Implement local decision delivery and reconcile blocked workplan requirements

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a1046e-fcad-7ea3-bf36-361fc8d679e8

charts/flex-auth/templates/deployment.yaml

@@ -5,6 +5,13 @@ metadata:
   labels:
     {{- include "flex-auth.labels" . | nindent 4 }}
 spec:
+  {{- if .Values.outbox.enabled }}
+  {{- if ne (int .Values.replicaCount) 1 }}
+  {{- fail "outbox requires replicaCount=1: one writer per source and PVC" }}
+  {{- end }}
+  strategy:
+    type: Recreate
+  {{- end }}
   replicas: {{ .Values.replicaCount }}
   selector:
     matchLabels:
@@ -31,6 +38,12 @@ spec:
           imagePullPolicy: {{ .Values.image.pullPolicy }}
           args:
             {{- toYaml .Values.args | nindent 12 }}
+            {{- if .Values.outbox.enabled }}
+            - --outbox-dir
+            - {{ .Values.outbox.mountPath | quote }}
+            - --emission-source
+            - {{ required "outbox.source is required when outbox.enabled=true" .Values.outbox.source | quote }}
+            {{- end }}
             {{- if eq (include "flex-auth.callerAuth.enabled" .) "true" }}
             {{- $binding := required "callerAuth.binding is required when callerAuth.mode is warn or enforce" .Values.callerAuth.binding }}
             - --caller-auth-mode
@@ -65,14 +78,26 @@ spec:
               drop:
                 - ALL
             readOnlyRootFilesystem: true
-          {{- if eq (include "flex-auth.callerAuth.enabled" .) "true" }}
+          {{- if or .Values.outbox.enabled (eq (include "flex-auth.callerAuth.enabled" .) "true") }}
           volumeMounts:
+            {{- if .Values.outbox.enabled }}
+            - mountPath: {{ .Values.outbox.mountPath | quote }}
+              name: flex-auth-outbox
+            {{- end }}
+            {{- if eq (include "flex-auth.callerAuth.enabled" .) "true" }}
             - mountPath: {{ .Values.callerAuth.reviewer.mountPath }}
               name: flex-auth-reviewer
               readOnly: true
+            {{- end }}
           {{- end }}
-      {{- if eq (include "flex-auth.callerAuth.enabled" .) "true" }}
+      {{- if or .Values.outbox.enabled (eq (include "flex-auth.callerAuth.enabled" .) "true") }}
       volumes:
+        {{- if .Values.outbox.enabled }}
+        - name: flex-auth-outbox
+          persistentVolumeClaim:
+            claimName: {{ default (printf "%s-outbox" (include "flex-auth.name" .)) .Values.outbox.existingClaim | quote }}
+        {{- end }}
+        {{- if eq (include "flex-auth.callerAuth.enabled" .) "true" }}
         - name: flex-auth-reviewer
           projected:
             defaultMode: 0440
@@ -88,4 +113,5 @@ spec:
                   items:
                     - key: ca.crt
                       path: ca.crt
+        {{- end }}
       {{- end }}

charts/flex-auth/templates/outbox-pvc.yaml

@@ -0,0 +1,19 @@
+{{- if and .Values.outbox.enabled (not .Values.outbox.existingClaim) }}
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: {{ include "flex-auth.name" . }}-outbox
+  annotations:
+    helm.sh/resource-policy: keep
+  labels:
+    {{- include "flex-auth.labels" . | nindent 4 }}
+spec:
+  accessModes:
+    - ReadWriteOnce
+  {{- if .Values.outbox.storageClassName }}
+  storageClassName: {{ .Values.outbox.storageClassName | quote }}
+  {{- end }}
+  resources:
+    requests:
+      storage: {{ .Values.outbox.size | quote }}
+{{- end }}

charts/flex-auth/values.yaml

@@ -9,6 +9,15 @@ image:
 
 replicaCount: 1
 
+# Inert until enabled for an approved pin. The outbox is single-writer.
+outbox:
+  enabled: false
+  source: ""
+  mountPath: /var/lib/flex-auth/outbox
+  size: 1Gi
+  storageClassName: ""
+  existingClaim: ""
+
 args:
   - serve
   - --addr