []templateRevision{lock.CICD, lock.Manifests, lock.Talos}
-	for index, checkout := range checkouts {
-		if !sameTemplateSource(revisions[index], checkout) {
-			return errors.New("configured template source or ref differs from its workspace revision lock")
-		}
-		commit, err := checkoutTemplateRevision(cfg, checkout, "")
-		if err != nil {
-			return errors.New("configured template revision cannot be resolved; correct the template source or ref, then rerun bootstrap")
-		}
-		revisions[index].Commit = commit
-	}
-	if err := replaceTemplateRevisionLock(lockPath, templateRevisionLock{Version: 1, CICD: revisions[0], Manifests: revisions[1], Talos: revisions[2]}); err != nil {
-		return errors.New("cannot update template revision lock")
-	}
-	return nil
-}
-
 func readTemplateRevisionLock(path string) (templateRevisionLock, error) {
 	var lock templateRevisionLock
 	data, err := os.ReadFile(path)
@@ -1757,27 +1755,6 @@ func writeTemplateRevisionLock(path string, lock templateRevisionLock) error {
 	return file.Close()
 }
 
-func replaceTemplateRevisionLock(path string, lock templateRevisionLock) error {
-	data, err := yaml.Marshal(lock)
-	if err != nil {
-		return err
-	}
-	file, err := os.CreateTemp(filepath.Dir(path), ".maidn-template-revisions-")
-	if err != nil {
-		return err
-	}
-	temporaryPath := file.Name()
-	defer os.Remove(temporaryPath)
-	if _, err := file.Write(data); err != nil {
-		_ = file.Close()
-		return err
-	}
-	if err := file.Close(); err != nil {
-		return err
-	}
-	return os.Rename(temporaryPath, path)
-}
-
 func sameTemplateSource(revision templateRevision, checkout templateCheckout) bool {
 	return validTemplateRevision(revision) && revision.Repository == config.RedactURL(checkout.Repository) && revision.Ref == checkout.Ref
 }

internal/bootstrap/bootstrap_test.go

@@ -111,57 +111,30 @@ func TestRemoveDuplicateAppDeliverySource(t *testing.T) {
 func TestGeneratedDeliveryUsesCombinedStaticBuildArtifactContract(t *testing.T) {
 	cfg := config.Config{
 		Git:      config.GitConfig{BaseURL: "https://git.example.test", Owner: "platform"},
-		Flux:     config.FluxConfig{Branch: "main", ClusterDomain: "example.test", ManifestsRepo: "manifests"},
+		Flux:     config.FluxConfig{Branch: "main", ManifestsRepo: "manifests"},
-		Delivery: config.DeliveryConfig{AppName: "web-ui", AppRepoURL: "https://git.example.test/apps/web-ui.git", AppRepoRef: "main", ProductionBranch: "production", ImageRepository: "registry.example.test/apps/web-ui", BuildStrategy: "static", BuildOutputDirectory: "dist/web-ui", BuildConfiguration: "production"},
+		Delivery: config.DeliveryConfig{AppName: "web-ui", AppRepoURL: "https://git.example.test/apps/web-ui.git", AppRepoRef: "main", ProductionBranch: "production", ImageRepository: "registry.example.test/apps/web-ui", BuildOutputDirectory: "dist/web-ui", BuildConfiguration: "production"},
 	}
 	content, err := renderAppDelivery(cfg)
 	if err != nil {
 		t.Fatal(err)
 	}
-	for _, expected := range []string{"name: build-layer", "maidn-node-static-image", "name: url\n          value: \"https://git.example.test/apps/web-ui.git\"", "name: revision\n          value: $(params.git-revision)", "name: image\n          value: $(params.image)", "name: output-directory\n          value: \"dist/web-ui\"", "name: build-configuration\n          value: \"production\"", "runAfter: [build-layer]", "maidn-preview-orphan-reconciler", "valid_pr_number()", "valid_commit()", "values: [promotion]", "values: [\"production\"]", "cmp -s \"$expected_marker\" \"$marker\"", "values: [closed]"} {
+	for _, expected := range []string{"name: build-layer", "maidn-node-static-image", "name: url\n          value: \"https://git.example.test/apps/web-ui.git\"", "name: revision\n          value: $(params.git-revision)", "name: image\n          value: $(params.image)", "runAfter: [build-layer]", "maidn-preview-orphan-reconciler", "valid_pr_number()", "valid_commit()", "values: [promotion]", "values: [\"production\"]", "cmp -s \"$expected_marker\" \"$marker\"", "values: [closed]"} {
 		if !strings.Contains(string(content), expected) {
 			t.Fatalf("generated delivery does not contain %q", expected)
 		}
 	}
-	for _, expected := range []string{"reconcileStrategy: Revision", "valuesFiles:\n                - ./charts/$APP_NAME/values.yaml\n                - ./preview/values.yaml", "valuesFiles:\n                - ./charts/$APP_NAME/values.yaml\n                - ./staging/values.yaml", "valuesFiles:\n                - ./charts/$APP_NAME/values.yaml\n                - ./production/values.yaml", "hostname: $APP_NAME-pr-$PR_NUMBER.example.test"} {
+	for _, unexpected := range []string{"maidn-git-clone", "maidn-node-static-build", "maidn-node-static-push", "runAfter: [clone]", "name: source", "workspace: source", "workspace: artifact", "easycsr", "test-org", "git rm -r"} {
-		if !strings.Contains(string(content), expected) {
-			t.Fatalf("generated delivery does not contain protected platform values %q", expected)
-		}
-	}
-	for _, unexpected := range []string{"maidn-git-clone", "maidn-node-static-build", "maidn-node-static-push", "runAfter: [clone]", "name: source", "workspace: source", "workspace: artifact", "easycsr", "test-org", "git rm -r", "$APP_URL", "$APP_REVISION", "platform-url", "platform-revision", "/tmp/platform", "/tmp/app/preview/values.yaml"} {
 		if strings.Contains(string(content), unexpected) {
 			t.Fatalf("generated delivery contains unexpected %q", unexpected)
 		}
 	}
 }
 
-func TestGeneratedDeliveryUsesRuntimeImageWithoutStaticParameters(t *testing.T) {
-	cfg := config.Config{
-		Git:      config.GitConfig{BaseURL: "https://git.example.test", Owner: "platform"},
-		Flux:     config.FluxConfig{Branch: "main", ClusterDomain: "example.test", ManifestsRepo: "manifests"},
-		Delivery: config.DeliveryConfig{AppName: "web-ui", AppRepoURL: "https://git.example.test/apps/web-ui.git", AppRepoRef: "main", ProductionBranch: "production", ImageRepository: "registry.example.test/apps/web-ui", BuildStrategy: "runtime", BuildOutputDirectory: "dist/web-ui", BuildConfiguration: "production"},
-	}
-	content, err := renderAppDelivery(cfg)
-	if err != nil {
-		t.Fatal(err)
-	}
-	for _, expected := range []string{"maidn-node-runtime-image", "name: url\n          value: \"https://git.example.test/apps/web-ui.git\"", "name: revision\n          value: $(params.git-revision)", "name: image\n          value: $(params.image)"} {
-		if !strings.Contains(string(content), expected) {
-			t.Fatalf("generated runtime delivery does not contain %q", expected)
-		}
-	}
-	for _, unexpected := range []string{"maidn-node-static-image", "name: output-directory", "name: build-configuration"} {
-		if strings.Contains(string(content), unexpected) {
-			t.Fatalf("generated runtime delivery contains static-only %q", unexpected)
-		}
-	}
-}
-
 func TestGeneratedDeliveryInitializesStagingAndPromotesByPullRequest(t *testing.T) {
 	cfg := config.Config{
 		Git:      config.GitConfig{BaseURL: "https://git.example.test", Owner: "platform"},
-		Flux:     config.FluxConfig{Branch: "main", ClusterDomain: "example.test", ManifestsRepo: "manifests"},
+		Flux:     config.FluxConfig{Branch: "main", ManifestsRepo: "manifests"},
-		Delivery: config.DeliveryConfig{AppName: "web-ui", AppRepoURL: "https://git.example.test/apps/web-ui.git", AppRepoRef: "main", ProductionBranch: "production", ImageRepository: "registry.example.test/apps/web-ui", BuildStrategy: "static", BuildOutputDirectory: "dist", BuildConfiguration: "production"},
+		Delivery: config.DeliveryConfig{AppName: "web-ui", AppRepoURL: "https://git.example.test/apps/web-ui.git", AppRepoRef: "main", ProductionBranch: "production", ImageRepository: "registry.example.test/apps/web-ui", BuildOutputDirectory: "dist", BuildConfiguration: "production"},
 	}
 	content, err := renderAppDelivery(cfg)
 	if err != nil {
@@ -190,10 +163,14 @@ func TestGeneratedDeliveryInitializesStagingAndPromotesByPullRequest(t *testing.
 	}
 }
 
