diff --git a/docs/00_overview/planned_features/02_mvp2/chore_arq_pool_aclose_deprecation/idea.md b/docs/00_overview/planned_features/02_mvp2/chore_arq_pool_aclose_deprecation/idea.md
index f3a099ba..a5940a42 100644
--- a/docs/00_overview/planned_features/02_mvp2/chore_arq_pool_aclose_deprecation/idea.md
+++ b/docs/00_overview/planned_features/02_mvp2/chore_arq_pool_aclose_deprecation/idea.md
@@ -38,3 +38,8 @@ Replace both `await arq_pool.close()` calls with `await arq_pool.aclose()` — `
## Relationship to other work
- Pure maintenance; no feature dependency. Pick up with any other `backend/app/main.py` touch.
+- **Surfaced a CI-policy gap:** this fix shipped via [PR #387](https://github.com/SoundMindsAI/relyloop/pull/387) (merged 2026-06-02 as `2e49ac99`), submitted by an external contributor. Its first run exposed that the `smoke` job hard-fails on every external-fork PR because forked PRs can't read `OPENAI_API_KEY_TEST` — captured as [`infra_smoke_fork_pr_secret_skip`](../infra_smoke_fork_pr_secret_skip/idea.md).
+
+## Postscript — shipped
+
+Shipped via PR #387 (squash commit `2e49ac99`, 2026-06-02). Both call sites converted to `aclose()`; regression tests added at both shutdown paths. The `fake_pool.close = AsyncMock(...)` stub flip predicted in "Scope signals" was applied, and `fake_pool.close` was additionally retained as an `AsyncMock` so the `close.assert_not_called()` negative assertion fails cleanly rather than crashing on a non-awaitable mock — a Gemini review point the contributor addressed before merge.
diff --git a/docs/00_overview/planned_features/02_mvp2/infra_smoke_fork_pr_secret_skip/idea.md b/docs/00_overview/planned_features/02_mvp2/infra_smoke_fork_pr_secret_skip/idea.md
new file mode 100644
index 00000000..8dea09ac
--- /dev/null
+++ b/docs/00_overview/planned_features/02_mvp2/infra_smoke_fork_pr_secret_skip/idea.md
@@ -0,0 +1,56 @@
+# infra_smoke_fork_pr_secret_skip — smoke job hard-fails on every external-fork PR because forked PRs can't read `OPENAI_API_KEY_TEST`
+
+**Date:** 2026-06-01
+**Status:** Idea — tangential discovery while merging PR #387 (`chore_arq_pool_aclose_deprecation`)
+**Tracking issue:** [#410](https://github.com/SoundMindsAI/relyloop/issues/410) (public — gives external contributors a findable "known fork limitation, not your code" explanation)
+**Type:** `infra_`
+**Priority:** P2 — does not block this repo's own branches (internal PRs see the secret), but every **external contributor** PR gets a permanent red ✗ on the `smoke` job for a reason unrelated to their code. Elevated by the OSS-launch posture (CHANGELOG + CITATION.cff just landed, #382): a red X on a first-time contributor's PR reads as "your change is broken" when it isn't.
+
+## Origin
+
+PR #387 (the `arq_pool.aclose()` deprecation fix from external contributor `Yashi248`, merged 2026-06-02 as `2e49ac99`). After updating the branch and approving the workflow run, **every code-validating job passed** (backend lint/typecheck/tests/coverage, frontend, docker buildx, license, DCO, secrets-defense) — the **only** red was `smoke (operator-path tutorial flow)`, run `26792913411`, job result `failure`.
+
+The smoke job failed on its very first real step, **"Sanity-check OPENAI_API_KEY_TEST is populated"**, before running a single test:
+
+```
+##[error]OPENAI_API_KEY_TEST secret is empty — smoke gate requires it
+ (per chore_tutorial_polish §3 + decision log M5)
+##[error]Process completed with exit code 1.
