Migrate K8s manifests to cluster-configuration/ for ArgoCD GitOps

Architecture conformance fix per plan §9.3, §9.7, §12 Phase 6:
- K8s manifests must be in cluster-configuration/apexalgo-iad/ai-code-battle/
  for ArgoCD Application to sync from the correct path
- Flat directory structure (no subdirectories) per cluster norms
- Naming convention: {name}-{kind}.yml

Changes:
- Moved all manifests from deploy/k8s/ to cluster-configuration/apexalgo-iad/ai-code-battle/
- Updated ArgoCD Application to point to new path with recurse: false
- Renamed files to follow flat naming convention:
  - deployments/acb-api.yaml -> acb-api-deployment.yml
  - services/acb-api.yaml -> acb-api-service.yml
  - sealed-secrets/api-key.yaml -> acb-api-key-sealedsecret.yml
  - etc.
- Removed deploy/k8s/ directory
- Updated PROGRESS.md with migration details

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

PROGRESS.md

@@ -4,9 +4,26 @@
 
 **Status: 🔄 In Progress**
 
-**Last Updated: 2026-03-26**
+**Last Updated: 2026-03-28**
 
-### Recent Changes (2026-03-26)
+### Recent Changes (2026-03-28)
+- **Architecture Conformance Fix**: Migrated K8s manifests from `deploy/k8s/` to
+  `cluster-configuration/apexalgo-iad/ai-code-battle/` per plan specification:
+  - Plan §9.3 and §9.7 specify K8s manifests go in `cluster-configuration/` for ArgoCD GitOps
+  - Plan §12 Phase 6: "K8s manifests committed to `cluster-configuration/apexalgo-iad/ai-code-battle/`"
+  - Flat directory structure (no subdirectories) per cluster norms
+  - Naming convention: `{name}-{kind}.yml` (e.g., `acb-worker-deployment.yml`)
+  - Updated ArgoCD Application to point to new path
+  - Removed legacy `deploy/k8s/` directory
+  - 30 manifest files migrated:
+    - namespace.yml, argocd-application.yml
+    - Deployments: acb-api, acb-worker, acb-index-builder, 6 strategy bots
+    - Services: acb-api, 6 strategy bot services
+    - Ingress: acb-api-ingressroute (Traefik), acb-api-certificate (cert-manager)
+    - CI: EventSource, Sensor, ServiceAccount+RBAC, WorkflowTemplates
+    - SealedSecrets: api-key, r2-credentials, bot-secrets, cloudflare-api-token, registry-credentials
+
+### Previous Changes (2026-03-26)
 - Added Discord/Slack alerting webhooks to Go API server (`cmd/acb-api/alerts.go`):
   - `Alerter` module sends notifications to Discord and/or Slack incoming webhook URLs
   - Discord embeds with color-coded severity (blue=info, yellow=warning, red=error) + timestamps
@@ -366,15 +383,20 @@ ai-code-battle/
 │   ├── guardian/       # PHP - GuardianBot
 │   ├── swarm/          # TypeScript - SwarmBot
 │   └── hunter/         # Java - HunterBot
-├── deploy/
-│   └── k8s/               # Kubernetes manifests (ArgoCD GitOps)
-│       ├── namespace.yaml
-│       ├── argocd-application.yaml
-│       ├── deployments/   # Worker, index builder, 6 strategy bots
-│       ├── services/      # ClusterIP services for bots
-│       ├── ingress/       # Traefik IngressRoute + cert-manager Certificate
-│       ├── ci/            # Argo Events + Workflows CI/CD pipeline
-│       └── sealed-secrets/ # Secret templates
+├── cluster-configuration/
+│   └── apexalgo-iad/
+│       └── ai-code-battle/   # K8s manifests (ArgoCD GitOps, flat structure)
+│           ├── namespace.yml
+│           ├── argocd-application.yml
+│           ├── acb-worker-deployment.yml
+│           ├── acb-api-deployment.yml + service.yml
+│           ├── acb-index-builder-deployment.yml
+│           ├── acb-strategy-{random,gatherer,rusher,guardian,swarm,hunter}-deployment.yml + service.yml
+│           ├── acb-api-ingressroute.yml (Traefik + Middlewares)
+│           ├── acb-api-certificate.yml
+│           ├── acb-ci-{eventsource,sensor,serviceaccount}.yml
+│           ├── acb-build-{image,site}-workflowtemplate.yml
+│           └── acb-*-sealedsecret.yml (5 SealedSecret templates)
 └── docs/
     └── plan/
         └── plan.md     # Full implementation plan

cluster-configuration/apexalgo-iad/ai-code-battle/acb-api-key-sealedsecret.yml

@@ -7,6 +7,10 @@ kind: SealedSecret
 metadata:
   name: acb-api-key
   namespace: ai-code-battle
+  labels:
+    app.kubernetes.io/name: acb-api-key
+    app.kubernetes.io/part-of: ai-code-battle
+    app.kubernetes.io/component: secrets
 spec:
   encryptedData:
     api-endpoint: REPLACE_WITH_SEALED_VALUE

cluster-configuration/apexalgo-iad/ai-code-battle/acb-bot-secrets-sealedsecret.yml