-func TestRenderAppDeliveryRequiresCompleteConfig(t *testing.T) {
+func TestGenerateAppDeliveryRequiresCompleteConfig(t *testing.T) {
-	_, err := renderAppDelivery(config.Config{Git: config.GitConfig{BaseURL: "https://git.example.test"}, Delivery: config.DeliveryConfig{AppName: "legacy-app"}})
+	dir := t.TempDir()
-	if err == nil || !strings.Contains(err.Error(), "delivery buildStrategy") {
+	err := GenerateAppDelivery(dir, config.Config{Git: config.GitConfig{BaseURL: "https://git.example.test"}, Delivery: config.DeliveryConfig{AppName: "legacy-app"}})
-		t.Fatalf("renderAppDelivery() error = %v, want incomplete delivery error", err)
+	if err == nil || !strings.Contains(err.Error(), "delivery appName") {
+		t.Fatalf("GenerateAppDelivery() error = %v, want incomplete delivery error", err)
+	}
+	if _, statErr := os.Stat(filepath.Join(dir, ".tekton")); !os.IsNotExist(statErr) {
+		t.Fatal("GenerateAppDelivery() wrote delivery files before rejecting incomplete config")
 	}
 }
 

internal/bootstrap/onboard.go

@@ -7,27 +7,14 @@ import (
 	"io"
 	"os"
 	"path/filepath"
-	"strings"
 
 	"github.com/Pingu-Studio/MaidnCLI/internal/config"
 	"github.com/Pingu-Studio/MaidnCLI/internal/forgejo"
 	"gopkg.in/yaml.v3"
 )
 
-type onboardingRepoManager interface {
+// OnboardApp imports one clean checkout into the configured Forgejo owner,
-	EnsureRepository(string, string) (bool, error)
+// publishes its delivery branch, registers it with Flux, then adds its webhook.
-	RemoteBranchRevision(string, string) (string, error)
-	PushRef(string, string, string, string) error
-	EnsureProtectedBranch(string, string) error
-	PublishRepositoryPullRequest(string, string, string, string, func(string) error) (bool, error)
-	EnsureWebhook(string, string, string) error
-}
-
-var newOnboardingRepoManager = func(baseURL, token, owner, username, manifestsRepo, fluxRepo, branch, migrationBranch string) onboardingRepoManager {
-	return forgejo.NewRepoManager(baseURL, token, owner, username, manifestsRepo, fluxRepo, branch, migrationBranch)
-}
-
-// OnboardApp opens a reviewed central cluster-registration pull request.
 func OnboardApp(cfg config.Config, sourceDir string) error {
 	resolved, err := config.ResolveAppOnboarding(cfg)
 	if err != nil {
@@ -43,35 +30,56 @@ func OnboardApp(cfg config.Config, sourceDir string) error {
 	if sourceBranch != resolved.Delivery.AppRepoRef {
 		return errors.New("--from branch must match delivery appRepoRef")
 	}
-	sourceRevision, err := forgejo.BranchRevision(sourceDir, sourceBranch)
-	if err != nil {
-		return err
-	}
 	owner, repository, err := forgejo.RepositoryFromURL(resolved.Delivery.AppRepoURL)
 	if err != nil {
 		return err
 	}
-	sourceManager := newOnboardingRepoManager(resolved.Git.BaseURL, resolved.Git.Token, owner, resolved.Git.Username, "", "", resolved.Delivery.AppRepoRef, "")
+	if owner != resolved.Git.Owner {
-	if _, err := sourceManager.EnsureRepository(repository, "Application build input for Maidn CI/CD"); err != nil {
+		return errors.New("delivery appRepoUrl owner must match git owner for app onboarding")
+	}
+	deliveryBranch, err := forgejo.DeliveryBranch(resolved.Delivery.AppName, resolved.Delivery.AppRepoRef)
+	if err != nil {
 		return err
 	}
-	if err := publishInitialAppBranches(sourceManager, sourceDir, resolved.Delivery.AppRepoURL, sourceRevision, resolved.Delivery.AppRepoRef, resolved.Delivery.ProductionBranch); err != nil {
+	manager := forgejo.NewRepoManager(resolved.Git.BaseURL, resolved.Git.Token, resolved.Git.Owner, resolved.Git.Username, "", "", resolved.Delivery.AppRepoRef, "")
+	if _, err := manager.EnsureRepository(repository, "Application source for Maidn CI/CD delivery"); err != nil {
 		return err
 	}
-	if err := sourceManager.EnsureProtectedBranch(repository, resolved.Delivery.ProductionBranch); err != nil {
+	if err := publishInitialAppBranches(manager, sourceDir, resolved.Delivery.AppRepoURL, sourceBranch, resolved.Delivery.AppRepoRef, resolved.Delivery.ProductionBranch); err != nil {
+		return err
+	}
+	if err := manager.EnsureProtectedBranch(repository, resolved.Delivery.ProductionBranch); err != nil {
 		return fmt.Errorf("protect Forgejo production branch: %w", err)
 	}
-	if err := ensurePlatformBranch(sourceManager, repository, resolved.Delivery.AppRepoURL, resolved.Delivery.AppName); err != nil {
+	changed, err := manager.PublishDeliveryBranch(sourceDir, sourceBranch, resolved.Delivery.AppRepoURL, deliveryBranch, func(dir string) error {
+		if err := GenerateAppDelivery(dir, resolved); err != nil {
 			return err
 		}
-	registrationBranch := registrationBranch(resolved.Delivery.AppName, sourceRevision)
+		return GenerateAppSecretAccess(dir, resolved)
-	clusterManager := newOnboardingRepoManager(resolved.Git.BaseURL, resolved.Git.Token, resolved.Git.Owner, resolved.Git.Username, "", "", resolved.Flux.Branch, "")
+	})
-	if _, err := clusterManager.PublishRepositoryPullRequest(resolved.Flux.RepoName, "feat: register "+resolved.Delivery.AppName+" delivery", registrationBranch, resolved.Flux.Branch, func(dir string) error {
+	if err != nil {
-		return registerAppInCluster(dir, resolved)
+		return err
+	}
+	if changed {
+		if err := manager.EnsurePullRequest(repository, "feat: migrate delivery to Tekton", deliveryBranch, resolved.Delivery.AppRepoRef); err != nil {
+			return err
+		}
+	}
+	if open, err := manager.HasOpenPullRequest(repository, deliveryBranch); err != nil {
+		return err
+	} else if open {
+		if err := manager.MergePullRequest(repository, deliveryBranch); err != nil {
+			return err
+		}
+	}
+
+	registrationBranch := "maidn/register-" + resolved.Delivery.AppName
+	if _, err := manager.PublishRepositoryPullRequest(resolved.Flux.RepoName, "feat: register "+resolved.Delivery.AppName+" delivery", registrationBranch, resolved.Flux.Branch, func(dir string) error {
+		return RegisterAppInCluster(dir, resolved)
 	}); err != nil {
 		return fmt.Errorf("register app in cluster repository: %w", err)
 	}
-	secrets, err := readOperationalSecrets(resolved.SOPS.OperationalSecretsPath, resolved.SOPS.AgeKeyPath)
+	secrets, err := ReadOperationalSecrets(resolved.SOPS.OperationalSecretsPath, resolved.SOPS.AgeKeyPath)
 	if err != nil {
 		return fmt.Errorf("read encrypted webhook authorization: %w", err)
 	}
@@ -84,37 +92,21 @@ func OnboardApp(cfg config.Config, sourceDir string) error {
 		return err
 	}
 	webhookURL := "https://tekton." + resolved.Flux.ClusterDomain + "/"
-	if err := sourceManager.EnsureWebhook(repository, webhookURL, authorization); err != nil {
+	if err := manager.EnsureWebhook(repository, webhookURL, authorization); err != nil {
 		return fmt.Errorf("register Forgejo webhook: %w", err)
 	}
+	if err := manager.TriggerWebhookTest(repository, webhookURL, resolved.Delivery.AppRepoRef); err != nil {
+		return fmt.Errorf("trigger Forgejo webhook test: %w", err)
+	}
 	return nil
 }
 
