state-hub/docs/retirement-cutover-slice-plan.md

State Hub retirement — cutover slice plan

Execution owner: STATE-WP-0079-T04/T05 Re-baselined: 2026-09-05 Inventory: SHR-INV-0001, original 425-item inventory in prj-state-hub-retirement/inventory/. Counts below identify historical slices; current owner contracts take precedence over the original owner assignments.

This checklist replaces the obsolete August 19–20 readiness snapshot. That snapshot and the original off/dual/owner proposal remain in Git history. RM_SLICE_* names were proposed controls, not proof of deployed flags. Do not execute the old workstation dual-run instructions against the cluster service: ADR-002 forbids central services from mutating workstation checkouts.

Evidence required to switch a slice

For each route family, identify the current caller and destination endpoint, compare representative identities/content/counts in a read-only parity run, record the exact deployment/source revisions, exercise rollback, and retain the switch receipt. An owner workplan marked finished or an imported Python router proves neither deployed endpoint availability nor data migration. Production writer changes require a concrete recoverable cutover, within user authorization. No new permanent receiving authority belongs in State Hub during retirement.

Current route-family checklist

Slice / historical items	Receiver and contract evidence	Caller / route-switch evidence	Remaining gate and rollback
A1 registry / 27	Repo Manager observation/scaffolding; STATE-WP-0081 and 0086 establish forge-derived projection	rmgr sync verified pushed commit 74a3b22 on primary/railiance01 in the preceding session	Inventory remaining registry callers per endpoint. Keep current projection while proving the owner read; do not restore checkout mutation in central
A2 work records / 59	RMGR-WP-0008 implements file-backed workplan, intake, decision, dependency and task mutations; RMGR-WP-0005 identifiers finished	Repository files + rmgr sync are the current write convention. Two ad-hoc task-filter callers identified and guidance corrected in this review	Work-record caller inventory and per-kind writer receipts still required. Revert source commit and reconcile for a reviewed rollback; no second file authority
A3 registers / 49	RMGR-WP-0008 register spine; SBOM Nexus is the current SBOM product owner	Live State Hub config uses Nexus for both SBOM reads/writes. Direct Nexus licence and snapshot reads return 200. Two more compatibility interfaces retired in the meter September 5	Other registers need individual caller/parity receipts. Preserve SBOM history; remaining /sbom/ traffic and retained compatibility handlers prevent deleting the whole router
A4 work/repo UI / 22	hub-core projection + UI clients; RMGR-ADR-003 excludes a Repo Manager dashboard	No complete State Hub UI redirect receipt established	First prove backing reads; rollback redirects to the retained UI
A5 topic spine / 8	Published Repo Manager classification contract, accepted by HUB-WP-0004	No complete State Hub caller-switch receipt established	Prove deployed consumer contract and parity; retain source-backed classification projection
B1 catalogs / 34	HUB-WP-0004/0005 receiving architecture and /api/v2 absorption	Completion covers the Core Hub route groups, not every State Hub capability/registry route	Map each State Hub catalog to a deployed endpoint and migration receipt
B2 messaging/interface log / 22	Native /ports/messaging/messages uses a distinct envelope; new authenticated /ports/projections/statehub-inbox preserves bounded State Hub history	T08 complete: 20-row import, six parity cases, private transport and disable/re-enable proof; no production reader switched	T09 / HUB-WP-0011: freshness, caller credentials and aliases before one reader switch. Interface log and writer cutover remain separate
B3 telemetry / 32	Native /ports/events/progress exists; token/software catalogs need separate mappings	Literal /progress and /token-events absence does not imply no native receiving contract	Map native semantics and historical identity/count parity; writer exclusivity and rollback receipts remain necessary
B4 projection/policy / 20	HUB-WP-0004/0005; policy publication belongs to policy-nexus	State Hub still serves its projection routes; no full family receipt established	Map individual projections and policy publication; retain source/runtime boundaries and current reads
B5 hub UI / 17	Hub Core runtime/console exists	Core Hub absorption does not establish replacement of State Hub dashboard pages	Prove A4/B1–B4 data contracts before redirect; retain UI rollback
C1 execution / 13	ACTIVITY-WP-0029 finished; Activity Core owns scheduling/ops_run	STATE-WP-0079 records launch-request rejection (410), replacement semantics, and corrected unconsumed requests	Verify every remaining execution caller uses the owner contract. Do not revive the obsolete launch queue for rollback
C2 jobs / 5	ACTIVITY-WP-0029 finished; scheduler is Activity Core, reconciliation engine is Repo Manager	Receiving/sweep handoffs recorded in owner workplan	Attach remaining per-job deployment and caller receipts; keep scheduler ownership distinct from work-record authority
D1 service catalog / 11	OPS-WP-0003 finished; reviewed packages and /api/v2 conformance gate	Owner contract completion established; State Hub family-switch receipt still missing	Compare catalog identities and UI bindings; preserve current reads until switched
D2 Fabric / 10	railiance-fabric authority, FIN-WP-0003 consumer gate	August 31 dual-read import: 131 nodes/117 edges; green hash/count/provenance checks, rollback and roll-forward exercised	Hosted runtime/persistence/auth/freshness remains RAIL-FAB-WP-0028 (proposed). Keep retained import rollback; do not claim the local authority is a hosted production receiver
D3 kaizen / 2	the-custodian, original two-tool disposition	No fresh removal/delegation receipt collected in this review	Locate current tools/consumers and owner contract before removal
E1 suggestions / 17	Archived history in the-custodian	STATE-WP-0079 records eight read routes at 410, six MCP tools removed, dashboard removed	Completed surface removal; tables retained for final dump
E2 legacy workplans / 13	Preferred /workplans routes and workplan_id parameters	Workstream REST handlers return 410 and meter rejected calls. Task query alias still accepted	Seven legacy meter records remain after today's two SBOM retirements; observe volume-scaled quiet periods and complete T07 attribution
E3 UI feedback / 1	State Hub until cutover	Feedback still needed during transition	T06 zero-normal-traffic gate; do not confuse it with retired suggestions
E4 meter / 9	State Hub until all other retirement evidence complete	Eight retired / seven legacy interfaces, zero current candidates after September 5 action	Retire last, after the remaining interfaces and final evidence are closed

