ANSWERED 2026-09-22 by hpomen (#478) and system-steward (#479). FACTS: the only GitLab is gitlab-ce on the Omen at http://192.168.123.153:9080 (use the IP, never localhost - external_url is unset). It is a LAN CONVENIENCE MIRROR, not the source of truth, and not backed up; GitHub-private is the offsite of record. 5 projects under root/, 0 groups. ZERO runners, container registry DISABLED, deploy tokens disabled (project access tokens work: write_repository, Maintainer, expiry). No CI exists anywhere in the fleet - SPICE would be the first pipeline. ADOPTED: GitHub stays origin; no build/test on .69 (hub + LiteLLM + 20 GB Ollama, commit-exhaustion history); deploy into .69 only through a deploy-only grant, never the docker socket; if a runner lands on the Omen: concurrency 1, hard memory limit, the -m:1 / MaxParallelThreads=2 recipe, gated on SPICE being down. OPERATOR DECIDES: (1) CI as a GATE (GitHub Actions, cloud) or BEST-EFFORT (runner on the Omen, part-time host that flaps); (2) the deploy grant into .69; (3) if GitLab is used: hpomen creates root/spice and mints the project token on the operator's word.