---
id: STATE-WP-0071
type: workplan
title: "Railiance01 workstream caller migration deploy"
domain: infotech
repo: state-hub
status: proposed
owner: codex
topic_slug: custodian
planning_priority: high
planning_order: 71
created: "2026-07-09"
updated: "2026-07-09"
---

# STATE-WP-0071 — Railiance01 workstream caller migration deploy

**Parent coordination:** `STATE-WP-0070` T01 (phase-2 legacy retirement — deploy
and meter attribution).

**Hub message:** ops-warden inbox `467153f3-30ee-44c0-b89c-7f99fdf9f005`
(2026-07-09).

**Runbook:** `docs/evidence/railiance01-state-hub-deploy-20260709.md`

## Goal

Deploy workstream→workplan caller migrations to production paths so legacy-meter
`GET /workstreams/*` traffic drops and usage is attributed to named components
(`state-hub.fix-consistency`, activity-core resolvers).

## Context

Two hosts participate; do not conflate them:

| Host | Role |
| --- | --- |
| **WSL workstation** | State Hub API + `consistency_check.py` execute here. The 15‑min sweep (`POST /consistency/sweep/remote-all`) runs this checkout when activity-core triggers via ops-bridge. |
| **railiance01** (`92.205.62.239`) | activity-core k8s runtime (triage, legacy-meter review, state_hub resolver). Code ships via **container image**, not host `git pull` alone. |

Evidence (2026-07-09): ~150k weekly legacy GET calls; railiance01 host checkout
was `050cbbc`; `git pull` failed with `.git/FETCH_HEAD` permission denied.

**Target commits (minimum):**

| Repo | Commit | Deliverable |
| --- | --- | --- |
| `state-hub` | `14b7d84` | `/workplans` callers, identity headers, workplan-index 410 |
| `activity-core` | `5a92923` | `/workplans` resolver, progress `workplan_id` only |

## Out of scope

- Retiring additional `/workstreams` routes (STATE-WP-0070 T02).
- MCP alias removal (STATE-WP-0070 T03).
- State Hub cluster image rebuild on railiance01 (in-cluster API is separate from
  workstation sweep path unless explicitly required).

## Task: WSL workstation baseline

```task
id: STATE-WP-0071-T01
status: todo
priority: high
```

On the operator WSL machine (State Hub home):

1. `bridge status` — `state-hub-railiance01` must be `connected`.
2. `cd ~/state-hub && git pull --ff-only origin main` — verify ≥ `14b7d84`.
3. `curl -fsS http://127.0.0.1:8000/state/health` — start API with `make api` if down.
4. Record `git log -1 --oneline` in progress evidence.

Done when workstation `state-hub` is at target commit and hub API is healthy.

## Task: ops-bridge tunnel health

```task
id: STATE-WP-0071-T02
status: todo
priority: high
```

Restore tunnel mesh required for railiance01 → workstation sweep:

1. `bridge status` — all production tunnels `connected` (especially
   `state-hub-railiance01`, `state-hub-mcp-railiance01`).
2. If stale/stopped: `bridge up state-hub-railiance01` then `bridge check state-hub-railiance01`.
3. From WSL: confirm activity-core bridge path reaches hub
   (`actcore-state-hub-bridge` pattern per `docs/consistency-sweep-runbook.md`).

Done when `state-hub-railiance01` is connected and hub health is reachable through
the bridge URL used by activity-core.

## Task: railiance01 git checkout repair and pull

```task
id: STATE-WP-0071-T03
status: todo
priority: high
```

SSH to railiance01 (`ssh railiance01` / `tegwick@92.205.62.239`):

1. Fix `.git` ownership if needed:
   `sudo chown -R "$(whoami):$(id -gn)" ~/state-hub/.git ~/activity-core/.git`
2. `cd ~/activity-core && git fetch origin main && git pull --ff-only origin main`
   — verify ≥ `5a92923`.
3. `cd ~/state-hub && git pull --ff-only origin main` — verify ≥ `14b7d84`
   (host checkout; used for operator scripts/docs).
4. Log both SHAs in progress evidence.