-func registrationBranch(appName, revision string) string {
+// publishInitialAppBranches establishes the immutable source baseline before delivery setup.
-	return "maidn/register-" + appName + "-" + revision[:12]
+func publishInitialAppBranches(manager *forgejo.RepoManager, sourceDir, targetURL, sourceBranch, targetBranch, productionBranch string) error {
-}
+	sourceRevision, err := forgejo.BranchRevision(sourceDir, sourceBranch)
-
-func platformBranch(appName string) string {
-	return "maidn/platform-" + appName
-}
-
-func ensurePlatformBranch(manager onboardingRepoManager, repository, repositoryURL, appName string) error {
-	branch := platformBranch(appName)
-	revision, err := manager.RemoteBranchRevision(repositoryURL, branch)
 	if err != nil {
-		return fmt.Errorf("read Forgejo platform branch: %w", err)
+		return err
 	}
-	if revision == "" {
-		return fmt.Errorf("approved Forgejo platform branch %q must exist before central registration", branch)
-	}
-	if err := manager.EnsureProtectedBranch(repository, branch); err != nil {
-		return fmt.Errorf("protect Forgejo platform branch: %w", err)
-	}
-	return nil
-}
-
-// publishInitialAppBranches establishes the immutable source baseline before central registration.
-func publishInitialAppBranches(manager onboardingRepoManager, sourceDir, targetURL, sourceRevision, targetBranch, productionBranch string) error {
 	mainRevision, err := manager.RemoteBranchRevision(targetURL, targetBranch)
 	if err != nil {
 		return fmt.Errorf("read target base branch: %w", err)
@@ -151,10 +143,6 @@ func publishInitialAppBranches(manager onboardingRepoManager, sourceDir, targetU
 
 // RegisterAppInCluster writes only the managed Flux registration for one app.
 func RegisterAppInCluster(dir string, cfg config.Config) error {
-	return registerAppInCluster(dir, cfg)
-}
-
-func registerAppInCluster(dir string, cfg config.Config) error {
 	content, err := renderAppRegistration(cfg)
 	if err != nil {
 		return err
@@ -216,11 +204,7 @@ func renderAppRegistration(cfg config.Config) ([]byte, error) {
 	if err := config.ValidateDelivery(cfg); err != nil {
 		return nil, err
 	}
-	secretAccess, err := renderAppSecretAccess(cfg)
+	branch, err := forgejo.DeliveryBranch(cfg.Delivery.AppName, cfg.Delivery.AppRepoRef)
-	if err != nil {
-		return nil, err
-	}
-	delivery, err := renderAppDelivery(cfg)
 	if err != nil {
 		return nil, err
 	}
@@ -236,25 +220,67 @@ spec:
     name: forgejo-flux-credentials
   ref:
     branch: %s
-`, cfg.Delivery.AppName, cfg.Delivery.AppRepoURL, platformBranch(cfg.Delivery.AppName))
+---
-	if len(secretAccess) != 0 {
+apiVersion: kustomize.toolkit.fluxcd.io/v1
-		content += "---\n" + string(secretAccess)
+kind: Kustomization
+metadata:
+  name: %s
+  namespace: flux-system
+spec:
+  interval: 5m
+  path: ./.tekton
+  prune: true
+  wait: true
+  targetNamespace: tekton-pipelines
+  dependsOn:
+    - name: tekton-catalog
+  sourceRef:
+	   kind: GitRepository
+	   name: %s
+`, cfg.Delivery.AppName, cfg.Delivery.AppRepoURL, branch, cfg.Delivery.AppName, cfg.Delivery.AppName)
+	if hasRuntimeSecretGrant(cfg) {
+		content += fmt.Sprintf(`---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: %s-secrets
+  namespace: flux-system
+spec:
+  interval: 5m
+  path: ./.maidn
+  prune: true
+  wait: true
+  dependsOn:
+    - name: external-secrets-config
+  sourceRef:
+    kind: GitRepository
+    name: %s
+`, cfg.Delivery.AppName, cfg.Delivery.AppName)
 	}
-	return append([]byte(content+"---\n"), delivery...), nil
+	return []byte(content), nil
 }
 
-// renderAppSecretAccess renders only central OpenBao references, never secret values.
+func hasRuntimeSecretGrant(cfg config.Config) bool {
-func renderAppSecretAccess(cfg config.Config) ([]byte, error) {
+	for _, grant := range cfg.SecretGrants {
-	if err := config.ValidateSecretGrants(cfg.SecretGrants); err != nil {
+		if grant.Application == cfg.Delivery.AppName && grant.Consumer == "runtime" {
-		return nil, err
+			return true
 		}
-	var manifests []string
+	}
+	return false
+}
+
+// GenerateAppSecretAccess renders only OpenBao references, never secret values.
+func GenerateAppSecretAccess(dir string, cfg config.Config) error {
+	if err := config.ValidateSecretGrants(cfg.SecretGrants); err != nil {
+		return err
+	}
+	var manifests string
 	for _, grant := range cfg.SecretGrants {
 		if grant.Application != cfg.Delivery.AppName || grant.Consumer != "runtime" {
 			continue
 		}
 		name := cfg.Delivery.AppName + "-runtime-" + grant.Environment
-		manifest := fmt.Sprintf(`apiVersion: v1
+		manifests += fmt.Sprintf(`apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: maidn-%s
@@ -294,11 +320,21 @@ spec:
   data:
 `, name, grant.Environment, name, grant.Environment, name, name, name, grant.Environment, name, name)
 		for _, secret := range grant.Secrets {
-			manifest += fmt.Sprintf("    - secretKey: %s\n      remoteRef:\n        key: apps/%s/%s\n        property: value\n", secret, grant.Application, secret)
+			manifests += fmt.Sprintf("    - secretKey: %s\n      remoteRef:\n        key: apps/%s/%s\n        property: value\n", secret, grant.Application, secret)
 		}
-		manifests = append(manifests, manifest)
+		manifests += "---\n"
 	}
-	return []byte(strings.Join(manifests, "---\n")), nil
+	if manifests == "" {
+		return nil
+	}
+	maidnDir := filepath.Join(dir, ".maidn")
+	if err := os.MkdirAll(maidnDir, 0755); err != nil {
+		return err
+	}
+	if err := os.WriteFile(filepath.Join(maidnDir, "kustomization.yaml"), []byte("apiVersion: kustomize.config.k8s.io/v1beta1\nkind: Kustomization\nresources:\n  - secret-access.yaml\n"), 0644); err != nil {
+		return err
+	}
+	return os.WriteFile(filepath.Join(maidnDir, "secret-access.yaml"), []byte(manifests), 0644)
 }
 
 func readRegularFile(path string) ([]byte, error) {

internal/bootstrap/onboard_test.go

@@ -2,7 +2,6 @@ package bootstrap
 
 import (
 	"bytes"
-	"errors"
 	"io"
 	"os"
 	"os/exec"
@@ -32,13 +31,51 @@ func onboardingConfig() config.Config {
 		Flux: config.FluxConfig{Branch: "main", RepoName: "cluster", ManifestsRepo: "manifests", ClusterDomain: "example.test"},
 		Delivery: config.DeliveryConfig{
 			AppName: "web-ui", AppRepoURL: "https://git.example.test/test-org-2/web-ui.git", AppRepoRef: "main", ProductionBranch: "production",
-			ImageRepository: "registry.example.test/test-org-2/web-ui", BuildStrategy: "static", BuildOutputDirectory: "dist", BuildConfiguration: "production",
+			ImageRepository: "registry.example.test/test-org-2/web-ui", BuildOutputDirectory: "dist", BuildConfiguration: "production",
 			WebhookHostname: "tekton.example.test", WebhookPath: "/",
 		},
 	}
 }
 