+```
+
+## Problem
+
+`.github/workflows/pr.yml` triggers on `pull_request:` ([pr.yml:43](../../../../.github/workflows/pr.yml)) — **not** `pull_request_target`. GitHub deliberately withholds repository secrets from workflows triggered by a PR opened from a **fork** (security: prevents secret exfiltration by an attacker's PR). So for any external-contributor PR:
+
+1. `OPENAI_API_KEY_TEST: ${{ secrets.OPENAI_API_KEY_TEST }}` ([pr.yml:536](../../../../.github/workflows/pr.yml)) resolves to the empty string.
+2. It is written to `./secrets/openai_key` ([pr.yml:553](../../../../.github/workflows/pr.yml)) as a zero-byte file.
+3. The "Sanity-check OPENAI_API_KEY_TEST is populated" step greps for non-whitespace content and `exit 1`s with the message above ([pr.yml:565–571](../../../../.github/workflows/pr.yml)).
+
+This is **structural**, not a code defect — it reproduces identically on every fork PR regardless of the diff. The smoke job's existing `if: ${{ vars.SKIP_HEAVY_CI != 'true' }}` ([pr.yml:492](../../../../.github/workflows/pr.yml)) is a blunt global kill-switch; it is not fork-aware, so when heavy CI is on, fork PRs always go red here.
+
+## Proposed capability
+
+Make the `smoke-test` job **fork-aware**: when the PR head repo is a fork (the runner therefore has no secret), skip the smoke job gracefully with an explicit notice instead of hard-failing. Candidate shapes (pick at spec time):
+
+- **A — Job-level `if` guard (preferred).** Add a fork condition to the existing `if:` so the whole job is skipped on fork PRs:
+ `if: ${{ vars.SKIP_HEAVY_CI != 'true' && github.event.pull_request.head.repo.full_name == github.repository }}`.
+ A skipped job shows neutral (not red). Pair with a tiny always-green "smoke (skipped — fork PR, no secrets)" notice job so the status is self-explanatory to the contributor.
+- **B — In-step soft skip.** Change the sanity-check step to detect the empty secret on a fork and `echo "::notice::"` + early-`exit 0` (with a guard that it ONLY soft-skips for forks, never for the upstream repo where an empty secret is a real misconfiguration).
+- **C — `pull_request_target`.** Rejected by default — runs in the base-repo context with secret access against untrusted fork code; a known RCE-class footgun. Out of scope unless paired with a vetted checkout-and-sandbox pattern.
+
+Whichever is chosen, the upstream-repo path MUST keep failing loudly on a genuinely empty secret (the original M5 intent) — the soft-skip applies **only** to the fork case.
+
+## Scope signals
+
+- **CI / infra:** one YAML job in `pr.yml` (`if:` guard + optional notice job). No backend/frontend/migration changes.
+- **Test coupling:** none — no application code touched.
+- **Decision surface:** which approach (A/B/C), and whether to add the always-green notice job so a skipped status is legible to contributors. One forcing decision: confirm the soft-skip is fork-gated and never weakens the upstream empty-secret guard.
+
+## Why deferred (not fixed inline)
+
+Surfaced at PR #387 merge time; that PR was an external contributor's two-line deprecation fix and the right call was to merge it (the failure was provably environmental — see the adjudication comment on #387). Editing `pr.yml`'s smoke job inside #387 would have mixed an unrelated CI-policy change into a contributor's narrow diff, and the contributor can't even test a secrets-dependent workflow change from their fork. Belongs in its own maintainer-owned infra PR.
+
+## Relationship to other work
+
+- **[`infra_smoke_reseed_runtime_budget`](../infra_smoke_reseed_runtime_budget/idea.md)** — the **sibling "smoke job stays red" issue**, but an **independent** failure mode. That one is about the Playwright demo-ubi reseed blowing the 25-min wall-clock budget once Solr boots; this one is about fork PRs lacking the secret. They fail at different steps and neither fix resolves the other: even with the runtime budget fixed, a fork PR still dies at the secret sanity-check; even with the secret present, an internal PR can still hit the runtime cap. Both must ship for `smoke` to be green on **every** PR. Coordinate so the two `pr.yml` edits don't collide.
