docs: close private shadow rehearsal

WORK-RECORDS.md

@@ -56,6 +56,6 @@
 | task | CORE-WP-0010-T05 | todo | — | workplans/CORE-WP-0010-runtime-absorption-and-archive.md |
 | task | CORE-WP-0011-T01 | done | — | workplans/CORE-WP-0011-railiance01-production-relocation.md |
 | task | CORE-WP-0011-T02 | done | — | workplans/CORE-WP-0011-railiance01-production-relocation.md |
-| task | CORE-WP-0011-T03 | wait | — | workplans/CORE-WP-0011-railiance01-production-relocation.md |
+| task | CORE-WP-0011-T03 | done | — | workplans/CORE-WP-0011-railiance01-production-relocation.md |
 | task | CORE-WP-0011-T04 | todo | — | workplans/CORE-WP-0011-railiance01-production-relocation.md |
 | task | CORE-WP-0011-T05 | todo | — | workplans/CORE-WP-0011-railiance01-production-relocation.md |

docs/deployment/railiance01-shadow-runbook.md

@@ -6,7 +6,12 @@ stops before public Ingress, DNS, tunnel changes, a final write freeze, or any
 CoulombCore teardown.
 
 Authoritative deploy input: `/home/worsch/rapp-core-hub` at or after package
-commit `03effc8`, chart `0.3.0`.
+commit `7cfa8bb`, chart `0.3.1`.
+
+The private-shadow rehearsal completed on 2026-08-21. The procedure below is
+retained for repeatability and rollback; completion evidence is in
+`docs/evidence/core-hub-railiance01-private-shadow-2026-08-21.md`. It still
+does not authorize public cutover.
 
 ## 1. Admission gates
 

docs/evidence/core-hub-railiance01-private-shadow-2026-08-21.md

@@ -0,0 +1,53 @@
+# Core Hub railiance01 private-shadow completion — 2026-08-21
+
+## Result
+
+The private Core Hub shadow is healthy on railiance01 and the rehearsal gate
+`CORE-WP-0011-T03` is complete. Public Ingress remains absent. Production
+traffic, DNS, the ops-bridge tunnel, the CoulombCore writer, and the source
+runtime were not changed or retired.
+
+The platform-owned detailed evidence is
+`/home/worsch/railiance-platform/docs/evidence/core-hub-private-shadow-2026-08-21.md`
+at railiance-platform commit `1206ed5`.
+
+## Data reconciliation
+
+- A consistent logical archive was captured from the live source at
+  `2026-08-20 22:12:26 UTC`; its SHA-256 is
+  `3770946a1032c4109fea32fc00f4411c2f4d9311a28fb17bfc3d0d2de888db8b`.
+- Source and restored target matched at Alembic revision `20260627_0002`,
+  eight tables and 39 rows before shadow smoke activity.
+- The source archive's `public` tables were moved explicitly into the accepted
+  target `core_hub` schema. Ownership, migration-role membership and runtime
+  SELECT grants were verified.
+- Later target counts differ only by the protected write operations performed
+  by the successful shadow smokes; this target remains a rehearsal copy, not
+  the production writer.
+
+## Runtime and credential proof
+
+- Helm release revision 2 runs `rapp-core-hub` chart `0.3.1`, package commit
+  `7cfa8bb`, at immutable image digest
+  `sha256:0db6f7c646c6d4c1fbc844dc266fcf883584637e1c1f47802efe1c6a98558d3c`.
+- The migration Job completed and the Deployment, Service, three governed
+  Secret projections and three NetworkPolicies are healthy; no Ingress exists.
+- API-token, runtime-database and migration-database credentials use disjoint,
+  namespace-limited OpenBao/ESO paths. Cross-namespace and sibling/parent-path
+  denials and runtime-versus-migration role separation passed.
+- A chart `0.3.1` lease refresh changed the runtime Secret and application
+  child PID while the pod UID stayed fixed, the container restart count stayed
+  zero, and readiness returned. Logs contained only the non-secret rotation
+  notice.
+
+## Private verification
+
+The hardened package verifier passed. Authenticated smoke run
+`20260820224419-43dc05` passed health, readiness, OpenAPI, four public catalogs,
+unauthenticated `401` enforcement, and authenticated protected reads and
+writes. The token was injected from approved custody, never copied into this
+repo, and the temporary token file was shredded after use.
+
+The next gate is `CORE-WP-0011-T04`. It requires separate explicit operator
+approval for a bounded write freeze, final transfer/reconciliation, public
+routing and tunnel changes, plus rollback readiness.

workplans/CORE-WP-0011-railiance01-production-relocation.md

@@ -8,7 +8,7 @@ status: active
 owner: codex
 topic_slug: infotech
 created: "2026-08-20"
-updated: "2026-08-20"
+updated: "2026-08-21"
 parent_project: prj-state-hub-retirement
 parent_workplan: SHR-WP-0002
 related:
@@ -137,7 +137,7 @@ that this workstation is not the production workplan-UUID registrar.
 
 ```task
 id: CORE-WP-0011-T03
-status: wait
+status: done
 priority: high
 ```
 
@@ -162,6 +162,24 @@ requirements, private smokes, live lease-rotation proof and rehearsal rollback
 are recorded in `docs/deployment/railiance01-shadow-runbook.md` so work can
 resume immediately after platform admission.
 
+Completed 2026-08-21. `RPF-WP-0021` admitted Core Hub as the fourth and final
+`platform-pg` consumer, established separate static API-token and dynamic
+runtime/migration database lanes, and restored a consistent 39-row source
+archive. The source `public` tables were explicitly reconciled into the
+accepted target `core_hub` schema; all eight tables, Alembic revision
+`20260627_0002`, ownership and runtime grants matched before shadow smoke
+activity. The migration Job completed, Helm revision 2 deployed package chart
+`0.3.1` at `rapp-core-hub` commit `7cfa8bb`, and no Ingress exists.
+
+The hardened private verifier and authenticated smoke
+`20260820224419-43dc05` passed all ten checks. A fresh runtime lease then
+changed the projected Secret and application child PID while the pod UID and
+container restart count remained stable; readiness returned without exposing
+a credential. The shadow now contains the expected smoke-created rows, while
+the public endpoint and source writer remain on CoulombCore. Repo-local
+evidence is in
+`docs/evidence/core-hub-railiance01-private-shadow-2026-08-21.md`.
+
 ## Cut over production traffic
 
 ```task
@@ -197,7 +215,7 @@ this repo unless the separate absorption workplan has also completed.
 
 - [x] Decommission deadline and live source/target inventory are recorded
 - [x] Governed rapp package renders and passes policy checks
-- [ ] Shadow restore/reconciliation and consumer smokes pass on railiance01
+- [x] Shadow restore/reconciliation and consumer smokes pass on railiance01
 - [ ] Production traffic and tunnel move with explicit approval and rollback
 - [ ] Stabilization passes and CoulombCore no longer hosts Core Hub dependencies
 - [ ] `CORE-WP-0010` remains independently sequenced behind `HUB-WP-0004`