[thiras]

decdn/sponsord was merged into the decdn/decdn workspace (decdn 34da2d80, 2026-10-20) and archived. decdn's release now ships sponsord and sponsord-onramp in the same release as decdn-node and decdn: the same archive names, one shared SHA256SUMS, sponsord-image-digest.txt / sponsord-onramp-image-digest.txt, the same ghcr.io/decdn/sponsord* image names and the same signing keys. The merge landed after decdn v0.2.0, so no decdn release carries the sponsord archives yet; v0.3.0 is expected to be the first.

This PR repoints every path at decdn/decdn and makes the decdn bump the only bump:

• Roles. sponsord and sponsord_onramp download, resolve and build from decdn/decdn (*_release_base, *_release_index, *_source_repo); the unit Documentation= and the prose follow. The source build needs no change: cargo build -p sponsord / -p sponsord-onramp selects the workspace member.
• KEYS. roles/sponsord/files/sponsord-release-KEYS.asc → decdn-release-KEYS.asc, a byte copy of decdn_node's, as the onramp's already was; the onramp role now verifies its own archive against its own copy instead of reaching into the sponsord role by role_path. make test-scripts checks all three copies are identical.
• Pins. sponsord_version and sponsord_onramp_version stay as variables (collection API unchanged) and must now equal decdn_node_version (make test-scripts, and upstream-drift refuses to run otherwise). scripts/bump_decdn.py rewrite moves all three lines, the sponsord commented examples and Compose's two sponsord image digests (--sponsord-image-digest, --onramp-image-digest); open-decdn-bump.sh downloads and GPG-verifies all three digest files and copies a changed KEYS into every role. The sponsord README's bump checklist folds into decdn_node's.
• upstream-drift. One release line: the sponsord digest checks read decdn/decdn's assets at the decdn tag; the decdn/sponsord resolve and release-line check are gone.
• Docs, Compose, cloud-init, monitoring. AGENTS.md's "Pinned upstream releases", SECURITY.md, the role and path READMEs, compose/.env.example, the cloud-init publisher template and lint, the alert runbook_urls (docs/sponsord/operator.md upstream) and the molecule fixtures' repo strings.

Lines stay at 0.2 here. A 0.3 pin would make test-scripts, the chart's CLI fetch and the bump script's own unit tests red until v0.3.0 exists, so this PR is green on its own and the (now sponsord-aware) automatic bump PR that decdn's publish-crates.sh opens after v0.3.0 moves every pin and digest to 0.3 in one go. Until then compose/.env.example's sponsord digests are still decdn/sponsord v0.2.0's (the last separate release).

Merge order. Merge this after decdn v0.3.0 ships, then the bump/decdn-v0.3.0 PR (a bump PR opened before this merges comes from the old script and leaves the sponsord pins behind: close it and rerun scripts/open-decdn-bump.sh v0.3.0 from main once this is in). Between the two, a default deploy from main would resolve decdn/decdn 0.2 → v0.2.0, which has no sponsord archives, so do not deploy sponsord from main in that window. Then release decdn.node, decdn.publisher and the chart (new line). Follow-ups outside this repo: fleet's host_vars/sponsord/main.yml and docs name decdn/sponsord; the workspace CLAUDE.md.

Checks run locally: make test-scripts, make lint, make lint-ansible, make lint-compose, make lint-cloud-init, galaxy/check-playbooks.sh for both collections (galaxy-importer is not installed here), make molecule SCENARIOS='validation-sponsord sponsord-install'.

🤖 Generated with Claude Code