docs: record successful isolated CI build

CHANGELOG.md

@@ -2,6 +2,7 @@
 
 ## Не выпущено
 
+- CI actions теперь используют workspace, переданный Gitea, для Caddyfile и Kaniko build context; CI run 69 и smoke run 70 прошли на self-hosted runner.
 - Runner installer сохраняет `HOME` и XDG-пути в user-unit `docker.service`, перезапускает активный daemon и проверяет окружение его процесса.
 - Runner installer защищает image и mountpoint root-owned home-каталогом, оставляет регистрацию и workspace в runner-owned каталоге, безопасно форматирует образ по открытому FD и проверяет `nosuid,nodev`.
 - Backend `0.11.3`: ключ подписи поисковых снимков читается из Docker secret-файла, а не из аргументов процесса. Добавлена базовая инфраструктура VPS, Caddy HTTPS proxy с разделёнными Compose-сетями и CI-проверка конфигурации; публикация образов и production-деплой остаются выключены до проверки runner, registry, backup/restore и ограниченного deploy-helper.

docs/operations/CI_RUNNER.md

@@ -54,7 +54,9 @@ Dockerfiles are built in a separate pinned Kaniko container action with explicit
 job container receives no Docker socket. Kaniko uses `--no-push` and
 `--no-push-cache`, so CI validates the full backend and OpenSearch builds but
 does not publish images or export build output. The two builds run sequentially
-within one job; peak memory and disk use still require a runner canary. No registry credentials,
+within one job. CI run 69 completed both builds under the configured per-job
+limits; this confirms the workflow path and resource fit for that run, not
+host-wide resource metrics. No registry credentials,
 production secrets, elevated container options, or arbitrary host mounts are configured.
 
 The Kaniko action uses the `linux/amd64` v1.28.5-debug manifest
@@ -201,10 +203,11 @@ On head `3a89dc21`, CI run 63 failed at the host audit root guard and smoke run
 with `exec: "validate": executable file not found`; Kaniko was skipped and smoke
 run 66 succeeded. On head `d96fc4d3`, CI run 67 failed because the Caddy action
 looked for `/github/workspace/deploy/production/Caddyfile`, which was not
-mounted at that fixed path; Kaniko was skipped and smoke run 68 succeeded. This
-PR passes `${{ github.workspace }}` to the container actions and uses it for the
-Caddyfile, Kaniko context, and Dockerfile paths. A new runner canary must verify
-those paths and resource fit. Root-guard tests
+mounted at that fixed path; Kaniko was skipped and smoke run 68 succeeded. On
+head `5d72bb09`, CI run 69 and smoke run 70 succeeded. CI validated the Caddyfile
+and built the backend and OpenSearch images using `${{ github.workspace }}`
+within the configured per-job limits. Image publishing, host-wide resource
+metrics, and production deployment remain unverified. Root-guard tests
 use `setpriv` for negative cases when jobs start as UID 0 and separately test
 the host-audit guard with simulated UID 0 and UID 65534; the real host audit,
 production config setup, and runner installer are never executed as root by

docs/operations/CURRENT_STATE.md

@@ -99,10 +99,11 @@ UFW rule details, and protected file metadata remain unverified.
   with `exec: "validate": executable file not found`; Kaniko was skipped and
   smoke run 66 succeeded. On head `d96fc4d3`, CI run 67 failed because the
   Caddy action's fixed `/github/workspace/...` path did not exist; Kaniko was
-  skipped and smoke run 68 succeeded. The current branch passes
-  `${{ github.workspace }}` to Caddy and Kaniko actions; a new runner run must
-  verify workspace resolution, image builds, and fit within the configured
-  3 GiB / 2 CPU per-job limits. No VPS changes are made.
+  skipped and smoke run 68 succeeded. On head `5d72bb09`, CI run 69 and smoke
+  run 70 succeeded. CI validated the Caddyfile and built the backend and
+  OpenSearch images using `${{ github.workspace }}` within the configured
+  3 GiB / 2 CPU per-job limits. Image publishing, host-wide resource metrics,
+  and production deployment remain unverified. No VPS changes are made.
 - An isolated local Compose smoke test built backend/OpenSearch images,
   reached healthy status for OpenSearch, backend, and Caddy, and returned HTTP
   200 for `/review` through Caddy. Its containers, networks, and volumes were
@@ -120,8 +121,8 @@ UFW rule details, and protected file metadata remain unverified.
   and restore of real production data remain unverified because production is
   not deployed.
 - Cloudflare edge response was checked; origin DNS target, origin certificate,
-  Full (strict), registry publishing, successful Caddy/Kaniko action execution,
-  runner resource fit, and production deployment have not been verified. The
+  Full (strict), registry publishing, host-wide runner metrics, and production
+  deployment have not been verified. The
   owner-reported Idle state has not been independently checked through runner
   inventory because the API returned 403.
 - This audit made no host changes. No package or service was installed by this
@@ -141,10 +142,9 @@ UFW rule details, and protected file metadata remain unverified.
 3. Run `sudo bash /opt/akyldash/current/infra/deploy/install-helper.sh` after
    reviewing the checkout; it grants only fixed verification, Compose
    `config`/`status`, and guarded rollback commands.
-4. After PR review, inspect the latest CI and smoke runs on `akyldash-ci`.
-   Confirm both pinned container actions complete within the configured per-job
-   CPU, memory, and disk limits. Production deployment remains manual and has
-   no CI job.
+4. After merging the reviewed PR, confirm a subsequent CI and smoke run on
+   `akyldash-ci`. Image publishing and production deployment remain manual and
+   are not part of CI.
 5. Test backup/restore and rollback only with synthetic data in an isolated
    environment before any production deployment.
 
@@ -158,6 +158,6 @@ in the Caddy action because the runner tried to execute `validate` directly;
 Kaniko was skipped. CI run 67 then found that the action's fixed
 `/github/workspace` path did not contain the repository; Kaniko was skipped.
 The branch now passes Gitea's `${{ github.workspace }}` value into all three
-container action invocations. A successful run must verify Caddy, both image
-builds, and resource fit before these actions are considered validated runner
-behavior.
+container action invocations. CI run 69 verified Caddy, both image builds, and
+fit within the configured per-job limits; smoke run 70 passed. Host-wide runner
+metrics, image publishing, and production deployment remain unverified.