a272f5fcda
- Mark T16/T17 done with cutover evidence and decision coupling doc - Add business-model-canvas and bootstrap-protocol canon (T20/T21) - Record Core Hub readiness-summary evidence stubs - Refresh fos-hub-bootstrap-sequence-status and core-hub-replacement-evidence
121 lines
6.3 KiB
Markdown
121 lines
6.3 KiB
Markdown
# Core Hub Replacement Evidence Handoff
|
|
|
|
Date: 2026-06-30
|
|
|
|
Related workplans: `CUST-WP-0052`, `CUST-WP-0025`, `CUST-WP-0047`,
|
|
`CUST-WP-0049`, `CORE-WP-0008`, `CORE-WP-0004`, `CORE-WP-0005`,
|
|
`CORE-WP-0007`.
|
|
|
|
## Current Evidence
|
|
|
|
Core Hub now has the API-first replacement lane needed to stop expanding the
|
|
old Inter-Hub-first ops-hub path:
|
|
|
|
- `CORE-WP-0008-T02`: repeatable deployed-smoke harness exists through
|
|
`make deployed-smoke`. It probes health/readiness, OpenAPI compatibility,
|
|
public catalogs, protected-route `401` behavior, operator auth, ops-hub
|
|
bootstrap-equivalent creation, widget/event write, key-prefix evidence, and
|
|
hub-registry visibility. It was verified against a disposable local HTTP Core
|
|
Hub runtime, not a live staging endpoint.
|
|
- `CORE-WP-0008-T03`: activity-core has a direct Core Hub
|
|
`core-hub-interaction-event` sink, verified locally against a disposable Core
|
|
Hub runtime. Deployed execution still needs `CORE_HUB_BASE_URL`, runtime key,
|
|
and widget mapping from approved custody.
|
|
- `CORE-WP-0008-T04`: staging deployment profile, Kubernetes manifests,
|
|
migration job shape, secret references, health/readiness probes, rollback
|
|
notes, and container build checks are documented.
|
|
- `CORE-WP-0008-T05`: `make operator-cli` wraps the same API behavior for
|
|
deployed smoke, ops-hub bootstrap status, migration validate/import, and
|
|
cutover readiness summaries.
|
|
- `CORE-WP-0006`: protected `/console` prototype exists with readiness,
|
|
registry, migration/cutover, action-required, access metadata, and evidence
|
|
stream sections. `make visual-check` passed on 2026-06-27 with desktop/mobile,
|
|
no-overlap, horizontal-overflow, protected-route, PNG, and non-secret checks.
|
|
- `CORE-WP-0008-T06`: the web UI is gated behind API/CLI readiness and has a
|
|
compact whynot-aligned first-screen backlog. The UI should not start by
|
|
recreating every old Inter-Hub screen.
|
|
|
|
**2026-07-02/03 update:** Deployed evidence now exists. Staging smoke
|
|
`20260702143544-6c8f18`, production smoke `20260702235645-59bf1e`, activity-core
|
|
sink event `ae43db56-902d-411a-a495-25acd464fdd8`, and migration import (28
|
|
records, idempotent) are documented in `docs/evidence/` and aggregated via
|
|
`readiness-summary` (`readyForCutover: true` on 2026-07-08).
|
|
|
|
## 0047 And 0049 Decision
|
|
|
|
**Superseded 2026-07-03:** `CUST-WP-0047-T05` and `CUST-WP-0049-T06` are
|
|
cancelled in their workplans. Core Hub production cutover plus deployed smoke
|
|
evidence replaced the legacy Inter-Hub widget activation and bootstrap access
|
|
lane. Inter-Hub remains rollback-only through `CORE-WP-0007` stabilization.
|
|
|
|
See `docs/core-hub-cutover-decision-coupling.md` for the full decision record.
|
|
|
|
## CUST-WP-0025 Phase 3 Reset Recommendation
|
|
|
|
`CUST-WP-0025-T13` through `T19` should be rewritten before execution:
|
|
|
|
- T13: replace "create standalone ops-hub repo" with Core Hub-owned API-first
|
|
ops evidence and registry work. Defer any standalone ops-hub repo until after
|
|
Core Hub cutover proves the boundary still needs a separate service.
