the-custodian/canon/standards/coulombcore-production-freeze_v0.1.md

---
id: canon-coulombcore-production-freeze
type: standard
title: "CoulombCore Production Freeze v0.1"
domain: custodian
status: active
version: "0.1"
created: "2026-07-03"
decided_by: custodian
tags: ["infrastructure", "coulombcore", "railiance01", "production", "freeze", "drain"]
related_workplans:
  - CUST-WP-0054
  - RAIL-HO-WP-0005
---

# CoulombCore Production Freeze v0.1

## Status

**Active from 2026-07-03.** CoulombCore (`92.205.130.254`) is frozen for new
production workloads.

## Context

Under the fleet role model (`CUST-WP-0054`, `docs/workstation-independence-fleet-architecture.md`):

| Machine | Role |
| --- | --- |
| **railiance01** | Production home — growing Railiance fleet |
| **coulombcore** | Legacy/experimental only; drain then phoenix to **railiance02** |
| **workstation** | Temporary dev environment |

Despite the role model, coulombcore still hosts production-critical workloads
(State Hub cluster primary, Core Hub, issue-core, Gitea, OpenBao, identity
stack, GitOps control plane). This freeze stops the problem from growing while
the drain sequence in `docs/coulombcore-drain-placement-plan.md` executes.

## Policy

### Frozen (blocked without exception)

No **new** production workloads may be introduced on coulombcore after
2026-07-03:

- New Helm releases, ArgoCD Applications, or CNPG clusters intended as
  long-lived production
- New public DNS names under `*.coulomb.social` for production services
- New credential lanes whose **primary** runtime home is coulombcore
- New CI/CD publish targets that make coulombcore the canonical registry or
  forge (canonical target is railiance01 Forgejo per `RAIL-HO-WP-0005`)
- New automation schedules that **require** coulombcore as the sole runtime
  host (activity-core production is already on railiance01)

### Grandfathered (existing production may run)

Workloads already in production on coulombcore before 2026-07-03 may continue
until their drain step completes. They are **not** newly promoted production —
they are legacy carry-over on a condemned host.

### Allowed on coulombcore during drain

| Category | Examples |
| --- | --- |
| Drain migrations | Staged-promotion overlays targeting railiance01; cutover drills in isolated namespaces |
| Read-only mirrors | Gitea read-only rollback mirror after Forgejo cutover |
| Short-lived probes | Disposable Forgejo/restore namespaces per `RAIL-HO-WP-0005` probe strategy |
| Experimental / non-prod | Staging profiles, smoke namespaces, operator-attended bootstrap |
| Fleet mesh transit | Forward tunnels from railiance01 to coulombcore cluster services until those services move (T02 interim) |

### Promotion gate

A workload counts as **production on railiance01** only after passing the
staged-promotion contract (`RAIL-BS-WP-0006`). Coulombcore deployments do not
satisfy this gate after 2026-07-03.

## Enforcement

1. **Workplan review** — new workplans proposing coulombcore production require
   an explicit exception row in the drain plan with rollback evidence.
2. **ArgoCD / GitOps** — new Applications with production intent must target
   `railiance01-k3s`, not `coulombcore-k3s`, unless tagged `drain-migration`
   or `experimental`.
3. **Agent instructions** — coding agents must not deploy new production
   services to coulombcore; route to railiance01 overlays or file an exception
   request via State Hub `needs_human`.
4. **Inventory drift** — `ops/service-inventory.yml` rows for coulombcore
   production services carry `lifecycle_state: draining` after their drain
   wave starts.

## Exceptions

Document each exception in `docs/coulombcore-drain-placement-plan.md` under
**Documented exceptions** with:

- workload id
- reason the drain sequence cannot absorb it yet
- target host and target date
- rollback method
- approving workplan or operator decision id

## Exit criteria (lift freeze)

The freeze lifts for coulombcore as a **host** when:

1. All drain waves in the placement plan reach `retired` or `migrated`
2. Identity + OpenBao (last wave) run on railiance01
3. `CUST-WP-0054-T09` phoenix begins — coulombcore is wiped and rebuilt as
   railiance02, not returned to production

After phoenix, the machine identity is **railiance02**; the coulombcore freeze
standard applies only to the historical drain period.

## Related documents

- Drain sequence: `docs/coulombcore-drain-placement-plan.md`
- Architecture: `docs/workstation-independence-fleet-architecture.md`
- Forgejo migration: `RAIL-HO-WP-0005` in `railiance-infra`
- Staged promotion: `RAIL-BS-WP-0006` (finished)