riotpiao.com/tasks/01-phase0-unblock.md

# Phase 0 — Unblock

Blocking. Nothing ships until this lands. Requires [00-decisions.md](00-decisions.md) #1 and #2 answered first.

## Tasks

- [ ] **0.1** Resolve which GitOps repo owns the portfolio; delete or correct the losing manifest
  - Depends on: decision #1
  - Verify: `kubectl get application portfolio -n argocd` shows one, correct, source

- [ ] **0.2** Point `infra/argocd-apps.yaml` `repoURL` and image reference at real hostnames (fix NXDOMAIN)
  - Verify: `kubectl get pods -n portfolio` → `2/2 Running`

- [ ] **0.3** Replace `:latest` tag with commit-SHA tag in `infra/portfolio/base/deployment.yaml`; keep `imagePullPolicy: IfNotPresent` (correct once tags are immutable)
  - Verify: new commit → new tag → Argo rolls out automatically, no manual `kubectl set image`

- [ ] **0.4** Diagnose `forgejo-gitea` stuck `Init:0/3` (3h+) — read init container logs before changing anything
  - Command: `kubectl logs -n cicd <forgejo-gitea-pod> -c <init-container-name>`
  - Verify: pod reaches `Running`, image builds succeed

- [ ] **0.5** Diagnose apex 403 — check Cloudflare tunnel Public Hostnames list and WAF event log
  - Depends on: decision #2
  - Verify: `curl -sS -o /dev/null -w '%{http_code}\n' https://riotpiao.com` → `200`

- [ ] **0.6** Add Vitest + Testing Library + `msw`; add `test` and `test:watch` scripts to `package.json`
  - Verify: `pnpm test` → runner executes, 0 tests, exit 0

- [ ] **0.6a** Add Playwright (`pnpm create playwright`); add `test:e2e` script to `package.json`; wire into CI as a hard gate (build fails if `test:e2e` fails)
  - Playwright is a hard requirement, not optional, for every phase that ships a UI surface (Phase 2, 3, 4, 5) — no surface merges without a passing e2e spec
  - Verify: `pnpm test:e2e` → runner executes, 0 tests, exit 0

- [ ] **0.7** Triage unrelated cluster issues: `sms` Application Degraded (`macos-bluebubbles` Pending 3h), `longhorn-config` OutOfSync
  - Unrelated to atlas, but delivery tree (Phase 3) will render both red on day one — fix or explicitly accept as known-red

## Phase verify

```bash
kubectl get pods -n portfolio                                    # 2/2 Running
curl -sS -o /dev/null -w '%{http_code}\n' https://riotpiao.com   # 200
pnpm test                                                         # runner executes, 0 tests, exit 0
pnpm test:e2e                                                     # runner executes, 0 tests, exit 0
```

Next: [02-phase1-atlas-core.md](02-phase1-atlas-core.md)