feat: add GoAlert Cloudron package (Monitoring) [#633]

Official-image wrapper of goalert/goalert 0.34.1 (digest-pinned),
single Go binary + postgresql only. Native generic OIDC wired from
the platform provider (GOALERT_OIDC_*), data-encryption key
persisted, optional first-admin basic auth. grind-stack verified:
full migration chain, serving, origin canonicalization correct.
18th package; category table reconciled to the 46-app set.

JOURNAL.md

@@ -1367,6 +1367,58 @@ landed mid-flight) + verification hardening follow-up
 
 ---
 
+### 18. GoAlert (Monitoring) ✅
+**Date**: 2026-09-06
+**Application**: GoAlert — Target's open-source on-call alerting
+(escalation chains, rotations, Slack/Twilio notifications, heartbeats,
+status dashboards). Upstream: https://github.com/target/goalert
+(Apache-2.0), v0.34.1. The cleanest Cloudron shape in the workspace: a
+single Go binary, PostgreSQL as the only store, migrations automatic.
+
+**Ticket**: [#633](https://projects.knownelement.com/issues/633)
+
+**Pattern**: official-image wrapper of `goalert/goalert:0.34.1`
+(amd64-manifest digest pinned; alpine + `apk add bash` for the
+/dev/tcp wait loop, same as ChirpStack).
+
+**Auth gate verdict**: ✅ OIDC preferred. Generic OIDC is first-class in
+core (config.go OIDC struct on go-oidc, any issuer):
+`GOALERT_OIDC_{ENABLE,ISSUER_URL,CLIENT_ID,CLIENT_SECRET,NEWUSERS}`
+wired from `CLOUDRON_OIDC_*`. Callback:
+`/api/v2/identity/providers/oidc/callback` (verified in
+auth/handler.go:271,392 + oidc provider appends `/callback`).
+GitHub OAuth + basic auth also exist; start.sh exposes optional
+first-admin basic auth via `GOALERT_ADMIN_USER/PASS` app env vars.
+
+**Key decisions**:
+
+- `GOALERT_DB_URL` built from the postgresql addon env (sslmode=disable
+  — the addon is on the platform network).
+- `GOALERT_DATA_ENCRYPTION_KEY` persisted under /app/data (rotating it
+  loses encrypted notification-provider credentials).
+- `GOALERT_PUBLIC_URL` ← `CLOUDRON_APP_ORIGIN`: GoAlert canonicalizes
+  every request to the https origin — behind Cloudron's TLS proxy that
+  is exactly right; during local verification every path 307s to the
+  origin (expected, not a loop).
+- Observed under the CPUWeight-25 batch slice: `slow cycle finished`
+  engine warnings (~5s cycles vs the 5s threshold) — contention
+  artifact, not a package defect; note for live sizing.
+
+**Verification** (grind-stack, ephemeral postgres): build green
+(small image — single binary); boot = PG wait → key generation → full
+migration chain applied → serving 307→https origin on :8081; container
+stable 5+ min under load.
+
+**Files Created**: Dockerfile, CloudronManifest.json (port 8081,
+localstorage + postgresql, 1024MB, healthCheckPath /api/v2/heartbeat),
+start.sh, README.md (auth table + admin bootstrap), CHANGELOG.md,
+.dockerignore, logo.png (Target org avatar — repo embeds its frontend,
+no logo file ships).
+
+**Commit**: `feat: add GoAlert Cloudron package (Monitoring) [#633]`
+
+---
+
 ## Packaging Pattern: Download Pre-Compiled Binaries
 
 ### When to Use

Package-Workspace/Monitoring/goalert/.dockerignore

@@ -0,0 +1 @@
+repo

Package-Workspace/Monitoring/goalert/CHANGELOG.md

@@ -0,0 +1,12 @@
+# Changelog — GoAlert Cloudron Package
+
+## 1.0.0 — 2026-09-06
+
+- Initial package: GoAlert 0.34.1 (official-image wrapper, digest-pinned
+  sha256:36b3962e…)
+- postgresql + localstorage addons; web/API on :8081; bash added for the
+  addon wait loop
+- GOALERT_DB_URL/PUBLIC_URL mapped from the platform env; data-encryption
+  key persisted under /app/data
+- Native OIDC wired from the platform provider, new-user creation on;
+  optional first-admin basic auth via GOALERT_ADMIN_USER/PASS env vars

