From 2755e8c91f16f445628705f387e942f08198413b Mon Sep 17 00:00:00 2001 From: codex Date: Mon, 24 Aug 2026 23:20:11 +0200 Subject: [PATCH] =?UTF-8?q?feat(workplan):=20close=20CUST-WP-0067-T08=20?= =?UTF-8?q?=E2=80=94=20central=20MCP=20deployed=20and=20verified?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit state-hub-mcp serves SSE on ClusterIP 10.43.110.80:8001, verified from the node rather than through a tunnel, and reads central's data end-to-end (79 repos). Remote port map and dev-hub registration repointed off the reverse tunnel. state-hub-mcp-railiance01 is now safe to remove. state-hub-railiance01 is not: ~120 AGENTS.md files still depend on it until T07. Co-Authored-By: Claude Opus 5 --- ...nels-yaml-proposed-changes-CUST-WP-0067.md | 30 +++++++++++-------- ...WP-0067-hub-authority-target-resolution.md | 16 ++++++++-- 2 files changed, 30 insertions(+), 16 deletions(-) diff --git a/docs/recovery/tunnels-yaml-proposed-changes-CUST-WP-0067.md b/docs/recovery/tunnels-yaml-proposed-changes-CUST-WP-0067.md index b7b3049..cbec133 100644 --- a/docs/recovery/tunnels-yaml-proposed-changes-CUST-WP-0067.md +++ b/docs/recovery/tunnels-yaml-proposed-changes-CUST-WP-0067.md @@ -24,15 +24,16 @@ health check that can be satisfied by a different process is not a health check. Prefer probing through the tunnel's own bind address once instance identity lands (T03). -## 2. `state-hub-mcp-railiance01` — probes the wrong port +## 2. `state-hub-mcp-railiance01` — retire (was: probes the wrong port) -Forwards `:8001`, probes `:8000`: +Superseded 2026-08-24. An MCP server now runs on central +(`state-hub-mcp`, ClusterIP `10.43.110.80:8001`, CUST-WP-0067-T08), so this +tunnel has nothing left depending on it — the documented `dev-hub` registration +has been repointed at the ClusterIP. **Remove the entry** rather than fixing its +health check, which probed `:8000` while forwarding `:8001`. ```yaml - state-hub-mcp-railiance01: - health_check: -- url: http://127.0.0.1:8000/state/health -+ url: http://127.0.0.1:8001/state/health +- state-hub-mcp-railiance01: # -R 18001 -> workstation:8001 ``` ## 3. Reverse relay tunnels — retire @@ -48,11 +49,14 @@ railiance01, so an agent there currently routes `localhost:18000 -> workstation:8000 -> jump host -> 10.43.68.154:8000` to reach a service on its own machine. -**Before removing**, repoint remote agents. On railiance01 the primary is -reachable in-cluster with no tunnel at all — this is where "abandon tunneling" -genuinely applies. The global agent instructions' remote port map -(`State Hub API http://127.0.0.1:18000`) must be updated in the same change, or -remote sessions will silently lose the hub. +Status 2026-08-24: -Sequencing: repoint remote agents and update the port map first, then remove -these two entries. Removing them first breaks every remote session. +- `state-hub-mcp-railiance01` — **safe to remove now.** Central MCP is serving + and the global port map points at it. +- `state-hub-railiance01` — **not yet.** The global instructions are repointed, + but roughly 120 `AGENTS.md` files across both machines still tell agents to + use `127.0.0.1:18000`. Removing it before `CUST-WP-0067-T07` repoints those + breaks any session that follows its own repo's instructions. + +On railiance01 both services are reachable in-cluster with no tunnel at all — +this is where "abandon tunneling" genuinely applies. diff --git a/workplans/CUST-WP-0067-hub-authority-target-resolution.md b/workplans/CUST-WP-0067-hub-authority-target-resolution.md index 7cce2a8..f554ede 100644 --- a/workplans/CUST-WP-0067-hub-authority-target-resolution.md +++ b/workplans/CUST-WP-0067-hub-authority-target-resolution.md @@ -299,7 +299,7 @@ the rendered guidance matches the live topology. ```task id: CUST-WP-0067-T08 -status: todo +status: done priority: medium state_hub_task_id: "b17505c0-ea13-5ee2-87ca-8c06607f3b5b" ``` @@ -387,5 +387,15 @@ ssh tegwick@92.205.62.239 'curl -sI http://:8001/sse' kubectl -n state-hub get pods -l app.kubernetes.io/component=mcp ``` -Only once that serves may `state-hub-mcp-railiance01` be removed and the remote -`dev-hub` registration repointed. +**Done (2026-08-24):** deployed and verified. `state-hub-mcp` is Running, +serving SSE on ClusterIP `10.43.110.80:8001` — confirmed from the node itself +rather than through a tunnel: HTTP 200, `text/event-stream`, and a real MCP +endpoint handshake, not merely an open port. End-to-end the pod reaches the +in-cluster API (`API_BASE=http://state-hub:8000`) and reads central's data, 79 +repositories rather than the retired cache's 122. + +The global agent instructions now point remote `dev-hub` at that ClusterIP, and +the remote port map lists no tunnel for either service. + +`state-hub-mcp-railiance01` is now unblocked for removal — the last thing +depending on it is the documented registration, which has been repointed.