From c631b0a9179721b68d48c1ee2e3c8e2ca9bfea5e Mon Sep 17 00:00:00 2001
From: Thore Cimbal <cfx@riot.8shield.net>
Date: Sat, 1 Aug 2026 04:35:21 +0200
Subject: [PATCH] CLAUDE.md: Topologie-Ausnahme fuer Rotations-PRs +
 .gitlab-ci.yml in Struktur

Der TURN-Rotations-CronJob erreicht git.lab nicht und oeffnet seinen PR
weiter auf Gitea - dokumentiert, wie er kanonisch zu mergen ist
(Beispiel 640c934 vom 2026-08-01), inkl. Mirror-Force-Sync-API.
Karpathy-Guidelines unveraendert.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PKhFj1S3UdD6xL2fbWPeYj
---
 CLAUDE.md | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/CLAUDE.md b/CLAUDE.md
index 66bd6a5..b086f36 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -31,10 +31,18 @@ force-overwrites divergent state. Issues/wiki/releases stay on Gitea. The same r
 applies to ThreadNet-Web, threadnet-call, thread-net-git and threadnet-operating; only
 the `Backlogs` repo (and this repo's wiki) are still direct-to-Gitea.
 
+**Exception that needs manual handling**: the monthly TURN-rotation CronJob runs in the
+cluster (no route to git.lab) and still opens its PR on Gitea. Never merge that PR on
+Gitea — instead fetch the rotation branch, merge it into main locally, push to git.lab;
+the mirror carries it back, Gitea auto-closes the PR (worked example: 2026-08-01,
+commit 640c934). If the mirror lags, force it: GitLab API
+`POST /projects/<id>/remote_mirrors/<mirror_id>/sync`.
+
 ## Repository Structure
 
 ```
 gitops/
+├── .gitlab-ci.yml            # Lab-CI verify job (YAML validation + SOPS-encryption check)
 ├── clusters/matrix/          # Flux GitRepository definition; entry point for reconciliation
 ├── apps/
 │   ├── base/