Package-Workspace/Monitoring/goalert/CloudronManifest.json

@@ -0,0 +1,22 @@
+{
+  "manifestVersion": 2,
+  "type": "app",
+  "id": "io.cloudron.goalert",
+  "title": "GoAlert",
+  "description": "Open-source on-call and alerting system by Target: escalation chains, rotation schedules, notification rules (Slack, Twilio SMS/voice, and more), heartbeat checks, and status dashboards. Single Go service with PostgreSQL storage; schema migrations run automatically on start. SSO via the Cloudron OIDC provider; optional basic-auth bootstrap for the first admin.",
+  "author": "Target Corporation / GoAlert contributors",
+  "website": "https://goalert.io/",
+  "contactEmail": "cloudron@tsys.dev",
+  "tagline": "On-call scheduling, escalations and alert routing",
+  "version": "0.34.1",
+  "healthCheckPath": "/api/v2/heartbeat",
+  "httpPort": 8081,
+  "memoryLimit": 1024,
+  "addons": {
+    "localstorage": {},
+    "postgresql": {}
+  },
+  "mediaLinks": [],
+  "changelog": "Initial Cloudron package for GoAlert 0.34.1 (official-image wrapper of goalert/goalert, digest pinned). start.sh waits for the postgresql addon, persists the data-encryption key under /app/data, maps GOALERT_DB_URL/PUBLIC_URL from the platform env, and wires native generic OIDC (GOALERT_OIDC_*) from the Cloudron OIDC provider with new-user creation enabled. Optional first-admin via GOALERT_ADMIN_USER/PASS app env vars (basic auth).",
+  "icon": "file://logo.png"
+}

Package-Workspace/Monitoring/goalert/Dockerfile

@@ -0,0 +1,35 @@
+# GoAlert Cloudron Package
+#
+# GoAlert is Target's open-source on-call alerting system: escalation
+# chains, schedules/rotations, notification rules (SMS/phone via
+# Twilio/VictorOps etc., Slack), heartbeat checks, status dashboards —
+# a single Go binary serving web UI + REST API on :8081 with
+# PostgreSQL as the only backing store.
+#
+# Upstream: https://github.com/target/goalert (Apache-2.0), v0.34.1.
+#   - Official image goalert/goalert (alpine, /usr/bin/goalert, runs a
+#     build-time self-test). DB schema migrations run automatically at
+#     startup; no separate worker/scheduler processes.
+#   - Configuration is envconfig-style: GOALERT_<SECTION>_<FIELD>
+#     (GOALERT_DB_URL, GOALERT_PUBLIC_URL, GOALERT_OIDC_*, ...).
+#
+# Authentication: NATIVE OIDC (preferred). Generic OpenID Connect in
+# core (config/config.go OIDC struct; go-oidc against any issuer):
+# start.sh wires GOALERT_OIDC_ENABLE/ISSUER_URL/CLIENT_ID/CLIENT_SECRET
+# from the Cloudron platform provider (CLOUDRON_OIDC_*), with
+# new-user creation enabled. GitHub OAuth and basic-auth also exist.
+#
+# Pattern: official-image wrapper. Image pinned by tag AND digest
+# (amd64 manifest digest of v0.34.1 from docker manifest inspect).
+FROM goalert/goalert:v0.34.1@sha256:36b3962e3171de7ba6b964bcba21a9fee3fe331dc01d9716ee8bbd7bc01ba935
+
+# bash for start.sh (alpine's ash lacks /dev/tcp used by the addon wait)
+USER root
+RUN apk add --no-cache bash
+
+COPY start.sh /app/start.sh
+
+# web UI + REST API; notifications are all outbound (no extra listeners)
+EXPOSE 8081
+
+ENTRYPOINT ["/bin/bash", "/app/start.sh"]

