coulomb/the-custodian
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update stabilization checkpoint after canary template

Browse Source
This commit is contained in:
Bernd Worsch
2026-06-27 16:41:42 +02:00
parent 629f4c1f53
commit 5128ab8830
3 changed files with 22 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
docs/infrastructure-stabilization-pickup-checkpoint.md
View File

@@ -25,7 +25,7 @@ State Hub active workstreams queried on 2026-06-27:
| `cust-wp-0051` | This metaplan is the coordination layer for remaining cross-workplan gates. | | `cust-wp-0051` | This metaplan is the coordination layer for remaining cross-workplan gates. |
| `activity-wp-0016-llm-output-robustness-trust-boundary` | Repo-side output robustness bundle is prepared; live deploy/smoke proof remains. | | `activity-wp-0016-llm-output-robustness-trust-boundary` | Repo-side output robustness bundle is prepared; live deploy/smoke proof remains. |
| `three-phoenix-ha-cluster` | HA substrate remains future critical-workload work, not the current State Hub cutover blocker. | | `three-phoenix-ha-cluster` | HA substrate remains future critical-workload work, not the current State Hub cutover blocker. |
| `staged-promotion-lifecycle` | T02 `railiance/app.toml` contract, T03 overlay repo pattern/script, and T04 Stage 1 runner are done; continue with T05 canary template before broad production migrations. | | `staged-promotion-lifecycle` | T02 `railiance/app.toml` contract, T03 overlay repo pattern/script, T04 Stage 1 runner, and T05 canary template are done; continue with T06 deploy/observe tooling before broad production migrations. |
| `rail-ho-wp-0005` | Forgejo production migration is parked behind explicit design, SMTP, backup, runner, and cutover decisions. | | `rail-ho-wp-0005` | Forgejo production migration is parked behind explicit design, SMTP, backup, runner, and cutover decisions. |
| `net-wp-0020` | OpenBao unseal/token custody remains an operator design and smoke gate. | | `net-wp-0020` | OpenBao unseal/token custody remains an operator design and smoke gate. |
| `issue-wp-0003` | issue-core service is healthy; activity-core REST emission wiring remains. | | `issue-wp-0003` | issue-core service is healthy; activity-core REST emission wiring remains. |
@@ -106,7 +106,7 @@ Resume from `docs/daily-triage-stabilization-status.md` and
`ISSUE_SINK_TYPE=rest` and one known-safe emission smoke. `ISSUE_SINK_TYPE=rest` and one known-safe emission smoke.
5. Request explicit State Hub cutover approval for `CUST-WP-0011-T07`, or 5. Request explicit State Hub cutover approval for `CUST-WP-0011-T07`, or
record that WSL2 remains primary for the next operating period. record that WSL2 remains primary for the next operating period.
6. Continue staged-promotion T05 and start artifact-store D7.1/D7.2 6. Continue staged-promotion T06 and start artifact-store D7.1/D7.2
so Forgejo and storage work inherit clear production promotion gates. so Forgejo and storage work inherit clear production promotion gates.
7. Keep Forgejo cutover and State Hub HA work parked until their human decision 7. Keep Forgejo cutover and State Hub HA work parked until their human decision
and drill gates are satisfied. and drill gates are satisfied.

6
docs/near-term-production-service-lanes-status.md
View File

@@ -14,7 +14,7 @@ before starting larger migrations.
| `issue-wp-0003` | issue-core is live through ArgoCD; image `0.2.1`, Service port `8765`, ExternalSecret Ready, authenticated smoke created Gitea issue `175`. | Do not flip activity-core blindly. First inject `ISSUE_CORE_API_KEY` into `actcore-runtime-secret` through route `activity-core-issue-sink`; then set activity-core `ISSUE_CORE_URL` to port `8765`, set `ISSUE_SINK_TYPE=rest`, restart/sync, and run one safe emission smoke. | | `issue-wp-0003` | issue-core is live through ArgoCD; image `0.2.1`, Service port `8765`, ExternalSecret Ready, authenticated smoke created Gitea issue `175`. | Do not flip activity-core blindly. First inject `ISSUE_CORE_API_KEY` into `actcore-runtime-secret` through route `activity-core-issue-sink`; then set activity-core `ISSUE_CORE_URL` to port `8765`, set `ISSUE_SINK_TYPE=rest`, restart/sync, and run one safe emission smoke. |
| `rail-ho-wp-0005` | Forgejo migration remains pre-implementation. Inventory is in progress; production decisions, SMTP/email recovery, cutover, and legacy retirement are human-gated. | Resolve T02 production decisions first, then build the disposable Forgejo probe. Do not start production cutover before promotion lifecycle, email recovery, package registry, Actions, backup/restore, and migration drill pass. | | `rail-ho-wp-0005` | Forgejo migration remains pre-implementation. Inventory is in progress; production decisions, SMTP/email recovery, cutover, and legacy retirement are human-gated. | Resolve T02 production decisions first, then build the disposable Forgejo probe. Do not start production cutover before promotion lifecycle, email recovery, package registry, Actions, backup/restore, and migration drill pass. |
| `artifact-store-wp-0007` | All tasks are still `todo`; no live secret gate is currently recorded. | Start with D7.1 fork/object-store landscape and D7.2 compatibility harness. Route D7.3 STS credential vending to NetKingdom if implementation belongs outside artifact-store. | | `artifact-store-wp-0007` | All tasks are still `todo`; no live secret gate is currently recorded. | Start with D7.1 fork/object-store landscape and D7.2 compatibility harness. Route D7.3 STS credential vending to NetKingdom if implementation belongs outside artifact-store. |
| `staged-promotion-lifecycle` | Lifecycle spec, T02 `railiance/app.toml` contract, T03 overlay repo pattern/script, and T04 `railiance run` Stage 1 runner are done; canary template, deployment observation, promotion, and rollback tasks remain. | Start T05 canary Helm chart template using generated overlays as reference consumers for Stage 2 promotion gates. | | `staged-promotion-lifecycle` | Lifecycle spec, T02 `railiance/app.toml` contract, T03 overlay repo pattern/script, T04 `railiance run` Stage 1 runner, and T05 canary Helm template are done; deployment observation, promotion, and rollback tasks remain. | Start T06 `railiance deploy --stage 2` and observation tooling using generated overlays as reference consumers for Stage 2 promotion gates. |
## Credential And Operator Routing ## Credential And Operator Routing
@@ -40,8 +40,8 @@ No secret value was read or written. The required non-secret evidence is:
1. Close the issue-core handoff gate because the service is already healthy and 1. Close the issue-core handoff gate because the service is already healthy and
only activity-core live emission remains. only activity-core live emission remains.
2. Continue staged-promotion with T05 canary template implementation before 2. Continue staged-promotion with T06 deploy/observe tooling before Forgejo
Forgejo cutover work accelerates. cutover work accelerates.
3. Run artifact-store D7.1/D7.2 as an assessment/build harness lane, with D7.3 3. Run artifact-store D7.1/D7.2 as an assessment/build harness lane, with D7.3
routed to NetKingdom if STS vending is not artifact-store-owned. routed to NetKingdom if STS vending is not artifact-store-owned.
4. Keep Forgejo production cutover parked behind explicit T02 decisions and the 4. Keep Forgejo production cutover parked behind explicit T02 decisions and the

