Implement approval engine production readiness

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a05e2e-805b-7042-a750-71f473bceea2

deploy/README.md

@@ -0,0 +1,26 @@
+# Deployment gates
+
+The checked-in StatefulSet is a reviewed release input, not evidence of a live
+deployment. Replace both image placeholders with the same immutable digest.
+SQLite is intentionally limited to one replica, `ReadWriteOnce` storage, and an
+`OnDelete` update: never start two writers against a copied database.
+
+Before applying:
+
+1. Register the exact `approval-engine` audience, caller scopes, and service
+   clients in KeyCape. Confirm the in-cluster JWKS endpoint and configured
+   issuer match the manifest.
+2. Register `approval-engine` as an audit-core sender, add matching audit-core
+   ingress, and provision `approval-engine-audit` through the credential owner.
+   The Secret must contain key `audit-token`; never commit its value.
+3. Build and scan the image, replace `REPLACE_WITH_RELEASE_DIGEST`, then run
+   `make deploy-dry-run`.
+4. Take a verified backup. Roll out by deleting the sole pod, then prove
+   readiness, restart persistence, outbox drain, heartbeat, and restore.
+5. Enable a caller namespace only by applying label
+   `railiance.io/approval-engine-client=true`; JWT scope checks remain the inner
+   boundary.
+
+The audit-core receiver-side registration, cadence findings, and accepted-count
+reconciliation are tracked by `AUDIT-WP-0009-T04/T06/T09` and cannot be closed
+from this repository.

deploy/approval-engine.yaml

@@ -0,0 +1,118 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: approval-engine
+  labels:
+    kubernetes.io/metadata.name: approval-engine
+    railiance.io/workload-class: platform
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: approval-engine
+  namespace: approval-engine
+spec:
+  selector:
+    app.kubernetes.io/name: approval-engine
+  ports:
+    - {name: http, port: 8080, targetPort: http, protocol: TCP}
+---
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: approval-engine
+  namespace: approval-engine
+spec:
+  serviceName: approval-engine
+  replicas: 1
+  podManagementPolicy: OrderedReady
+  updateStrategy: {type: OnDelete}
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: approval-engine
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: approval-engine
+    spec:
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 10001
+        fsGroup: 10001
+        seccompProfile: {type: RuntimeDefault}
+      initContainers:
+        - name: migrate
+          image: forgejo.coulomb.social/coulomb/approval-engine@sha256:REPLACE_WITH_RELEASE_DIGEST
+          args: ["migrate", "--db", "/data/approvals.sqlite"]
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities: {drop: ["ALL"]}
+            readOnlyRootFilesystem: true
+          volumeMounts:
+            - {name: data, mountPath: /data}
+            - {name: tmp, mountPath: /tmp}
+      containers:
+        - name: approval-engine
+          image: forgejo.coulomb.social/coulomb/approval-engine@sha256:REPLACE_WITH_RELEASE_DIGEST
+          args:
+            - serve
+            - --production
+            - --db
+            - /data/approvals.sqlite
+            - --host
+            - 0.0.0.0
+            - --port
+            - "8080"
+            - --tenant
+            - platform
+            - --jwt-issuer
+            - https://auth.netkingdom.local
+            - --jwt-audience
+            - approval-engine
+            - --jwks-url
+            - http://key-cape.sso.svc.cluster.local:8080/jwks
+            - --audit-url
+            - http://audit-core.audit-core.svc.cluster.local:8080
+            - --audit-token-file
+            - /var/run/secrets/approval-engine/audit-token
+          ports:
+            - {name: http, containerPort: 8080}
+          resources:
+            requests: {cpu: 50m, memory: 64Mi}
+            limits: {cpu: 500m, memory: 256Mi}
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities: {drop: ["ALL"]}
+            readOnlyRootFilesystem: true
+          startupProbe:
+            httpGet: {path: /healthz, port: http}
+            periodSeconds: 3
+            failureThreshold: 20
+          readinessProbe:
+            httpGet: {path: /readyz, port: http}
+            periodSeconds: 10
+            timeoutSeconds: 2
+          livenessProbe:
+            httpGet: {path: /healthz, port: http}
+            periodSeconds: 20
+            timeoutSeconds: 2
+          volumeMounts:
+            - {name: data, mountPath: /data}
+            - {name: tmp, mountPath: /tmp}
+            - name: audit-token
+              mountPath: /var/run/secrets/approval-engine
+              readOnly: true
+      volumes:
+        - name: tmp
+          emptyDir: {}
+        - name: audit-token
+          secret:
+            secretName: approval-engine-audit
+            defaultMode: 0440
+  volumeClaimTemplates:
+    - metadata:
+        name: data
+      spec:
+        accessModes: ["ReadWriteOnce"]
+        resources:
+          requests: {storage: 1Gi}

deploy/networkpolicies.yaml

@@ -0,0 +1,60 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: approval-engine-default-deny
+  namespace: approval-engine
+spec:
+  podSelector: {}
+  policyTypes: [Ingress, Egress]
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: approval-engine-callers
+  namespace: approval-engine
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: approval-engine
+  policyTypes: [Ingress]
+  ingress:
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: secrets-engine
+        - namespaceSelector:
+            matchLabels:
+              railiance.io/approval-engine-client: "true"
+      ports:
+        - {protocol: TCP, port: 8080}
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: approval-engine-egress
+  namespace: approval-engine
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: approval-engine
+  policyTypes: [Egress]
+  egress:
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: sso
+      ports:
+        - {protocol: TCP, port: 8080}
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: audit-core
+      ports:
+        - {protocol: TCP, port: 8080}
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
+      ports:
+        - {protocol: UDP, port: 53}
+        - {protocol: TCP, port: 53}