ci(wiki-maintenance): run the audit as the vault's script, commit only vault content

The audit agent had no executable path in CI (Bash limited to the two
retrieval tools), wrote itself scripts it could not run and reported one
of seven checks (runs 10262, 10362). The checks are mechanical, so
notes/bin/wiki_audit.py does them without a model. push-notes adds only
wiki/, raw/ and output/, so scratch files in the checkout root are no
longer committed.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

.woodpecker/wiki-maintenance.yml

@@ -1,12 +1,11 @@
 # Nightly wiki maintenance for the Notes vault (k.renner/notes), replacing the
-# workstation's wiki-maintenance.timer: distill the raw/ backlog into wiki/,
-# then audit wiki/. Each agent is its own `claude` run, not a subagent of an
-# orchestrator, so nothing depends on background tasks in print mode (the
-# workstation job died on their 600 s ceiling). The pipeline commits and pushes
-# as Claude Bot; the push webhook then refreshes the wiki-index service.
+# workstation's wiki-maintenance.timer: distill the raw/ backlog into wiki/
+# (a `claude` run of the wiki-distill agent), then audit wiki/ with the vault's
+# own script (structural checks, no model). The pipeline commits and pushes as
+# Claude Bot; the push webhook then refreshes the wiki-index service.
 #
-# The agents and their retrieval scripts address the vault as ~/Notes, so each
-# agent step links $HOME/Notes to the checkout instead of rewriting them.
+# The agent and its retrieval scripts address the vault as ~/Notes, so the
+# distill step links $HOME/Notes to the checkout instead of rewriting them.
 when:
   - event: cron
     cron: wiki-maintenance
@@ -64,31 +63,9 @@ steps:
   - name: audit
     image: gitea.renner.uno/gitea_admin/ci-claude:2.1.280
     pull: true
-    environment:
-      CLAUDE_CODE_OAUTH_TOKEN:
-        from_secret: claude_code_oauth_token
-      TYPESAFE_API_KEY:
-        from_secret: typesafe_api_key
-      WIKI_INDEX_BASIC_AUTH:
-        from_secret: wiki_index_basic_auth
     commands:
-      - |
-        set -eu
-        ln -sfn "$$PWD/notes" "$$HOME/Notes"
-        mkdir -p "$$HOME/.config/wiki-index"
-        printf '%s' "$$WIKI_INDEX_BASIC_AUTH" | tr -d '\r\n' > "$$HOME/.config/wiki-index/basic-auth"
-        chmod 600 "$$HOME/.config/wiki-index/basic-auth"
-      - |
-        set -eu
-        MODEL=$$(sh scripts/ci/pick-model.sh "structural audit of ~1700 markdown notes: frontmatter completeness, broken links, orphans; mechanical checks, little reasoning")
-        if [ -n "$$MODEL" ]; then echo "audit: selected model $$MODEL"; else echo "audit: using the CLI default model"; fi
-        cd notes
-        cat ../ci/agents/wiki-maintenance/audit.md | claude $${MODEL:+--model $$MODEL} \
-          --agent wiki-audit \
-          --permission-mode acceptEdits \
-          --allowedTools "Read,Write,Glob,Grep,Bash(/root/Notes/bin/wiki_rank.py:*),Bash(/root/Notes/bin/wiki_ask.py:*)" \
-          --settings ../ci/agents/wiki-maintenance/settings.json \
-          -p
+      # Findings are report lines in output/, not a pipeline failure.
+      - python3 -B notes/bin/wiki_audit.py --vault "$$PWD/notes"
 