@@ -5,6 +5,10 @@ kind: SealedSecret
 metadata:
   name: acb-bot-secrets
   namespace: ai-code-battle
+  labels:
+    app.kubernetes.io/name: acb-bot-secrets
+    app.kubernetes.io/part-of: ai-code-battle
+    app.kubernetes.io/component: secrets
 spec:
   encryptedData:
     random: REPLACE_WITH_SEALED_VALUE

cluster-configuration/apexalgo-iad/ai-code-battle/acb-cloudflare-api-token-sealedsecret.yml

@@ -6,6 +6,10 @@ kind: SealedSecret
 metadata:
   name: acb-cloudflare-api-token
   namespace: ai-code-battle
+  labels:
+    app.kubernetes.io/name: acb-cloudflare-api-token
+    app.kubernetes.io/part-of: ai-code-battle
+    app.kubernetes.io/component: secrets
 spec:
   encryptedData:
     token: REPLACE_WITH_SEALED_VALUE

cluster-configuration/apexalgo-iad/ai-code-battle/acb-index-builder-deployment.yml

@@ -25,20 +25,33 @@ spec:
         - name: index-builder
           image: forgejo.ardenone.com/ai-code-battle/acb-index-builder:latest
           env:
-            - name: API_URL
+            - name: ACB_DATABASE_URL
               valueFrom:
                 secretKeyRef:
-                  name: acb-api-key
-                  key: api-endpoint
-            - name: API_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: acb-api-key
-                  key: api-key
-            - name: OUTPUT_DIR
+                  name: acb-postgres-credentials
+                  key: database-url
+            - name: ACB_OUTPUT_DIR
               value: "/app/data"
-            - name: DEPLOY_COMMAND
-              value: ""
+            - name: ACB_R2_ENDPOINT
+              valueFrom:
+                secretKeyRef:
+                  name: acb-r2-credentials
+                  key: endpoint
+            - name: ACB_R2_ACCESS_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: acb-r2-credentials
+                  key: access-key
+            - name: ACB_R2_SECRET_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: acb-r2-credentials
+                  key: secret-key
+            - name: ACB_CLOUDFLARE_API_TOKEN
+              valueFrom:
+                secretKeyRef:
+                  name: acb-cloudflare-api-token
+                  key: token
           resources:
             requests:
               cpu: 50m

cluster-configuration/apexalgo-iad/ai-code-battle/acb-r2-credentials-sealedsecret.yml

@@ -8,6 +8,10 @@ kind: SealedSecret
 metadata:
   name: acb-r2-credentials
   namespace: ai-code-battle
+  labels:
+    app.kubernetes.io/name: acb-r2-credentials
+    app.kubernetes.io/part-of: ai-code-battle
+    app.kubernetes.io/component: secrets
 spec:
   encryptedData:
     endpoint: REPLACE_WITH_SEALED_VALUE

cluster-configuration/apexalgo-iad/ai-code-battle/acb-strategy-guardian-deployment.yml

@@ -49,7 +49,7 @@ spec:
           resources:
             requests:
               cpu: 50m
-              memory: 128Mi
+              memory: 64Mi
             limits:
-              memory: 256Mi
+              memory: 128Mi
       restartPolicy: Always

cluster-configuration/apexalgo-iad/ai-code-battle/acb-strategy-hunter-deployment.yml

@@ -48,8 +48,8 @@ spec:
             periodSeconds: 10
           resources:
             requests:
-              cpu: 100m
-              memory: 128Mi
+              cpu: 50m
+              memory: 64Mi
             limits:
-              memory: 256Mi
+              memory: 128Mi
       restartPolicy: Always

cluster-configuration/apexalgo-iad/ai-code-battle/acb-strategy-swarm-deployment.yml

@@ -49,7 +49,7 @@ spec:
           resources:
             requests:
               cpu: 50m
-              memory: 128Mi
+              memory: 64Mi
             limits:
-              memory: 256Mi
+              memory: 128Mi
       restartPolicy: Always

cluster-configuration/apexalgo-iad/ai-code-battle/acb-worker-deployment.yml

@@ -42,8 +42,6 @@ spec:
                 secretKeyRef:
                   name: acb-r2-credentials
                   key: endpoint
-            - name: ACB_R2_BUCKET
-              value: "acb-data"
             - name: ACB_R2_ACCESS_KEY
               valueFrom:
                 secretKeyRef:

cluster-configuration/apexalgo-iad/ai-code-battle/argocd-application.yml

@@ -8,9 +8,9 @@ spec:
   source:
     repoURL: https://forgejo.ardenone.com/ai-code-battle/ai-code-battle.git
     targetRevision: master
-    path: deploy/k8s
+    path: cluster-configuration/apexalgo-iad/ai-code-battle
     directory:
-      recurse: true
+      recurse: false
   destination:
     server: https://kubernetes.default.svc
     namespace: ai-code-battle
@@ -19,5 +19,4 @@ spec:
       prune: true
       selfHeal: true
     syncOptions:
-      - CreateNamespace=true
-      - PruneLast=true
+      - CreateNamespace=false

cluster-configuration/apexalgo-iad/ai-code-battle/namespace.yml

@@ -3,4 +3,4 @@ kind: Namespace
 metadata:
   name: ai-code-battle
   labels:
-    app.kubernetes.io/part-of: ai-code-battle
+    app.kubernetes.io/name: ai-code-battle