the-custodian/docs/core-hub-cutover-decision-coupling.md

Core Hub Cutover Decision Coupling

Date: 2026-07-08

Related workplans: CUST-WP-0025-T17, CORE-WP-0005, CORE-WP-0007, CUST-WP-0047, CUST-WP-0049.

Decision Summary

Core Hub is the preferred production framework surface for ops evidence and hub registry work. Haskell Inter-Hub remains available as rollback-only fallback through the stabilization window and until CORE-WP-0007 operator sign-off retires it.

Question	Decision
Is legacy Inter-Hub still required for normal operation?	No — production ingress at hub.coulomb.social serves Core Hub since 2026-07-03.
Is Inter-Hub fallback still required?	Yes, rollback-only until stabilization closes and CORE-WP-0007-T02 is approved.
Are the three cutover gates satisfied?	Yes — deployed API smoke, staging import, and activity-core sink evidence all pass.
Can Phase 4 fin-hub work begin?	Yes — multi-hub pattern is proven at Level 2→3 boundary; fin models remain separate implementation.

Readiness Gates

Evidence stubs live under docs/evidence/ and aggregate through Core Hub readiness-summary:

cd /home/worsch/core-hub
make operator-cli CLI_ARGS="readiness-summary \
  --deployed-smoke-report /home/worsch/the-custodian/docs/evidence/core-hub-deployed-smoke-20260702235645.json \
  --migration-report /home/worsch/the-custodian/docs/evidence/core-hub-migration-import-20260703.json \
  --activity-core-report /home/worsch/the-custodian/docs/evidence/core-hub-activity-core-sink-20260702.json"

Required gates:

Gate	Status	Evidence
deployed_api_smoke	pass	run 20260702235645-59bf1e (production); staging 20260702143544-6c8f18
staging_import	pass	28 records imported idempotently; production reconcile 0/28/0
activity_core_sink	pass	event ae43db56-902d-411a-a495-25acd464fdd8 posted and verified
legacy_inter_hub_reference	optional	retained for rollback validation only

Public Stabilization Probes (2026-07-08)

Unauthenticated checks against https://hub.coulomb.social:

Endpoint	Expected	Observed
/healthz	200	200 (service: core-hub)
/readyz	200	200 (configuration, database_url, api_auth ok)
/api/v2/widget-types	200	200
/api/v2/hubs	401	401 (hardened contract)

Consumer Compatibility Notes

Consumers migrating from Inter-Hub /api/v2 must account for:

1. Auth hardening — /api/v2/hubs is protected on Core Hub. Anonymous listing consumers must obtain a token. Audit found no production dependency on anonymous 200 responses.
2. Catalog shape — Core Hub catalogs use {name, slug, description}; Inter-Hub used {name, label, description, ownerHubId, status}. Parsers must accept slug as the stable identifier.
3. Health endpoints — Core Hub adds /healthz and /readyz; Inter-Hub returned 404 on these paths.
4. Ops vocabulary — all 7 orphaned ops-* widget types and matching event types are seeded in Core Hub before cutover; migrated widgets are referentially complete.

Rollback and Haskell Retirement Gates

Rollback remains one ingress flip:

1. Delete Core Hub ingress (30-ingress.yaml)
2. Apply rollback-inter-hub-ingress.yaml
3. Inter-Hub deployment stays running untouched through stabilization

CORE-WP-0007 Haskell retirement requires:

• stabilization window close (through 2026-07-10T17:35Z per workplan)
• operator approval after repeated public probe pass
• explicit decision that rollback is no longer operationally required

Supersede Decisions

Legacy task	Superseded by	Date
CUST-WP-0047-T05 Inter-Hub widget activation	Core Hub production cutover + deployed smoke	2026-07-03
CUST-WP-0049-T06 Inter-Hub bootstrap access lane	Core Hub operator CLI + deployed evidence	2026-07-03

Do not request new Inter-Hub operator keys for the preferred replacement lane.

Cross-Hub Coupling (FOS §9)

From	To	Signal
Core Hub (ops)	dev-hub (State Hub)	progress/decision records, workplan status
activity-core	Core Hub	core-hub-interaction-event sink
fin-hub (future)	dev-hub	budget pressure alerts (T25)
fin-hub (future)	Core Hub	per-service cost attribution (T25)

NATS transport for cross-hub messaging remains a later decision; HTTP evidence sinks and State Hub progress records are sufficient for the current cutover gate.