-func TestRegisterAppInClusterRendersCentralDeliveryResources(t *testing.T) {
+func TestGenerateAppDeliveryReplacesOnlyKnownGeneratedFiles(t *testing.T) {
+	dir := t.TempDir()
+	tektonDir := filepath.Join(dir, ".tekton")
+	if err := os.Mkdir(tektonDir, 0755); err != nil {
+		t.Fatal(err)
+	}
+	for _, name := range []string{"kustomization.yaml", "pipeline.yaml"} {
+		if err := os.WriteFile(filepath.Join(tektonDir, name), []byte("old generated content\n"), 0644); err != nil {
+			t.Fatal(err)
+		}
+	}
+	if err := GenerateAppDelivery(dir, onboardingConfig()); err != nil {
+		t.Fatal(err)
+	}
+	pipeline, err := os.ReadFile(filepath.Join(tektonDir, "pipeline.yaml"))
+	normalized := strings.ReplaceAll(string(pipeline), "\r\n", "\n")
+	if err != nil || !strings.Contains(normalized, "https://git.example.test/test-org-2/web-ui.git") || !strings.Contains(normalized, "name: HOME\n        value: /tekton/home") || !strings.Contains(normalized, "grep -qxF \"  namespace: staging\"") || !strings.Contains(normalized, "namespace: production") || !strings.Contains(normalized, "name: web-ui-wait-delivery") || !strings.Contains(normalized, "name: web-ui-report-delivery") || !strings.Contains(normalized, "forgejo-delivery-status") || !strings.Contains(normalized, "$(context.pipelineRun.name)") || !strings.Contains(normalized, "Promotion PR opened or updated") || strings.Contains(normalized, "taskRunTemplate:") {
+		t.Fatalf("target-specific pipeline = %q, %v", pipeline, err)
+	}
+	decoder := yaml.NewDecoder(bytes.NewReader(pipeline))
+	for {
+		var document yaml.Node
+		err := decoder.Decode(&document)
+		if err == io.EOF {
+			break
+		}
+		if err != nil {
+			t.Fatalf("generated pipeline YAML: %v", err)
+		}
+	}
+	if err := os.WriteFile(filepath.Join(tektonDir, "custom.yaml"), []byte("custom: true\n"), 0644); err != nil {
+		t.Fatal(err)
+	}
+	if err := GenerateAppDelivery(dir, onboardingConfig()); err == nil || !strings.Contains(err.Error(), "unmanaged") {
+		t.Fatalf("custom .tekton content was accepted: %v", err)
+	}
+}
+
+func TestRegisterAppInClusterRendersManagedFluxSource(t *testing.T) {
 	dir := t.TempDir()
 	tektonDir := filepath.Join(dir, "base", "tekton")
 	if err := os.MkdirAll(tektonDir, 0755); err != nil {
@@ -51,7 +88,7 @@ func TestRegisterAppInClusterRendersCentralDeliveryResources(t *testing.T) {
 		t.Fatal(err)
 	}
 	registration, err := os.ReadFile(filepath.Join(tektonDir, "apps", "web-ui.yaml"))
-	if err != nil || !strings.Contains(string(registration), "branch: maidn/platform-web-ui") || !strings.Contains(string(registration), "secretRef:\n    name: forgejo-flux-credentials") || !strings.Contains(string(registration), "kind: Task") || !strings.Contains(string(registration), "name: web-ui-update-manifest") || !strings.Contains(string(registration), "kind: Pipeline") || !strings.Contains(string(registration), "name: web-ui\n") || strings.Contains(string(registration), "maidn/delivery-") || strings.Contains(string(registration), "path: ./.tekton") || strings.Contains(string(registration), "apiVersion: kustomize.toolkit.fluxcd.io") {
+	if err != nil || !strings.Contains(string(registration), "branch: maidn/delivery-web-ui") || !strings.Contains(string(registration), "secretRef:\n    name: forgejo-flux-credentials") || !strings.Contains(string(registration), "dependsOn:\n    - name: tekton-catalog") || !strings.Contains(string(registration), "path: ./.tekton") {
 		t.Fatalf("registration = %q, %v", registration, err)
 	}
 	for path, resource := range map[string]string{filepath.Join(tektonDir, "kustomization.yaml"): "apps", filepath.Join(tektonDir, "apps", "kustomization.yaml"): "web-ui.yaml"} {
@@ -60,17 +97,6 @@ func TestRegisterAppInClusterRendersCentralDeliveryResources(t *testing.T) {
 			t.Fatalf("Kustomization %s does not include %s: %q, %v", path, resource, content, err)
 		}
 	}
-	decoder := yaml.NewDecoder(bytes.NewReader(registration))
-	for {
-		var document yaml.Node
-		err := decoder.Decode(&document)
-		if err == io.EOF {
-			break
-		}
-		if err != nil {
-			t.Fatalf("registration YAML: %v", err)
-		}
-	}
 	if err := os.WriteFile(filepath.Join(tektonDir, "apps", "web-ui.yaml"), bytes.ReplaceAll(registration, []byte("\n"), []byte("\r\n")), 0644); err != nil {
 		t.Fatal(err)
 	}
@@ -85,11 +111,19 @@ func TestRegisterAppInClusterRendersCentralDeliveryResources(t *testing.T) {
 	}
 }
 
-func TestRenderAppRegistrationIncludesOnlyDeclaredRuntimeSecretAccess(t *testing.T) {
+func TestGenerateAppSecretAccessRendersOnlyDeclaredRuntimeSecrets(t *testing.T) {
+	dir := t.TempDir()
 	cfg := onboardingConfig()
 	cfg.SecretGrants = []config.SecretGrant{{Application: "web-ui", Consumer: "runtime", Environment: "staging", Secrets: []string{"api-key"}, Shared: []string{"payments"}}}
+	if err := GenerateAppSecretAccess(dir, cfg); err != nil {
+		t.Fatal(err)
+	}
+	access, err := os.ReadFile(filepath.Join(dir, ".maidn", "secret-access.yaml"))
+	if err != nil || !strings.Contains(string(access), "namespace: staging") || !strings.Contains(string(access), "key: apps/web-ui/api-key") || strings.Contains(string(access), "shared/payments") {
+		t.Fatalf("secret access = %q, %v", access, err)
+	}
 	registration, err := renderAppRegistration(cfg)
-	if err != nil || !strings.Contains(string(registration), "namespace: staging") || !strings.Contains(string(registration), "key: apps/web-ui/api-key") || strings.Contains(string(registration), "shared/payments") || strings.Contains(string(registration), ".maidn") {
+	if err != nil || !strings.Contains(string(registration), "name: web-ui-secrets") || !strings.Contains(string(registration), "path: ./.maidn") {
 		t.Fatalf("secret registration = %q, %v", registration, err)
 	}
 }
@@ -112,7 +146,7 @@ func TestPublishInitialAppBranchesCreatesAndPreservesProduction(t *testing.T) {
 	onboardingGit(t, "", "init", "--bare", target)
 
 	manager := forgejo.NewRepoManager("https://git.example.test", "", "owner", "", "", "", "main", "")
-	if err := publishInitialAppBranches(manager, source, target, sourceRevision, "main", "production"); err != nil {
+	if err := publishInitialAppBranches(manager, source, target, "source", "main", "production"); err != nil {
 		t.Fatal(err)
 	}
 	for _, branch := range []string{"main", "production"} {
@@ -139,7 +173,7 @@ func TestPublishInitialAppBranchesCreatesAndPreservesProduction(t *testing.T) {
 	existingProduction := onboardingGit(t, production, "rev-parse", "production")
 	onboardingGit(t, production, "push", preservedTarget, "production:production")
 
