recipe-enroll: create mirrors public (gitea/wordpress were private-from-birth, darkening report STATUS)

.opencode/skills/recipe-enroll/SKILL.md

@@ -43,7 +43,10 @@ On cc-ci, after `abra recipe fetch <recipe>`, read `~/.abra/recipes/<recipe>/`:
 ### 2. Create + sync the mirror
 
 Create `recipe-maintainers/<recipe>` (Gitea API: `POST /orgs/recipe-maintainers/repos`,
-`{"name":…,"private":true,"default_branch":"main","auto_init":false}`), then force-sync from
+`{"name":…,"private":false,"default_branch":"main","auto_init":false}`) — a recipe mirror MUST be
+created **public**: the cc-ci recipe mirrors are public (fleet invariant; the report's live PR-STATUS
+proxy `report./pr/<recipe>/<n>` is tokenless and only sees public repos — private-from-birth mirrors
+like gitea/wordpress left its status cells dark until flipped). Then force-sync from
 coopcloud with the existing helper **run on cc-ci with creds injected via stdin** (the host has
 no `.testenv`):
 ```

memory/MEMORY.md

@@ -3,7 +3,7 @@
 - [Orchestrator host: Hetzner](orchestrator-host-hetzner.md) — runs on Hetzner cpx22; rebuild cmd, loops-service bounce, git-identity gotcha
 - [Push commits to remote](push-commits-to-remote.md) — push to git.autonomic.zone right after every commit in this repo
 - [Regression canary cadence](regression-canary-cadence.md) — server E2E canaries run on polish/review/release, not every commit
-- [Recipe-mirrors public / org blocker](recipe-mirrors-public-org-blocker.md) — mirrors public but recipe-maintainers ORG is private → live PR-STATUS column dark until operator flips org public
+- [Recipe-mirrors MUST be public](recipe-mirrors-public-org-blocker.md) — org public since ~2026-06, but /recipe-enroll created late mirrors (gitea, wordpress) private-from-birth, darkening report STATUS cells; flipped public + skill fixed 2026-09-14
 - [abra chaos-deploy checkout gotcha](abra-chaos-deploy-checkout-gotcha.md) — `abra app new` moves recipe checkout to release tag; checkout PR branch after, or chaos deploys wrong tree
 - [Shared recipe-checkout race](shared-recipe-checkout-race.md) — never git-checkout ~/.abra/recipes/<recipe> on cc-ci while its CI build runs; harness deploys from that tree
 - [immich pgvecto.rs DROP DATABASE panic](immich-pgvectors-drop-database-panic.md) — DROP DATABASE crashes immich's postgres image; use pg_dump --clean --if-exists + search_path rewrite

memory/recipe-mirrors-public-org-blocker.md

@@ -1,29 +1,26 @@
 ---
 name: recipe-mirrors-public-org-blocker
-description: "Recipe mirrors are public repos but the recipe-maintainers ORG is private-visibility, so anon reads 404; bot can't flip the org"
+description: "Recipe mirrors MUST be public (fleet invariant: the report's tokenless PR-STATUS proxy only sees public repos); org is public since ~2026-06, but late-enrolled mirrors (gitea, wordpress) were created private-from-birth by /recipe-enroll — fixed 2026-09-14"
 metadata:
   node_type: memory
   type: project
   originSessionId: f7960036-d990-4a21-a81e-f7c486d97fea
 ---
 
-As of 2026-06-09 all 21 recipe mirrors under `recipe-maintainers` were flipped `private=false`
-(secret-scanned first), to power the Recipe Report's live PR-STATUS column via the tokenless
-same-origin proxy `report.ci.commoninternet.net/pr/<recipe>/<n>` (shipped in cc-ci
-`nix/modules/reports.nix`). BUT the **org itself is `visibility: private`**, which makes Gitea 404
-all its repos for anonymous users — so the live STATUS column shows a muted "?" instead of open/✓.
+The Recipe Report's live PR-STATUS column (`report.ci.commoninternet.net/pr/<recipe>/<n>`,
+shipped in cc-ci `nix/modules/reports.nix`) is a tokenless same-origin nginx proxy to the Gitea
+API — it can ONLY see public repos. So **`recipe-maintainers/<recipe>` mirrors MUST be public**
+(fleet invariant; cc-ci/cc-ci-orchestrator/archived repos stay deliberately private).
 
-**Blocker:** `autonomic-bot` cannot flip the org (PATCH `/orgs/recipe-maintainers` → 403 "Must be an
-organization owner"; `is_admin=false`; the basic-auth credential lacks `write:organization` scope,
-even though the bot is in the Owners team). Confirmed model: `autonomic-cooperative` is a public org
-and its repos ARE anonymously visible; `recipe-maintainers` is private and they are not.
+History: originally ALL mirrors were private; on 2026-06-09 the 21 then-existing mirrors were
+flipped `private=false` after a secret-scan, and the `recipe-maintainers` org was later flipped
+public by the operator (the old 'org is private' blocker is RESOLVED).
 
-**Why:** the whole live-status feature is dark until this is resolved. Private repos stay hidden even
-in a public org, so flipping the org public does NOT expose the four locked-private repos (`cc-ci`,
-`cc-ci-secrets`, `cc-ci-orchestrator`, `archived-cc-ci-orchestrator`).
-
-**How to apply:** operator (an org owner) must set `recipe-maintainers` org visibility to **public**
-in the Gitea UI (Settings → make org public), OR provision a token with `write:organization` scope.
-The instant that happens, the proxy returns 200 PR JSON and the column lights up — no redeploy needed.
-Verify: `curl https://report.ci.commoninternet.net/pr/cryptpad/5` should return PR JSON, not a 404.
+Recurrence (2026-09-14): /recipe-enroll still carried the old instruction to create mirrors with
+`"private":true` — so the later-enrolled mirrors `gitea` (2026-06-11) and `wordpress` (2026-08-03)
+were **private from birth**, leaving the report STATUS cells for those rows permanently "?"
+(gitea/wordpress rows in week-2026-09-11). Fixed: secret-scanned both, flipped `private=false`
+via PATCH `/repos/recipe-maintainers/<r>`, patched the skill to create `private:false`. The
+report now lights up for every row — verify any new PR row with
+`curl https://report.ci.commoninternet.net/pr/<recipe>/<n>` returning PR JSON, not 404.
 Related: [[push-commits-to-remote]].