+- **[`chore_arq_pool_aclose_deprecation`](../chore_arq_pool_aclose_deprecation/idea.md)** — the shipped fix (PR #387, `2e49ac99`) whose CI run surfaced this. That work is done; this is the CI-policy gap its first external-contributor run exposed.
diff --git a/docs/00_overview/planned_features/02_mvp2/infra_smoke_reseed_runtime_budget/idea.md b/docs/00_overview/planned_features/02_mvp2/infra_smoke_reseed_runtime_budget/idea.md
index 6d2c487e..65afbbe6 100644
--- a/docs/00_overview/planned_features/02_mvp2/infra_smoke_reseed_runtime_budget/idea.md
+++ b/docs/00_overview/planned_features/02_mvp2/infra_smoke_reseed_runtime_budget/idea.md
@@ -61,6 +61,7 @@ Per CLAUDE.md "fix inline by default" rule, options A and B are both inline-chea
- **Sibling of** `infra_solr_smoke_stability` ([PR #383](https://github.com/SoundMindsAI/relyloop/pull/383), merged with smoke red per D-6). The smoke-solr-stability runbook (`docs/03_runbooks/smoke-solr-stability.md`) needs a new lever-cascade entry after this work ships, OR a section noting that reseed-runtime is a separate concern from Solr stability.
- **Independent of** `infra_solr_ci_readiness` Phase 1 (backend half — shipped, unaffected).
+- **Sibling "smoke job stays red" issue:** [`infra_smoke_fork_pr_secret_skip`](../infra_smoke_fork_pr_secret_skip/idea.md) — a **separate, independent** smoke-red failure mode (external-fork PRs can't read `OPENAI_API_KEY_TEST`, so smoke hard-fails at the secret sanity-check). Neither fix resolves the other: this idea fixes the reseed wall-clock; that one fixes the fork-secret gate. Both must ship for `smoke` to be green on every PR — and both edit the same `pr.yml` smoke-test job, so coordinate the YAML changes to avoid collisions.
## Scope signals
diff --git a/website/docs/roadmap.md b/website/docs/roadmap.md
index 6f8b7228..3970a7b1 100644
--- a/website/docs/roadmap.md
+++ b/website/docs/roadmap.md
@@ -180,7 +180,7 @@
- 🟡 [Query Normalizer Typed Pipeline](https://github.com/SoundMindsAI/relyloop/tree/main/docs/00_overview/planned_features/02_mvp2/feat_query_normalizer_typed_pipeline)
- 🟡 [UBI LLM Study Comparison](https://github.com/SoundMindsAI/relyloop/tree/main/docs/00_overview/planned_features/02_mvp2/feat_ubi_llm_study_comparison)
-??? note "Infrastructure & tooling (7)"
+??? note "Infrastructure & tooling (8)"
- ✅ [Adapter Solr](https://github.com/SoundMindsAI/relyloop/tree/main/docs/00_overview/implemented_features/2026_05_31_infra_adapter_solr) · [#336](https://github.com/SoundMindsAI/relyloop/pull/336)
- ✅ [Solr CI Readiness](https://github.com/SoundMindsAI/relyloop/tree/main/docs/00_overview/implemented_features/2026_06_01_infra_solr_ci_readiness) · [#367](https://github.com/SoundMindsAI/relyloop/pull/367)
@@ -188,6 +188,7 @@
- 🟡 [Arq Subprocess Test](https://github.com/SoundMindsAI/relyloop/tree/main/docs/00_overview/planned_features/02_mvp2/infra_arq_subprocess_test)
- 🟡 [Generated Artifact Freshness Gate](https://github.com/SoundMindsAI/relyloop/tree/main/docs/00_overview/planned_features/02_mvp2/infra_generated_artifact_freshness_gate)
- 🟡 [Openapi Types Freshness Gate](https://github.com/SoundMindsAI/relyloop/tree/main/docs/00_overview/planned_features/02_mvp2/infra_openapi_types_freshness_gate)
+ - 🟡 [Smoke Fork PR Secret Skip](https://github.com/SoundMindsAI/relyloop/tree/main/docs/00_overview/planned_features/02_mvp2/infra_smoke_fork_pr_secret_skip)
- 🟡 [Smoke Reseed Runtime Budget](https://github.com/SoundMindsAI/relyloop/tree/main/docs/00_overview/planned_features/02_mvp2/infra_smoke_reseed_runtime_budget)
??? note "Maintenance & fixes (21)"