---
id: RAILIANCE-WP-0014
type: workplan
title: "Core Hub Helm cutover and vergabe-teilnahme image refresh"
domain: financials
repo: railiance-apps
status: ready
owner: codex
topic_slug: railiance
created: "2026-07-10"
updated: "2026-07-10"
state_hub_workstream_id: "780c8d1d-ea75-479e-9733-10b518dde242"
---

# Core Hub Helm cutover and vergabe-teilnahme image refresh

Follow-up to `RAILIANCE-WP-0012` and custodian inbox `3ced85c7`. The S5 Helm
chart, values, Makefile targets, and runbook exist; the live cluster may still
run Core Hub from `core-hub/k8s/railiance-production/` manifests.

Separately, the 2026-07-10 delivery-lane snapshot shows `vergabe-teilnahme`
deployed at `f95de14` while the source repo head is `1061f3e` (14-commit drift).

Production-touching deploy steps require explicit image tags and operator
approval. Do not store secrets in workplans.

## Core Hub server dry-run on Railiance01

```task
id: RAILIANCE-WP-0014-T01
status: todo
priority: high
state_hub_task_id: "b9dea9f3-f0c0-41c1-b9c4-ec4c44d43d55"
```

Run `CORE_HUB_IMAGE_TAG=<sha> make check-core-hub-image`,
`core-hub-server-dry-run`, and `core-hub-dry-run` against Railiance01. Record the
chosen image tag and any schema or secret prerequisites before apply.

## Adopt Helm-managed Core Hub release

```task
id: RAILIANCE-WP-0014-T02
status: wait
priority: high
state_hub_task_id: "0e591104-0123-4e4a-84ff-5deb435e8441"
```

Run `core-hub-migrate` then `core-hub-deploy` with an explicit
`CORE_HUB_IMAGE_TAG`. Confirm the Helm release owns `core-hub-api`, runtime
ConfigMap, and Service in namespace `core-hub`. Retire duplicate resources from
the service-repo `k8s/railiance-production/` apply path once stable.

Blocked on: `RAILIANCE-WP-0014-T01`.

## Verify Core Hub post-cutover smoke

```task
id: RAILIANCE-WP-0014-T03
status: wait
priority: high
state_hub_task_id: "eca3ce8b-68a8-44d0-90c7-2cdefa482200"
```

Run `make core-hub-status`, `make core-hub-smoke`, and `make core-hub-release-info`.
Ingress for `hub.coulomb.social` must remain healthy. Document rollback steps in
`docs/core-hub-on-railiance01.md` if Helm values drift from prior manifests.

Blocked on: `RAILIANCE-WP-0014-T02`.

## Refresh vergabe-teilnahme production image

```task
id: RAILIANCE-WP-0014-T04
status: todo
priority: medium
state_hub_task_id: "d547f68d-52ec-4ff1-952b-ec70c834e0d3"
```

Identify the current published image tag for `vergabe-teilnahme` in the Forgejo
registry, verify the manifest with `tools/check-oci-image.sh`, run
`vergabe-dry-run` and `vergabe-server-dry-run` if available, then deploy with an
explicit tag. Close the 14-commit drift noted in the delivery-lane evidence.

## Post-deploy vergabe smoke and runbook evidence

```task
id: RAILIANCE-WP-0014-T05
status: wait
priority: medium
state_hub_task_id: "4eaaa345-4252-46c1-bd8a-49d654ec48f4"
```

After deploy, run `make vergabe-status`, migrations if required, and HTTPS smoke
against `vergabe-teilnahme.whywhynot.de`. Update `docs/vergabe-teilnahme.md`
with the deployed tag, date, and smoke result (non-secret).

Blocked on: `RAILIANCE-WP-0014-T04`.