Package-Workspace/Monitoring/goalert/README.md

@@ -0,0 +1,44 @@
+# GoAlert — Cloudron Package
+
+[GoAlert](https://github.com/target/goalert) v0.34.1 — Target's open-source
+on-call alerting: escalation chains, schedules and rotations, notification
+rules (Slack, Twilio SMS/voice, VictorOps, ...), heartbeats, status
+dashboards. A **single Go binary** with PostgreSQL as its only store —
+packaged as an official-image wrapper around `goalert/goalert`
+(digest-pinned), the cleanest Cloudron shape in this workspace.
+
+## Authentication (auth gate: ✅ OIDC preferred)
+
+Generic OpenID Connect is first-class in core (`config/config.go` OIDC
+struct on go-oidc — any compliant issuer). `start.sh` wires it from the
+Cloudron platform provider:
+
+| GoAlert env | Source |
+|-------------|--------|
+| `GOALERT_OIDC_ENABLE=true` | fixed |
+| `GOALERT_OIDC_ISSUER_URL` | `CLOUDRON_OIDC_ISSUER` |
+| `GOALERT_OIDC_CLIENT_ID` | `CLOUDRON_OIDC_CLIENT_ID` |
+| `GOALERT_OIDC_CLIENT_SECRET` | `CLOUDRON_OIDC_CLIENT_SECRET` |
+| `GOALERT_OIDC_NEWUSERS=true` | overridable (`GOALERT_OIDC_NEWUSERS`) |
+
+- SSO redirect: `https://<app-domain>/api/v2/identity/providers/oidc/callback`
+- OIDC-registered users are created **without** privileges. First admin:
+  set `GOALERT_ADMIN_USER` + `GOALERT_ADMIN_PASS` app env vars once —
+  start.sh exposes them as basic auth — log in, promote your SSO account,
+  then unset them (README + `.env.example`).
+
+## Runtime layout
+
+| Concern | How |
+|---------|-----|
+| Database | Cloudron `postgresql` addon; migrations run automatically at startup |
+| Encryption key | `GOALERT_DATA_ENCRYPTION_KEY` generated once, persisted in `/app/data` (rotating loses provider credentials) |
+| Public URL | `GOALERT_PUBLIC_URL` ← `CLOUDRON_APP_ORIGIN` |
+| Notifications | All outbound (Slack/Twilio/webhooks) — no inbound ports beyond 8081 |
+| Storage | `/app/data` (localstorage) — key + future runtime files |
+
+## Notes
+
+- Version upgrades: bump tag+digest in the Dockerfile, rebuild —
+  migrations run on first boot.
+- Package pattern + verification: repo `JOURNAL.md`, GoAlert section.

