# Core Hub private-shadow preflight — 2026-08-20

This records non-secret source/target metadata gathered for
`RPF-WP-0021-T05`. It is preparation only: no source data was dumped or
restored because the governed credential projections under T04 are not yet
live.

## Target admission

At `2026-08-20T21:31:13Z` on railiance01:

- namespace `core-hub` was Active and carried
  `railiance.io/postgres-client=platform-pg` plus the package identity labels;
- CNPG `Database/core-hub` reported `status.applied=true` against
  `platform-pg`, with reclaim policy `retain` and owner `core_hub_owner`;
- the `core_hub` database existed but intentionally contained no application
  tables before the rehearsal restore; and
- the KV store, database store and three ExternalSecret manifests all passed
  Kubernetes server-side dry-run after namespace creation.

A disposable `postgres:16-alpine` pod was then allowed to become Ready in the
`core-hub` namespace. DNS resolved
`platform-pg-rw.databases.svc.cluster.local` to its ClusterIP and `pg_isready`
reported port 5432 accepting connections. The probe used no database
credential and was deleted immediately afterward. This verifies the reviewed
namespace label and `platform-pg` consumer NetworkPolicy path.

## Source snapshot inventory

A read-only query ran through the existing `coulombcore` SSH route against
`apps-pg/core_hub`. No Secret or connection value was read. The live source
writer remained enabled, so these counts are a rehearsal baseline and must be
captured again with the eventual consistent dump.

| Object | Rows |
| --- | ---: |
| `public.alembic_version` | 1 |
| `public.api_consumers` | 3 |
| `public.api_keys` | 10 |
| `public.hub_capability_manifests` | 2 |
| `public.hubs` | 2 |
| `public.interaction_events` | 3 |
| `public.migration_runs` | 2 |
| `public.widgets` | 16 |

The source Alembic revision was `20260627_0002`. No user-defined sequence was
reported. The table set and counts are small enough for a bounded logical-copy
rehearsal, but the restore remains gated on T04 so that migration and runtime
checks use the intended distinct dynamic leases rather than a bootstrap login.