diff --git a/docs/compact-sitting-v14-release-runbook.md b/docs/compact-sitting-v14-release-runbook.md index 0db731e..3a41bb4 100644 --- a/docs/compact-sitting-v14-release-runbook.md +++ b/docs/compact-sitting-v14-release-runbook.md @@ -1,6 +1,9 @@ # Runbook: release compact-sitting v14 to `flex-auth-informed-decision-sitting` -**Date prepared:** 2026-11-01 (owner: access-engine / flex-auth; nothing below has been run) +**Date prepared:** 2026-11-01 (owner: access-engine / flex-auth) +**Status:** RELEASED 2026-11-01 by the founder: Helm revision 14 (14:27:06 +0100), informed-decision +pinned v14 at 005709a in the same window, step-4 checks matched. Receipt: +`docs/evidence/2026-11-01-compact-sitting-v14/release-receipt.json`. Rollback target: revision 13. **Workplan:** `workplans/FLEX-WP-0040-bounded-execution-pdp-gate.md`, FLEX-WP-0040-T07 **Owner note:** `docs/compact-sitting-v14-present-existing.md` ("Live steps") **Approval:** founder, 2026-11-01, relayed by the net-kingdom coordinator @@ -211,9 +214,10 @@ is not the problem. ## After a successful release (owner follow-up) -- Record the Helm revision and the step-4 output under - `docs/evidence/2026-11-01-compact-sitting-v14/` and mark FLEX-WP-0040-T07 accordingly. -- Update `registry/release-units/flex-auth-informed-decision-sitting.yaml` to the new image - digest and source. +- Done 2026-11-01: Helm revision 14 and the step-4 output recorded in + `docs/evidence/2026-11-01-compact-sitting-v14/release-receipt.json`; FLEX-WP-0040-T07 + carries the release note. +- Done 2026-11-01: `registry/release-units/flex-auth-informed-decision-sitting.yaml` pins + image `dce2ce6f…dd6c` and source `4d5ae6e`. - Keep `values/informed-decision-lifecycle-review.candidate.yaml` as the v13 rollback reference until the v14 pair has run cleanly. diff --git a/docs/evidence/2026-11-01-compact-sitting-v14/release-receipt.json b/docs/evidence/2026-11-01-compact-sitting-v14/release-receipt.json new file mode 100644 index 0000000..fa21d25 --- /dev/null +++ b/docs/evidence/2026-11-01-compact-sitting-v14/release-receipt.json @@ -0,0 +1,84 @@ +{ + "scope": "founder-run release of compact-sitting v14 to Helm release flex-auth-informed-decision-sitting; results as observed by the founder and relayed by the net-kingdom coordinator; owner recorded, did not run any live step", + "date": "2026-11-01", + "operator": "founder (net-kingdom coordinator guiding)", + "runbook": "docs/compact-sitting-v14-release-runbook.md (access-engine 4d5ae6e7ec9b495e43c11b4f73eb6ff27eaa17d9)", + "release": { + "name": "flex-auth-informed-decision-sitting", + "namespace": "flex-auth", + "chart": "charts/flex-auth", + "values": "values/informed-decision-sitting.yaml" + }, + "step0_state_in_force": { + "helm_revision": 13, + "status": "deployed", + "image": "forgejo.coulomb.social/coulomb/flex-auth@sha256:6c6dc263f4a7f6461e109e133c004c080e8e373acfead8611856c5fb3e44168e", + "policy": "/opt/flex-auth/examples/informed-decision-lifecycle-review/policy.md (v13)", + "prev": 13, + "note": "confirms the source-evidence reading (FLEX-WP-0034 rev 13); values file bdac62bc was stale" + }, + "step1_dry_run_diff": { + "dry_run": "ok", + "diff_objects": [ + "Deployment/flex-auth-informed-decision-sitting" + ], + "changes": [ + "--policy -> /opt/flex-auth/examples/informed-decision-present-existing-review/policy.md", + "added --caller-audience flex-auth (binary default; no behaviour change)", + "image -> sha256:dce2ce6f1def41d162c999818caeee09dc5404331f305b0d20306fade450dd6c", + "memory request 32Mi -> 40Mi" + ] + }, + "step2_upgrade": { + "command": "helm upgrade --atomic --wait --timeout 3m", + "helm_revision": 14, + "status": "deployed", + "deployed_at": "2026-11-01T14:27:06+01:00", + "rollout": "successful", + "image": "forgejo.coulomb.social/coulomb/flex-auth@sha256:dce2ce6f1def41d162c999818caeee09dc5404331f305b0d20306fade450dd6c", + "image_tag": "main-f4c9f2b", + "policy": { + "package": "informed-decision.compact-sitting", + "version": "v14", + "package_digest": "sha256:8911458f36f1a60598aa19592a2d752a74dffe2617fd86238407ac87bc300fde" + } + }, + "step3_consumer": { + "repo": "informed-decision", + "runbook": "deploy/lifecycle/RELEASE-INFD-WP-0010-T02.md (step 3b)", + "argo": "Succeeded at 005709a37228ba9e6d5a658aada0b62bf49649f5, Healthy", + "image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:ca75f0be03af0bd96a66b08d2949bdc2d16365a93ffabcd6593074b565e8f01b", + "policy_pin": "v14 sha256:8911458f36f1a60598aa19592a2d752a74dffe2617fd86238407ac87bc300fde", + "timing": "immediately after step 2" + }, + "step4_verify": { + "method": "port-forward svc/flex-auth-informed-decision-sitting, 