   - name: push-notes
     image: gitea.renner.uno/gitea_admin/ci-claude:2.1.280
@@ -102,7 +79,9 @@ steps:
         cd notes
         git config user.email "claude-bot@renner.uno"
         git config user.name "Claude Bot"
-        if git diff --quiet && git diff --cached --quiet && [ -z "$$(git ls-files --others --exclude-standard)" ]; then
+        # Only the vault content is committed; anything an agent leaves elsewhere
+        # in the checkout (run 10362: scratch scripts in the root) stays behind.
+        if [ -z "$$(git status --porcelain -- wiki raw output)" ]; then
           echo "wiki-maintenance: no changes"
           exit 0
         fi
@@ -112,7 +91,7 @@ steps:
         # leaves the PR open for a human and fails the run.
         BRANCH="wiki-maintenance/$$(date -u +%F)-$$CI_PIPELINE_NUMBER"
         git checkout -q -b "$$BRANCH"
-        git add -A
+        git add -A -- wiki raw output
         git commit -q -m "wiki maintenance $$(date -u +%F): distill + audit (CI run $$CI_PIPELINE_NUMBER)"
         TOKEN=$$(printf '%s' "$$WIKI_BOT_TOKEN" | tr -d '\r\n')
         git -c http.extraheader="AUTHORIZATION: token $$TOKEN" push origin "HEAD:$$BRANCH"

ci/agents/wiki-maintenance/audit.md

@@ -1,5 +0,0 @@
-You are running as the scheduled wiki-maintenance job in CI. The Notes vault is checked out at ~/Notes (the repository k.renner/notes).
-
-Run the standard audit pass over ~/Notes/wiki/ and write the dated report to ~/Notes/output/. Do not modify any wiki note. Do not commit or push; the pipeline does that.
-
-End with two lines: notes scanned, and issues found by category.

ci/agents/wiki-maintenance/settings.json

@@ -1,5 +1,5 @@
 {
-  "//": "Permission scope for the wiki-maintenance agents (wiki-distill, wiki-audit) in CI.",
+  "//": "Permission scope for the wiki-maintenance agent (wiki-distill) in CI.",
   "//2": "The step's environment holds a Gitea push token, a TypeSafe key and the wiki-index",
   "//3": "client credential, so the Read tool is kept away from /proc (env dumps), /root outside",
   "//4": "the vault symlink target, /etc and the checkout's .git/. The vault itself is the work.",

kubernetes/apps/monitoring-rules/prometheusrule-openbao.yaml

@@ -57,10 +57,14 @@ spec:
           # the ClusterSecretStore goes InvalidProviderConfig and no
           # ExternalSecret can refresh.
           #
-          # No window: below quorum the secret store is down and every
-          # ExternalSecret stalls with it, so waiting only delays the page.
+          # Short window: readiness is only a proxy for quorum. A one-second
+          # node NotReady flap makes the node lifecycle controller mark that
+          # node's pods not-ready for ~30s while raft keeps its leader and
+          # serves (issue #920, during a rolling reboot with one replica
+          # already evicted). A really sealed or crashed majority persists,
+          # and existing Secrets keep their last values, so 2m costs little.
           expr: max by (namespace, statefulset) (kube_statefulset_status_replicas_ready{namespace="openbao", statefulset="openbao"}) < 2
-          for: 0m
+          for: 2m
           labels:
             severity: critical
           annotations:

kubernetes/infrastructure/k8s-gateway/helmrelease.yaml

@@ -1,11 +1,16 @@
 apiVersion: source.toolkit.fluxcd.io/v1
-kind: HelmRepository
+kind: OCIRepository
 metadata:
   name: k8s-gateway
   namespace: kube-system
 spec:
   interval: 24h
-  url: https://k8s-gateway.github.io/k8s_gateway/
+  url: oci://codeberg.org/k8s-gateway/charts/k8s-gateway
+  ref:
+    semver: ">=2.4.0"
+  layerSelector:
+    mediaType: "application/vnd.cncf.helm.chart.content.v1.tar+gzip"
+    operation: copy
 ---
 # In-cluster authoritative resolver for renner.uno.
 #
@@ -28,14 +33,10 @@ metadata:
   namespace: kube-system
 spec:
   interval: 30m
-  chart:
-    spec:
-      chart: k8s-gateway
-      version: ">=2.4.0"
-      sourceRef:
-        kind: HelmRepository
-        name: k8s-gateway
-        namespace: kube-system
+  chartRef:
+    kind: OCIRepository
+    name: k8s-gateway
+    namespace: kube-system
   install:
     remediation:
       retries: 3