# T05 Phase 0 Preflight Evidence — 2026-07-06

Workplan: `CUST-WP-0054-T05`  
Parent runbook: `docs/state-hub-railiance01-cutover-plan.md`  
`no_secret_material_recorded: true`

## Checklist

| Step | Action | Result | Evidence |
| --- | --- | --- | --- |
| 0.1 | Baseline API totals | **pass** | See § API summary below |
| 0.2 | Per-table PG counts (coulombcore) | **pass** | See § Table counts below |
| 0.3 | Forgejo image pull (railiance01) | **pass** | `main-f9f0091` + `latest` @ `sha256:0b62f2d530cf7` |
| 0.4 | Manifest dry-run (railiance01) | **pass** | Server + client dry-run exit 0 |
| 0.5 | Storage / CNPG review | **pass** | `local-path` default; 75G free on `/`; CNPG healthy |
| 0.6 | Operator approval | **pending** | Required before Phase 2 freeze |

## API summary (`GET /state/summary` @ 2026-07-06T16:06:15Z)

```json
{
  "topics": { "total": 14 },
  "workstreams": { "total": 637, "active": 11, "finished": 582 },
  "tasks": { "total": 3983, "todo": 88, "progress": 4, "done": 3696 },
  "decisions": { "total": 79, "open": 1, "resolved": 76 }
}
```

Full artifact: captured at preflight run from `http://127.0.0.1:8000/state/summary`.

## Table counts — coulombcore `state-hub-db` (production writer)

Queried via `kubectl exec` on `databases/state-hub-db-1` as `postgres`:

| Table | Count | CUST-WP-0011-T07 reference |
| --- | ---: | --- |
| `workplans` | 637 | was 633 at 2026-07-03 cutover |
| `tasks` | 3983 | was 3964 |
| `progress_events` | 8717 | was 8192 |
| `topics` | 14 | was 14 |
| `token_events` | 1936 | was 1933 |
| `managed_repos` | 74 | — |
| `decisions` | 79 | — |

**Cutover gate:** post-restore counts on railiance01 must match this table exactly.

## Production deployment (coulombcore, source of dump)

| Item | Value |
| --- | --- |
| API image | `gitea.coulomb.social/coulomb/state-hub:f2e042a` |
| API pod | `state-hub/state-hub-7d565cddf4-jnpfw` Running |
| CNPG cluster | `databases/state-hub-db` — healthy, 11d |
| ClusterIP | `10.43.170.94:8000` |
| Workstation access | ops-bridge `state-hub-primary` → above Svc |

## Target image (railiance01 deploy)

| Tag | Digest | Notes |
| --- | --- | --- |
| `forgejo.coulomb.social/coulomb/state-hub:main-f9f0091` | `sha256:0b62f2d530cf7` | CI build from tier-3 promotion |
| `forgejo.coulomb.social/coulomb/state-hub:latest` | same | Alias |
| `:f9f0091` | **not found** | Use `main-f9f0091` or `latest` in Helm values |

## railiance01 platform readiness

| Check | Status |
| --- | --- |
| CNPG operator (`cnpg-system`) | Running |
| Existing CNPG clusters | `forgejo-db`, `net-kingdom-pg` healthy |
| `state-hub` namespace | Does not exist (expected — Phase 1 creates) |
| `state-hub-db` on railiance01 | Not deployed (expected) |
| StorageClass | `local-path` (default) |
| Node disk | 75G available on `/` (96G volume, 23% used) |
| Sweep hostname | `239.62.205.92.host.secureserver.net` |
| Partial clone tree | `/home/tegwick/activity-core`, `llm-connect`, … |

## Dry-run output summary

```bash
cd ~/state-hub
KUBECONFIG=~/.kube/config-hosteurope make railiance-state-hub-server-dry-run  # exit 0
KUBECONFIG=~/.kube/config-hosteurope make railiance-state-hub-client-dry-run   # exit 0
```

Server dry-run created (dry-run): `state-hub-db-credentials`, `state-hub-db` Cluster,
DB NetworkPolicies, `state-hub` Namespace, `state-hub-env`, ConfigMap, Service, Deployment.

## Phase 1 readiness

Phase 0 is **complete except operator approval (0.6)**. Phase 1 may proceed without
approval (empty stack deploy). Phase 2 freeze/restore **requires** explicit approval.

### Recommended Helm image pin for Phase 1

```yaml
image:
  repository: forgejo.coulomb.social/coulomb/state-hub
  tag: "main-f9f0091"
```

Update `state-hub/deploy/railiance/apps/helm/state-hub-values.yaml` and promote
to `railiance-apps` before or during Phase 1.

## Open items carried to Phase 1

1. Create SOPS-backed `state-hub-db-credentials` on railiance01 (platform)
2. Create `state-hub-env` Secret with `DATABASE_URL` pointing at railiance01 CNPG rw svc
3. Confirm image pull secret if Forgejo registry requires auth from cluster (currently pulls anonymously)