-	if err := publishInitialAppBranches(manager, source, preservedTarget, sourceRevision, "main", "production"); err != nil {
+	if err := publishInitialAppBranches(manager, source, preservedTarget, "source", "main", "production"); err != nil {
 		t.Fatal(err)
 	}
 	if got := onboardingGit(t, "", "--git-dir", preservedTarget, "rev-parse", "refs/heads/production"); got != existingProduction {
@@ -149,139 +183,10 @@ func TestPublishInitialAppBranchesCreatesAndPreservesProduction(t *testing.T) {
 		t.Fatal(err)
 	}
 	onboardingGit(t, source, "commit", "-am", "updated source")
-	if err := publishInitialAppBranches(manager, source, preservedTarget, sourceRevision, "main", "production"); err != nil {
+	if err := publishInitialAppBranches(manager, source, preservedTarget, "source", "main", "production"); err != nil {
 		t.Fatal(err)
 	}
 	if got := onboardingGit(t, "", "--git-dir", preservedTarget, "rev-parse", "refs/heads/main"); got != sourceRevision {
 		t.Fatalf("main = %s, want existing %s", got, sourceRevision)
 	}
 }
-
-type onboardingManagerFake struct {
-	owner           string
-	calls           []string
-	remoteRevisions map[string]string
-}
-
-func (m *onboardingManagerFake) EnsureRepository(repo, _ string) (bool, error) {
-	m.calls = append(m.calls, "ensure "+m.owner+"/"+repo)
-	return false, nil
-}
-
-func (m *onboardingManagerFake) RemoteBranchRevision(targetURL, branch string) (string, error) {
-	m.calls = append(m.calls, "remote "+targetURL+":"+branch)
-	if m.remoteRevisions != nil {
-		return m.remoteRevisions[branch], nil
-	}
-	return "existing", nil
-}
-
-func (m *onboardingManagerFake) PushRef(_, targetURL, _, targetBranch string) error {
-	m.calls = append(m.calls, "push "+targetURL+":"+targetBranch)
-	return nil
-}
-
-func (m *onboardingManagerFake) EnsureProtectedBranch(repo, branch string) error {
-	m.calls = append(m.calls, "protect "+m.owner+"/"+repo+":"+branch)
-	return nil
-}
-
-func (m *onboardingManagerFake) HasOpenPullRequest(repo, branch string) (bool, error) {
-	m.calls = append(m.calls, "open-pr "+m.owner+"/"+repo+":"+branch)
-	return false, nil
-}
-
-func (m *onboardingManagerFake) MergePullRequest(repo, branch string) error {
-	m.calls = append(m.calls, "merge-pr "+m.owner+"/"+repo+":"+branch)
-	return nil
-}
-
-func (m *onboardingManagerFake) PublishRepositoryPullRequest(repo, _, branch, _ string, _ func(string) error) (bool, error) {
-	m.calls = append(m.calls, "register "+m.owner+"/"+repo+":"+branch)
-	return true, nil
-}
-
-func (m *onboardingManagerFake) EnsureWebhook(repo, _, _ string) error {
-	m.calls = append(m.calls, "webhook "+m.owner+"/"+repo)
-	return nil
-}
-
-func (m *onboardingManagerFake) TriggerWebhookTest(repo, _, branch string) error {
-	m.calls = append(m.calls, "webhook-test "+m.owner+"/"+repo+":"+branch)
-	return nil
-}
-
-func TestOnboardAppUsesCanonicalSourceAndCentralClusterManagers(t *testing.T) {
-	source := filepath.Join(t.TempDir(), "source")
-	if err := os.Mkdir(source, 0755); err != nil {
-		t.Fatal(err)
-	}
-	onboardingGit(t, source, "init", "-b", "main")
-	onboardingGit(t, source, "config", "user.name", "Test")
-	onboardingGit(t, source, "config", "user.email", "test@example.test")
-	if err := os.WriteFile(filepath.Join(source, "README.md"), []byte("source\n"), 0644); err != nil {
-		t.Fatal(err)
-	}
-	onboardingGit(t, source, "add", "README.md")
-	onboardingGit(t, source, "commit", "-m", "source")
-
-	cfg := onboardingConfig()
-	cfg.Git.Username, cfg.Git.Token = "bot", "test-token"
-	cfg.Delivery.AppRepoURL = "https://git.example.test/Maidn/maidn-e2e-web.git"
-	sourceManager := &onboardingManagerFake{owner: "Maidn"}
-	clusterManager := &onboardingManagerFake{owner: cfg.Git.Owner}
-	originalManager, originalSecrets := newOnboardingRepoManager, readOperationalSecrets
-	t.Cleanup(func() {
-		newOnboardingRepoManager, readOperationalSecrets = originalManager, originalSecrets
-	})
-	newOnboardingRepoManager = func(_, _, owner, _, _, _, _, _ string) onboardingRepoManager {
-		switch owner {
-		case "Maidn":
-			return sourceManager
-		case cfg.Git.Owner:
-			return clusterManager
-		default:
-			t.Fatalf("unexpected onboarding manager owner %q", owner)
-			return nil
-		}
-	}
-	readOperationalSecrets = func(string, string) (map[string]map[string]string, error) {
-		return nil, errors.New("stop after registration")
-	}
-
-	err := OnboardApp(cfg, source)
-	if err == nil || !strings.Contains(err.Error(), "read encrypted webhook authorization") {
-		t.Fatalf("OnboardApp() = %v", err)
-	}
-	sourceCalls := strings.Join(sourceManager.calls, "\n")
-	for _, want := range []string{
-		"ensure Maidn/maidn-e2e-web",
-		"remote https://git.example.test/Maidn/maidn-e2e-web.git:main",
-		"remote https://git.example.test/Maidn/maidn-e2e-web.git:production",
-		"protect Maidn/maidn-e2e-web:production",
-		"remote https://git.example.test/Maidn/maidn-e2e-web.git:maidn/platform-web-ui",
-		"protect Maidn/maidn-e2e-web:maidn/platform-web-ui",
-	} {
-		if !strings.Contains(sourceCalls, want) {
-			t.Fatalf("source manager calls = %q, missing %q", sourceCalls, want)
-		}
-	}
-	if strings.Contains(sourceCalls, "delivery") || strings.Contains(sourceCalls, "ensure-pr") || strings.Contains(sourceCalls, "merge-pr") {
-		t.Fatalf("source manager published a delivery change: %q", sourceCalls)
-	}
-	sourceRevision := onboardingGit(t, source, "rev-parse", "main")
-	if got := strings.Join(clusterManager.calls, "\n"); got != "register test-org-2/cluster:maidn/register-web-ui-"+sourceRevision[:12] {
-		t.Fatalf("cluster manager calls = %q", got)
-	}
-}
-
-func TestEnsurePlatformBranchRequiresExistingBranch(t *testing.T) {
-	manager := &onboardingManagerFake{owner: "Maidn", remoteRevisions: map[string]string{}}
-	err := ensurePlatformBranch(manager, "maidn-e2e-web", "https://git.example.test/Maidn/maidn-e2e-web.git", "web-ui")
-	if err == nil || !strings.Contains(err.Error(), "maidn/platform-web-ui") {
-		t.Fatalf("ensurePlatformBranch() error = %v", err)
-	}
-	if strings.Contains(strings.Join(manager.calls, "\n"), "protect") {
-		t.Fatalf("missing platform branch was protected: %q", manager.calls)
-	}
-}

internal/bootstrap/template_revisions_test.go

@@ -40,61 +40,20 @@ func TestEnsureTemplateRevisionsReusesLockedCommitAfterBranchDrift(t *testing.T)
 	if err := ensureTemplateRevisions(workspace, cfg); err != nil {
 		t.Fatal(err)
 	}
-	locked := map[string]string{}
+	locked := git.commits["cicd"]
-	for name, commit := range git.commits {
+	git.commits["cicd"] = strings.Repeat("d", 40)
-		locked[name] = commit
-	}
-	git.commits = map[string]string{"cicd": strings.Repeat("d", 40), "manifests": strings.Repeat("e", 40), "talos": strings.Repeat("f", 40)}
 	git.resetCalls()
 	if err := ensureTemplateRevisions(workspace, cfg); err != nil {
 		t.Fatal(err)
 	}
-	lock, err := readTemplateRevisionLock(filepath.Join(workspace, "maidn-template-revisions.yaml"))
+	if git.fetched["cicd"] != locked || git.checkedOut["cicd"] != locked {
-	if err != nil {
+		t.Fatalf("branch drift changed locked CICD revision: fetched %q, checked out %q", git.fetched["cicd"], git.checkedOut["cicd"])
-		t.Fatal(err)
-	}
-	for name, commit := range locked {
-		if git.fetched[name] != commit || git.checkedOut[name] != commit {
-			t.Fatalf("branch drift changed locked %s revision: fetched %q, checked out %q", name, git.fetched[name], git.checkedOut[name])
-		}
-	}
-	if lock.CICD.Commit != locked["cicd"] || lock.Manifests.Commit != locked["manifests"] || lock.Talos.Commit != locked["talos"] {
-		t.Fatalf("normal bootstrap rewrote template lock: %#v", lock)
 	}
 	if strings.Contains(git.commands(), "fetch origin main") {
 		t.Fatal("later run fetched a mutable branch instead of the lock commit")
 	}
 }
 
