coulomb/the-custodian
4
0
Fork 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity Actions

feat(workplan): close CUST-WP-0067-T08 — central MCP deployed and verified
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
state-hub-mcp serves SSE on ClusterIP 10.43.110.80:8001, verified from the node
rather than through a tunnel, and reads central's data end-to-end (79 repos).
Remote port map and dev-hub registration repointed off the reverse tunnel.

state-hub-mcp-railiance01 is now safe to remove. state-hub-railiance01 is not:
~120 AGENTS.md files still depend on it until T07.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
codex 2026-08-24 23:20:11 +02:00
parent def3b0e802
commit 2755e8c91f
2 changed files with 30 additions and 16 deletions
Download patch file Download diff file Expand all files Collapse all files

30
docs/recovery/tunnels-yaml-proposed-changes-CUST-WP-0067.md
View file

@ -24,15 +24,16 @@ health check that can be satisfied by a different process is not a health check.
Prefer probing through the tunnel's own bind address once instance identity
lands (T03).
## 2. `state-hub-mcp-railiance01` — probes the wrong port
## 2. `state-hub-mcp-railiance01` — retire (was: probes the wrong port)
Forwards `:8001`, probes `:8000`:
Superseded 2026-08-24. An MCP server now runs on central
(`state-hub-mcp`, ClusterIP `10.43.110.80:8001`, CUST-WP-0067-T08), so this
tunnel has nothing left depending on it — the documented `dev-hub` registration
has been repointed at the ClusterIP. **Remove the entry** rather than fixing its
health check, which probed `:8000` while forwarding `:8001`.
```yaml
state-hub-mcp-railiance01:
health_check:
- url: http://127.0.0.1:8000/state/health
+ url: http://127.0.0.1:8001/state/health
- state-hub-mcp-railiance01: # -R 18001 -> workstation:8001
```
## 3. Reverse relay tunnels — retire
@ -48,11 +49,14 @@ railiance01, so an agent there currently routes
`localhost:18000 -> workstation:8000 -> jump host -> 10.43.68.154:8000` to reach
a service on its own machine.
**Before removing**, repoint remote agents. On railiance01 the primary is
reachable in-cluster with no tunnel at all — this is where "abandon tunneling"
genuinely applies. The global agent instructions' remote port map
(`State Hub API http://127.0.0.1:18000`) must be updated in the same change, or
remote sessions will silently lose the hub.
Status 2026-08-24:
Sequencing: repoint remote agents and update the port map first, then remove
these two entries. Removing them first breaks every remote session.
- `state-hub-mcp-railiance01` — **safe to remove now.** Central MCP is serving
and the global port map points at it.
- `state-hub-railiance01` — **not yet.** The global instructions are repointed,
but roughly 120 `AGENTS.md` files across both machines still tell agents to
use `127.0.0.1:18000`. Removing it before `CUST-WP-0067-T07` repoints those
breaks any session that follows its own repo's instructions.
On railiance01 both services are reachable in-cluster with no tunnel at all —
this is where "abandon tunneling" genuinely applies.