Update State Hub image build provenance

state-hub/docs/container-image.md

@@ -49,8 +49,24 @@ Expected response:
 {"status":"ok","db":"connected"}
 ```
 
+## Current Local Build
+
+Verified local build on 2026-05-15:
+
+```text
+image: state-hub:local
+digest: sha256:039d29654ccb3754c6ecdbe497c6364bbd8452edcdcb7fa937dd9debf5b734ff
+created: 2026-05-15T14:54:48+02:00
+size: 106004480 bytes
+alembic: t7o8p9q0r1s2 (head)
+health: GET /state/health -> {"status":"ok","db":"connected"}
+```
+
+Smoke command used a temporary container on host port 18000 so it did not
+conflict with the live workstation State Hub on port 8000.
+
 ## Registry
 
-The final registry target is intentionally not hardcoded yet. CUST-WP-0011
-still has an open human decision for Gitea registry versus an interim external
-registry.
+The registry target for CUST-WP-0011 is the self-hosted Gitea registry, but
+publishing remains blocked until the Gitea package/container registry endpoint
+is enabled and Docker can authenticate against `/v2/`.

workplans/CUST-WP-0011-state-hub-threephoenix-migration.md

@@ -8,7 +8,7 @@ status: active
 owner: custodian
 topic_slug: custodian
 created: "2026-03-11"
-updated: "2026-05-02"
+updated: "2026-05-15"
 state_hub_workstream_id: "967baafb-d92d-405a-ba0b-0d00d37c4940"
 supersedes_intent_from: "Migrate Custodian State Hub to ThreePhoenix Cluster"
 follow_up_workplan: CUST-WP-0038
@@ -200,6 +200,14 @@ login/push still receives HTTP 404 from `/v2/`. Runtime inspection shows the
 live Gitea `app.ini` has no `[packages]` section, so package registry
 enablement/routing must be applied before publishing `state-hub:local`.
 
+Progress 2026-05-15: rebuilt the image from current `state-hub/` sources as
+`state-hub:local` with digest
+`sha256:039d29654ccb3754c6ecdbe497c6364bbd8452edcdcb7fa937dd9debf5b734ff`
+(106004480 bytes). Verified `/state/health` returns
+`{"status":"ok","db":"connected"}` from a temporary container on host port
+18000 and confirmed in-image Alembic reports `t7o8p9q0r1s2 (head)`. Build
+provenance is recorded in `state-hub/docs/container-image.md`.
+
 Remaining: enable the Gitea package/container registry, then tag, push, and
 pull the image from railiance01.