Close HARNESS-WP-0002-T02: live Railiance cutover done

Full cutover executed on railiance01 with operator go-ahead: host
secrets dir + checkout renamed, host venv recreated from scratch
(renaming a venv directory breaks its embedded shebang paths), image
rebuilt/imported, renamed k8s manifests applied alongside the old
namespace (not overwriting it), rollout + in-cluster smoke verified,
then the authoritative host smoke script run against the live
deployment: ok: true, committed: true, pushed: true, with a matching
harness_smoke event confirmed in State Hub. Only after that verification
did we delete the old agent-harness namespace and checkout.

Found and fixed two host-side references the original checklist hadn't
anticipated: path substitutions inside the (secrets, not directly read)
env file, and ~/.ssh/config's forgejo-agent-harness Host block, whose
IdentityFile still pointed at the pre-rename secrets path.

HARNESS-WP-0002 is now fully done (4/4).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

deploy/README.md

@@ -3,19 +3,30 @@
 Single shared harness instance on **railiance01**. Secrets stay on the host
 (Lanes 2–3); the container image is the portable runtime package.
 
-> **Renamed from agent-harness (HARNESS-WP-0002-T02).** Image tag, k8s
-> namespace/labels, CLI command, and Python package are all renamed in
-> this repo already. The commands below assume the **rename cutover
-> checklist** just below has been done on railiance01 first — this is a
-> live production deployment for `binky-control`, so the cutover itself
-> is deliberately not automated from a workstation session.
+> **Renamed from agent-harness (HARNESS-WP-0002-T02) — cutover done
+> 2026-07-26.** Railiance now runs `rein-aharness` end to end: image tag,
+> k8s namespace, CLI command, Python package, host secrets dir, and
+> checkout are all renamed, verified via the authoritative host smoke
+> script (`ok: true, committed: true, pushed: true`), and the old
+> `agent-harness` namespace/checkout are gone. Checklist kept below as a
+> record and in case this ever needs redoing (e.g. a second host).
 
-## Rename cutover checklist (do this on railiance01 before redeploying)
+## Rename cutover checklist (done on railiance01 2026-07-26)
 
 1. Move the host-side secrets dir: `mv ~/.local/agent-harness ~/.local/rein-aharness`
    (or symlink, if anything else still reads the old path).
+   **Also needed, not anticipated by this checklist originally:** two
+   path references *inside* `~/.local/rein-aharness/env` (AppRole dir,
+   PYTHONPATH — fixed with a blind, precise `sed` substitution; the
+   file wasn't read directly, a direct `cat` was correctly classifier-blocked
+   as a secrets file) and `~/.ssh/config`'s `Host forgejo-agent-harness`
+   `IdentityFile` (alias name itself left unchanged, only the path it
+   points at). Check both again if redoing this elsewhere.
 2. Move/rename the checkout: `mv ~/agent-harness ~/rein-aharness` (or a fresh
-   `deploy-rsync` to the new path — see Makefile).
+   `deploy-rsync` to the new path — see Makefile). If the checkout has an
+   associated venv, **recreate it from scratch** rather than moving it —
+   a venv's shebang lines embed absolute paths, so renaming the directory
+   alone breaks `pip` and every installed entry point.
 3. Verify no other host cron/systemd unit still references
    `~/agent-harness` or the `agent-harness` command directly.
 4. Once the above is done, `kubectl delete namespace agent-harness` **after**

workplans/HARNESS-WP-0002-rename-and-glas-harness-alignment.md

@@ -65,16 +65,37 @@ ConfigMap names, the Railiance host directory, and
   itself, and not deleting the old k8s namespace until the new one is
   confirmed working
 
-**Still open — the actual live cutover:** running the checklist on
-railiance01, rebuilding+importing the image there, applying the renamed
-k8s manifests, and running the host smoke script against the live
-deployment. Not attempted from this session — real production surgery
-on `binky-control`'s live automation, needs the operator present for
-the actual host-side moves and a confirmed rollback point.
+**Live cutover done (2026-07-26), operator go-ahead:**
+- Moved `~/.local/agent-harness` → `~/.local/rein-aharness` on
+  railiance01; fixed two host-side references the rename checklist
+  hadn't anticipated: the AppRole/PYTHONPATH paths inside `env` (plain
+  `sed`, no secret values touched or viewed — the classifier correctly
+  blocked a direct `cat` of that file, so all edits were blind, precise
+  substring substitutions), and `~/.ssh/config`'s `Host
+  forgejo-agent-harness` `IdentityFile`, which still pointed at the old
+  secrets path (alias name itself left unchanged — it's just a label,
+  and rein-aharness's own code references it by that exact name).
+- `make deploy-rsync` to the renamed checkout path (old one was 8 days
+  stale, fresh sync instead of `mv`).
+- Rebuilt the host venv at the new path from scratch — a venv's shebang
+  lines embed absolute paths, so renaming the directory alone breaks
+  `pip`/the entry point; recreated with `python3 -m venv` +
+  `pip install -e ~/rein-aharness -e ~/llm-connect`.
+- `make image-export` → scp → `k3s ctr images import`, `kubectl apply -k`
+  the renamed manifests (new `rein-aharness` namespace stood up
+  alongside the old one, not overwriting it).
+- Verified before touching anything old: `kubectl rollout status`
+  succeeded, the in-cluster smoke Job completed, and the **authoritative
+  host smoke script** passed fully (`ok: true, committed: true,
+  pushed: true`, real commit to `executor-sandbox`, `harness_smoke`
+  event confirmed in State Hub).
+- Only then, with the operator's go-ahead: deleted the old
+  `agent-harness` k8s namespace and removed the stale `~/agent-harness`
+  checkout. No trace of the old name left on the host.
 
 ```task
 id: HARNESS-WP-0002-T02
-status: progress
+status: done
 priority: medium
 state_hub_task_id: "7c5d23cd-d7fd-4c79-8847-448b83feb673"
 ```