# Core Hub railiance01 private-shadow completion — 2026-08-21

## Result

The private Core Hub shadow is healthy on railiance01 and the rehearsal gate
`CORE-WP-0011-T03` is complete. Public Ingress remains absent. Production
traffic, DNS, the ops-bridge tunnel, the CoulombCore writer, and the source
runtime were not changed or retired.

The platform-owned detailed evidence is
`/home/worsch/railiance-platform/docs/evidence/core-hub-private-shadow-2026-08-21.md`
at railiance-platform commit `1206ed5`.

## Data reconciliation

- A consistent logical archive was captured from the live source at
  `2026-08-20 22:12:26 UTC`; its SHA-256 is
  `3770946a1032c4109fea32fc00f4411c2f4d9311a28fb17bfc3d0d2de888db8b`.
- Source and restored target matched at Alembic revision `20260627_0002`,
  eight tables and 39 rows before shadow smoke activity.
- The source archive's `public` tables were moved explicitly into the accepted
  target `core_hub` schema. Ownership, migration-role membership and runtime
  SELECT grants were verified.
- Later target counts differ only by the protected write operations performed
  by the successful shadow smokes; this target remains a rehearsal copy, not
  the production writer.

## Runtime and credential proof

- Helm release revision 2 runs `rapp-core-hub` chart `0.3.1`, package commit
  `7cfa8bb`, at immutable image digest
  `sha256:0db6f7c646c6d4c1fbc844dc266fcf883584637e1c1f47802efe1c6a98558d3c`.
- The migration Job completed and the Deployment, Service, three governed
  Secret projections and three NetworkPolicies are healthy; no Ingress exists.
- API-token, runtime-database and migration-database credentials use disjoint,
  namespace-limited OpenBao/ESO paths. Cross-namespace and sibling/parent-path
  denials and runtime-versus-migration role separation passed.
- A chart `0.3.1` lease refresh changed the runtime Secret and application
  child PID while the pod UID stayed fixed, the container restart count stayed
  zero, and readiness returned. Logs contained only the non-secret rotation
  notice.

## Private verification

The hardened package verifier passed. Authenticated smoke run
`20260820224419-43dc05` passed health, readiness, OpenAPI, four public catalogs,
unauthenticated `401` enforcement, and authenticated protected reads and
writes. The token was injected from approved custody, never copied into this
repo, and the temporary token file was shredded after use.

The next gate is `CORE-WP-0011-T04`. It requires separate explicit operator
approval for a bounded write freeze, final transfer/reconciliation, public
routing and tunnel changes, plus rollback readiness.