10-minute token for informed-decision:review (audience flex-auth), synthetic requests from this directory", + "results": [ + [ + "verify-self-approval", + "deny", + "self_approval_refused", + "v14", + "sha256:8911458f36f1a60598aa19592a2d752a74dffe2617fd86238407ac87bc300fde" + ], + [ + "verify-missing-action", + "deny", + "approval_action_not_admitted", + "v14", + "sha256:8911458f36f1a60598aa19592a2d752a74dffe2617fd86238407ac87bc300fde" + ], + [ + "no-token", + "http 401" + ] + ], + "expected": "matched", + "consumer_check": "informed-decision review page for an existing memo loads with the v14 pin" + }, + "not_claimed": "no present-existing approval by nk-bind-executor has been reviewed yet; no human disposition is recorded by this receipt", + "rollback": { + "command": "helm -n flex-auth rollback flex-auth-informed-decision-sitting 13 --wait --timeout 3m, then informed-decision back to its v13 pin", + "values": "values/informed-decision-lifecycle-review.candidate.yaml (image 6c6dc263, v13 31be5985, 32Mi)" + } +} diff --git a/registry/release-units/flex-auth-informed-decision-sitting.yaml b/registry/release-units/flex-auth-informed-decision-sitting.yaml index c6fd14c..0b3bbf5 100644 --- a/registry/release-units/flex-auth-informed-decision-sitting.yaml +++ b/registry/release-units/flex-auth-informed-decision-sitting.yaml @@ -36,7 +36,7 @@ pins: digest: hashAlgorithm: SHA-256 normalisationAlgorithm: ociArtifactDigest/v1 - value: sha256:6c6dc263f4a7f6461e109e133c004c080e8e373acfead8611856c5fb3e44168e + value: sha256:dce2ce6f1def41d162c999818caeee09dc5404331f305b0d20306fade450dd6c sources: - name: access-engine type: git @@ -44,4 +44,4 @@ pins: digest: hashAlgorithm: SHA-1 normalisationAlgorithm: gitCommit/v1 - value: f529c71eb063dd8b263524663f0ca7cee15c5ee6 + value: 4d5ae6e7ec9b495e43c11b4f73eb6ff27eaa17d9 diff --git a/values/informed-decision-sitting.yaml b/values/informed-decision-sitting.yaml index afcb0a0..b75eada 100644 --- a/values/informed-decision-sitting.yaml +++ b/values/informed-decision-sitting.yaml @@ -1,7 +1,8 @@ -# FLEX-WP-0040-T07 release candidate (founder-approved 2026-11-01; NOT yet applied): +# FLEX-WP-0040-T07: released by the founder 2026-11-01, Helm revision 14 (receipt +# docs/evidence/2026-11-01-compact-sitting-v14/release-receipt.json): # compact-sitting v14 sha256:8911458f36f1a60598aa19592a2d752a74dffe2617fd86238407ac87bc300fde, # CI image main-f4c9f2b (Go 1.26.10). Runbook: docs/compact-sitting-v14-release-runbook.md. -# In force before this release (Helm rev 13, FLEX-WP-0034, v13): image 6c6dc263...168e, +# Before this release (Helm rev 13, FLEX-WP-0034, v13): image 6c6dc263...168e, # exact values values/informed-decision-lifecycle-review.candidate.yaml (rollback). name: flex-auth-informed-decision-sitting image: diff --git a/workplans/FLEX-WP-0040-bounded-execution-pdp-gate.md b/workplans/FLEX-WP-0040-bounded-execution-pdp-gate.md index ba57c11..23ea23f 100644 --- a/workplans/FLEX-WP-0040-bounded-execution-pdp-gate.md +++ b/workplans/FLEX-WP-0040-bounded-execution-pdp-gate.md @@ -8,7 +8,7 @@ status: active flavor: implementation owner: access-engine created: "2026-10-31" -updated: "2026-10-31" +updated: "2026-11-01" related: [NK-WP-0056, FLEX-WP-0039, FLEX-WP-0031] state_hub_workstream_id: "1b0a9f9e-9d09-52da-8dd0-8269dd3d27ec" --- @@ -141,6 +141,17 @@ Gate met: 46 embedded tests and the Go pin/evaluation tests pass; v13 untouched. Live use waits on informed-decision carrying `approval_action` and a founder release (image, values, consumer pin); no deployment from this task. +Released 2026-11-01 (founder-run, runbook `docs/compact-sitting-v14-release-runbook.md`): +Helm `flex-auth-informed-decision-sitting` revision 14 (from 13), image +`main-f4c9f2b` `sha256:dce2ce6f1def41d162c999818caeee09dc5404331f305b0d20306fade450dd6c` +(Go 1.26.10 rebuild after the founder required zero HIGH/CRITICAL; Trivy 0), policy v14. +informed-decision pinned v14 in the same window (005709a, image `ca75f0be…`, carrying +`approval_action` from 80ef840). Native checks deny `self_approval_refused` and +`approval_action_not_admitted` under v14/8911458f; no token is 401; the consumer's review +page loads. Rollback: revision 13 (`6c6dc263`, v13). Receipt: +`docs/evidence/2026-11-01-compact-sitting-v14/release-receipt.json`. No executor approval +has been reviewed yet. + ## Founder decision 2026-10-31 Approved by the founder (`proposed` -> `ready`) after the NK-WP-0056-T02 owner answers (hub decision 19afd15e). The T06 pilot runs without the gate and records it as `not-evaluated`; a second admission needs this gate or a founder-recorded exception.