docs: prepare core-hub archive closeout

scripts/core_hub_stabilization_check.sh

@@ -1,28 +1,59 @@
 #!/usr/bin/env bash
-# Core Hub production stabilization snapshot for CORE-WP-0007-T02.
-# Complements the scheduled activity-core job (core_hub_stabilization_check).
+# hub-core production stabilization gate for CORE-WP-0010-T05.
 set -euo pipefail
 
 BASE_URL="${CORE_HUB_BASE_URL:-https://hub.coulomb.social}"
 STATE_HUB_URL="${STATE_HUB_URL:-http://127.0.0.1:8000}"
+OPS_HUB_ROOT="${OPS_HUB_ROOT:-/home/worsch/ops-hub}"
+RAPP_CORE_HUB_ROOT="${RAPP_CORE_HUB_ROOT:-/home/worsch/rapp-core-hub}"
+EXPECTED_RUNTIME_VERSION="${EXPECTED_RUNTIME_VERSION:-0.2.0}"
+export EXPECTED_RUNTIME_VERSION
+
+echo "=== hub-core public authority (${BASE_URL}) ==="
+curl -fsS "${BASE_URL}/healthz" | python3 -c '
+import json, os, sys
+payload = json.load(sys.stdin)
+assert payload.get("status") == "ok", payload
+assert payload.get("version") == os.environ["EXPECTED_RUNTIME_VERSION"], payload
+'
+echo "/healthz -> ok (version ${EXPECTED_RUNTIME_VERSION})"
+
+curl -fsS "${BASE_URL}/readyz" | python3 -c '
+import json, sys
+payload = json.load(sys.stdin)
+checks = payload.get("checks") or {}
+assert payload.get("service") == "hub-core", payload
+assert payload.get("status") == "ok", payload
+assert checks.get("environment") == "production", checks
+assert checks.get("configured_backend") == "postgresql", checks
+assert checks.get("active_backend") == "postgresql", checks
+assert checks.get("database") == "ok", checks
+assert checks.get("authorization") == "ok", checks
+assert checks.get("legacy_write_groups") == "none", checks
+assert set(filter(None, checks.get("v2_write_groups", "").split(","))) == {
+    "credentials", "deferred", "interaction", "registry"
+}, checks
+assert {"credentials", "deferred", "interaction", "operator", "registry", "system"} <= set(
+    filter(None, checks.get("v2_groups", "").split(","))
+), checks
+'
+echo "/readyz -> ok (PostgreSQL/auth healthy; hub-core is sole writer)"
 
-echo "=== Core Hub public surface (${BASE_URL}) ==="
-for path in /healthz /readyz /api/v2/widget-types; do
-  code=$(curl -sS -o /dev/null -w '%{http_code}' "${BASE_URL}${path}")
-  echo "${path} -> ${code}"
-done
 hubs_code=$(curl -sS -o /dev/null -w '%{http_code}' "${BASE_URL}/api/v2/hubs")
 echo "/api/v2/hubs -> ${hubs_code} (expect 401 hardened contract)"
-widget_count=$(curl -fsS "${BASE_URL}/api/v2/widget-types" | python3 -c "
-import json,sys
-payload=json.load(sys.stdin)
-items=payload if isinstance(payload,list) else payload.get('data',[])
+test "${hubs_code}" = "401"
+
+widget_count=$(curl -fsS "${BASE_URL}/api/v2/widget-types" | python3 -c '
+import json, sys
+payload = json.load(sys.stdin)
+items = payload if isinstance(payload, list) else payload.get("data", [])
+assert len(items) >= 26, len(items)
 print(len(items))
-")
+')
 echo "widget_types count=${widget_count} (expect >= 26)"
 
 echo
-echo "=== optional deployed smoke (needs approved token) ==="
+echo "=== optional protected deployed smoke (needs approved token) ==="
 if [[ -n "${CORE_HUB_OPERATOR_TOKEN_FILE:-}" && -f "${CORE_HUB_OPERATOR_TOKEN_FILE}" ]]; then
   make deployed-smoke
 else
@@ -30,12 +61,14 @@ else
 fi
 
 echo
-echo "=== optional ops-hub gate probe ==="
-if command -v make >/dev/null && [[ -d "${HOME}/ops-hub" ]]; then
-  (cd "${HOME}/ops-hub" && make interhub-gate IHUB_BASE="${BASE_URL}") || true
-else
-  echo "skip: ops-hub checkout unavailable"
-fi
+echo "=== required ops-hub consumer gate ==="
+test -d "${OPS_HUB_ROOT}"
+(cd "${OPS_HUB_ROOT}" && make interhub-gate IHUB_BASE="${BASE_URL}")
+
+echo
+echo "=== required deployment-package gate ==="
+test -d "${RAPP_CORE_HUB_ROOT}"
+(cd "${RAPP_CORE_HUB_ROOT}" && make verify-live)
 
 echo
 echo "=== last 6 core_hub_stabilization_check events ==="
@@ -46,4 +79,7 @@ for e in json.load(sys.stdin):
     probe=d.get('probe') or {}
     print(e['created_at'][:19], (e.get('summary') or '')[:72],
           'pass='+str(probe.get('overall_pass')))
-" 2>/dev/null || echo "no stabilization events yet"
+" 2>/dev/null || echo "no stabilization events yet"
+
+echo
+echo "ok: hub-core stabilization gate passed"