What today's probes establish

• Central health identifies primary/railiance01.
• The live State Hub configuration has SBOM_NEXUS_READ_MODE=nexus and SBOM_NEXUS_WRITE_MODE=nexus, using the cluster SBOM Nexus service.
• Direct Nexus /sbom/report/licences/ and /sbom/snapshots/ returned 200 from the State Hub pod. Their State Hub meter entries are now retired. This does not delete the compatibility handlers or historical data.
• The earlier literal-prefix probe missed existing native messaging, event and projection ports. The bounded inbox projection now has live parity evidence. Scoped NetworkPolicy admission resolved State Hub-to-candidate transport; unauthenticated requests from the source pod now reach the 401 boundary.
• Session trace identifies ad-hoc legacy task reads in fluid-telegram and ops-warden. Their corrected canonical queries return 200 with 8 and 5 tasks. No evidence identifies the other historical callers yet.

Evidence: docs/evidence/STATE-WP-0079-sbom-retirement-20260905.json and docs/evidence/STATE-WP-0079-caller-and-receiver-review-20260905.md.

Next executable work

1. T07: observe the remaining legacy readers with component attribution. The known caller repositories and bundled State Hub skill now prescribe canonical reads. Preserve the quiet clocks; do not exercise legacy URLs to test them.
2. T09 / HUB-WP-0011: establish monotonic freshness and stale-source behavior, caller-specific credentials and canonical/alias scope before one production inbox reader switch. T08's frozen snapshot parity and rollback are complete; see docs/evidence/statehub-inbox-pilot-20260905.md and JSON receipt.
3. RAIL-FAB-WP-0028-T01 remains the owner decision for runtime, persistent store, auth, backup/restore and deployment repository. Its T02–T04 deliver deployment, freshness and final direct-consumer receipts; no new Fabric authority here.
4. Re-evaluate eligible interfaces from a fresh seven-day meter capture. The quiet ladder is 7 days for 1–99 historical calls, 30 for 100–9,999, and 60 for 10,000+. A new call restarts the relevant clock, including rejected requests.

Freeze and infrastructure boundary

T06 remains blocked until move/replace families and legacy retirement complete, followed by a fresh zero-normal-read/write window. Final dump, restore proof, service stop and repository archive then form one separately reviewable operation. The original schema-history/keep items and nine infrastructure couplings (database, scheduler, connectivity) remain explicit final-window checks; they are not route flags. Ops Bridge connectivity survives retirement.