--- id: OPS-WP-0002 type: workplan title: "Bootstrap ops-hub as an Inter-Hub Operations extension" domain: infotech repo: ops-hub status: archived owner: codex topic_slug: inter_hub created: "2026-06-06" updated: "2026-07-07" state_hub_workstream_id: "bea9126c-2f58-41d4-90d1-af4d096f4a10" --- # Bootstrap ops-hub as an Inter-Hub Operations extension ## Goal Turn the HelixForge `HF-WP-0001` handoff into the first concrete `ops-hub` implementation track. `ops-hub` should become the Operations / System 1 Inter-Hub extension for operational truth: environments, hosts, clusters, services, endpoints, releases, backups, incidents, risks, runbooks, readiness gates, and migration waves. This repo owns domain-specific implementation assets. `inter-hub` remains the generic framework, registry, authentication, manifest, widget, event, and bootstrap API substrate. ## Current Gate As of 2026-07-07, production Inter-Hub exposes the bootstrap API surface at `https://hub.coulomb.social`. Run `make interhub-gate` to verify the current gate before bootstrap. Do not run manual database seeding unless the operator explicitly chooses that fallback. The preferred bootstrap path is the supported Inter-Hub API. Gate criteria: - Unauthenticated `GET /api/v2/hubs` returns `200` (public discovery) or `401` (auth-gated listing), not `404`. - OpenAPI lists `/hubs`, `/hub-capability-manifests`, `/api-consumers`, and `/policy-scopes`. - The bootstrap/smoke client can create or reuse the `ops-hub` hub, activate its manifest, create the runtime API consumer/key, seed initial widgets, and persist the first governed ops event. ## Handoff Sources - `/home/worsch/helix-forge/workplans/HF-WP-0001-establish-ops-hub-first-extension.md` - `/home/worsch/helix-forge/wiki/OpsHubInventory.md` - `/home/worsch/helix-forge/wiki/OpsHubReadinessGates.md` - `/home/worsch/helix-forge/wiki/OpsHubBootstrapRunbook.md` - `/home/worsch/helix-forge/wiki/ops-hub-manifest.draft.json` - `/home/worsch/helix-forge/wiki/ops-hub-widgets.seed.json` ## Port HelixForge Handoff Artifacts ```task id: OPS-WP-0002-T01 status: done priority: high state_hub_task_id: "7cd1eddb-f508-493b-89b1-6d8575bfd3df" ``` Create repo-local docs and seed data for the ops vocabulary, initial inventory, readiness gates, bootstrap runbook, manifest draft, and widget seed. Done when the `ops-hub` repo can be understood without opening HelixForge for routine implementation details. Keep links back to HelixForge for architectural context. Completed 2026-06-06: - Ported initial inventory to `docs/initial-inventory.md`. - Ported readiness gates to `docs/readiness-gates.md`. - Ported bootstrap runbook to `docs/bootstrap-runbook.md`. - Ported manifest and widget seeds to `seeds/`. - Added `docs/README.md` as the handoff index. ## Define Repository Source Layout ```task id: OPS-WP-0002-T02 status: done priority: high state_hub_task_id: "27d45a1d-813d-482f-8017-3884be4b509e" ``` Choose and create the first source layout for bootstrap/smoke tooling, collectors, adapters, and tests. Add the repo-native lint, test, build, and run commands to `AGENTS.md`. Done when future code changes have an obvious home and a verification command. Completed 2026-06-06: - Added `pyproject.toml`. - Added Python package layout under `src/ops_hub/`. - Added operator scripts under `scripts/`. - Added tests under `tests/`. - Documented current verification commands in `AGENTS.md`. ## Implement Inter-Hub Production Gate Probe ```task id: OPS-WP-0002-T03 status: done priority: high state_hub_task_id: "3ef0493c-6652-4dd2-a794-5e309c6cef88" ``` Build a small probe that checks the public Inter-Hub bootstrap API gate: - `/api/v2/hubs` response is `200` or `401` unauthenticated. - OpenAPI lists the required bootstrap paths. - The result is machine-readable and suitable for a scheduled ops signal later. Done when the probe can run locally without secrets and reports the current gate as pass/fail with clear reasons. Completed 2026-06-06: `scripts/interhub-gate-probe.py` checks unauthenticated `/api/v2/hubs` status and required OpenAPI bootstrap paths, emits JSON, and exits nonzero while the gate is closed. Updated 2026-07-07 to accept public hub discovery (`200`) as well as auth-gated listing (`401`). ## Implement Bootstrap Smoke Client ```task id: OPS-WP-0002-T04 status: done priority: high state_hub_task_id: "1a8fa43a-d524-4852-94dc-2606098002dc" ``` Implement the authenticated bootstrap/smoke client once Inter-Hub production exposes the supported bootstrap API. The client should use `IHUB_BASE` and `IHUB_OPERATOR_KEY` and should create or reuse: - `ops-hub` hub row - active capability manifest - runtime API consumer/key - initial governed ops widgets - first `ops-endpoint-verified` event Done when a dry-run and an attended real run both produce repeatable evidence without direct DB access. Completed 2026-07-07: - Extracted bootstrap logic to `src/ops_hub/bootstrap.py`. - `scripts/ops-hub-bootstrap-api.py` supports `--dry-run` and `--skip-event`. - Public hub discovery is attempted before authenticated listing. - `make interhub-bootstrap-dry-run` and `make test` verify the client locally. - Attended production run: `make interhub-bootstrap IHUB_OPERATOR_KEY_FILE=...` ## Seed First Operational Signal ```task id: OPS-WP-0002-T05 status: done priority: medium state_hub_task_id: "b7d09ecd-0899-470d-aea5-6e2f07caae96" ``` Submit the first governed ops signal for the Gitea registry endpoint once the manifest, widget, event type, and API key exist. Initial signal: ```json { "eventType": "ops-endpoint-verified", "endpoint": "https://gitea.coulomb.social/v2/", "expectedStatus": 401, "viewContext": "railiance-apps/workplans/RAIL-AP-WP-0001" } ``` Done when the event is visible in Inter-Hub and traceable to the owning Railiance workplan. Completed 2026-07-07 via `warden access --exec` with `platform-admin` OpenBao token: - Hub `ops-hub` (`4f6e4cf7-6a96-4ff2-8a37-08c9f9e405d2`) reused. - Active manifest `00aaf90a-8e76-4b0e-892d-33b162862f38` reused. - Event `3c894714-1b90-4cfa-9ce1-340704bd6526` (`ops-endpoint-verified`) on widget `8c768282-aca6-466b-9c62-c6fc8f2d5624`. - Runtime key prefix `ch_HfXNc138N` stored at `platform/operators/ops-hub/runtime` (`OPS_HUB_KEY`).