# T05 Phase 4 Evidence — Sweep Checkout Migration (2026-07-06)

Workplan: `CUST-WP-0054-T05`  
Parent runbook: `docs/state-hub-railiance01-cutover-plan.md`  
`no_secret_material_recorded: true`

## Checklist

| Step | Action | Result | Evidence |
| --- | --- | --- | --- |
| 4.1 | Clone root `/home/tegwick/<slug>` | **pass** | 74 host_paths registered; 73 new clones + 4 retried |
| 4.2 | Bulk clone from git remotes | **pass** | `railiance01-bulk-clone-repos.sh` on railiance01 |
| 4.3 | Register `host_paths` | **pass** | host=`239.62.205.92.host.secureserver.net` × 74 |
| 4.4 | Sweep on railiance01 | **pass** | `POST /consistency/sweep/remote-all` exit_code=0 |
| 4.5 | Writeback on railiance01 | **pass** | `the-custodian` fix: `push: pushed` from `/home/tegwick/` |

**Phase 4 status: complete.**

## Infrastructure changes

### state-hub image (`main-phase4-sweep`)

Imported to railiance01 k3s (local build; promote via Forgejo CI next):

- Dockerfile: `git`, `openssh-client`
- `STATE_HUB_SWEEP_HOSTNAME` env (Kubernetes pod hostname cannot contain dots)
- `api/classification.py`: railiance01 path fallback for allowed-values YAML
- `scripts/consistency_check.py`: `_sweep_hostname()` for `host_paths` resolution

### Helm (`deploy/railiance/apps/helm/state-hub-values.yaml`)

```yaml
sweep:
  enabled: true
  hostname: 239.62.205.92.host.secureserver.net
  hostPath: /home/tegwick
  sshHostPath: /home/tegwick/.ssh
```

Deployment mounts host clone tree + SSH config; `postStart` sets
`git config --global safe.directory '*'` (root in pod, tegwick-owned repos).

### railiance01 host

- SSH: `~/.ssh/config` with `forgejo-remote` + `gitea-remote` (workstation `id_gitea` copied)
- Clone tree: `/home/tegwick/<slug>` (77 entries incl. tooling dirs)
- Failed-then-fixed slugs: `ihp-railiance-probe`, `llm-connect`, `markitect-project` (from `markitect_project`), `vergabe_teilnahme` (from `vergabe-teilnahme`)

## Tooling added (the-custodian)

- `tools/railiance01-bulk-clone-repos.sh`
- `tools/railiance01-register-host-paths.sh`

## Verification

```bash
# Single-repo fix inside pod — railiance01 path, push succeeds
kubectl -n state-hub exec deploy/state-hub -- \
  python3 /app/scripts/consistency_check.py --repo the-custodian --fix \
  --api-base http://127.0.0.1:8000
# → repo_path: /home/tegwick/the-custodian, push: pushed

# Full sweep canary
curl -s -X POST http://127.0.0.1:8000/consistency/sweep/remote-all \
  -H "Content-Type: application/json" \
  -d '{"max_seconds":300,"source":"phase4-canary"}'
# → exit_code: 0, 8 repos processed (budget-limited first pass), skipped_missing: 0
```

`.custodian-brief.md` on railiance01 (`17:08 UTC`) is newer than workstation (`15:27 UTC`).

Workstation `host_paths[bnt-lap001]` retained for dev; production sweep resolves
`host_paths[239.62.205.92.host.secureserver.net]`.

## Follow-ups (Phase 5)

- Promote `main-phase4-sweep` image via Forgejo CI (replace hand-imported tag)
- Allow longer first-pass sweep budget or multiple cron cycles to reconcile all 74 repos
- activity-core scheduled sweeps should recover (were failing with exit_code=1 pre-Phase-4)

## Next: Phase 5

48–72h stabilization before coulombcore hub teardown.