/health returned nginx 404 through the ingress while the service answered 200
in-cluster. The ingress rule was correct on paper — /health Exact ->
reuse-surface:8000 alongside / Prefix -> reuse-surface-landing:8080 — but
Traefik derives router priority from the length of the generated rule string,
and Path(`/health`) and PathPrefix(`/`) are both 15 characters. The tie broke
toward the landing page. PathPrefix(`/v1`) is longer, which is why /v1 worked
and the fault looked like a /health-only bug.
traefik.ingress.kubernetes.io/router.priority applies per Ingress, not per
path, so the catch-all moves into its own Ingress with priority 1. Every API
route now outranks it regardless of rule length.
This is not cosmetic: make reuse-smoke curls /health and false-negatives on an
otherwise healthy release.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
image.tag was "e3ae22e", a Gitea-era tag. charts/reuse-surface/values.yaml was
repointed to the Forgejo repository in 04be416, but no e3ae22e tag was ever
published there — CI only began pushing to Forgejo three hours after that
commit. Authenticated tags/list returns latest, main-b035664, main-bca7165,
main-f9d957a. So the release could not pull its image, making ImagePullBackOff
a present risk on any restart rather than one tied to the 2026-08-31 CoulombCore
retirement.
Pin main-b035664, verified to resolve (manifest 200). It is a CI build of
reuse-surface main and carries the compose hardening that stops a single
malformed member index from returning HTTP 500 for the whole federated index —
needed before evidence-binder can be re-enabled as a source.
Also ships REUSE-WP-0019 T04/T05/T06, closed as finished but never deployed.
Not applied. Deploy is the manual `make reuse-deploy`, which needs
KUBECONFIG for Railiance01.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Retires the shared prefix. Live plans move to the new prefix keeping their
running number; finished and archived files keep the old prefix as
historical record, per the ADR-007 option 2 migration ruling.
Hub UUIDs are unchanged, so reconciliation matches on
state_hub_workstream_id rather than filename and will update the slug in
place instead of registering duplicates.
Assigned in RMGR-WP-0004-T09.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
CORE_HUB_IMAGE_REPOSITORY was the only one of four app image defaults still on
gitea.coulomb.social. It is passed as --set image.repository= when a tag is
supplied, so it overrides helm/core-hub-values.yaml at deploy time - fixing the
values file alone would have left the actual deploy path pointing at the frozen
CoulombCore registry.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
helm/core-hub-values.yaml was the last file still pulling from
gitea.coulomb.social. Both hostnames resolve, but to different machines -
gitea.coulomb.social to 92.205.130.254 (CoulombCore) and forgejo.coulomb.social
to 92.205.62.239 (Railiance01) - so this quietly deployed core-hub from the
frozen CoulombCore registry rather than failing loudly. Every other values file
in this repo, including charts/core-hub/values.yaml for the same app, already
used forgejo.
The tag is a render-time placeholder; deploys pass CORE_HUB_IMAGE_TAG=<sha>, so
the next core-hub rollout must confirm that sha is present on the Forgejo
registry before promoting.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Forgejo has replaced Gitea as the forge. Updates SCOPE.md Current State,
AGENTS.md and .claude/rules/repo-identity.md, which still described Gitea as
the operational forge.
Deliberately NOT changed, because they are accurate rather than stale:
- migration and coexistence prose in docs/forgejo-on-railiance01.md,
docs/forge-source-of-truth-decision.md and the capability registry, where
Gitea is the thing being migrated from
- gitea-charts/gitea 12.5.0, the real Helm chart Forgejo deploys from
- gitea-db, a running CNPG cluster, and the gitea- prefixed doc filenames in
railiance-forge, which still exist under those names
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Builds SECRET_KEY, optional URL-encoded DATABASE_URL from app DB
credentials, and USER_ENGINE_PROXY_SECRET from user-engine-runtime.
Never prints values; Makefile dry-run and apply targets.
Maintainer decision, 2026-07-29: adopts TRSL V1C1 as this repo's
preliminary governing license, per target-revenue's
workplans/TREV-WP-0008-governance-and-pilot-rollout.md T05. Full
specialist legal review is deferred until out of beta (target-revenue
SCOPE.md §1). No Phase is yet declared for this repo.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Mark workplan active with T01/T02 done, document topology, extend status
for activity-core mode, and wire Make targets to the platform multi-host
backup CLI. T03 remains operator-blocked on ESO token.
Capture post-WP-0015 posture (workstation SPOF) and register a workplan to
move unattended Option A + Forgejo backup automation to railiance01 via
activity-core without a laptop control plane.
Cluster egress blocks age installs (github + Alpine CDN). Declare
workstation-cron schedule ConfigMap as the unattended path and keep
Option A CronJobs suspended until a prebuilt image is available.
Materialize offsite Secret from OpenBao, deploy per-cluster CronJobs,
generalize multi-cluster logical backup + status health for Option A,
seed encrypted uploads and restore-drill evidence; workplan finished.
Descoped out of RAIL-HO-WP-0005 T04/T09. Drives cnpg-backup-status degraded→healthy.
Blocked on CCR-2026-0004 offsite credential provisioning (operator/OpenBao).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
