codex
a042bee363
Completes the migration begun on 2026-08-25, which covered active workplans only. The archived copies kept their historical identifiers, and three repositories shared one number space — so their task identifiers collided, blocking task-level projection reset for those workplans. Numbering continues each repository's active sequence rather than restarting, so no identifier is reused. Projection UUIDs are re-derived from the new canonical ids. Refs CUST-WP-0068, STATE-WP-0083-T06 Assistant: claude-code Assistant-Model: opus Assistant-Process: 2583210@bnt-lap001 Assistant-Session: f2bff2d5-e9b2-4338-92ca-10282a927006
112 lines
4.4 KiB
Markdown
112 lines
4.4 KiB
Markdown
---
|
|
id: RCLUSTER-WP-0001
|
|
type: workplan
|
|
title: "activity-core cluster-owned deploy/verify"
|
|
domain: financials
|
|
repo: railiance-cluster
|
|
status: finished
|
|
owner: codex
|
|
topic_slug: railiance
|
|
created: "2026-06-15"
|
|
updated: "2026-06-16"
|
|
state_hub_workstream_id: "7c577c73-43e1-546c-af4b-f90bb3e31a9b"
|
|
---
|
|
|
|
> **Terminology note:** Historical text in this archived workplan may use the legacy term "workstream". The fleet term is **workplan** (`canon/standards/workplan-terminology-fleet_v0.1.md`).
|
|
|
|
# activity-core cluster-owned deploy/verify
|
|
|
|
## Context
|
|
|
|
activity-core `ACTIVITY-WP-0007-T06` needs live Railiance cluster evidence for
|
|
the disabled ops inventory probe. That live verification should be owned by the
|
|
cluster/operator layer, not by arbitrary activity-core sessions with local
|
|
`kubectl` assumptions.
|
|
|
|
This workplan creates a cluster-owned path that keeps credentials in
|
|
operator-owned locations while returning only non-secret evidence to State Hub.
|
|
|
|
## Implement cluster-owned verifier
|
|
|
|
```task
|
|
id: RCLUSTER-WP-0001-T01
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "0ff9064f-8d27-5c4f-be9c-7ac82aa90768"
|
|
```
|
|
|
|
Add a repeatable command that:
|
|
|
|
- reconciles the activity-core Railiance runtime bundle;
|
|
- reruns `actcore-sync`;
|
|
- checks the `ops-service-inventory-probes` ActivityDefinition exists and is
|
|
still disabled;
|
|
- triggers the disabled definition manually through the in-cluster API path;
|
|
- verifies a fresh `ops_inventory_probe` progress event exists in State Hub;
|
|
- posts a non-secret State Hub evidence note for activity-core to cite.
|
|
|
|
Implemented as `tools/cmd/railiance-verify-activity-core` with Makefile target
|
|
`verify-activity-core`. The script defaults to the `railiance01` SSH executor;
|
|
use `ACTIVITY_CORE_CLUSTER_HOST=local` only for an explicitly selected local
|
|
`kubectl` context.
|
|
|
|
## Run live verification and publish evidence
|
|
|
|
```task
|
|
id: RCLUSTER-WP-0001-T02
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "dda59987-7c7d-5e29-a9c5-e93ac705999d"
|
|
```
|
|
|
|
Run `make verify-activity-core` against the Railiance cluster. On success, cite
|
|
the State Hub evidence note id in this task and in activity-core
|
|
`ACTIVITY-WP-0007-T06`.
|
|
|
|
If a gate fails, the verifier must still post a non-secret State Hub note with
|
|
the failing gate and last completed evidence fields.
|
|
|
|
2026-06-15: Completed against Railiance01 after refreshing the same-tag
|
|
`activity-core:railiance01-prod` image from activity-core commit `ab17378`,
|
|
importing digest `sha256:cff43c72455b9fc4fc11a0a997b4671a38987bb4583a600245dd961965af0e40`
|
|
into k3s containerd, syncing the current runtime bundle to
|
|
`/home/tegwick/activity-core/k8s/railiance`, and restarting the activity-core
|
|
runtime deployments. The verifier reconciled the runtime bundle, completed
|
|
`actcore-sync`, confirmed `ops-service-inventory-probes` exists and remains
|
|
disabled, triggered it manually, verified State Hub progress
|
|
`4c82360d-33e7-455b-8ab4-33facd4a3f8e`, and posted evidence note
|
|
`baeeaeac-aa6d-4406-ae64-e54577f21386`.
|
|
|
|
An intermediate verifier invocation accidentally targeted the local
|
|
CoulombCore `kubectl` context. It created only `actcore-*` runtime resources in
|
|
the existing `activity-core` namespace; those resources were removed with the
|
|
runtime manifest cleanup, and the pre-existing `llm-connect` deployment remains
|
|
running.
|
|
|
|
Operational cleanup note: the successful Railiance01 verifier run used
|
|
`ACTIVITY_CORE_RESTART_DEPLOYMENTS=1` after importing the same-tag image. The
|
|
script was corrected afterward to restart only `actcore-api`,
|
|
`actcore-worker`, and `actcore-event-router`, because
|
|
`actcore-state-hub-bridge` uses host networking and a rolling restart leaves a
|
|
new bridge pod pending behind the host-bound running pod. A 2026-06-16 cleanup
|
|
check showed the bridge rollout had settled on Railiance01: the host-bound
|
|
bridge pod was running and the replacement ReplicaSet was scaled to zero, so no
|
|
manual live cleanup was needed.
|
|
|
|
## Handoff closure to activity-core
|
|
|
|
```task
|
|
id: RCLUSTER-WP-0001-T03
|
|
status: done
|
|
priority: medium
|
|
state_hub_task_id: "3fb86fed-435b-557e-83d5-44260d1ff483"
|
|
```
|
|
|
|
After live evidence exists, update activity-core `ACTIVITY-WP-0007-T06` to cite
|
|
the Railiance evidence and close it if Inter-Hub submission is active or
|
|
explicitly deferred with the clean State Hub fallback result.
|
|
|
|
2026-06-15: Updated activity-core `ACTIVITY-WP-0007-T06` to cite Railiance
|
|
evidence note `baeeaeac-aa6d-4406-ae64-e54577f21386` and close the task with
|
|
Inter-Hub submission explicitly deferred while the State Hub fallback evidence
|
|
path is verified.
|