This change records the approved TEST bootstrap for EventHorizon and Bodylog. Production workloads and data were not changed. No provider calls were enabled. The TEST workloads use their isolated databases and synthetic fixtures.
Gitea 1.24.6 now has a nonadministrator account, test-package-pull, with package-read access only in the EventHorizon and BodyLog organizations. Its dedicated teams grant repo.packages=read; other organization units are disabled. Repository collaborator permission is none for the two source repositories. The PAT scope is exactly read:package (PAT id 26). It has no automatic expiry; owner review/revocation is due by 2026-12-25. The token value is stored only in the Kubernetes image-pull secrets and is not recorded here.
Verified HTTPS package reads returned status 200 for the exact immutable images:
gitea.app.lan/eventhorizon/eventhorizon@sha256:8cdf316d4afa85855876ed8f1f881136fa25c52f2c644c09f73a24ed888d2e10gitea.app.lan/bodylog/bodylog.dev@sha256:2c4b74624b619d3eec2773626e76574fe7e59abb23654c786a11db846b54f6f9Only these TEST namespaces received image-pull secrets: event-horizon-test/event-horizon-registry and bodylog-test/bodylog-test-registry.
The source-declared TEST Services, Deployments, PDB and Ingress resources are live in event-horizon-test; Bodylog TEST Service, Deployment and Ingress are live in bodylog-test. Deployments use the exact image digests above, completed startup migrations, and reached Ready. Existing database/storage admission records were checked before apply; database resources were not changed.
TEST routes:
Normal HTTPS trust succeeded. API checks returned 200 for EventHorizon /healthz, /readyz, and the synthetic persona d8cf4c79-76ef-4b3b-a29c-fac9d5572c01. Bodylog /healthz and /api/frontend-version returned 200. A normal Bodylog TEST login and /api/tasks request returned 200; the response contained exactly one reserved synthetic starter task. Fixture credentials remain only in restricted task storage; their values are intentionally omitted. EventHorizon has no LLM/feedback key configured; Bodylog retains only its limited TEST finance encryption secret. No provider calls were made.
Read-only production health checks for both applications returned 200 before and after route setup.
Canonical procedure: 2026-04-06 Bodylog app.lan Traefik route.
The documented Traefik configuration on kryptovisor.auth.home.lan was updated by atomic compare-and-swap, preserving owner/mode and the existing wildcard TLS configuration. Only the two TEST Host rules were added to their existing upstreams; no certificate or DNS changes were made. Configuration SHA-256 changed from b6e6fed52ac75f2cea30db7c8a78716e75a4555a8a54fda77b060a74ce4ed498 to a3a2ca0386d1cac3a7158d6194c96b2d1cfd7df3c0ef664aa048dc6d5868a5bf. A restricted rollback copy is at /home/ax_julian/temp/traefik-cert-conf-before-test-vhosts-20260926.yml. Traefik was restarted using the documented method; both TEST HTTPS routes and existing production routes remained healthy.
EventHorizon source sets spec.ingressClassName: nginx in k8s/test/ingress.yaml, matching the live cluster IngressClass. Commit 75e18008 was pushed to branch delivery/test-environment-20260926 for existing PR #1396. Feature CI status and final review/integration remain to be measured by the parent delivery owner.
API fixture and login acceptance are verified. Full browser UI acceptance is not yet claimed: the repository's Playwright config defaults to production and ignores HTTPS errors; the discovered EventHorizon browser specs are not configured for this TEST origin, and Bodylog's .browser.test.jsx files are Vitest component tests rather than live-site browser acceptance. No confirmed existing worker-only TEST browser acceptance route was found in this bounded check.