Done when both repos pull cleanly and meet minimum commits.

**Blocked path:** if permission fix fails, flag `needs_human` with exact error.

## Task: activity-core k8s image rollout (railiance01-prod)

```task
id: STATE-WP-0071-T04
status: todo
priority: high
```

Roll resolver/progress changes into the running cluster per
`activity-core/k8s/railiance/README.md`:

1. Build `activity-core:railiance01-prod` from `~/activity-core` at ≥ `5a92923`.
2. `docker save` + `scp` to railiance01 + `k3s ctr images import`.
3. `rsync` k8s manifests if changed; `kubectl apply -f k8s/railiance/20-runtime.yaml`.
4. Run `actcore-sync` job; restart `actcore-worker`, `actcore-api`,
   `actcore-event-router`.
5. `kubectl -n activity-core get pods` — all runtime pods ready.

Done when actcore-api health check passes and worker pods run the new image digest.

## Task: Consistency sweep canary and legacy-meter capture

```task
id: STATE-WP-0071-T05
status: todo
priority: high
```

Verify end-to-end caller migration:

1. From WSL, trigger one sweep:
   `curl -s -X POST http://127.0.0.1:8000/consistency/sweep/remote-all \
     -H "Content-Type: application/json" -d '{"max_seconds": 300}'`
2. Confirm progress event `consistency_sweep_remote_all` with `exit_code: 0` and
   no `automation_error`.
3. Capture evidence:
   `python ~/state-hub/scripts/capture_legacy_meter_evidence.py --days 7`
   → `docs/evidence/legacy-meter-weekly-review-YYYYMMDD.json`
4. Success signals:
   - `state-hub.fix-consistency` appears in component buckets (not only `unknown`).
   - `GET /workstreams/*` 7-day window counts trend down vs 2026-07-08 baseline.

Done when evidence file is committed and shows attribution + declining legacy REST.

## Task: Closeout — update parent workplan and ops message

```task
id: STATE-WP-0071-T06
status: todo
priority: medium
```

1. Mark STATE-WP-0070 T01 `done` if success criteria met.
2. Reply on ops-warden thread `467153f3-30ee-44c0-b89c-7f99fdf9f005` with deploy
   result (SHAs, sweep outcome, meter snapshot path).
3. Update `docs/evidence/railiance01-state-hub-deploy-20260709.md` checklist.
4. Log hub progress milestone; move this workplan to `finished`.

Done when STATE-WP-0071 is `finished` and STATE-WP-0070 T01 reflects deploy complete.

## Sequencing

```
T01 WSL baseline ──┐
T02 bridge health ─┼──► T03 railiance01 git ──► T04 k8s rollout ──► T05 meter capture ──► T06 closeout
```

T01 and T02 can run in parallel. T04 depends on T03. T05 depends on T04 and T01.

## Acceptance criteria

- Workstation and railiance01 checkouts at target commits.
- activity-core k8s runtime healthy on railiance01.
- Legacy-meter 7-day capture shows `state-hub.fix-consistency` attribution.
- `GET /workstreams/*` weekly counts materially below 2026-07-08 baseline (exact
  threshold: operator judges ≥50% drop on top three GET keys, or zero after one
  full week post-deploy).

## Automatic implementation notes (Ralph / agent)

- Use `warden sign` / SSH cert if raw `ssh railiance01` fails; do not request
  secrets via State Hub messages.
- Prefer `bridge` MCP or CLI for tunnel ops.
- Human gate: `sudo chown` on railiance01 if non-interactive SSH cannot elevate.
- Do not retire additional legacy routes in this workplan (STATE-WP-0070 T02).
- After workplan file is approved, run `statehub fix-consistency --repo state-hub`
  to register tasks in the hub DB.