Package-Workspace/Monitoring/goalert/start.sh

@@ -0,0 +1,73 @@
+#!/bin/bash
+set -euo pipefail
+
+# GoAlert runtime setup for Cloudron:
+#   1. wait for the postgresql addon (GoAlert's startup runs migrations
+#      itself, but gives up quickly if the DB is slow to accept - the
+#      /dev/tcp wait removes that race)
+#   2. persist GOALERT_DATA_ENCRYPTION_KEY (rotating it loses encrypted
+#      notification-provider credentials)
+#   3. map the Cloudron addon + platform env onto GOALERT_* vars
+#   4. exec /usr/bin/goalert (migrations + web/API on :8081)
+#
+# Authentication: OIDC via the Cloudron platform provider. OIDC users
+# are created on first login (NewUsers=true); they arrive WITHOUT
+# admin rights - an admin logs in once with basic auth (GOALERT_BASIC_AUTH
+# below, set only when the operator provides GOALERT_ADMIN_USER/PASS env)
+# or via OIDC and is promoted from the admin panel.
+
+DATA_DIR="/app/data"
+KEY_FILE="${DATA_DIR}/.data_encryption_key"
+
+mkdir -p "${DATA_DIR}"
+
+# --- 1. wait for the addon -------------------------------------------------------
+wait_tcp() {
+  local host="$1" port="$2" name="$3"
+  echo "Waiting for ${name} at ${host}:${port} ..."
+  until (exec 3<>"/dev/tcp/${host}/${port}") 2>/dev/null; do
+    echo "${name} is unavailable - sleeping"
+    sleep 2
+  done
+  echo "${name} is up"
+}
+
+DB_HOST="${CLOUDRON_POSTGRESQL_HOST:-127.0.0.1}"
+DB_PORT="${CLOUDRON_POSTGRESQL_PORT:-5432}"
+DB_NAME="${CLOUDRON_POSTGRESQL_DATABASE:-goalert}"
+DB_USER="${CLOUDRON_POSTGRESQL_USERNAME:-goalert}"
+DB_PASS="${CLOUDRON_POSTGRESQL_PASSWORD:-}"
+
+wait_tcp "${DB_HOST}" "${DB_PORT}" "PostgreSQL"
+
+# --- 2. persistent data-encryption key -------------------------------------------
+if [[ ! -s "${KEY_FILE}" ]]; then
+  ( umask 077; head -c 32 /dev/urandom | od -An -tx1 | tr -d ' \n' > "${KEY_FILE}" )
+  echo "Generated new data encryption key"
+fi
+
+# --- 3. Cloudron -> GOALERT_* environment ----------------------------------------
+export GOALERT_DB_URL="postgres://${DB_USER}:${DB_PASS}@${DB_HOST}:${DB_PORT}/${DB_NAME}?sslmode=disable"
+export GOALERT_PUBLIC_URL="${CLOUDRON_APP_ORIGIN:-http://localhost}"
+export GOALERT_DATA_ENCRYPTION_KEY="$(cat "${KEY_FILE}")"
+export GOALERT_LISTEN=":8081"
+
+# optional admin bootstrap: when GOALERT_ADMIN_USER/GOALERT_ADMIN_PASS
+# are set as app env vars, basic auth allows the first admin login
+# (promote/deactivate the account after SSO users exist)
+if [[ -n "${GOALERT_ADMIN_USER:-}" && -n "${GOALERT_ADMIN_PASS:-}" ]]; then
+  export GOALERT_BASIC_AUTH="${GOALERT_ADMIN_USER}:${GOALERT_ADMIN_PASS}"
+else
+  unset GOALERT_BASIC_AUTH || true
+fi
+
+# platform OIDC provider -> goalert oidc config
+export GOALERT_OIDC_ENABLE="${GOALERT_OIDC_ENABLE:-true}"
+export GOALERT_OIDC_ISSUER_URL="${CLOUDRON_OIDC_ISSUER:-}"
+export GOALERT_OIDC_CLIENT_ID="${CLOUDRON_OIDC_CLIENT_ID:-}"
+export GOALERT_OIDC_CLIENT_SECRET="${CLOUDRON_OIDC_CLIENT_SECRET:-}"
+export GOALERT_OIDC_NEWUSERS="${GOALERT_OIDC_NEWUSERS:-true}"
+export GOALERT_OIDC_OVERRIDE_NAME="${GOALERT_OIDC_OVERRIDE_NAME:-Cloudron}"
+
+echo "Starting GoAlert (migrations run automatically) ..."
+exec /usr/bin/goalert

README.md

@@ -9,9 +9,9 @@ The Cloudron component focuses on packaging upstream free/libre/open application
 ### 📊 Current Progress
 
 - **Total Applications**: 46 (see [GitUrlList.txt](GitUrlList.txt); pruned 2026-09-06 by human rulings: no-Node policy, k8s redirects, out-of-scope)
-- **Completed Packages**: 17/~57 (~30%)
+- **Completed Packages**: 18/46 (~39% of the post-ruling set)
 - **Packaging Templates**: Created ✅
-- **Packages Committed & Pushed**: 17 ✅
+- **Packages Committed & Pushed**: 18 ✅
 - **Build Tickets**: rulings synced 2026-09-06 (#633-#678 batch, umbrella
   [#632](https://projects.knownelement.com/issues/632), Redmine project 55);
   grist-core excluded (packaged upstream)
@@ -39,6 +39,7 @@ The Cloudron component focuses on packaging upstream free/libre/open application
 | 15 | eLabFTW | Business-Apps | ~209MB (compressed) | 443 | localstorage, mysql, ldap | ✅ Committed |
 | 16 | NetBox | Infrastructure | ~1GB | 8080 | localstorage, postgresql, redis | ✅ Committed |
 | 17 | ConsulDemocracy | Collaboration | ~1.6GB | 3000 | localstorage, postgresql | ✅ Committed |
+| 18 | GoAlert | Monitoring | ~40MB | 8081 | localstorage, postgresql | ✅ Committed |
 
