# Core Hub to hub-core production cutover evidence — 2026-08-21

## Outcome

Hub-core became the public `https://hub.coulomb.social` authority at
2026-08-21T20:49:50+02:00. The current release is Helm revision 20 of chart
`rapp-core-hub` 0.4.0. Core Hub remains Ready with no public route and no
writer groups as the live rollback through the stabilization window.

## Immutable identities

- hub-core source revision: `055cf49`
- authoritative hub-core image digest:
  `sha256:adf580d09a4a9139b1663c41d59d46903a007e03a3ae567e09b8a6ec23708ab8`
- rollback Core Hub image digest:
  `sha256:388a94ec752e13a0031e329a45e970480c41691e969d4e40c31924669e8d0005`
- database: `core_hub` on railiance01 `platform-pg`
- source/target schemas: `core_hub` / `hub_runtime`

## Data gates

The full import, idempotent replay, restart-persistence check, delta replay,
and reverse export passed. Source and target had identical record identities
and the following canonical counts and content hashes:

| Resource | Count | SHA-256 |
| --- | ---: | --- |
| `hubs` | 2 | `1903171468a9ec1e19afc8e6d6c3dccd8ec96abbb2eb7a6d43cb0694a27d1bed` |
| `hubCapabilityManifests` | 2 | `71cc6cf72176558ce656a31f786b81032976355436f4207ef267e079890f0ba5` |
| `apiConsumers` | 3 | `ee909a15b21c514cab56b35219fb86f39ee092c61a2b05e24827b316e5b47710` |
| `apiKeys` | 10 | `a6a5123f410e996f8c40922ab8289ff8a1d91a0324234e25d91197ceabf9f6c0` |
| `widgets` | 16 | `f9b0abfc236e16264b0b02cc22ee680e4a71da58d990db1edae67dfe16a372a1` |
| `interactionEvents` | 4 | `32d617ff66f67d6a9da516b449145c66a92d7f9e0e2ecede3916957f7402213c` |
| `migrationRuns` | 2 | `47318fe8f2fa51c66a8fadf2d548ef1d45d1429c365ea97a50d4620d8e6c9c61` |

No raw key or credential value was exported or recorded as evidence.

## Runtime and consumer gates

- All five route groups (`system`, `registry`, `credentials`, `interaction`,
  `deferred`) route to hub-core.
- All four mutable writer groups belong only to hub-core. Core Hub rejects
  writes and advertises an empty writer set.
- Hub-core internal conformance passed 8/8.
- `ops-hub` `make interhub-gate` passed against the public host.
- The activity-core stabilization resolver passed all five checks.
- Both Deployments are Ready, dependency-aware readiness reports PostgreSQL
  and authentication healthy, and `make verify-live` passed.

During the registry fence probe, the still-running legacy process briefly
accepted one exact synthetic `must-not-write` hub before its configuration
checksum restart. The identified row was removed after an exact identity/name
check; the restarted legacy runtime then returned 503 and the target/public
dataset remained at the expected two hubs. No user record was affected.

## Rollback rehearsal

The final cutover was rolled back with Helm to the pre-cutover configuration,
creating revision 19. Core Hub served healthy public health/readiness checks.
The final source delta replay preserved all counts and hashes. Forward deploy
then created current revision 20, after which image, readiness, writer-fence,
conformance, ops-hub, and activity-core gates all passed again.

## Stabilization and residual owner

The seven-day stabilization interval is
2026-08-21T20:49:50+02:00 through no earlier than
2026-08-28T20:49:50+02:00. `CORE-WP-0010-T05` owns the final review, Forgejo
read-only archive, and handoff of any remaining product-intent gaps. Core Hub
must remain available as the no-writer rollback until that task closes.