docs: record hub-core production cutover

docs/evidence/core-hub-hub-core-cutover-2026-08-21.md

@@ -0,0 +1,70 @@
+# Core Hub to hub-core production cutover evidence — 2026-08-21
+
+## Outcome
+
+Hub-core became the public `https://hub.coulomb.social` authority at
+2026-08-21T20:49:50+02:00. The current release is Helm revision 20 of chart
+`rapp-core-hub` 0.4.0. Core Hub remains Ready with no public route and no
+writer groups as the live rollback through the stabilization window.
+
+## Immutable identities
+
+- hub-core source revision: `055cf49`
+- authoritative hub-core image digest:
+  `sha256:adf580d09a4a9139b1663c41d59d46903a007e03a3ae567e09b8a6ec23708ab8`
+- rollback Core Hub image digest:
+  `sha256:388a94ec752e13a0031e329a45e970480c41691e969d4e40c31924669e8d0005`
+- database: `core_hub` on railiance01 `platform-pg`
+- source/target schemas: `core_hub` / `hub_runtime`
+
+## Data gates
+
+The full import, idempotent replay, restart-persistence check, delta replay,
+and reverse export passed. Source and target had identical record identities
+and the following canonical counts and content hashes:
+
+| Resource | Count | SHA-256 |
+| --- | ---: | --- |
+| `hubs` | 2 | `1903171468a9ec1e19afc8e6d6c3dccd8ec96abbb2eb7a6d43cb0694a27d1bed` |
+| `hubCapabilityManifests` | 2 | `71cc6cf72176558ce656a31f786b81032976355436f4207ef267e079890f0ba5` |
+| `apiConsumers` | 3 | `ee909a15b21c514cab56b35219fb86f39ee092c61a2b05e24827b316e5b47710` |
+| `apiKeys` | 10 | `a6a5123f410e996f8c40922ab8289ff8a1d91a0324234e25d91197ceabf9f6c0` |
+| `widgets` | 16 | `f9b0abfc236e16264b0b02cc22ee680e4a71da58d990db1edae67dfe16a372a1` |
+| `interactionEvents` | 4 | `32d617ff66f67d6a9da516b449145c66a92d7f9e0e2ecede3916957f7402213c` |
+| `migrationRuns` | 2 | `47318fe8f2fa51c66a8fadf2d548ef1d45d1429c365ea97a50d4620d8e6c9c61` |
+
+No raw key or credential value was exported or recorded as evidence.
+
+## Runtime and consumer gates
+
+- All five route groups (`system`, `registry`, `credentials`, `interaction`,
+  `deferred`) route to hub-core.
+- All four mutable writer groups belong only to hub-core. Core Hub rejects
+  writes and advertises an empty writer set.
+- Hub-core internal conformance passed 8/8.
+- `ops-hub` `make interhub-gate` passed against the public host.
+- The activity-core stabilization resolver passed all five checks.
+- Both Deployments are Ready, dependency-aware readiness reports PostgreSQL
+  and authentication healthy, and `make verify-live` passed.
+
+During the registry fence probe, the still-running legacy process briefly
+accepted one exact synthetic `must-not-write` hub before its configuration
+checksum restart. The identified row was removed after an exact identity/name
+check; the restarted legacy runtime then returned 503 and the target/public
+dataset remained at the expected two hubs. No user record was affected.
+
+## Rollback rehearsal
+
+The final cutover was rolled back with Helm to the pre-cutover configuration,
+creating revision 19. Core Hub served healthy public health/readiness checks.
+The final source delta replay preserved all counts and hashes. Forward deploy
+then created current revision 20, after which image, readiness, writer-fence,
+conformance, ops-hub, and activity-core gates all passed again.
+
+## Stabilization and residual owner
+
+The seven-day stabilization interval is
+2026-08-21T20:49:50+02:00 through no earlier than
+2026-08-28T20:49:50+02:00. `CORE-WP-0010-T05` owns the final review, Forgejo
+read-only archive, and handoff of any remaining product-intent gaps. Core Hub
+must remain available as the no-writer rollback until that task closes.