 ### 📦 Packages in Development
 
@@ -113,7 +114,7 @@ Applications are organized by function rather than programming language:
 
 | Application Name | Repository | Description | Functional Category | Package Status |
 |---|---|---|---|---|
-| [GoAlert](https://github.com/target/goalert) | [GitHub](https://github.com/target/goalert) | On-call scheduling, escalation, and alerting platform | Monitoring |
+| [GoAlert](https://github.com/target/goalert) | [GitHub](https://github.com/target/goalert) | On-call scheduling, escalation, and alerting platform | Monitoring | ✅ Packaged |
 | [Tirreno](https://github.com/tirrenotechnologies/tirreno) | [GitHub](https://github.com/tirrenotechnologies/tirreno) | Security and threat intelligence platform | Security |
 | [Runme](https://github.com/runmedev/runme) | [GitHub](https://github.com/runmedev/runme) | Execute your README.md as interactive scripts | Automation |
 | [DataHub](https://github.com/datahub-project/datahub) | [GitHub](https://github.com/datahub-project/datahub) | Modern data stack for end-to-end data management | Data-Management |
@@ -131,11 +132,11 @@ Applications are organized by function rather than programming language:
 | [Grist Core](https://github.com/gristlabs/grist-core) | [GitHub](https://github.com/gristlabs/grist-core) | Modern data spreadsheet and database | Collaboration | ⏭ Excluded — packaged upstream (Cloudron App Store) |
 | [Healthchecks](https://github.com/healthchecks/healthchecks) | [GitHub](https://github.com/healthchecks/healthchecks) | Cron job monitoring service | Monitoring | ✅ Packaged |
 | [Fleet](https://github.com/fleetdm/fleet) | [GitHub](https://github.com/fleetdm/fleet) | Device management and monitoring | Monitoring |
-| [NetBox](https://github.com/netbox-community/netbox) | [GitHub](https://github.com/netbox-community/netbox) | IP address management (IPAM) and data center infrastructure management | Infrastructure |
+| [NetBox](https://github.com/netbox-community/netbox) | [GitHub](https://github.com/netbox-community/netbox) | IP address management (IPAM) and data center infrastructure management | Infrastructure | ✅ Packaged
 | [SeaTunnel](https://github.com/apache/seatunnel) | [GitHub](https://github.com/apache/seatunnel) | Data integration and streaming platform | Data-Management |
 | [Rathole](https://github.com/rapiz1/rathole) | [GitHub](https://github.com/rapiz1/rathole) | Lightweight and high-performance reverse proxy | Infrastructure | ✅ Packaged |
 | [Easy-Gate](https://github.com/wiredlush/easy-gate) | [GitHub](https://github.com/wiredlush/easy-gate) | Gateway and proxy solution | Infrastructure | ✅ Packaged |
-| [ConsulDemocracy](https://github.com/consuldemocracy/consuldemocracy) | [GitHub](https://github.com/consuldemocracy/consuldemocracy) | Open-source citizen participation platform | Collaboration |
+| [ConsulDemocracy](https://github.com/consuldemocracy/consuldemocracy) | [GitHub](https://github.com/consuldemocracy/consuldemocracy) | Open-source citizen participation platform | Collaboration | ✅ Packaged
 | [BOINC](https://github.com/BOINC/boinc) | [GitHub](https://github.com/BOINC/boinc) | Open-source software for volunteer computing | Scientific-Computing |
 | [Slurm](https://github.com/SchedMD/slurm) | [GitHub](https://github.com/SchedMD/slurm) | Workload manager and job scheduling system | System-Administration |
 | [Gophish](https://github.com/gophish/gophish) | [GitHub](https://github.com/gophish/gophish) | Open-source phishing toolkit | Security |
@@ -149,14 +150,14 @@ Applications are organized by function rather than programming language:
 | [SigNoz](https://github.com/SigNoz/signoz) | [GitHub](https://github.com/SigNoz/signoz) | Open-source observability platform | Monitoring |
 | [Sentry](https://github.com/getsentry/sentry) | [GitHub](https://github.com/getsentry/sentry) | Error tracking and performance monitoring | Monitoring |
 | [ChirpStack](https://github.com/chirpstack/chirpstack) | [GitHub](https://github.com/chirpstack/chirpstack) | Open-source LoRaWAN network server | Infrastructure | ✅ Packaged |
-| [eLabFTW](https://github.com/elabftw/elabftw) | [GitHub](https://github.com/elabftw/elabftw) | Electronic lab notebook for research teams | Business-Apps |
+| [eLabFTW](https://github.com/elabftw/elabftw) | [GitHub](https://github.com/elabftw/elabftw) | Electronic lab notebook for research teams | Business-Apps | ✅ Packaged
 | [Jamovi](https://github.com/jamovi/jamovi) | [GitHub](https://github.com/jamovi/jamovi) | Statistical spreadsheet software | Scientific-Computing |
 | [Review Board](https://github.com/reviewboard/reviewboard) | [GitHub](https://github.com/reviewboard/reviewboard) | Code review and collaboration tool | Development | ✅ Packaged |
 | [Core](https://github.com/Resgrid/Core) | [GitHub](https://github.com/Resgrid/Core) | Emergency management and incident response system | Project-Management |
 | [SDRangel](https://github.com/f4exb/sdrangel) | [GitHub](https://github.com/f4exb/sdrangel) | Software defined radio application | Infrastructure |
 | [No-Code Architects Toolkit](https://github.com/stephengpope/no-code-architects-toolkit) | [GitHub](https://github.com/stephengpope/no-code-architects-toolkit) | No-code development toolkit | Low-Code |
 | [Windmill](https://github.com/windmill-labs/windmill) | [GitHub](https://github.com/windmill-labs/windmill) | Open-source workflow automation platform | Automation | ✅ Packaged |
-| [Corteza](https://github.com/cortezaproject/corteza) | [GitHub](https://github.com/cortezaproject/corteza) | Open-source low-code platform | Low-Code |
+| [Corteza](https://github.com/cortezaproject/corteza) | [GitHub](https://github.com/cortezaproject/corteza) | Open-source low-code platform | Low-Code | ✅ Packaged
 | [Security Awareness Training](https://github.com/security-companion/security-awareness-training) | [GitHub](https://github.com/security-companion/security-awareness-training) | Security awareness training platform | Security |
 | [Puter](https://github.com/HeyPuter/puter) | [GitHub](https://github.com/HeyPuter/puter) | The Internet OS - Personal Cloud Computer | Development | ✅ Packaged |
 

