Implement approval engine production readiness
Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a05e2e-805b-7042-a750-71f473bceea2
This commit is contained in:
parent
ebce5abb27
commit
2bd2d19a98
30 changed files with 1679 additions and 53 deletions
|
|
@ -4,11 +4,20 @@ type: workplan
|
|||
title: "Production readiness and consumer adoption"
|
||||
domain: infotech
|
||||
repo: approval-engine
|
||||
status: proposed
|
||||
status: active
|
||||
owner: codex
|
||||
topic_slug: netkingdom
|
||||
created: "2026-09-01"
|
||||
updated: "2026-09-01"
|
||||
updated: "2026-09-02"
|
||||
reviewed_at: "2026-09-01"
|
||||
reviewed_against_commit: "ebce5abb276c01ab29ce2526f3b8abb332dc9e90"
|
||||
reviewed_note: >-
|
||||
Reviewed against approval-engine's finished spine, KeyCape's RS256/JWKS and
|
||||
service-token contract, access-engine caller-auth/binding surface,
|
||||
audit-core's deployed authenticated ingestion plus open AUDIT-WP-0009
|
||||
approval-source/cadence/reconciliation tasks, and secrets-engine's waiting
|
||||
exact-action/decision-consumption tasks. Repo-owned implementation can
|
||||
proceed; live T03-T05 closure remains evidence-gated on those owners.
|
||||
origin: residual
|
||||
origin_ref: APPROVAL-WP-0001
|
||||
state_hub_workstream_id: "4fa25ad5-f5d0-5592-aa59-085f8ee3edaf"
|
||||
|
|
@ -23,11 +32,21 @@ the residual production scope deliberately excluded from APPROVAL-WP-0001.
|
|||
The workplan is proposed pending review against the deployment estate and the
|
||||
current key-cape, access-engine, audit-core, and secrets-engine contracts.
|
||||
|
||||
Review completed 2026-09-01. The plan is active. Production mode will verify
|
||||
KeyCape JWT signatures and exact issuer/audience/scopes; local caller-supplied
|
||||
identity never becomes authenticated evidence. SQLite remains the first
|
||||
production store only as a single-replica StatefulSet with explicit migration,
|
||||
backup, integrity, and restore gates. audit-core delivery can be implemented
|
||||
against its existing authenticated idempotent ingest, while heartbeat findings,
|
||||
count reconciliation, and sender registration remain external gates in
|
||||
`AUDIT-WP-0009` T04/T06/T09. The first live PEP proof remains jointly gated on
|
||||
secrets-engine T04/T02 and deployment of this service.
|
||||
|
||||
## Authenticate lifecycle mutations and approver evidence
|
||||
|
||||
```task
|
||||
id: APPROVAL-WP-0002-T01
|
||||
status: todo
|
||||
status: progress
|
||||
priority: high
|
||||
state_hub_task_id: "dc4523f5-e0af-5734-a0ef-07aa7f2b2a27"
|
||||
```
|
||||
|
|
@ -37,11 +56,24 @@ authenticated identities. An API-supplied `subject_id`, `actor`, or
|
|||
`decision_id` is provenance only until independently authenticated. Keep
|
||||
authorization decisions in access-engine and approval doctrine in gate-house.
|
||||
|
||||
Acceptance: production startup requires a signature-valid KeyCape JWT verifier;
|
||||
every non-health API route requires an explicit scope; approval entry identity
|
||||
and assurance come only from verified claims; create binds `binding.actor` to
|
||||
the authenticated subject; consume is restricted to service/agent principals;
|
||||
missing, expired, wrong-issuer, wrong-audience, wrong-scope, or unverifiable
|
||||
tokens fail closed without mutation.
|
||||
|
||||
Repository implementation complete 2026-09-02: RS256/JWKS verification,
|
||||
issuer/audience/time/profile validation, exact scopes, store-tenant isolation,
|
||||
verified approver evidence, and a deny-all default are covered by tests. Remains
|
||||
`progress` until KeyCape owns and proves the production audience/client/scope
|
||||
registrations.
|
||||
|
||||
## Harden durable storage and migrations
|
||||
|
||||
```task
|
||||
id: APPROVAL-WP-0002-T02
|
||||
status: todo
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "2bef94ca-9482-5eff-9bd9-39adef292a78"
|
||||
```
|
||||
|
|
@ -50,11 +82,21 @@ Define the production persistence, backup/restore, migration, concurrency, and
|
|||
recovery posture. Prove schema upgrades preserve existing approvals and that
|
||||
crash recovery cannot separate mutations from outbox evidence.
