railiance-platform/docs/evidence/core-hub-shadow-preflight-2026-08-20.md
codex 90a0192e4f
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
CI Smoke / container-smoke (push) Successful in 1s
Record Core Hub lease and network readiness
2026-08-20 23:44:35 +02:00

2.1 KiB

Core Hub private-shadow preflight — 2026-08-20

This records non-secret source/target metadata gathered for RPF-WP-0021-T05. It is preparation only: no source data was dumped or restored because the governed credential projections under T04 are not yet live.

Target admission

At 2026-08-20T21:31:13Z on railiance01:

  • namespace core-hub was Active and carried railiance.io/postgres-client=platform-pg plus the package identity labels;
  • CNPG Database/core-hub reported status.applied=true against platform-pg, with reclaim policy retain and owner core_hub_owner;
  • the core_hub database existed but intentionally contained no application tables before the rehearsal restore; and
  • the KV store, database store and three ExternalSecret manifests all passed Kubernetes server-side dry-run after namespace creation.

A disposable postgres:16-alpine pod was then allowed to become Ready in the core-hub namespace. DNS resolved platform-pg-rw.databases.svc.cluster.local to its ClusterIP and pg_isready reported port 5432 accepting connections. The probe used no database credential and was deleted immediately afterward. This verifies the reviewed namespace label and platform-pg consumer NetworkPolicy path.

Source snapshot inventory

A read-only query ran through the existing coulombcore SSH route against apps-pg/core_hub. No Secret or connection value was read. The live source writer remained enabled, so these counts are a rehearsal baseline and must be captured again with the eventual consistent dump.

Object Rows
public.alembic_version 1
public.api_consumers 3
public.api_keys 10
public.hub_capability_manifests 2
public.hubs 2
public.interaction_events 3
public.migration_runs 2
public.widgets 16

The source Alembic revision was 20260627_0002. No user-defined sequence was reported. The table set and counts are small enough for a bounded logical-copy rehearsal, but the restore remains gated on T04 so that migration and runtime checks use the intended distinct dynamic leases rather than a bootstrap login.