-func TestRefreshTemplateRevisionsUpdatesExistingLockToConfiguredHeads(t *testing.T) {
-	workspace, cfg, git := templateRevisionTestConfig(t)
-	useTemplateRevisionGit(t, git)
-	if err := ensureTemplateRevisions(workspace, cfg); err != nil {
-		t.Fatal(err)
-	}
-	git.commits = map[string]string{"cicd": strings.Repeat("d", 40), "manifests": strings.Repeat("e", 40), "talos": strings.Repeat("f", 40)}
-	git.resetCalls()
-
-	if err := refreshTemplateRevisions(workspace, cfg); err != nil {
-		t.Fatal(err)
-	}
-	lock, err := readTemplateRevisionLock(filepath.Join(workspace, "maidn-template-revisions.yaml"))
-	if err != nil {
-		t.Fatal(err)
-	}
-	for name, commit := range git.commits {
-		if git.fetched[name] != commit || git.checkedOut[name] != commit {
-			t.Fatalf("refresh did not use configured %s branch head: fetched %q, checked out %q", name, git.fetched[name], git.checkedOut[name])
-		}
-	}
-	if lock.CICD.Commit != git.commits["cicd"] || lock.Manifests.Commit != git.commits["manifests"] || lock.Talos.Commit != git.commits["talos"] {
-		t.Fatalf("refresh did not update template lock: %#v", lock)
-	}
-	if !strings.Contains(git.commands(), "fetch origin main") || strings.Contains(git.commands(), "template-password") {
-		t.Fatal("refresh did not safely fetch configured branch heads")
-	}
-}
-
 func TestEnsureTemplateRevisionsRejectsChangedRefWithoutGit(t *testing.T) {
 	workspace, cfg, git := templateRevisionTestConfig(t)
 	useTemplateRevisionGit(t, git)

internal/config/config.go

@@ -164,12 +164,12 @@ func ResolveAppOnboarding(cfg Config) (Config, error) {
 	if err != nil {
 		return cfg, err
 	}
-	owner, repository, err := deliveryRepositoryOwner(resolved.Delivery.AppRepoURL)
+	owner, _, err := deliveryRepositoryOwner(resolved.Delivery.AppRepoURL)
 	if err != nil {
 		return cfg, err
 	}
-	if owner != resolved.Git.Owner && (owner != "Maidn" || !strings.HasPrefix(repository, "maidn-e2e-")) {
+	if owner != resolved.Git.Owner {
-		return cfg, errors.New("delivery appRepoUrl owner must match git owner or identify a canonical Maidn E2E fixture")
+		return cfg, errors.New("delivery appRepoUrl owner must match git owner for app onboarding")
 	}
 	if resolved.Delivery.ProductionBranch != "production" {
 		return cfg, errors.New("delivery productionBranch must be literal production for app onboarding")
@@ -215,9 +215,6 @@ func validateRepositoryURL(value string) error {
 }
 
 func applyDefaults(cfg *Config) {
-	if cfg.Delivery.BuildStrategy == "" {
-		cfg.Delivery.BuildStrategy = "static"
-	}
 	if cfg.ClusterID == "" {
 		cfg.ClusterID = cfg.Talos.Cluster.Name
 	}
@@ -320,9 +317,6 @@ func applyDefaults(cfg *Config) {
 }
 
 func applyDeliveryDefaults(cfg *Config) {
-	if cfg.Delivery.BuildStrategy == "" {
-		cfg.Delivery.BuildStrategy = "static"
-	}
 	if cfg.Delivery.AppRepoRef == "" {
 		cfg.Delivery.AppRepoRef = cfg.Flux.Branch
 	}
@@ -548,9 +542,6 @@ func ValidateDelivery(cfg Config) error {
 	if !regexp.MustCompile(`^[a-z0-9]([a-z0-9-]{0,45}[a-z0-9])?$`).MatchString(cfg.Delivery.AppName) {
 		return errors.New("delivery appName must be a lowercase DNS label of at most 47 characters")
 	}
-	if cfg.Delivery.BuildStrategy != "static" && cfg.Delivery.BuildStrategy != "runtime" {
-		return errors.New("delivery buildStrategy must be static or runtime")
-	}
 	if cfg.Delivery.ProductionBranch == cfg.Delivery.AppRepoRef || !validDeliveryBranch(cfg.Delivery.ProductionBranch) {
 		return errors.New("delivery productionBranch must be a valid branch distinct from appRepoRef")
 	}

internal/config/config_test.go

@@ -17,7 +17,7 @@ func validConfig(t *testing.T) Config {
 		Templates:     TemplateConfig{TalosRepoURL: "https://git.example.test/talos.git", TalosRepoRef: "main", CICDRepoURL: "https://git.example.test/template.git", CICDRepoRef: "main", ManifestsRepoURL: "https://git.example.test/manifests.git", ManifestsRepoRef: "main"},
 		Cilium:        CiliumConfig{TrafficInterface: "eth1", LoadBalancerStart: "192.168.45.19", LoadBalancerEnd: "192.168.45.30"},
 		DemocraticCSI: DemocraticCSIConfig{TrueNASAPIKey: "api-key", TrueNASHost: "truenas.example.test", TargetPortal: "truenas.example.test:3260", ShareHost: "truenas.example.test", DatasetParentNFS: "pool/kubernetes/nfs/v", DatasetSnapshotsNFS: "pool/kubernetes/nfs/s", AllowedNetworks: "192.168.45.0/24", NameSuffix: "-test", PortalGroup: "1", InitiatorGroup: "1"},
-		Delivery:      DeliveryConfig{AppName: "web-ui", AppRepoURL: "https://git.example.test/test-org/web-ui.git", AppRepoRef: "main", ProductionBranch: "production", ImageRepository: "registry.example.test/test-org/web-ui", BuildStrategy: "static", BuildOutputDirectory: "dist", BuildConfiguration: "production", WebhookHostname: "tekton.example.test", WebhookPath: "/"},
+		Delivery:      DeliveryConfig{AppName: "web-ui", AppRepoURL: "https://git.example.test/test-org/web-ui.git", AppRepoRef: "main", ProductionBranch: "production", ImageRepository: "registry.example.test/test-org/web-ui", BuildOutputDirectory: "dist", BuildConfiguration: "production", WebhookHostname: "tekton.example.test", WebhookPath: "/"},
 		Talos: TalosConfig{
 			RepoDirName: "talos", TerraformDir: "terraform", GeneratedDir: "generated", ConfigFileName: "terraform.tfvars",
 			Proxmox: TalosProxmoxConfig{APIURL: "https://proxmox.example.test:8006", APITokenID: "id", APITokenSecret: "secret"},
@@ -64,7 +64,6 @@ func TestResolveDeliveryAppliesDefaultsOnlyForExplicitAppOperations(t *testing.T
 	cfg.Delivery.AppRepoRef = ""
 	cfg.Delivery.BuildOutputDirectory = ""
 	cfg.Delivery.BuildConfiguration = ""
-	cfg.Delivery.BuildStrategy = ""
 	cfg.Delivery.WebhookHostname = ""
 	cfg.Delivery.WebhookPath = ""
 
@@ -79,25 +78,11 @@ func TestResolveDeliveryAppliesDefaultsOnlyForExplicitAppOperations(t *testing.T
 	if err != nil {
 		t.Fatal(err)
 	}
-	if !delivery.Delivery.Configured() || delivery.Delivery.BuildStrategy != "static" || delivery.Delivery.AppRepoRef != "main" || delivery.Delivery.BuildOutputDirectory != "dist" || delivery.Delivery.BuildConfiguration != "production" || delivery.Delivery.WebhookURL() != "https://tekton.example.test/" {
+	if !delivery.Delivery.Configured() || delivery.Delivery.AppRepoRef != "main" || delivery.Delivery.BuildOutputDirectory != "dist" || delivery.Delivery.BuildConfiguration != "production" || delivery.Delivery.WebhookURL() != "https://tekton.example.test/" {
 		t.Fatalf("ResolveDelivery() did not apply the complete delivery contract: %#v", delivery.Delivery)
 	}
 }
 
-func TestValidateDeliveryBuildStrategy(t *testing.T) {
-	cfg := validConfig(t)
-	for _, strategy := range []string{"static", "runtime"} {
-		cfg.Delivery.BuildStrategy = strategy
-		if err := ValidateDelivery(cfg); err != nil {
-			t.Fatalf("ValidateDelivery() rejected %q: %v", strategy, err)
-		}
-	}
-	cfg.Delivery.BuildStrategy = "container"
-	if err := ValidateDelivery(cfg); err == nil || !strings.Contains(err.Error(), "buildStrategy") {
-		t.Fatalf("ValidateDelivery() accepted invalid build strategy: %v", err)
-	}
-}
-
 func TestValidateDeliveryRequiresCompleteConfig(t *testing.T) {
 	cfg := validConfig(t)
 	cfg.Delivery.ImageRepository = ""
@@ -114,26 +99,16 @@ func TestValidateDeliveryRejectsUnsafeTektonDashboardURL(t *testing.T) {
 	}
 }
 