|
||||
|
||||
Acceptance: schema version is explicit; production serve refuses an unmigrated
|
||||
or in-memory store; migration is a separate repeatable command; backup uses
|
||||
SQLite's online backup API and integrity verification; restore is documented as
|
||||
a stopped-single-writer operation; tests cover legacy upgrade, backup/restore,
|
||||
and outbox atomicity after restart.
|
||||
|
||||
Completed 2026-09-02: schema v2 migration, production no-auto-migrate gate,
|
||||
integrity/status surface, online mode-0600 backup, stopped-writer restore runbook,
|
||||
retry-attempt state, and migration/backup/atomicity tests are in place.
|
||||
|
||||
## Package and deploy the service
|
||||
|
||||
```task
|
||||
id: APPROVAL-WP-0002-T03
|
||||
status: todo
|
||||
status: wait
|
||||
priority: high
|
||||
state_hub_task_id: "f0aa2e6d-19e6-5b43-886c-efa4e3de5f22"
|
||||
```
|
||||
|
|
@ -63,11 +105,23 @@ Add the governed image/deployment surface, health and readiness behavior,
|
|||
resource bounds, and fail-closed caller configuration. A local WSGI development
|
||||
server is not production evidence.
|
||||
|
||||
Acceptance: a digest-pin-ready image and single-writer StatefulSet manifest
|
||||
exist with non-root/read-only-root controls, PVC, migration init container,
|
||||
resource bounds, probes, and default-deny network policy. Live completion also
|
||||
requires an immutable image digest, KeyCape registrations, audit sender
|
||||
credential, successful rollout, and restart/restore evidence.
|
||||
|
||||
Repository implementation complete 2026-09-02: the digest-pin-ready non-root
|
||||
image builds and runs; the single-writer StatefulSet, PVC, migration init,
|
||||
read-only root, resources, probes, and default-deny policies pass client dry-run.
|
||||
Waiting on release digest, KeyCape/audit registrations and credentials, rollout,
|
||||
restart, and restore evidence.
|
||||
|
||||
## Wire outbox delivery and reconciliation
|
||||
|
||||
```task
|
||||
id: APPROVAL-WP-0002-T04
|
||||
status: todo
|
||||
status: wait
|
||||
priority: high
|
||||
state_hub_task_id: "777a5cf5-c1db-5e07-8de6-ab109db5ccdc"
|
||||
```
|
||||
|
|
@ -76,11 +130,22 @@ Deliver the local outbox asynchronously to audit-core, preserve event-id
|
|||
deduplication, publish lag/depth signals, emit the declared heartbeat, and prove
|
||||
the Gate House reconciliation contract against accepted event counts.
|
||||
|
||||
Acceptance: the sender adapts the local event to audit-core's authenticated
|
||||
HTTP ingest, reuses event id as idempotency key, rereads a mounted token file,
|
||||
marks drained only on accepted/duplicate, retains retryable failures, exposes
|
||||
attempt/lag state, and emits the declared heartbeat. Live reconciliation waits
|
||||
on `AUDIT-WP-0009-T04/T06/T09`; do not invent that receiver surface here.
|
||||
|
||||
Repository implementation complete 2026-09-02: audit-core envelope adaptation,
|
||||
event-id idempotency, mounted-token reread, accepted/duplicate handling,
|
||||
retry-attempt/lag metrics, and periodic heartbeats are tested. Waiting on the
|
||||
audit-core sender registration/ingress and receiver-owned reconciliation work.
|
||||
|
||||
## Prove one live PEP consumption path
|
||||
|
||||
```task
|
||||
id: APPROVAL-WP-0002-T05
|
||||
status: todo
|
||||
status: wait
|
||||
priority: high
|
||||
state_hub_task_id: "3196fb77-3df0-5358-ae12-2d07bac12041"
|
||||
```
|
||||
|
|
@ -89,3 +154,14 @@ Integrate one protected-system consumer under `GH-DEC-2026-003`: claim before
|
|||
decision, CAS consume after ALLOW and before side effect, same-digest retry,
|
||||
different-digest conflict, spent-on-failure behavior, and no protected action
|
||||
when approval-engine is unavailable.
|
||||
|
||||
Acceptance: a repeatable harness proves the PEP sequence against the real HTTP
|
||||
surface without performing a protected action; live closure requires a
|
||||
secrets-engine-owned handler and evidence that no OpenBao call occurs on every
|
||||
failure case. This repo may supply the protocol client and fixture, but may not
|
||||
claim the consumer's side effect.
|
||||
|
||||
Repository implementation complete 2026-09-02: the HTTP PEP client and
|
||||
fail-closed sequencing harness prove claim-before-decision and CAS-consume-before
|
||||
callback, including unavailable, DENY, digest mismatch, and conflict paths.
|
||||
Waiting on the secrets-engine-owned handler and live no-OpenBao-on-failure proof.
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue