diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index 1db62c8..678c4ae 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -56,6 +56,6 @@ | task | CORE-WP-0010-T05 | todo | — | workplans/CORE-WP-0010-runtime-absorption-and-archive.md | | task | CORE-WP-0011-T01 | done | — | workplans/CORE-WP-0011-railiance01-production-relocation.md | | task | CORE-WP-0011-T02 | done | — | workplans/CORE-WP-0011-railiance01-production-relocation.md | -| task | CORE-WP-0011-T03 | wait | — | workplans/CORE-WP-0011-railiance01-production-relocation.md | +| task | CORE-WP-0011-T03 | done | — | workplans/CORE-WP-0011-railiance01-production-relocation.md | | task | CORE-WP-0011-T04 | todo | — | workplans/CORE-WP-0011-railiance01-production-relocation.md | | task | CORE-WP-0011-T05 | todo | — | workplans/CORE-WP-0011-railiance01-production-relocation.md | diff --git a/docs/deployment/railiance01-shadow-runbook.md b/docs/deployment/railiance01-shadow-runbook.md index 12630d4..33b5ac1 100644 --- a/docs/deployment/railiance01-shadow-runbook.md +++ b/docs/deployment/railiance01-shadow-runbook.md @@ -6,7 +6,12 @@ stops before public Ingress, DNS, tunnel changes, a final write freeze, or any CoulombCore teardown. Authoritative deploy input: `/home/worsch/rapp-core-hub` at or after package -commit `03effc8`, chart `0.3.0`. +commit `7cfa8bb`, chart `0.3.1`. + +The private-shadow rehearsal completed on 2026-08-21. The procedure below is +retained for repeatability and rollback; completion evidence is in +`docs/evidence/core-hub-railiance01-private-shadow-2026-08-21.md`. It still +does not authorize public cutover. ## 1. Admission gates diff --git a/docs/evidence/core-hub-railiance01-private-shadow-2026-08-21.md b/docs/evidence/core-hub-railiance01-private-shadow-2026-08-21.md new file mode 100644 index 0000000..f07c4c2 --- /dev/null +++ b/docs/evidence/core-hub-railiance01-private-shadow-2026-08-21.md @@ -0,0 +1,53 @@ +# Core Hub railiance01 private-shadow completion — 2026-08-21 + +## Result + +The private Core Hub shadow is healthy on railiance01 and the rehearsal gate +`CORE-WP-0011-T03` is complete. Public Ingress remains absent. Production +traffic, DNS, the ops-bridge tunnel, the CoulombCore writer, and the source +runtime were not changed or retired. + +The platform-owned detailed evidence is +`/home/worsch/railiance-platform/docs/evidence/core-hub-private-shadow-2026-08-21.md` +at railiance-platform commit `1206ed5`. + +## Data reconciliation + +- A consistent logical archive was captured from the live source at + `2026-08-20 22:12:26 UTC`; its SHA-256 is + `3770946a1032c4109fea32fc00f4411c2f4d9311a28fb17bfc3d0d2de888db8b`. +- Source and restored target matched at Alembic revision `20260627_0002`, + eight tables and 39 rows before shadow smoke activity. +- The source archive's `public` tables were moved explicitly into the accepted + target `core_hub` schema. Ownership, migration-role membership and runtime + SELECT grants were verified. +- Later target counts differ only by the protected write operations performed + by the successful shadow smokes; this target remains a rehearsal copy, not + the production writer. + +## Runtime and credential proof + +- Helm release revision 2 runs `rapp-core-hub` chart `0.3.1`, package commit + `7cfa8bb`, at immutable image digest + `sha256:0db6f7c646c6d4c1fbc844dc266fcf883584637e1c1f47802efe1c6a98558d3c`. +- The migration Job completed and the Deployment, Service, three governed + Secret projections and three NetworkPolicies are healthy; no Ingress exists. +- API-token, runtime-database and migration-database credentials use disjoint, + namespace-limited OpenBao/ESO paths. Cross-namespace and sibling/parent-path + denials and runtime-versus-migration role separation passed. +- A chart `0.3.1` lease refresh changed the runtime Secret and application + child PID while the pod UID stayed fixed, the container restart count stayed + zero, and readiness returned. Logs contained only the non-secret rotation + notice. + +## Private verification + +The hardened package verifier passed. Authenticated smoke run +`20260820224419-43dc05` passed health, readiness, OpenAPI, four public catalogs, +unauthenticated `401` enforcement, and authenticated protected reads and +writes. The token was injected from approved custody, never copied into this +repo, and the temporary token file was shredded after use. + +The next gate is `CORE-WP-0011-T04`. It requires separate explicit operator +approval for a bounded write freeze, final transfer/reconciliation, public +routing and tunnel changes, plus rollback readiness. diff --git a/workplans/CORE-WP-0011-railiance01-production-relocation.md b/workplans/CORE-WP-0011-railiance01-production-relocation.md index 283308a..425b2a5 100644 --- a/workplans/CORE-WP-0011-railiance01-production-relocation.md +++ b/workplans/CORE-WP-0011-railiance01-production-relocation.md @@ -8,7 +8,7 @@ status: active owner: codex topic_slug: infotech created: "2026-08-20" -updated: "2026-08-20" +updated: "2026-08-21" parent_project: prj-state-hub-retirement parent_workplan: SHR-WP-0002 related: @@ -137,7 +137,7 @@ that this workstation is not the production workplan-UUID registrar. ```task id: CORE-WP-0011-T03 -status: wait +status: done priority: high ``` @@ -162,6 +162,24 @@ requirements, private smokes, live lease-rotation proof and rehearsal rollback are recorded in `docs/deployment/railiance01-shadow-runbook.md` so work can resume immediately after platform admission. +Completed 2026-08-21. `RPF-WP-0021` admitted Core Hub as the fourth and final +`platform-pg` consumer, established separate static API-token and dynamic +runtime/migration database lanes, and restored a consistent 39-row source +archive. The source `public` tables were explicitly reconciled into the +accepted target `core_hub` schema; all eight tables, Alembic revision +`20260627_0002`, ownership and runtime grants matched before shadow smoke +activity. The migration Job completed, Helm revision 2 deployed package chart +`0.3.1` at `rapp-core-hub` commit `7cfa8bb`, and no Ingress exists. + +The hardened private verifier and authenticated smoke +`20260820224419-43dc05` passed all ten checks. A fresh runtime lease then +changed the projected Secret and application child PID while the pod UID and +container restart count remained stable; readiness returned without exposing +a credential. The shadow now contains the expected smoke-created rows, while +the public endpoint and source writer remain on CoulombCore. Repo-local +evidence is in +`docs/evidence/core-hub-railiance01-private-shadow-2026-08-21.md`. + ## Cut over production traffic ```task @@ -197,7 +215,7 @@ this repo unless the separate absorption workplan has also completed. - [x] Decommission deadline and live source/target inventory are recorded - [x] Governed rapp package renders and passes policy checks -- [ ] Shadow restore/reconciliation and consumer smokes pass on railiance01 +- [x] Shadow restore/reconciliation and consumer smokes pass on railiance01 - [ ] Production traffic and tunnel move with explicit approval and rollback - [ ] Stabilization passes and CoulombCore no longer hosts Core Hub dependencies - [ ] `CORE-WP-0010` remains independently sequenced behind `HUB-WP-0004`