Advance RPF-WP-0021 platform onboarding

workplans/RPF-WP-0021-core-hub-platform-onboarding.md

@@ -108,7 +108,7 @@ State Hub; workplan UUID assignment remains with the production registrar.
 
 ```task
 id: RPF-WP-0021-T02
-status: progress
+status: done
 priority: high
 ```
 
@@ -125,8 +125,7 @@ baseline. The untracked `consumers/issue-core.yaml` is not a real consumer —
 `ISSUE-WP-0007` explicitly removed Postgres from that package — and must not
 silently consume a slot.
 
-Live apply, database role creation, namespace labeling, and OpenBao database
-role configuration remain attended operations after declaration review.
+OpenBao database role configuration remains an attended operation under T04.
 
 Read-only preflight 2026-08-20: `platform-pg-1` used 9m CPU and 362Mi memory
 against a 1Gi limit, with only `audit_core` and operator sessions present;
@@ -134,6 +133,23 @@ against a 1Gi limit, with only `audit_core` and operator sessions present;
 does not satisfy ADR-0004's representative multi-consumer peak measurement.
 Evidence: `docs/evidence/core-hub-postgres-capacity-preflight-2026-08-20.md`.
 
+Capacity admission completed 2026-08-20. A bounded live probe opened 56
+sessions in four declaration groups and repeated the occupancy with one active
+bounded sort per group. `platform-pg` peaked at 174Mi/1Gi; the 85Mi increase is
+about 1.52Mi per opened backend. Even adding that delta to the earlier 362Mi
+sample yields 447Mi, under 44% of the limit. Core Hub is accepted as the fourth
+and final declaration without raising the pod limit. Evidence:
+`docs/evidence/core-hub-postgres-capacity-admission-2026-08-20.md`.
+
+Completed 2026-08-20. `rapp-postgres` commit `4f316cc` accepts and publishes
+the Core Hub declaration as the fourth `platform-pg` consumer. All 31 package
+tests and consumer rendering passed; the railiance01 server-side dry-run
+accepted the generated resource. The idempotent package provisioner then
+created `core_hub`, its `core_hub` schema, distinct NOLOGIN owner/migration/
+runtime roles and bounded role settings. CNPG `Database/core-hub` reports
+`status.applied=true`, targets `platform-pg`, retains the database on resource
+deletion, and names `core_hub_owner` as owner.
+
 ## T03 — Correct the runtime credential delivery contract
 
 ```task
@@ -207,6 +223,16 @@ high-risk boundary to deny direct data reads on the new path. Database-engine
 policy/store manifests wait for the accepted Postgres declaration and the T03
 consumer correction.
 
+Progress 2026-08-20 after T02 admission: added an exact two-path database ESO
+policy, a namespace-limited `openbao-core-hub-database` store, and three
+disjoint ExternalSecrets. Runtime and migration each use one `dataFrom.extract`
+so a username/password pair comes from one lease; both refresh every five
+minutes. The database store and all projections passed railiance01 server-side
+dry-run. The package namespace is live with the reviewed `platform-pg` client
+label. Live role/store activation correctly stopped because the current
+OpenBao session receives 403 and CCR-2026-0013 is still proposed; no authority
+or placeholder Secret was improvised.
+
 ## T05 — Support the private shadow restore and verification
 
 ```task
@@ -224,11 +250,17 @@ the private endpoint.
 This task ends with repeatable shadow evidence. It does not flip
 `hub.coulomb.social`, freeze production writes, or remove CoulombCore.
 
+Preflight 2026-08-20: the source has Alembic revision `20260627_0002`, eight
+public tables and 39 total rows. The admitted target intentionally has no
+application tables before restore. No dump or restore was attempted ahead of
+the T04 credential gate. Evidence:
+`docs/evidence/core-hub-shadow-preflight-2026-08-20.md`.
+
 ## Acceptance
 
 - [x] Private Forgejo repo exists, validated commit `4403c9b` is preserved,
       and the registered workplan prefix is consistent.
-- [ ] Core Hub is an accepted, capacity-reviewed `rapp-postgres` consumer.
+- [x] Core Hub is an accepted, capacity-reviewed `rapp-postgres` consumer.
 - [ ] Static API-token and dynamic database credentials have distinct,
       least-privilege delivery paths.
 - [ ] Database credential rotation cannot leave a running pod using an expired