docs(CUST-WP-0054): record Phase 1 empty stack evidence on railiance01

Phase 1 deploy complete: CNPG state-hub-db, Alembic at head, empty hub
healthy on ClusterIP 10.43.68.154. Documents gitea image workaround and
Forgejo rebuild prerequisite before Phase 2.

docs/state-hub-railiance01-cutover-phase1-2026-07-06.md

@@ -0,0 +1,90 @@
+# T05 Phase 1 Evidence — Empty Stack on railiance01 (2026-07-06)
+
+Workplan: `CUST-WP-0054-T05`  
+Parent runbook: `docs/state-hub-railiance01-cutover-plan.md`  
+`no_secret_material_recorded: true`
+
+## Checklist
+
+| Step | Action | Result | Evidence |
+| --- | --- | --- | --- |
+| 1.1 | Create `state-hub` namespace | **pass** | `kubectl get ns state-hub` |
+| 1.2 | Deploy `state-hub-db` CNPG | **pass** | Cluster `databases/state-hub-db` healthy, 1 instance |
+| 1.3 | Apply DB NetworkPolicies | **pass** | Applied from `deploy/railiance/platform/` |
+| 1.4 | Create `state-hub-env` Secret | **pass** | `DATABASE_URL` → `state-hub-db-rw.databases.svc.cluster.local` |
+| 1.5 | Helm image pin (Forgejo target) | **deferred** | Values updated; deploy uses gitea workaround (see § Image) |
+| 1.6 | Alembic init Job | **pass** | `state-hub-alembic-init` Completed; head `f0a1b2c3d4e5` |
+| 1.7 | Helm install + `/state/health` | **pass** | Pod Running; health `ok`, db `connected` |
+
+**Phase 1 status: complete** (empty hub healthy; no production data). Phase 2 blocked on operator approval (Phase 0.6).
+
+## Deployed resources (railiance01-k3s)
+
+| Resource | Namespace | Status |
+| --- | --- | --- |
+| Secret `state-hub-db-credentials` | `databases` | present |
+| CNPG Cluster `state-hub-db` | `databases` | healthy |
+| Secret `state-hub-env` | `state-hub` | present |
+| Helm release `state-hub` (rev 2) | `state-hub` | deployed |
+| Job `state-hub-alembic-init` | `state-hub` | Completed |
+| Deployment `state-hub` | `state-hub` | Running 1/1 |
+| Service `state-hub` | `state-hub` | ClusterIP `10.43.68.154:8000` |
+
+Kubeconfig: `KUBECONFIG=~/.kube/config-hosteurope` (workstation WSL).
+
+## API verification (port-forward `18080:8000`)
+
+```bash
+curl -s http://127.0.0.1:18080/state/health
+# {"status":"ok","db":"connected"}
+
+curl -s http://127.0.0.1:18080/state/summary
+# totals: topics=0, workstreams=0, tasks=0, decisions=0
+```
+
+Captured: 2026-07-06T16:24:19Z.
+
+## Database verification (empty schema)
+
+Alembic at head `f0a1b2c3d4e5`. Baseline gate tables — all **zero rows**:
+
+| Table | Count |
+| --- | ---: |
+| `workplans` | 0 |
+| `tasks` | 0 |
+| `topics` | 0 |
+| `progress_events` | 0 |
+| `token_events` | 0 |
+| `managed_repos` | 0 |
+| `decisions` | 0 |
+
+Queried via `kubectl exec` on `databases/state-hub-db-1` as `postgres`.
+
+Post-Phase-2 restore must match coulombcore preflight counts exactly (see
+`docs/state-hub-railiance01-cutover-preflight-2026-07-06.md`).
+
+## Image workaround
+
+| Image | Status | Notes |
+| --- | --- | --- |
+| `forgejo.coulomb.social/coulomb/state-hub:main-f9f0091` | **broken** | Empty `/tmp/requirements.txt`; `ModuleNotFoundError: asyncpg` |
+| `gitea.coulomb.social/coulomb/state-hub:f2e042a` | **deployed** | Helm `--set image.*` override; matches coulombcore production pin |
+
+Helm values file targets Forgejo (`main-f9f0091`) for post-fix cutover. Rebuild
+Forgejo image before Phase 2 so production and CI share one registry.
+
+**Root cause (suspected):** CI DinD build completed without failing on empty
+requirements install; investigate `Dockerfile.ci` generation and add build-time
+`import asyncpg` gate in workflow.
+
+## Phase 2 prerequisites
+
+- [ ] Operator approval for freeze/final restore (Phase 0.6)
+- [ ] Fix and republish Forgejo `state-hub` image with working venv
+- [ ] Fresh `pg_dump` from coulombcore per CUST-WP-0011-T07 playbook
+
+## References
+
+- `state-hub/deploy/railiance/apps/helm/state-hub-values.yaml` — Forgejo image pin
+- `docs/state-hub-railiance01-cutover-plan.md` — Phase 2–5 sequence
+- ClusterIP `10.43.68.154` — capture for Phase 3 tunnel rewire

workplans/CUST-WP-0054-workstation-independence-and-fleet-realignment.md

@@ -214,15 +214,16 @@ so file writebacks no longer touch workstation paths.
 
 **Planning (2026-07-06):** Cutover runbook at
 `docs/state-hub-railiance01-cutover-plan.md`. Inventory: primary on coulombcore
-(637 ws / 3983 tasks); railiance01 has CNPG operator + Forgejo but **no**
-`state-hub` namespace or `state-hub-db` yet; activity-core reaches hub via
+(637 ws / 3983 tasks); activity-core reaches hub via
 `fleet-state-hub-coulombcore` → `:18000`. Target hostname for sweep paths:
-`239.62.205.92.host.secureserver.net`. Image for deploy:
-`forgejo.coulomb.social/coulomb/state-hub:main-f9f0091`. **Phase 0 preflight
-done** (2026-07-06): baseline counts recorded, dry-runs pass, image pull ok —
-see `docs/state-hub-railiance01-cutover-preflight-2026-07-06.md`. **Blocked on
-operator approval** before Phase 2 freeze/restore; Phase 1 (empty deploy) may
-start without approval.
+`239.62.205.92.host.secureserver.net`. **Phase 0 preflight done** (2026-07-06):
+baseline counts recorded — `docs/state-hub-railiance01-cutover-preflight-2026-07-06.md`.
+**Phase 1 complete** (2026-07-06): empty stack on railiance01 — CNPG `state-hub-db`
+healthy, Alembic at head, `/state/health` ok, baseline tables 0 rows; Service
+ClusterIP `10.43.68.154:8000`. Deploy uses `gitea…:f2e042a` workaround (Forgejo
+`main-f9f0091` empty venv); rebuild before Phase 2 —
+`docs/state-hub-railiance01-cutover-phase1-2026-07-06.md`. **Blocked on operator
+approval** before Phase 2 freeze/restore.
 
 ## Task: Working-memory and sink path decoupling