docs: prepare core-hub archive closeout

docs/deployment/stabilization-signoff.md

@@ -1,65 +1,64 @@
-# Core Hub production stabilization
+# hub-core production stabilization
 
-Post-cutover checks for `CORE-WP-0007-T02` operator sign-off after
-`CORE-WP-0005` moved `hub.coulomb.social` to Core Hub (2026-07-03).
+This is the stabilization and closeout gate for `CORE-WP-0010-T05` after
+hub-core replaced Core Hub as the public production runtime.
 
 ## Window
 
-- **Start:** 2026-07-03 (production cutover)
-- **End:** 2026-07-10T17:35:00Z (closeout job)
-- **Daily job:** 09:00 Europe/Berlin via activity-core
+- Start: `2026-08-21T20:49:50+02:00`
+- Earliest closeout: `2026-08-28T20:49:50+02:00`
+- Public endpoint: `https://hub.coulomb.social`
+- Production package: `rapp-core-hub` chart 0.4.0, Helm revision 20 at start
+- Rollback: Core Hub remains Ready with no writer groups
 
-## Automated checks
+The July Core Hub/Inter-Hub activities in `activity-definitions/` are retained
+as historical evidence. They must not be treated as the schedule for this
+window. Current fleet-side observation is owned by activity-core under
+`ACTIVITY-WP-0029`; this repository's manual gate is authoritative for archive
+closeout until that projection is confirmed.
 
-The `core-hub` context resolver query `stabilization_check` verifies:
+## Daily/manual gate
 
-| Check | Expected |
-| --- | --- |
-| `GET /healthz` | 200 |
-| `GET /readyz` | 200 |
-| `GET /api/v2/widget-types` | 200, count ≥ 26 |
-| `GET /api/v2/hubs` (unauthenticated) | 401 |
-
-State Hub progress events:
-
-- `core_hub_stabilization_check` — daily while the window is open
-- `core_hub_stabilization_closeout` — one-shot at window end
-
-Activity definitions live in `activity-definitions/` and are projected into
-`activity-core/k8s/railiance/20-runtime.yaml`.
-
-## Manual companion script
+Run from this repository:
 
 ```bash
-CORE_HUB_BASE_URL=https://hub.coulomb.social \
-STATE_HUB_URL=http://127.0.0.1:8000 \
-./scripts/core_hub_stabilization_check.sh
+make stabilization-check
 ```
 
-Optional full bootstrap smoke (needs approved operator token):
+The command fails closed unless all of the following pass:
 
-```bash
-CORE_HUB_BASE_URL=https://hub.coulomb.social \
-CORE_HUB_OPERATOR_TOKEN_FILE=/secure/path/to/token \
-make deployed-smoke
-```
+- public health reports runtime version 0.2.0;
+- readiness identifies hub-core, production PostgreSQL, database and
+  authorization health, all four candidate writer groups, and no legacy
+  writer group;
+- the public widget-type contract has at least 26 entries;
+- an unauthenticated protected request returns 401;
+- the ops-hub public consumer gate passes; and
+- the deployment package verifies both immutable workloads, routing, writer
+  ownership, credential metadata, policies, and authentication.
 
-## Operator sign-off for T02
+The protected deployed smoke is optional because it needs an approved token
+file. If it is used, the value must remain outside Git, State Hub, logs, and
+chat.
 
-Sign-off is a human decision recorded in State Hub after:
+## Closeout gate
 
-1. Daily checks (or closeout) show `overall_pass=true` through the window
-2. No rollback was invoked since cutover
-3. Operator approves retiring the Inter-Hub k8s rollback deployment
+After the earliest closeout time, require all of these before archive:
 
-Post a progress note or decision referencing workstream
-`a8d66822-e435-4b1e-ad81-37a298d1795e` / task `16eb7ce3-b574-4667-a189-c14ff5d0502b`,
-then proceed with `CORE-WP-0007-T02`.
+1. The manual stabilization gate passes.
+2. The activity-core resolver/evidence path passes against the public host.
+3. No unexplained data, contract, authorization, or writer-ownership drift is
+   open.
+4. The final source/target comparison or retained reverse-export evidence has
+   matching counts, identities, and canonical hashes.
+5. The runtime/database credential rotation observations in
+   `RAPP-POSTGRES-WP-0004-T03` and `RAILIANCE-WP-0023-T02` are resolved or
+   carry an explicit live residual owner.
+6. The operator approves rollback retirement and repository archive.
 
-## Deploy / enable
+Record the decision and final progress against workplan
+`f5a90aa2-e63f-4f94-b052-8be0d0ee55ea`, task
+`16525001-f85e-4dae-9dc4-d36cb1eb4fbe`.
 
-1. Rebuild and deploy `activity-core` on railiance01 with the new `core-hub`
-   context resolver.
-2. Apply the updated `activity-core/k8s/railiance/20-runtime.yaml` ConfigMap
-   projection for the two new ActivityDefinitions.
-3. Confirm events appear at `GET /progress/?event_type=core_hub_stabilization_check`.
+The complete procedure and residual ownership map are in
+`docs/deployment/archive-closeout.md`.