feat: add Release A monitor PG capability

config/hwlab-node-lanes.yaml

@@ -162,6 +162,8 @@ lanes:
         observability:
           prometheusOperator: false
           webProbe:
+            monitor:
+              configRef: config/hwlab-web-probe-monitor/runtime.nc01-v03.yaml#monitor
             monitorRoot:
               enabled: true
               sentinelId: nc01-web-probe-sentinel

config/hwlab-web-probe-monitor/runtime.nc01-v03.yaml

@@ -0,0 +1,66 @@
+version: 1
+kind: HwlabWebProbeMonitorRuntime
+metadata:
+  id: hwlab-web-probe-monitor-nc01-v03
+  owner: UniDesk
+  specRef: PJ2026-01060508
+  relatedIssues:
+    - 1868
+    - 1873
+monitor:
+  runtime:
+    node: NC01
+    lane: v03
+    namespace: hwlab-v03
+    deploymentName: hwlab-web-probe-monitor
+    serviceName: hwlab-web-probe-monitor
+    servicePort: 8090
+    replicas: 1
+    imageRef: 127.0.0.1:5000/hwlab/web-probe-sentinel:p3-service
+    healthPath: /api/health
+    databaseSecret:
+      name: hwlab-web-probe-monitor-db
+      key: DATABASE_URL
+      sourceRef: hwlab/web-probe-monitor-db.env
+    timeout:
+      requestSeconds: 15
+      startupSeconds: 30
+    pool:
+      max: 4
+      idleTimeoutSeconds: 30
+    pageSize: 100
+  persistence:
+    mode: host-postgres
+    authority: prepared-central-only
+    database: web_probe_monitor
+    schema: monitor
+  migration:
+    mode: legacy-authority
+    source:
+      registry: config/hwlab-node-lanes.yaml#lanes.v03.targets.NC01.observability.webProbe.sentinels
+      sentinelId: nc01-web-probe-sentinel
+      runtimeConfigRef: config/hwlab-web-probe-sentinel/profiles.yaml#nodes.${NODE}.sentinels.${nodeLower}-web-probe-sentinel.sentinel.configRefs.runtime
+      sqlitePath: /var/lib/web-probe-sentinel-nc01/index.sqlite
+      pvcName: hwlab-web-probe-sentinel-nc01-state
+      stateRoot: /var/lib/web-probe-sentinel-nc01
+    job:
+      name: hwlab-web-probe-monitor-migration
+      command: plan
+      readOnly: true
+  publicExposure:
+    enabled: false
+    mode: prepared-not-routed
+    hostname: monitor.pikapython.com
+  cicd:
+    consumer: sentinel-nc01-v03
+    mode: existing-pac-consumer
+  capabilities:
+    boundedReadModel: true
+    health: true
+    schema: true
+    schedulerDue: true
+    maintenance: true
+    runnerAvailability: true
+    runnerTriggerFacts: true
+    schedulerAuthority: legacy-sqlite
+    clientQueryAuthority: legacy-sqlite

config/secrets-distribution.yaml

@@ -109,6 +109,14 @@ targets:
     enabled: true
 
 kubernetesSecrets:
+  - name: hwlab-web-probe-monitor-db
+    targetId: hwlab-nc01-v03
+    secretName: hwlab-web-probe-monitor-db
+    type: Opaque
+    data:
+      - sourceRef: hwlab/web-probe-monitor-db.env
+        sourceKey: DATABASE_URL
+        targetKey: DATABASE_URL
   - name: hwlab-nc01-v03-opencode-server-auth
     targetId: hwlab-nc01-v03
     secretName: hwlab-v03-opencode-server-auth