From a62df364aa9d20733fd4b294babc9607e2ba0ccd Mon Sep 17 00:00:00 2001 From: tegwick Date: Tue, 7 Jul 2026 17:00:05 +0200 Subject: [PATCH] Close RAIL-HO-WP-0005-T02; record cutover Option A on WP-0005 Staged per-repo cutover is the official T11 mode. T02 design decisions complete. --- ...HO-WP-0005-forgejo-production-migration.md | 57 ++++++++++--------- 1 file changed, 30 insertions(+), 27 deletions(-) diff --git a/workplans/RAIL-HO-WP-0005-forgejo-production-migration.md b/workplans/RAIL-HO-WP-0005-forgejo-production-migration.md index 3765fc5..f523d93 100644 --- a/workplans/RAIL-HO-WP-0005-forgejo-production-migration.md +++ b/workplans/RAIL-HO-WP-0005-forgejo-production-migration.md @@ -74,9 +74,9 @@ change is made there. daily age-encrypted `forgejo dump` + `pg_dump` → Nextcloud WebDAV; 14 daily + 4 weekly retention; RPO 24h / RTO 4h. Record: `the-custodian/docs/forgejo-production-decisions.md` § Backup. -6. Cutover mode: ~~freeze-all vs staged~~ **LEANING staged per-repo (2026-07-04)** - based on `glas-harness` pilot; operator confirmation still needed. Freeze-all - remains fallback for final production wave if drift risk is unacceptable. +6. ~~Cutover mode~~ **DECIDED 2026-07-09 (Option A):** staged per-repo promotion + (no org-wide freeze). Freeze-all documented as emergency fallback only. Record: + `the-custodian/docs/forgejo-production-decisions.md` § Cutover. ## Safety Contract @@ -176,34 +176,36 @@ pending before T11 wave for remaining production repos. ```task id: RAIL-HO-WP-0005-T02 -status: progress +status: done priority: high -needs_human: true +needs_human: false state_hub_task_id: "f88115bf-4f99-49ef-a415-0b23750141b3" ``` Decide the production choices listed in "Key Decisions to Confirm". -**Partial (2026-07-09):** hostname, exposure, deployment pattern, live deploy, -in-cluster runner model (`ADR-004`), **SMTP (IONOS, T06 done)**, **package scope -(Option C)**, and **backup target (Option A: Nextcloud + age)** decided. Cutover -mode **leaning** staged per-repo (glas-harness pilot). Remaining operator -decision: final cutover confirmation. See -`the-custodian/docs/forgejo-production-decisions.md`. +**Done (2026-07-09):** All Key Decisions recorded in +`the-custodian/docs/forgejo-production-decisions.md`: + +- Hostname, exposure, deployment pattern, live deploy (2026-07-03) +- SMTP IONOS + OpenBao/ESO (T06 done 2026-07-08) +- Package scope **Option C** (OCI + npm + generic; others as needed) +- Actions runner in-cluster (`ADR-004`) +- Backup **Option A** (Nextcloud + age; balanced retention) +- Cutover **Option A** (staged per-repo; freeze-all emergency fallback only) Expected output: -- A short decision record in this workplan or a dedicated ADR. -- Hostname and exposure model. ✓ hostname; exposure follows railiance01 Traefik +- A short decision record in this workplan or a dedicated ADR. ✓ +- Hostname and exposure model. ✓ - SMTP provider and sender identity. ✓ -- Package registry scope. ✓ Option C (OCI + npm + generic; others as needed) -- Actions runner isolation model. -- Backup target, retention, encryption, and restore cadence. ✓ Option A - (Nextcloud; balanced retention; implementation T04/T09) -- Cutover strategy and rollback window. +- Package registry scope. ✓ +- Actions runner isolation model. ✓ +- Backup target, retention, encryption, and restore cadence. ✓ +- Cutover strategy and rollback window. ✓ staged per-repo + per-repo rollback **Done when:** implementation tasks are no longer blocked by open production -choices. +choices. **Met.** --- @@ -518,17 +520,17 @@ Execute production migration only after T06, T07, T08, T09, and T10 tier 0–2 gates pass. `state-hub` and other Wave-1 production repos require explicit operator approval per `CUST-WP-0054` drain sequence. -**Preferred cutover (staged per-repo):** +**Cutover mode (T02 Option A, 2026-07-09):** staged per-repo — no org-wide freeze. -1. Per repo: Gitea backup snapshot (or org-wide before each wave). +1. Per repo: Gitea backup snapshot before promotion. 2. Mirror git to Forgejo; switch workstation `origin` to `forgejo-remote`. 3. Port/verify Actions workflows on Forgejo runner. 4. Update State Hub `remote_url` and railiance01 sweep checkouts when promoted. -5. Mark Gitea repo read-only (org policy); do not delete. -6. Repeat until production set complete. +5. Mark **that** Gitea repo read-only; do not delete. +6. Stabilization window; repeat until production set complete. -**Freeze-all fallback:** single window if staged drift is unacceptable — same -steps but all repos in one maintenance period. +**Emergency fallback only:** org-wide freeze-all — not the primary plan; use if +staged drift becomes unacceptable (document rollback before invoking). **Done when:** all Railiance/Custodian repos use Forgejo as primary, Gitea is read-only fallback, and rollback instructions are documented. @@ -581,8 +583,9 @@ T03 isolated probe: CANCELLED (superseded by T05 + in-production pilots) **Current focus (2026-07-07):** T08 **done**; T10 tiers 0–2.5 **complete**, tier-3 `state-hub` cutover **in progress** (phase 5 stabilization). T09 restore drill -**passed**; backup **target** decided (Option A). Scheduled automation still -open (T04/T09). T02 cutover-mode confirmation remains operator-gated. T11 partial: `state-hub` primary +**passed**; backup target decided (Option A); T02 **done** (all design decisions). +Scheduled backup automation still open (T04/T09). Next: tier-3 staged promotions +(T10/T11) after backup 7-day gate. T11 partial: `state-hub` primary on railiance01; ~57 State Hub repos still point at Gitea remotes. Do not retire coulombcore `state-hub` until phase 5 closeout and operator signoff (`CUST-WP-0054-T05`).