-func TestResolveAppOnboardingAllowsOnlyCanonicalCrossOwnerSource(t *testing.T) {
+func TestResolveAppOnboardingRequiresTargetOwner(t *testing.T) {
 	cfg := validConfig(t)
 	cfg.Git.Owner = "test-org-2"
-	cfg.Delivery.AppRepoURL = "https://git.example.test/Maidn/maidn-e2e-web.git"
+	if _, err := ResolveAppOnboarding(cfg); err == nil || !strings.Contains(err.Error(), "owner must match") {
-	if _, err := ResolveAppOnboarding(cfg); err != nil {
+		t.Fatalf("ResolveAppOnboarding() accepted a source-owner target: %v", err)
-		t.Fatalf("ResolveAppOnboarding() rejected canonical source: %v", err)
 	}
 	cfg.Delivery.AppRepoURL = "https://git.example.test/test-org-2/web-ui.git"
 	if resolved, err := ResolveAppOnboarding(cfg); err != nil || resolved.Delivery.WebhookURL() != "https://tekton.example.test/" {
 		t.Fatalf("ResolveAppOnboarding() = %#v, %v", resolved.Delivery, err)
 	}
-	for _, appRepoURL := range []string{
-		"https://git.example.test/Maidn/web-ui.git",
-		"https://git.example.test/other-org/maidn-e2e-web.git",
-	} {
-		cfg.Delivery.AppRepoURL = appRepoURL
-		if _, err := ResolveAppOnboarding(cfg); err == nil || !strings.Contains(err.Error(), "canonical Maidn E2E fixture") {
-			t.Fatalf("ResolveAppOnboarding() accepted noncanonical cross-owner source %q: %v", appRepoURL, err)
-		}
-	}
 }
 
 func TestResolveAppOnboardingRequiresProductionBranch(t *testing.T) {

internal/config/types.go

@@ -45,7 +45,6 @@ type DeliveryConfig struct {
 	AppRepoRef           string `yaml:"appRepoRef"`
 	ProductionBranch     string `yaml:"productionBranch"`
 	ImageRepository      string `yaml:"imageRepository"`
-	BuildStrategy        string `yaml:"buildStrategy"`
 	BuildOutputDirectory string `yaml:"buildOutputDirectory"`
 	BuildConfiguration   string `yaml:"buildConfiguration"`
 	TektonDashboardURL   string `yaml:"tektonDashboardUrl,omitempty"`

internal/e2emutate/mutate.go

@@ -16,7 +16,7 @@ import (
 )
 
 const (
-	fixtureOwner  = "Maidn"
+	fixtureOwner  = "test-org-2"
 	fixturePrefix = "maidn-e2e-"
 	maxBodyBytes  = 1 << 20
 )
@@ -78,7 +78,7 @@ func (o Options) Validate() error {
 		return err
 	}
 	if o.Owner != fixtureOwner {
-		return errors.New("Forgejo mutation owner must be Maidn")
+		return errors.New("Forgejo mutation owner must be test-org-2")
 	}
 	for _, value := range []string{o.Repo, o.Branch} {
 		if !fixtureName(value) {

internal/e2emutate/mutate_test.go

@@ -27,7 +27,7 @@ func mutationResponse(status int, body string) *http.Response {
 func testOptions() Options {
 	return Options{
 		ForgejoURL: "https://git.example.test",
-		Owner:      "Maidn",
+		Owner:      "test-org-2",
 		Repo:       "maidn-e2e-repo",
 		Branch:     "maidn-e2e-branch",
 		SHA:        "0123456789abcdef0123456789abcdef01234567",
@@ -60,7 +60,7 @@ func TestMutatorUpdatesFixtureRefAndEnsuresOnePR(t *testing.T) {
 			t.Fatal("mutation request did not authenticate at the API boundary")
 		}
 		switch {
-		case request.Method == http.MethodPatch && request.URL.Path == "/api/v1/repos/Maidn/maidn-e2e-repo/git/refs/heads/maidn-e2e-branch":
+		case request.Method == http.MethodPatch && request.URL.Path == "/api/v1/repos/test-org-2/maidn-e2e-repo/git/refs/heads/maidn-e2e-branch":
 			var body struct {
 				SHA   string `json:"sha"`
 				Force bool   `json:"force"`
@@ -69,12 +69,12 @@ func TestMutatorUpdatesFixtureRefAndEnsuresOnePR(t *testing.T) {
 				t.Fatalf("unexpected branch update: %#v, %v", body, err)
 			}
 			return mutationResponse(http.StatusOK, ""), nil
-		case request.Method == http.MethodGet && request.URL.Path == "/api/v1/repos/Maidn/maidn-e2e-repo/pulls":
+		case request.Method == http.MethodGet && request.URL.Path == "/api/v1/repos/test-org-2/maidn-e2e-repo/pulls":
-			if request.URL.Query().Get("head") != "Maidn:maidn-e2e-branch" || request.URL.Query().Get("state") != "open" {
+			if request.URL.Query().Get("head") != "test-org-2:maidn-e2e-branch" || request.URL.Query().Get("state") != "open" {
 				t.Fatal("pull request lookup did not target the fixture branch")
 			}
 			return mutationResponse(http.StatusOK, "[]"), nil
-		case request.Method == http.MethodPost && request.URL.Path == "/api/v1/repos/Maidn/maidn-e2e-repo/pulls":
+		case request.Method == http.MethodPost && request.URL.Path == "/api/v1/repos/test-org-2/maidn-e2e-repo/pulls":
 			var body struct {
 				Head string `json:"head"`
 				Base string `json:"base"`
@@ -101,7 +101,7 @@ func TestMutatorCreatesFixtureRefWhenAbsent(t *testing.T) {
 		case http.MethodPatch:
 			return mutationResponse(http.StatusNotFound, ""), nil
 		case http.MethodPost:
-			if request.URL.Path != "/api/v1/repos/Maidn/maidn-e2e-repo/git/refs" {
+			if request.URL.Path != "/api/v1/repos/test-org-2/maidn-e2e-repo/git/refs" {
 				t.Fatalf("branch creation targeted %q", request.URL.Path)
 			}
 			return mutationResponse(http.StatusCreated, ""), nil

internal/forgejo/repo.go

@@ -97,7 +97,6 @@ type accessToken struct {
 }
 
 var copyGit = runGit
-var hasRemoteBranch = (*RepoManager).HasRemoteBranch
 
 func (e *APIError) Error() string {
 	return fmt.Sprintf("forgejo returned %s", e.Status)
@@ -420,7 +419,7 @@ func (rm *RepoManager) CreatePullRequest(repo, title, head, base string) error {
 	if err != nil {
 		return err
 	}
-	if status != http.StatusCreated && status != http.StatusUnprocessableEntity && status != http.StatusConflict {
+	if status != http.StatusCreated && status != http.StatusUnprocessableEntity {
 		return fmt.Errorf("unexpected Forgejo pull request status %d", status)
 	}
 	return nil
@@ -509,6 +508,70 @@ func (rm *RepoManager) PushRef(dir, repoURL, sourceRef, targetBranch string) err
 	return runGit(dir, environment, "push", repoURL, sourceRef+":refs/heads/"+targetBranch)
 }
 