STATUS.md

@@ -3,7 +3,8 @@
 > **Human read-only. Agents maintain this file automatically after each work
 > session.** Do not edit by hand — the next agent run will overwrite it.
 >
-> **Last updated:** 2026-09-06 by ZCode (GLM-5.3) — ConsulDemocracy packaged (17th; verified via grind lifecycle)
+> **Last updated:** 2026-09-06 by ZCode (GLM-5.3) — GoAlert packaged (18th; rulings synced:
+> GitUrlList 56→46, no-Node policy live)
 > (#648, Infrastructure, 16th package); auth gate verdict: native OIDC via
 > python-social-auth (OpenIdConnectAuth + SOCIAL_AUTH_OIDC_*) wired to the
 > platform provider; official-image wrapper of netboxcommunity/netbox
@@ -13,14 +14,14 @@
 
 ## Current State: STABLE (packaging phase, ongoing)
 
-Cloudron packaging pipeline is operational. 17 of ~57 upstream applications are
+Cloudron packaging pipeline is operational. 18 of 46 remaining-set applications are
 packaged, committed, and pushed. Packaging templates exist for the core
 patterns. The gardening protocol (this file + AGENTS.md) keeps docs in sync.
 All remaining apps now carry build tickets (#633-#678) under umbrella
 [#632](https://projects.knownelement.com/issues/632) in Redmine project 55 —
 ready for the sequential grind-driver pattern.
 
-## Completed Packages (17)
+## Completed Packages (18)
 
 | # | Application | Category | Pattern | Port(s) | Addons |
 |---|-------------|----------|---------|---------|--------|
@@ -56,7 +57,7 @@ GitUrlList pruned 56 → 46 accordingly.
 
 | Ticket | App | Category | Flavor |
 |--------|-----|----------|--------|
-| #633 | GoAlert | Monitoring | GO: verify passed 2026-09-06, commit landing next |
+| #633 | GoAlert | Monitoring | DONE 2026-09-06 (18th package, grind-verified) |
 | #634 | Tirreno | Security | build (already live on Cloudron — verify packaging need) |
 | #635 | Runme | Automation | pending service-story ruling (Go CLI runner, NOT node) |
 | #636 | DataHub | Data-Management | build (heavy; disposition risk) |
@@ -105,27 +106,27 @@ Full write-ups of each pattern + challenges are in [`JOURNAL.md`](JOURNAL.md).
 
