ops-hub/workplans/archived/260707-OPS-WP-0002-interhub-extension-bootstrap.md

id, type, title, domain, repo, status, owner, topic_slug, created, updated, state_hub_workstream_id

id	type	title	domain	repo	status	owner	topic_slug	created	updated	state_hub_workstream_id
OPS-WP-0002	workplan	Bootstrap ops-hub as an Inter-Hub Operations extension	infotech	ops-hub	archived	codex	inter_hub	2026-06-06	2026-07-07	bea9126c-2f58-41d4-90d1-af4d096f4a10

Bootstrap ops-hub as an Inter-Hub Operations extension

Goal

Turn the HelixForge HF-WP-0001 handoff into the first concrete ops-hub implementation track.

ops-hub should become the Operations / System 1 Inter-Hub extension for operational truth: environments, hosts, clusters, services, endpoints, releases, backups, incidents, risks, runbooks, readiness gates, and migration waves.

This repo owns domain-specific implementation assets. inter-hub remains the generic framework, registry, authentication, manifest, widget, event, and bootstrap API substrate.

Current Gate

As of 2026-07-07, production Inter-Hub exposes the bootstrap API surface at https://hub.coulomb.social. Run make interhub-gate to verify the current gate before bootstrap.

Do not run manual database seeding unless the operator explicitly chooses that fallback. The preferred bootstrap path is the supported Inter-Hub API.

Gate criteria:

• Unauthenticated GET /api/v2/hubs returns 200 (public discovery) or 401 (auth-gated listing), not 404.
• OpenAPI lists /hubs, /hub-capability-manifests, /api-consumers, and /policy-scopes.
• The bootstrap/smoke client can create or reuse the ops-hub hub, activate its manifest, create the runtime API consumer/key, seed initial widgets, and persist the first governed ops event.

Handoff Sources

• /home/worsch/helix-forge/workplans/HF-WP-0001-establish-ops-hub-first-extension.md
• /home/worsch/helix-forge/wiki/OpsHubInventory.md
• /home/worsch/helix-forge/wiki/OpsHubReadinessGates.md
• /home/worsch/helix-forge/wiki/OpsHubBootstrapRunbook.md
• /home/worsch/helix-forge/wiki/ops-hub-manifest.draft.json
• /home/worsch/helix-forge/wiki/ops-hub-widgets.seed.json

Port HelixForge Handoff Artifacts

id: OPS-WP-0002-T01
status: done
priority: high
state_hub_task_id: "7cd1eddb-f508-493b-89b1-6d8575bfd3df"

Create repo-local docs and seed data for the ops vocabulary, initial inventory, readiness gates, bootstrap runbook, manifest draft, and widget seed.

Done when the ops-hub repo can be understood without opening HelixForge for routine implementation details. Keep links back to HelixForge for architectural context.

Completed 2026-06-06:

• Ported initial inventory to docs/initial-inventory.md.
• Ported readiness gates to docs/readiness-gates.md.
• Ported bootstrap runbook to docs/bootstrap-runbook.md.
• Ported manifest and widget seeds to seeds/.
• Added docs/README.md as the handoff index.

Define Repository Source Layout

id: OPS-WP-0002-T02
status: done
priority: high
state_hub_task_id: "27d45a1d-813d-482f-8017-3884be4b509e"

Choose and create the first source layout for bootstrap/smoke tooling, collectors, adapters, and tests. Add the repo-native lint, test, build, and run commands to AGENTS.md.

Done when future code changes have an obvious home and a verification command.

Completed 2026-06-06:

• Added pyproject.toml.
• Added Python package layout under src/ops_hub/.
• Added operator scripts under scripts/.
• Added tests under tests/.
• Documented current verification commands in AGENTS.md.

Implement Inter-Hub Production Gate Probe

id: OPS-WP-0002-T03
status: done
priority: high
state_hub_task_id: "3ef0493c-6652-4dd2-a794-5e309c6cef88"

Build a small probe that checks the public Inter-Hub bootstrap API gate:

• /api/v2/hubs response is 200 or 401 unauthenticated.
• OpenAPI lists the required bootstrap paths.
• The result is machine-readable and suitable for a scheduled ops signal later.

Done when the probe can run locally without secrets and reports the current gate as pass/fail with clear reasons.

Completed 2026-06-06: scripts/interhub-gate-probe.py checks unauthenticated /api/v2/hubs status and required OpenAPI bootstrap paths, emits JSON, and exits nonzero while the gate is closed. Updated 2026-07-07 to accept public hub discovery (200) as well as auth-gated listing (401).

Implement Bootstrap Smoke Client

id: OPS-WP-0002-T04
status: done
priority: high
state_hub_task_id: "1a8fa43a-d524-4852-94dc-2606098002dc"

Implement the authenticated bootstrap/smoke client once Inter-Hub production exposes the supported bootstrap API.

The client should use IHUB_BASE and IHUB_OPERATOR_KEY and should create or reuse:

• ops-hub hub row
• active capability manifest
• runtime API consumer/key
• initial governed ops widgets
• first ops-endpoint-verified event

Done when a dry-run and an attended real run both produce repeatable evidence without direct DB access.

Completed 2026-07-07:

• Extracted bootstrap logic to src/ops_hub/bootstrap.py.
• scripts/ops-hub-bootstrap-api.py supports --dry-run and --skip-event.
• Public hub discovery is attempted before authenticated listing.
• make interhub-bootstrap-dry-run and make test verify the client locally.
• Attended production run: make interhub-bootstrap IHUB_OPERATOR_KEY_FILE=...

Seed First Operational Signal

id: OPS-WP-0002-T05
status: done
priority: medium
state_hub_task_id: "b7d09ecd-0899-470d-aea5-6e2f07caae96"

Submit the first governed ops signal for the Gitea registry endpoint once the manifest, widget, event type, and API key exist.

Initial signal:

{
  "eventType": "ops-endpoint-verified",
  "endpoint": "https://gitea.coulomb.social/v2/",
  "expectedStatus": 401,
  "viewContext": "railiance-apps/workplans/RAIL-AP-WP-0001"
}

Done when the event is visible in Inter-Hub and traceable to the owning Railiance workplan.

Completed 2026-07-07 via warden access --exec with platform-admin OpenBao token:

• Hub ops-hub (4f6e4cf7-6a96-4ff2-8a37-08c9f9e405d2) reused.
• Active manifest 00aaf90a-8e76-4b0e-892d-33b162862f38 reused.
• Event 3c894714-1b90-4cfa-9ce1-340704bd6526 (ops-endpoint-verified) on widget 8c768282-aca6-466b-9c62-c6fc8f2d5624.
• Runtime key prefix ch_HfXNc138N stored at platform/operators/ops-hub/runtime (OPS_HUB_KEY).