core-hub/workplans/CORE-WP-0011-railiance01-production-relocation.md

id	type	title	domain	repo	status	owner	topic_slug	created	updated	parent_project	parent_workplan	related
CORE-WP-0011	workplan	Relocate Core Hub production from CoulombCore to railiance01	infotech	core-hub	active	codex	infotech	2026-08-20	2026-08-20	prj-state-hub-retirement	SHR-WP-0002	CORE-WP-0005 CORE-WP-0007 CORE-WP-0010 HUB-WP-0004

Relocate Core Hub production from CoulombCore to railiance01

Goal

Move the existing Core Hub production service at hub.coulomb.social from CoulombCore to railiance01 before CoulombCore is decommissioned. Preserve the current /api/v2 contract, data, hostname, credentials boundary, and rollback evidence. Do not make runtime absorption into hub-core a prerequisite.

Decision and constraints

• Use the interim-move shape requested by SHR-WP-0002-T03: package and move Core Hub as-is, then resolve long-term absorption under CORE-WP-0010 and HUB-WP-0004 on their own architecture schedule.
• Use the governed Repo Manager rapp path. Because the live deployment truth is a Helm chart, initialize a managed package instead of asking rapp wrap to invent or ingest Helm content; retain this repo's manifests as source evidence until the package is verified.
• Treat the CoulombCore decommission date as a scheduling input, not as a reason to collapse the hub-core library-vs-thin-host decision.
• Any traffic flip, final data freeze/transfer, or old-runtime removal requires explicit operator approval and a rehearsed rollback.

Inventory source and target runtime

id: CORE-WP-0011-T01
status: progress
priority: high

Capture the live CoulombCore image, Deployment, Service, Ingress, database, secret references, resource policy, and tunnel/DNS ownership. Compare them to railiance01 and the checked-in k8s/railiance-production/ manifests.

Local review on 2026-08-20 confirms that the repo already carries a namespace, migration Job, API Deployment, Service, Ingress, health probes, and the historical migration/cutover runbook. The manifests need a live-state diff and modern platform-policy review before reuse. The retirement project reports no core-hub namespace or Deployment on railiance01. A read-only preflight on 2026-08-20 confirmed the current Kubernetes context reaches the Ready k3s node 239.62.205.92.host.secureserver.net (92.205.62.239, Kubernetes v1.35.1+k3s1), has no core-hub namespace or resources, and retains an inter-hub namespace. Pin the CoulombCore decommission date while this task is in progress so later gates have explicit deadlines. The retirement deadline is now pinned to 2026-08-31 (11 days from workplan creation). Source-cluster live state and target platform-policy comparison remain open.

The registry audit found that production/staging manifests, runbooks, and Forgejo CI already publish and pull forgejo.coulomb.social/coulomb/core-hub, but the local Makefile default and deployed-smoke evidence still named the CoulombCore-hosted Gitea registry. Those two active references were changed to Forgejo on 2026-08-20. The only remaining Gitea image reference is historical evidence in finished CORE-WP-0004; confirm the live source Deployment image and digest before declaring the dependency closed.

An attended source-cluster inventory remains required. On 2026-08-20 the CoulombCore kubeconfig pointed at the documented local API port 16443, but the tunnel was down; the current ops-bridge config no longer contains k3s-api-coulombcore. The sanctioned warden signer route was followed, but its credential broker requires an operator-held OpenBao issuer login unavailable to this non-interactive session. No alternate credential path was attempted. After operator login, collect metadata-only Deployment/Service/Ingress, image digest, Secret names and keys (never values), database target, resource policy, and Helm revision evidence before closing this task.

Build the relocatable application package

id: CORE-WP-0011-T02
status: done
priority: high

Wrap the current service through the governed rapp path. Pin the source revision and image digest, express namespace/runtime/database/secret dependencies without credential values, and add render/package checks. Reuse the current container and /healthz, /readyz, and deployed-smoke surfaces.

Done when the package renders deterministically, policy checks pass, and its rendered workload is equivalent to the live service except for documented railiance01 platform adaptations.

Completed locally on 2026-08-20 in /home/worsch/rapp-core-hub. Repo Manager initialized a Helm-managed package because the live deployment truth is the existing railiance-apps/charts/core-hub chart; rmgr rapp wrap deliberately refuses to invent or ingest Helm charts. The package absorbs that chart and adds an immutable Forgejo digest pin, safe-private Ingress default, non-root/read-only security contexts, ServiceAccount hardening, default-deny/DNS/Postgres/Traefik NetworkPolicies, deterministic render, Alembic migration, live smoke, and Helm rollback surfaces. Evidence:

• package tests: 5 passed;
• Helm lint: passed;
• family validator: 4 declarations ok;
• railiance01 Helm/Kubernetes server dry-run: passed;
• current image pin: sha256:0db6f7c646c6d4c1fbc844dc266fcf883584637e1c1f47802efe1c6a98558d3c.

Published and registered on 2026-08-20 after the operator created the Forgejo stub. Local history was attached without discarding either root. Private Forgejo main now includes credential-contract release commit 03effc8. Chart 0.3.0 separates the static API-token Secret from runtime and migration database lease Secrets and supervises the application through mounted-file rotation; seven tests prove separation, safe URL construction, no credential output, and restart signaling. State Hub registers active repo rapp-core-hub as 445ea292-70bb-435c-8c69-c4cb57a6985b, with the bnt-lap001:/home/worsch/rapp-core-hub host path, the canonical stub-root Git fingerprint, and Core Hub's topic ID. The package uses registered workplan prefix RAPPCOREHUB-WP-; consistency passes with only the expected warning that this workstation is not the production workplan-UUID registrar.

Deploy shadow runtime and rehearse data transfer

id: CORE-WP-0011-T03
status: todo
priority: high

Provision the railiance01 namespace, database role/database, governed secret delivery, migration Job, Deployment, and Service without moving production traffic. Rehearse backup/restore or logical transfer from CoulombCore, compare table and row counts, and run public plus authenticated consumer smokes against the private target endpoint.

Done when the shadow runtime is healthy, data reconciliation is repeatable, and ops-hub plus activity-core smokes pass against railiance01.

Cut over production traffic

id: CORE-WP-0011-T04
status: todo
priority: high

With explicit operator approval, freeze writes for the bounded final-transfer window, transfer and reconcile the final data, then move hub.coulomb.social and the active ops-bridge tunnel from CoulombCore to railiance01. Verify TLS, health/readiness, public catalogs, protected routes, operator console, consumer smokes, and the first post-cutover write.

Rollback must restore the prior traffic/tunnel target and database write path; the old runtime stays intact until stabilization closes.

Stabilize and release CoulombCore dependencies

id: CORE-WP-0011-T05
status: todo
priority: high

Run a time-bounded stabilization window with scheduled health and consumer checks. After operator sign-off, remove Core Hub from the CoulombCore shutdown critical path, retire core-hub-staging and any obsolete tunnel there, and record retained backup/rollback evidence and residual owners. Do not archive this repo unless the separate absorption workplan has also completed.

Acceptance

• Decommission deadline and live source/target inventory are recorded
• Governed rapp package renders and passes policy checks
• Shadow restore/reconciliation and consumer smokes pass on railiance01
• Production traffic and tunnel move with explicit approval and rollback
• Stabilization passes and CoulombCore no longer hosts Core Hub dependencies
• CORE-WP-0010 remains independently sequenced behind HUB-WP-0004