20
workplans/CUST-WP-0051-infrastructure-stabilization-metaplan.md
View File

@@ -44,7 +44,7 @@ Active registered workstreams with open work:
| cust-wp-0049 | 1 wait, 5 done | Access lane is ready; live bootstrap needs approved admin execution. | | cust-wp-0049 | 1 wait, 5 done | Access lane is ready; live bootstrap needs approved admin execution. |
| activity-wp-0016 | 1 wait, 2 progress, 5 todo, 2 done | Daily-triage output robustness needs live deploy/smoke evidence. | | activity-wp-0016 | 1 wait, 2 progress, 5 todo, 2 done | Daily-triage output robustness needs live deploy/smoke evidence. |
| three-phoenix-ha-cluster | 7 todo | Target HA substrate is planned but not executed. | | three-phoenix-ha-cluster | 7 todo | Target HA substrate is planned but not executed. |
| staged-promotion-lifecycle | 6 todo, 1 done | Promotion discipline needed before broad production cutovers. | | staged-promotion-lifecycle | 2 todo, 5 done | Promotion discipline needed before broad production cutovers. |
| rail-ho-wp-0005 | 11 todo, 1 progress | Forgejo production migration needs human design and cutover decisions. | | rail-ho-wp-0005 | 11 todo, 1 progress | Forgejo production migration needs human design and cutover decisions. |
| cust-wp-0045-cutover-runbook | 0 tasks | Registered runbook is appearing as an active no-task workstream. | | cust-wp-0045-cutover-runbook | 0 tasks | Registered runbook is appearing as an active no-task workstream. |
| net-wp-0020 | 2 wait, 1 todo, 2 done | OpenBao unseal custody models still need operator profile decisions. | | net-wp-0020 | 2 wait, 1 todo, 2 done | OpenBao unseal custody models still need operator profile decisions. |
@@ -295,8 +295,8 @@ Progress 2026-06-27 staged promotion:
rollback, and human approval gates. rollback, and human approval gates.
- `make fix-consistency REPO=railiance-cluster` passed with pre-existing - `make fix-consistency REPO=railiance-cluster` passed with pre-existing
C-12 warnings and synced the T02 status into State Hub. C-12 warnings and synced the T02 status into State Hub.
- Next staged-promotion picks are T04/T05 command and canary template - T02 through T05 are complete; the next staged-promotion pick is T06
implementation; T03 overlay repo pattern is now complete. deploy/observe tooling.
Progress 2026-06-27 staged promotion T03: Progress 2026-06-27 staged promotion T03:
@@ -331,6 +331,20 @@ Progress 2026-06-27 staged promotion T04:
- `make fix-consistency REPO=railiance-cluster` passed with pre-existing - `make fix-consistency REPO=railiance-cluster` passed with pre-existing
C-12 warnings and synced the T04 status into State Hub. C-12 warnings and synced the T04 status into State Hub.
Progress 2026-06-27 staged promotion T05:
- Completed `RAIL-BS-WP-0006-T05` in `/home/worsch/railiance-cluster`.
Generated overlays now include a Stage 2 canary Helm template with
stable/canary release identities, isolated ingress by default, optional
Traefik weighted routing, Prometheus annotations, HTTP probes, conservative
resource limits, rollback-safe Stage 2/Stage 3 values, and
`tests/stage2-template.sh`.
- Verified a fresh generated Forgejo overlay with schema validation,
`tests/stage1.sh`, `tests/stage2-template.sh`, and `bin/railiance run`.
Helm rendering was skipped because Helm is unavailable in this environment.
- `make fix-consistency REPO=railiance-cluster` passed with pre-existing
C-12 warnings and synced the T05 status into State Hub.
## Task: Decide State Hub Migration Strategy ## Task: Decide State Hub Migration Strategy
```task ```task