feat(workplan): close CUST-WP-0067-T08 — central MCP deployed and verified

state-hub-mcp serves SSE on ClusterIP 10.43.110.80:8001, verified from the node
rather than through a tunnel, and reads central's data end-to-end (79 repos).
Remote port map and dev-hub registration repointed off the reverse tunnel.

state-hub-mcp-railiance01 is now safe to remove. state-hub-railiance01 is not:
~120 AGENTS.md files still depend on it until T07.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docs/recovery/tunnels-yaml-proposed-changes-CUST-WP-0067.md

@@ -24,15 +24,16 @@ health check that can be satisfied by a different process is not a health check.
 Prefer probing through the tunnel's own bind address once instance identity
 lands (T03).
 
-## 2. `state-hub-mcp-railiance01` — probes the wrong port
+## 2. `state-hub-mcp-railiance01` — retire (was: probes the wrong port)
 
-Forwards `:8001`, probes `:8000`:
+Superseded 2026-08-24. An MCP server now runs on central
+(`state-hub-mcp`, ClusterIP `10.43.110.80:8001`, CUST-WP-0067-T08), so this
+tunnel has nothing left depending on it — the documented `dev-hub` registration
+has been repointed at the ClusterIP. **Remove the entry** rather than fixing its
+health check, which probed `:8000` while forwarding `:8001`.
 
 ```yaml
-  state-hub-mcp-railiance01:
-    health_check:
--     url: http://127.0.0.1:8000/state/health
-+     url: http://127.0.0.1:8001/state/health
+-  state-hub-mcp-railiance01:  # -R 18001 -> workstation:8001
 ```
 
 ## 3. Reverse relay tunnels — retire
@@ -48,11 +49,14 @@ railiance01, so an agent there currently routes
 `localhost:18000 -> workstation:8000 -> jump host -> 10.43.68.154:8000` to reach
 a service on its own machine.
 
-**Before removing**, repoint remote agents. On railiance01 the primary is
-reachable in-cluster with no tunnel at all — this is where "abandon tunneling"
-genuinely applies. The global agent instructions' remote port map
-(`State Hub API http://127.0.0.1:18000`) must be updated in the same change, or
-remote sessions will silently lose the hub.
+Status 2026-08-24:
 
-Sequencing: repoint remote agents and update the port map first, then remove
-these two entries. Removing them first breaks every remote session.
+- `state-hub-mcp-railiance01` — **safe to remove now.** Central MCP is serving
+  and the global port map points at it.
+- `state-hub-railiance01` — **not yet.** The global instructions are repointed,
+  but roughly 120 `AGENTS.md` files across both machines still tell agents to
+  use `127.0.0.1:18000`. Removing it before `CUST-WP-0067-T07` repoints those
+  breaks any session that follows its own repo's instructions.
+
+On railiance01 both services are reachable in-cluster with no tunnel at all —
+this is where "abandon tunneling" genuinely applies.

workplans/CUST-WP-0067-hub-authority-target-resolution.md

@@ -299,7 +299,7 @@ the rendered guidance matches the live topology.
 
 ```task
 id: CUST-WP-0067-T08
-status: todo
+status: done
 priority: medium
 state_hub_task_id: "b17505c0-ea13-5ee2-87ca-8c06607f3b5b"
 ```
@@ -387,5 +387,15 @@ ssh tegwick@92.205.62.239 'curl -sI http://<mcp-clusterip>:8001/sse'
 kubectl -n state-hub get pods -l app.kubernetes.io/component=mcp
 ```
 
-Only once that serves may `state-hub-mcp-railiance01` be removed and the remote
-`dev-hub` registration repointed.
+**Done (2026-08-24):** deployed and verified. `state-hub-mcp` is Running,
+serving SSE on ClusterIP `10.43.110.80:8001` — confirmed from the node itself
+rather than through a tunnel: HTTP 200, `text/event-stream`, and a real MCP
+endpoint handshake, not merely an open port. End-to-end the pod reaches the
+in-cluster API (`API_BASE=http://state-hub:8000`) and reads central's data, 79
+repositories rather than the retired cache's 122.
+
+The global agent instructions now point remote `dev-hub` at that ClusterIP, and
+the remote port map lists no tunnel for either service.
+
+`state-hub-mcp-railiance01` is now unblocked for removal — the last thing
+depending on it is the documented registration, which has been repointed.