From def3b0e802946f52c8b785131f7e9dcb20c509b7 Mon Sep 17 00:00:00 2001 From: codex Date: Mon, 24 Aug 2026 23:10:20 +0200 Subject: [PATCH] chore(workplan): record CUST-WP-0067-T08 release build and remaining operator steps Co-Authored-By: Claude Opus 5 --- ...WP-0067-hub-authority-target-resolution.md | 44 +++++++++++++++++-- 1 file changed, 41 insertions(+), 3 deletions(-) diff --git a/workplans/CUST-WP-0067-hub-authority-target-resolution.md b/workplans/CUST-WP-0067-hub-authority-target-resolution.md index 78eafb5..7cce2a8 100644 --- a/workplans/CUST-WP-0067-hub-authority-target-resolution.md +++ b/workplans/CUST-WP-0067-hub-authority-target-resolution.md @@ -348,6 +348,44 @@ is: merge, let CI build `main-`, then bump the tag *and* flip commit, then `helm upgrade`. The values file is deliberately left at `enabled: false` so an unrelated `helm upgrade` cannot ship a broken MCP. -Noticed in passing, not part of this task: that values file pins -`main-697dd49` while the cluster runs `main-76e6eda`. Declared and running -state disagree, which deserves its own look. +**Release built (2026-08-24).** Pushing revealed why the image would not have +rebuilt: the CI path filter matched `api/**` while the Dockerfile copies nine +more paths, so changes to `mcp_server/` — and to `migrations/`, which is the +serious one, since a schema migration would not have shipped — merged to main +without producing an image. Filter corrected to match the Dockerfile +(`8221216`); run #284 succeeded and `main-8221216` pulls on the node. + +The production values file also drifted: it pinned `main-697dd49` while the +cluster ran `main-76e6eda`, and it omitted `sweep.hostname`, which the live +release carries — so deploying from that file alone would have silently dropped +it. Both corrected; `helm template` from the file now renders byte-identical +output to the intended release. + +**Remaining, both blocked on operator permission:** + +1. Commit and push `deploy/railiance/apps/helm/state-hub-values.yaml` (tag bump + plus `mcp.enabled: true`). The edit is on disk, uncommitted — the permission + classifier declined the commit twice. +2. `helm upgrade` — also declined. Dry run is clean and adds only the + `state-hub-mcp` Deployment and ClusterIP Service: + +```bash +cd ~/state-hub +helm upgrade state-hub ./deploy/railiance/apps/charts/state-hub \ + -n state-hub -f deploy/railiance/apps/helm/state-hub-values.yaml \ + --wait --timeout 4m +``` + +Node headroom was checked first: CPU requests sit at 92% of ~4000m, leaving +~320m. The MCP pod requests 50m, which keeps enough for the API's `maxSurge=1` +roll. + +After the upgrade, verify from the node rather than through a tunnel: + +```bash +ssh tegwick@92.205.62.239 'curl -sI http://:8001/sse' +kubectl -n state-hub get pods -l app.kubernetes.io/component=mcp +``` + +Only once that serves may `state-hub-mcp-railiance01` be removed and the remote +`dev-hub` registration repointed.