|
|
- T14: replace standalone ops-specific models with Core Hub resources and
|
|
migration/read-model gaps, preserving `CUST-WP-0047` service inventory as
|
|
input evidence.
|
|
- T15: replace MCP-first ops tools with API and CLI parity first. Any MCP layer
|
|
should consume the proven Core Hub API later.
|
|
- T16: route infrastructure evidence through activity-core probes and Core Hub
|
|
interaction/deployment evidence, with credential ownership resolved through
|
|
approved custody routes rather than chat or workplans.
|
|
- T17: reframe cross-hub coupling around Core Hub events, State Hub progress,
|
|
and activity-core evidence sinks. Keep NATS as a later transport decision.
|
|
- T18: replace the old dashboard task with the whynot-aligned Core Hub operator
|
|
UI backlog from `CORE-WP-0008-T06`.
|
|
- T19: cancel or defer ops-hub MCP server registration until post-cutover
|
|
demand proves it is needed.
|
|
|
|
2026-06-27 follow-up: `CUST-WP-0025-T13` through `T19` have now been
|
|
rewritten around this recommendation. The rewrite is enough to stop the obsolete
|
|
standalone ops-hub scaffold sequence, but not enough to declare Core Hub
|
|
production cutover complete.
|
|
|
|
2026-06-27 T14 closeout: Core Hub now has
|
|
`docs/specs/ops-evidence-contract.md`, which defines the ops evidence API
|
|
resources, event vocabulary, non-secret access metadata rules, service inventory
|
|
mapping, readiness-summary inputs, and read-model gaps. This closes the T14
|
|
definition gate while leaving deployed evidence, cutover coupling, and UI work
|
|
for T16/T17/T18.
|
|
|
|
2026-06-27 T03 closeout: Core Hub now has a reusable IAM Profile verifier and
|
|
FastAPI dependency plus `tests/test_iam_profile.py`, which proves OIDC
|
|
discovery, JWKS signature validation, authorization-code + PKCE token issuance,
|
|
protected endpoint access, required IAM Profile claims, missing-token rejection,
|
|
wrong-audience rejection, and production rejection of local-development issuers.
|
|
This closes the identity integration template while leaving production issuer
|
|
wiring for the deployed Core Hub gates.
|
|
|
|
2026-06-27 T18 closeout: Core Hub `CORE-WP-0006` is finished and local
|
|
`make visual-check` passed for `/console`. The first UI surface is intentionally
|
|
compact and protected; broader UI implementation remains gated by deployed API
|
|
and CLI evidence through the rebuild backlog.
|
|
|
|
## Remaining Gates
|
|
|
|
2026-06-30 route refinement: `warden route find` for the Core Hub
|
|
staging smoke token need matched the OpenBao-owned `openbao-api-key`
|
|
lane for operator/runtime credentials, with `key-cape-oidc-login`
|
|
available for interactive auth and `ops-bridge-tunnel` for private
|
|
endpoint access when needed. ops-warden can route or assist eligible lanes,
|
|
but it does not own, mint, or store Core Hub token values.
|
|
|
|
- Run `make deployed-smoke` or `make operator-cli CLI_ARGS="deployed-smoke ..."`
|
|
against a real Core Hub staging URL with an approved operator token.
|
|
- Import the approved Inter-Hub export bundle into a staging Core Hub database
|
|
and keep dry-run reports visibly open until a reviewed non-dry-run import
|
|
succeeds.
|
|
- Run the deployed activity-core Core Hub sink smoke with approved runtime
|
|
token and widget mapping.
|
|
- Build a `readiness-summary` evidence report from deployed smoke, migration,
|
|
activity-core, and optional legacy Inter-Hub reference evidence.
|
|
- Keep `CORE-WP-0007` Haskell retirement blocked until staging import, dual-run
|
|
smokes, cutover, rollback notes, and operator approval are complete.
|
|
|