diff --git a/harnesses/contexts/gitea-admin/v1/harness.yaml b/harnesses/contexts/gitea-admin/v1/harness.yaml
index cbae8dd..0dc8c75 100644
--- a/harnesses/contexts/gitea-admin/v1/harness.yaml
+++ b/harnesses/contexts/gitea-admin/v1/harness.yaml
@@ -4,6 +4,9 @@ version: 1
 description: "Gitea admin: SSH, git identity, API token for skynet org"
 requires: []
 provides: [gitea-admin]
+# HC-11: repos this layer's forge credential may push to (host-qualified; CRS-103 gate).
+write_targets:
+  - "gitea.oreillyit.nz/skynet/*"
 
 git_identity:
   name: "agent-runtimes"
diff --git a/harnesses/contexts/gitea-ssh-accelerators/v1/harness.yaml b/harnesses/contexts/gitea-ssh-accelerators/v1/harness.yaml
index 20e8959..b3ff668 100644
--- a/harnesses/contexts/gitea-ssh-accelerators/v1/harness.yaml
+++ b/harnesses/contexts/gitea-ssh-accelerators/v1/harness.yaml
@@ -4,6 +4,9 @@ version: 1
 description: "Gitea SSH: clone/push via SSH key for gitea.oreillyit.nz (accelerator_automation / accelerators org)"
 requires: []
 provides: [git-access]
+# HC-11: repos this layer's forge credential may push to (host-qualified; CRS-103 gate).
+write_targets:
+  - "gitea.oreillyit.nz/accelerators/*"
 
 git_identity:
   name: "agent-runtimes"
diff --git a/harnesses/contexts/gitea-ssh-homelab/v1/harness.yaml b/harnesses/contexts/gitea-ssh-homelab/v1/harness.yaml
index d10a104..3ed95e6 100644
--- a/harnesses/contexts/gitea-ssh-homelab/v1/harness.yaml
+++ b/harnesses/contexts/gitea-ssh-homelab/v1/harness.yaml
@@ -4,6 +4,9 @@ version: 1
 description: "Gitea SSH: clone/push via SSH key for gitea.oreillyit.nz (cluster-administrator / homelab org)"
 requires: []
 provides: [git-access]
+# HC-11: repos this layer's forge credential may push to (host-qualified; CRS-103 gate).
+write_targets:
+  - "gitea.oreillyit.nz/homelab/*"
 
 git_identity:
   name: "agent-runtimes"
diff --git a/harnesses/contexts/gitea-ssh/v1/harness.yaml b/harnesses/contexts/gitea-ssh/v1/harness.yaml
index e05b647..cc7bf23 100644
--- a/harnesses/contexts/gitea-ssh/v1/harness.yaml
+++ b/harnesses/contexts/gitea-ssh/v1/harness.yaml
@@ -4,6 +4,9 @@ version: 1
 description: "Gitea SSH: clone/push via SSH key for gitea.oreillyit.nz (ai_enablement)"
 requires: []
 provides: [git-access]
+# HC-11: repos this layer's forge credential may push to (host-qualified; CRS-103 gate).
+write_targets:
+  - "gitea.oreillyit.nz/skynet/*"
 
 git_identity:
   name: "agent-runtimes"