# T05 Phase 1 Evidence — Empty Stack on railiance01 (2026-07-06)

Workplan: `CUST-WP-0054-T05`  
Parent runbook: `docs/state-hub-railiance01-cutover-plan.md`  
`no_secret_material_recorded: true`

## Checklist

| Step | Action | Result | Evidence |
| --- | --- | --- | --- |
| 1.1 | Create `state-hub` namespace | **pass** | `kubectl get ns state-hub` |
| 1.2 | Deploy `state-hub-db` CNPG | **pass** | Cluster `databases/state-hub-db` healthy, 1 instance |
| 1.3 | Apply DB NetworkPolicies | **pass** | Applied from `deploy/railiance/platform/` |
| 1.4 | Create `state-hub-env` Secret | **pass** | `DATABASE_URL` → `state-hub-db-rw.databases.svc.cluster.local` |
| 1.5 | Helm image pin (Forgejo target) | **deferred** | Values updated; deploy uses gitea workaround (see § Image) |
| 1.6 | Alembic init Job | **pass** | `state-hub-alembic-init` Completed; head `f0a1b2c3d4e5` |
| 1.7 | Helm install + `/state/health` | **pass** | Pod Running; health `ok`, db `connected` |

**Phase 1 status: complete** (empty hub healthy; no production data). Phase 2 blocked on operator approval (Phase 0.6).

## Deployed resources (railiance01-k3s)

| Resource | Namespace | Status |
| --- | --- | --- |
| Secret `state-hub-db-credentials` | `databases` | present |
| CNPG Cluster `state-hub-db` | `databases` | healthy |
| Secret `state-hub-env` | `state-hub` | present |
| Helm release `state-hub` (rev 2) | `state-hub` | deployed |
| Job `state-hub-alembic-init` | `state-hub` | Completed |
| Deployment `state-hub` | `state-hub` | Running 1/1 |
| Service `state-hub` | `state-hub` | ClusterIP `10.43.68.154:8000` |

Kubeconfig: `KUBECONFIG=~/.kube/config-hosteurope` (workstation WSL).

## API verification (port-forward `18080:8000`)

```bash
curl -s http://127.0.0.1:18080/state/health
# {"status":"ok","db":"connected"}

curl -s http://127.0.0.1:18080/state/summary
# totals: topics=0, workstreams=0, tasks=0, decisions=0
```

Captured: 2026-07-06T16:24:19Z.

## Database verification (empty schema)

Alembic at head `f0a1b2c3d4e5`. Baseline gate tables — all **zero rows**:

| Table | Count |
| --- | ---: |
| `workplans` | 0 |
| `tasks` | 0 |
| `topics` | 0 |
| `progress_events` | 0 |
| `token_events` | 0 |
| `managed_repos` | 0 |
| `decisions` | 0 |

Queried via `kubectl exec` on `databases/state-hub-db-1` as `postgres`.

Post-Phase-2 restore must match coulombcore preflight counts exactly (see
`docs/state-hub-railiance01-cutover-preflight-2026-07-06.md`).

## Image workaround

| Image | Status | Notes |
| --- | --- | --- |
| `forgejo.coulomb.social/coulomb/state-hub:main-f9f0091` | **broken** | Empty `/tmp/requirements.txt`; `ModuleNotFoundError: asyncpg` |
| `gitea.coulomb.social/coulomb/state-hub:f2e042a` | **deployed** | Helm `--set image.*` override; matches coulombcore production pin |

Helm values file targets Forgejo (`main-f9f0091`) for post-fix cutover. Rebuild
Forgejo image before Phase 2 so production and CI share one registry.

**Root cause:** DinD layer cache reused an empty `requirements.txt` layer from an
earlier build; CI reported success at `f9f0091` but venv was empty. Fixes pushed
to Forgejo `state-hub` @ `96b7306` (Dockerfile gates + `DEPS_LOCK_ID` cache bust);
image workflow still failing on runner — rebuild tracked before Phase 2.

## Phase 2 prerequisites

- [ ] Operator approval for freeze/final restore (Phase 0.6)
- [ ] Fix and republish Forgejo `state-hub` image with working venv
- [ ] Fresh `pg_dump` from coulombcore per CUST-WP-0011-T07 playbook

## References

- `state-hub/deploy/railiance/apps/helm/state-hub-values.yaml` — Forgejo image pin
- `docs/state-hub-railiance01-cutover-plan.md` — Phase 2–5 sequence
- ClusterIP `10.43.68.154` — capture for Phase 3 tunnel rewire