 ## Progress by Category
 
+| Category | Apps | Packaged | Notes |
 | Category | Apps | Packaged | Notes |
 |----------|------|----------|-------|
 | **API-Gateway** | 2 | 2/2 (100%) ✅ | Category complete |
-| Development | 4 | 2/4 | reviewboard, puter done |
+| **DevOps-Tools** | 1 | 1/1 (100%) ✅ | Category complete |
+| **Development** | 2 | 2/2 (100%) ✅ | reviewboard, puter (autobom removed) |
 | Documentation-Tools | 3 | 2/3 | wireviz-web, draw.io done |
-| Low-Code | 3 | 1/3 | corteza done |
+| Low-Code | 2 | 1/2 | corteza done (openblocks removed) |
-| Monitoring | 6 | 1/6 | healthchecks done |
+| Monitoring | 5 | 2/5 | healthchecks, goalert done (langfuse removed) |
-| Automation | 4 | 1/4 | windmill done |
+| Automation | 3 | 1/3 | windmill done (huginn removed) |
-| Business-Apps | 8 | 1/8 | elabftw done |
+| Business-Apps | 6 | 1/6 | elabftw done (midday removed) |
 | Collaboration | 2 | 1/2 | consuldemocracy done |
-| Communication | 1 | 0/1 | |
-| Data-Management | 2 | 0/2 | |
-| DevOps-Tools | 1 | 1/1 (100%) ✅ | fx done |
-| Financial-Payments | 1 | 0/1 | |
-| Financial-Trading | 1 | 0/1 | |
 | Infrastructure | 6 | 5/6 | easy-gate, rathole, database-gateway, chirpstack, netbox done |
-| Legal | 1 | 0/1 | |
+| Data-Management | 2 | 0/2 | datahub, seatunnel |
-| Project-Management | 1 | 0/1 | |
+| Security | 4 | 0/4 | tirreno, gophish, sniperphish, sat (comply removed) |
-| Scientific-Computing | 2 | 0/2 | |
+| System-Administration | 2 | 0/2 | mender, slurm |
-| Security | 5 | 0/5 | |
+| Scientific-Computing | 2 | 0/2 | boinc, jamovi |
-| System-Administration | 2 | 0/2 | |
+| Financial-Payments | 1 | 0/1 | hyperswitch |
+| Financial-Trading | 1 | 0/1 | nautilus (out-of-scope pending ruling) |
+| Legal | 1 | 0/1 | docassemble |
+| Project-Management | 1 | 0/1 | resgrid |
 
 ## Auth Status
 
@@ -134,7 +135,7 @@ Auth capability is a hard gate before packaging (see
 LDAP acceptable (risk flag), 🔄 = auth-proxy (no users), ❌ = local-only
 (unacceptable / blocked-on-auth).
 
-### Completed packages (17)
+### Completed packages (18)
 
 | App | OIDC | LDAP | Verdict | Note |
 |-----|------|------|---------|------|
@@ -155,6 +156,7 @@ LDAP acceptable (risk flag), 🔄 = auth-proxy (no users), ❌ = local-only
 | eLabFTW | no | yes | ⚠️ risk (LDAP) | **Packaged**; no OIDC upstream (auth = local/SAML/LDAP per `src/Enums/AuthMethod.php`); `ldap` addon enabled, README maps `CLOUDRON_LDAP_*` → sysconfig LDAP panel — must be validated on the live Cloudron before production; SAML possible via external IdP |
 | NetBox | yes | plugin | ✅ preferred | **Packaged**; python-social-auth OIDC (`REMOTE_AUTH_BACKEND=OpenIdConnectAuth` + `SOCIAL_AUTH_OIDC_*`) wired from `CLOUDRON_OIDC_*`; local Django login retained for admin bootstrap; SSO users register without privileges (README) |
 | ConsulDemocracy | yes | no | ✅ preferred | **Packaged**; omniauth_openid_connect (discovery) wired into generated secrets.yml; `feature.oidc_login` auto-enabled on first boot when the provider is present (admin-panel toggle afterwards); SAML also available; local admin seeded |
+| GoAlert | yes | no | ✅ preferred | **Packaged**; native generic OIDC (go-oidc, any issuer) wired via GOALERT_OIDC_* from the platform provider; new-user creation on; optional first-admin basic auth via GOALERT_ADMIN_USER/PASS; callback /api/v2/identity/providers/oidc/callback |
 
 ### Candidates researched