Document real deploy state: console live, webhook still broken

Console is fully live on apps (105) — deployed manually via deploy.sh
(twice: initial install, then again after the ReadWritePaths/mkdir
fixes landed), both systemd units active, verified end-to-end through
Caddy + Authentik + DNS.

Gitea webhook 14 is registered and its secret is confirmed synced
between Gitea and apps (rotated once already, ruling out drift as the
cause) but every delivery still 403s with a signature mismatch.
Debugging attempts (a git-committed test build, ad-hoc production
edits) both hit safety-classifier blocks this session (production code
mutation, signature data in logs) — left unresolved rather than forced
through. Auto-deploy via push doesn't work yet for this service; manual
deploy.sh re-runs are the workaround until someone tracks this down.

Added to the 60/90-day backlog.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

OIKOS.md

@@ -167,6 +167,14 @@ each is a `config_mutation`/`destructive`-class decision:
 Derived from gaps observed while building the 30-day roadmap, not
 guesswork. Roughly ordered by what unblocks the most:
 
+- **Fix the oikos-console deploy webhook's signature mismatch.** Console
+  is live on apps (105) via a manual `deploy.sh` run, but Gitea webhook
+  14's deliveries all 403 with a signature mismatch for a cause not yet
+  found — the secret is confirmed synced correctly on both sides
+  (rotated once already to rule out drift). Until fixed, `git push`
+  doesn't auto-redeploy the console the way it does for homelab-mcp/
+  secrets-issuance; re-run `deploy.sh` on apps manually after changes.
+  See [oikos/console/deploy/README.md](oikos/console/deploy/README.md).
 - **SSH-key-signed approval requests.** Replaces the design note in
   Week 4: age keys can't sign (encryption-only format), so per-agent
   request authentication needs `ssh-keygen -Y sign`/`-Y verify` against

oikos/console/deploy/README.md

@@ -10,19 +10,24 @@ webhook on `dtoro/Homelab-Docs`, port :9831.
 
 ## Status (2026-07-06)
 
-- **Gitea webhook: done.** Registered via the Gitea API as webhook id
+- **Console deploy on apps (105): done.** Live at `/opt/oikos-console`,
+  both systemd units enabled and active, verified locally
+  (`127.0.0.1:8091` → `200`) and end-to-end
+  (`https://oikos.hubris.network/` → `302`, the Authentik gate firing).
+- **Gitea webhook: registered but NOT currently working.** Webhook id
   **14** (`http://192.168.8.205:9831/deploy`, `push` events, `main`
-  branch filter, active). See
-  [infrastructure/auto-deploy.md](../../../infrastructure/auto-deploy.md).
-- **Console deploy on apps (105): not yet done.** Direct SSH bootstrap
-  was withheld pending explicit operator execution — see "One-time
-  setup" below. **Important:** webhook 14's secret was generated and
-  registered with Gitea *before* the apps-side install (order reversed
-  from the usual flow). It's encrypted at `secrets/oikos-console-deploy-secret.yaml`
-  (recipient: apps only). When you run `webhook/install.sh` below,
-  **skip its random-secret generation** — instead run
-  `homelab secret oikos-console-deploy-secret` on apps and write the
-  `webhook_secret` value into `/etc/oikos-console-deploy/secret` yourself.
+  branch filter, active) exists, and its secret is synced correctly
+  between Gitea and `/etc/oikos-console-deploy/secret` on apps (rotated
+  once to fix a drift from an earlier partial-PATCH update) — but
+  deliveries still 403 with a signature mismatch for a cause not yet
+  found. **Until this is fixed, `git push` to `main` will NOT
+  auto-redeploy the console** — run `deploy.sh` manually on apps after
+  any change (see "One-time setup" below; it's idempotent, safe to
+  re-run). Debugging this further needs either a git-committed (not
+  ad-hoc SSH-edited) debug build of `webhook.py`, or checking Gitea's
+  actual signing behavior against a captured raw request — both stalled
+  on safety-classifier blocks around production code edits and
+  credential handling this session, so left for a future pass.
 - **Caddy route: done.** Pushed to `dtoro/caddy-conf` (commit `c195142`),
   Authentik-gated matching `paperless.hubris.network`'s pattern, reload
   confirmed clean (an unrelated route stayed healthy through the reload).