+// DeliveryBranch returns the dedicated branch that carries generated delivery content.
+func DeliveryBranch(appName, baseBranch string) (string, error) {
+	branch := "maidn/delivery-" + appName
+	if appName == "" || branch == baseBranch {
+		return "", fmt.Errorf("delivery branch and configured base branch must differ")
+	}
+	return branch, nil
+}
+
+// PublishDeliveryBranch generates and commits delivery content in a temporary clone.
+func (rm *RepoManager) PublishDeliveryBranch(sourceDir, sourceBranch, repoURL, deliveryBranch string, generate func(string) error) (bool, error) {
+	if sourceDir == "" || sourceBranch == "" || deliveryBranch == "" || deliveryBranch == rm.Branch {
+		return false, fmt.Errorf("delivery source branch and dedicated delivery branch are required and must differ from the base branch")
+	}
+	hasBranch, err := rm.HasRemoteBranch(repoURL, deliveryBranch)
+	if err != nil {
+		return false, err
+	}
+	temporary, err := os.MkdirTemp("", "maidn-delivery-*")
+	if err != nil {
+		return false, err
+	}
+	defer os.RemoveAll(temporary)
+	cleanupAskPass, environment, err := rm.gitEnvironment()
+	if err != nil {
+		return false, err
+	}
+	defer cleanupAskPass()
+	if hasBranch {
+		if err := runGit("", environment, "clone", "--branch", deliveryBranch, repoURL, temporary); err != nil {
+			return false, err
+		}
+	} else if err := runGit("", os.Environ(), "clone", "--no-local", "--branch", sourceBranch, sourceDir, temporary); err != nil {
+		return false, err
+	}
+	if err := runGit(temporary, environment, "checkout", "-B", deliveryBranch); err != nil {
+		return false, err
+	}
+	if err := generate(temporary); err != nil {
+		return false, err
+	}
+	if err := runGit(temporary, environment, "add", ".tekton"); err != nil {
+		return false, err
+	}
+	changed, err := gitDiffQuiet(temporary, environment, "--cached")
+	if err != nil {
+		return false, err
+	}
+	if changed {
+		for _, args := range [][]string{{"config", "user.name", "Maidn"}, {"config", "user.email", "maidn@free-maidn.com"}, {"commit", "-m", "feat: add Maidn delivery pipeline"}} {
+			if err := runGit(temporary, environment, args...); err != nil {
+				return false, err
+			}
+		}
+	}
+	if !changed {
+		return false, nil
+	}
+	if err := rm.PushBranch(temporary, repoURL, deliveryBranch); err != nil {
+		return false, err
+	}
+	return true, nil
+}
+
 // PublishRepositoryPullRequest applies a managed change on a dedicated branch.
 // An existing branch is accepted only when it has exactly one open pull request.
 func (rm *RepoManager) PublishRepositoryPullRequest(repo, title, branch, base string, change func(string) error) (bool, error) {
@@ -516,19 +579,10 @@ func (rm *RepoManager) PublishRepositoryPullRequest(repo, title, branch, base st
 		return false, errors.New("repository pull request requires distinct non-empty branches")
 	}
 	repoURL := CloneURL(rm.BaseURL, rm.Owner, repo)
-	hasBranch, err := hasRemoteBranch(rm, repoURL, branch)
+	hasBranch, err := rm.HasRemoteBranch(repoURL, branch)
 	if err != nil {
 		return false, err
 	}
-	if hasBranch {
-		open, err := rm.HasOpenPullRequest(repo, branch)
-		if err != nil {
-			return false, err
-		}
-		if !open {
-			return false, fmt.Errorf("Forgejo branch %q exists without exactly one open pull request; refusing to reuse it", branch)
-		}
-	}
 	temporary, err := os.MkdirTemp("", "maidn-registration-*")
 	if err != nil {
 		return false, err
@@ -569,11 +623,14 @@ func (rm *RepoManager) PublishRepositoryPullRequest(repo, title, branch, base st
 		if !open {
 			return false, nil
 		}
-		return true, nil
+		return true, rm.MergePullRequest(repo, branch)
 	}
 	if err := rm.EnsurePullRequest(repo, title, branch, base); err != nil {
 		return false, err
 	}
+	if err := rm.MergePullRequest(repo, branch); err != nil {
+		return false, err
+	}
 	return true, nil
 }
 
@@ -790,10 +847,10 @@ func (rm *RepoManager) TriggerWebhookTest(repo, webhookURL, branch string) error
 	return nil
 }
 
-// EnsureProtectedBranch disables direct pushes to a managed branch.
+// EnsureProtectedBranch disables direct pushes to the configured production branch.
 func (rm *RepoManager) EnsureProtectedBranch(repo, branch string) error {
 	if repo == "" || branch == "" {
-		return errors.New("Forgejo repository and branch are required")
+		return errors.New("Forgejo repository and production branch are required")
 	}
 	endpoint := fmt.Sprintf("%s/api/v1/repos/%s/%s/branch_protections", rm.BaseURL, rm.Owner, repo)
 	var protections []branchProtection
@@ -811,11 +868,11 @@ func (rm *RepoManager) EnsureProtectedBranch(repo, branch string) error {
 		}
 	}
 	if len(matching) > 1 {
-		return fmt.Errorf("multiple Forgejo branch protections match branch %q", branch)
+		return fmt.Errorf("multiple Forgejo branch protections match production branch %q", branch)
 	}
 	if len(matching) == 1 {
 		if matching[0].EnablePush || matching[0].EnablePushWhitelist {
-			return fmt.Errorf("Forgejo branch %q permits direct pushes", branch)
+			return fmt.Errorf("Forgejo production branch %q permits direct pushes", branch)
 		}
 		return nil
 	}

internal/forgejo/repo_test.go

@@ -317,28 +317,6 @@ func TestEnsureProtectedBranchCreatesDirectPushProtection(t *testing.T) {
 	}
 }
 
-func TestEnsureProtectedBranchUsesCanonicalSourceOwnerPath(t *testing.T) {
-	server := httptest.NewServer(http.HandlerFunc(func(writer http.ResponseWriter, request *http.Request) {
-		if request.URL.Path != "/api/v1/repos/Maidn/maidn-e2e-web/branch_protections" {
-			t.Fatalf("canonical source mutation targeted %q", request.URL.Path)
-		}
-		switch request.Method {
-		case http.MethodGet:
-			_ = json.NewEncoder(writer).Encode([]branchProtection{})
-		case http.MethodPost:
-			writer.WriteHeader(http.StatusCreated)
-		default:
-			t.Fatalf("unexpected method %q", request.Method)
-		}
-	}))
-	defer server.Close()
-	manager := NewRepoManager(server.URL, "token", "Maidn", "user", "", "", "main", "")
-	manager.HTTPClient = server.Client()
-	if err := manager.EnsureProtectedBranch("maidn-e2e-web", "production"); err != nil {
-		t.Fatal(err)
-	}
-}
-
 func TestEnsureProtectedBranchRejectsExistingDirectPushRule(t *testing.T) {
 	server := httptest.NewServer(http.HandlerFunc(func(writer http.ResponseWriter, request *http.Request) {
 		if request.Method != http.MethodGet {
@@ -400,34 +378,6 @@ func TestHasRemoteBranchReturnsFalseForMissingBranch(t *testing.T) {
 	}
 }
 
-func TestPublishRepositoryPullRequestRejectsExistingBranchWithoutOpenPullRequest(t *testing.T) {
-	original := hasRemoteBranch
-	t.Cleanup(func() { hasRemoteBranch = original })
-	server := httptest.NewServer(http.HandlerFunc(func(writer http.ResponseWriter, request *http.Request) {
-		if request.Method != http.MethodGet || request.URL.Path != "/api/v1/repos/owner/cluster/pulls" || request.URL.Query().Get("state") != "open" || request.URL.Query().Get("head") != "maidn/register-web-ui-deadbeefcafe" {
-			t.Fatalf("unexpected pull request lookup: %s %s", request.Method, request.URL.String())
-		}
-		_ = json.NewEncoder(writer).Encode([]pullRequest{})
-	}))
-	defer server.Close()
-	manager := NewRepoManager(server.URL, "test-token", "owner", "user", "", "", "main", "")
-	manager.HTTPClient = server.Client()
-	hasRemoteBranch = func(got *RepoManager, repoURL, branch string) (bool, error) {
-		if got != manager || repoURL != CloneURL(server.URL, "owner", "cluster") || branch != "maidn/register-web-ui-deadbeefcafe" {
-			t.Fatalf("unexpected remote branch lookup: %q %q", repoURL, branch)
-		}
-		return true, nil
-	}
-
-	_, err := manager.PublishRepositoryPullRequest("cluster", "register web-ui", "maidn/register-web-ui-deadbeefcafe", "main", func(string) error {
-		t.Fatal("change ran for a stale registration branch")
-		return nil
-	})
-	if err == nil || !strings.Contains(err.Error(), "without exactly one open pull request") {
-		t.Fatalf("PublishRepositoryPullRequest() error = %v", err)
-	}
-}
-
 func TestMergePullRequest(t *testing.T) {
 	server := httptest.NewServer(http.HandlerFunc(func(writer http.ResponseWriter, request *http.Request) {
 		switch request.Method {
@@ -454,21 +404,6 @@ func TestMergePullRequest(t *testing.T) {
 	}
 }
 
-func TestCreatePullRequestAcceptsExistingConflict(t *testing.T) {
-	server := httptest.NewServer(http.HandlerFunc(func(writer http.ResponseWriter, request *http.Request) {
-		if request.Method != http.MethodPost || request.URL.Path != "/api/v1/repos/owner/cluster/pulls" {
-			t.Fatalf("unexpected pull request request: %s %s", request.Method, request.URL.Path)
-		}
-		writer.WriteHeader(http.StatusConflict)
-	}))
-	defer server.Close()
-	manager := NewRepoManager(server.URL, "token", "owner", "user", "manifests", "cluster", "main", "maidn/bootstrap-test")
-	manager.HTTPClient = server.Client()
-	if err := manager.CreatePullRequest("cluster", "title", "maidn/bootstrap-test", "main"); err != nil {
-		t.Fatal(err)
-	}
-}
-
 func TestEnsurePullRequestChecksExactOpenBranchBeforeCreating(t *testing.T) {
 	requests := 0
 	server := httptest.NewServer(http.HandlerFunc(func(writer http.ResponseWriter, request *http.Request) {