Access Failure — Read Before Declaring A Blocker

If an SSH or Forgejo Git command returns Permission denied (publickey), authentication failed, or looks like an expired/wrong token, do not conclude the credential is broken, and do not fall back to hacks — no direct DB inserts, HTTPS push, bare-repo creation, root@, pi@, or swapping in another key. That symptom is almost always the wrong port or wrong user, not an unauthorized key:

• Forgejo Git is port 2223, not 22. ssh git@100.120.38.37 (default :22) always says “Permission denied” — that is the host sshd, not Forgejo. Use ssh://git@100.120.38.37:2223/from-admin/{repo}.git. The canonical key is ~/.ssh/relik-pi4 (authenticates as from-admin on 2223) — a “rejected key” here is a wrong-port artifact, not an unauthorized key.
• Pi 4 shell is mehdifarah@…:22 with ~/.ssh/relik-pi4 — not pi@ / root@.
• The token already exists. The Forgejo from-admin token lives in the garden (/mnt/kitchen/from-house/secrets/forgejo/from-admin-token) — retrieve it; do not mint or “fix” one.

When in doubt, run from-house-secrets doctor first — it self-tests Forgejo Git auth on the correct port and tells you the truth in one command.

Do not configure global Git url.*.insteadOf rewrites that turn ssh://git@100.120.38.37:2223/... into an SSH alias such as ssh://forgejo-pi4/.... Local repo remotes may use an alias when ~/.ssh/config defines it, but the feed-contract URL must stay raw so from-house-secrets doctor and other ssh -F /dev/null checks cannot be hijacked by user Git config.