CUST-WP-0054 T01-T03: fleet architecture, de-hub runbook, drain plan
Documents the three-machine role model, fleet mesh topology, coulombcore freeze policy, and ordered drain sequence. Adds railiance01 systemd tunnel install assets and refreshes ops service inventory to reflect 2026-07-03 production placement (cluster State Hub, fleet mesh, draining coulombcore).
This commit is contained in:
codex
118
canon/standards/coulombcore-production-freeze_v0.1.md
Normal file
118
canon/standards/coulombcore-production-freeze_v0.1.md
Normal file
@@ -0,0 +1,118 @@
|
||||
---
|
||||
id: canon-coulombcore-production-freeze
|
||||
type: standard
|
||||
title: "CoulombCore Production Freeze v0.1"
|
||||
domain: custodian
|
||||
status: active
|
||||
version: "0.1"
|
||||
created: "2026-07-03"
|
||||
decided_by: custodian
|
||||
tags: ["infrastructure", "coulombcore", "railiance01", "production", "freeze", "drain"]
|
||||
related_workplans:
|
||||
- CUST-WP-0054
|
||||
- RAIL-HO-WP-0005
|
||||
---
|
||||
|
||||
# CoulombCore Production Freeze v0.1
|
||||
|
||||
## Status
|
||||
|
||||
**Active from 2026-07-03.** CoulombCore (`92.205.130.254`) is frozen for new
|
||||
production workloads.
|
||||
|
||||
## Context
|
||||
|
||||
Under the fleet role model (`CUST-WP-0054`, `docs/workstation-independence-fleet-architecture.md`):
|
||||
|
||||
| Machine | Role |
|
||||
| --- | --- |
|
||||
| **railiance01** | Production home — growing Railiance fleet |
|
||||
| **coulombcore** | Legacy/experimental only; drain then phoenix to **railiance02** |
|
||||
| **workstation** | Temporary dev environment |
|
||||
|
||||
Despite the role model, coulombcore still hosts production-critical workloads
|
||||
(State Hub cluster primary, Core Hub, issue-core, Gitea, OpenBao, identity
|
||||
stack, GitOps control plane). This freeze stops the problem from growing while
|
||||
the drain sequence in `docs/coulombcore-drain-placement-plan.md` executes.
|
||||
|
||||
## Policy
|
||||
|
||||
### Frozen (blocked without exception)
|
||||
|
||||
No **new** production workloads may be introduced on coulombcore after
|
||||
2026-07-03:
|
||||
|
||||
- New Helm releases, ArgoCD Applications, or CNPG clusters intended as
|
||||
long-lived production
|
||||
- New public DNS names under `*.coulomb.social` for production services
|
||||
- New credential lanes whose **primary** runtime home is coulombcore
|
||||
- New CI/CD publish targets that make coulombcore the canonical registry or
|
||||
forge (canonical target is railiance01 Forgejo per `RAIL-HO-WP-0005`)
|
||||
- New automation schedules that **require** coulombcore as the sole runtime
|
||||
host (activity-core production is already on railiance01)
|
||||
|
||||
### Grandfathered (existing production may run)
|
||||
|
||||
Workloads already in production on coulombcore before 2026-07-03 may continue
|
||||
until their drain step completes. They are **not** newly promoted production —
|
||||
they are legacy carry-over on a condemned host.
|
||||
|
||||
### Allowed on coulombcore during drain
|
||||
|
||||
| Category | Examples |
|
||||
| --- | --- |
|
||||
| Drain migrations | Staged-promotion overlays targeting railiance01; cutover drills in isolated namespaces |
|
||||
| Read-only mirrors | Gitea read-only rollback mirror after Forgejo cutover |
|
||||
| Short-lived probes | Disposable Forgejo/restore namespaces per `RAIL-HO-WP-0005` probe strategy |
|
||||
| Experimental / non-prod | Staging profiles, smoke namespaces, operator-attended bootstrap |
|
||||
| Fleet mesh transit | Forward tunnels from railiance01 to coulombcore cluster services until those services move (T02 interim) |
|
||||
|
||||
### Promotion gate
|
||||
|
||||
A workload counts as **production on railiance01** only after passing the
|
||||
staged-promotion contract (`RAIL-BS-WP-0006`). Coulombcore deployments do not
|
||||
satisfy this gate after 2026-07-03.
|
||||
|
||||
## Enforcement
|
||||
|
||||
1. **Workplan review** — new workplans proposing coulombcore production require
|
||||
an explicit exception row in the drain plan with rollback evidence.
|
||||
2. **ArgoCD / GitOps** — new Applications with production intent must target
|
||||
`railiance01-k3s`, not `coulombcore-k3s`, unless tagged `drain-migration`
|
||||
or `experimental`.
|
||||
3. **Agent instructions** — coding agents must not deploy new production
|
||||
services to coulombcore; route to railiance01 overlays or file an exception
|
||||
request via State Hub `needs_human`.
|
||||
4. **Inventory drift** — `ops/service-inventory.yml` rows for coulombcore
|
||||
production services carry `lifecycle_state: draining` after their drain
|
||||
wave starts.
|
||||
|
||||
## Exceptions
|
||||
|
||||
Document each exception in `docs/coulombcore-drain-placement-plan.md` under
|
||||
**Documented exceptions** with:
|
||||
|
||||
- workload id
|
||||
- reason the drain sequence cannot absorb it yet
|
||||
- target host and target date
|
||||
- rollback method
|
||||
- approving workplan or operator decision id
|
||||
|
||||
## Exit criteria (lift freeze)
|
||||
|
||||
The freeze lifts for coulombcore as a **host** when:
|
||||
|
||||
1. All drain waves in the placement plan reach `retired` or `migrated`
|
||||
2. Identity + OpenBao (last wave) run on railiance01
|
||||
3. `CUST-WP-0054-T09` phoenix begins — coulombcore is wiped and rebuilt as
|
||||
railiance02, not returned to production
|
||||
|
||||
After phoenix, the machine identity is **railiance02**; the coulombcore freeze
|
||||
standard applies only to the historical drain period.
|
||||
|
||||
## Related documents
|
||||
|
||||
- Drain sequence: `docs/coulombcore-drain-placement-plan.md`
|
||||
- Architecture: `docs/workstation-independence-fleet-architecture.md`
|
||||
- Forgejo migration: `RAIL-HO-WP-0005` in `railiance-infra`
|
||||
- Staged promotion: `RAIL-BS-WP-0006` (finished)
|
||||
Reference in New Issue
Block a user