coulomb/approval-engine
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Deploy scanned schema6 cadence release on approved hourly runtime

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a13eab-1e6a-7b33-9c37-372e90ada3a2
This commit is contained in:
tegwick 2026-10-15 21:33:50 +02:00
parent a786b061da
commit 9491d1d3a7
2 changed files with 25 additions and 18 deletions
Download patch file Download diff file Expand all files Collapse all files

39
deploy/README.md
View file

@ -5,23 +5,30 @@ The StatefulSet is deployed as of 2026-09-14. The metadata receipt is
storage, and an `OnDelete` update: never start two writers against a copied
database.
**Image: pinned, published and deployed.** Both `image:` references carry
`sha256:251941a5cb2724b57cc32cff6b693b1ab0be695bee4f56f02d51961189c0fa49`
(registry tag `0.1.0-hfact-be1a388`, source `be1a388`). Both references MUST stay
identical immutable digests: migration and server share one database.
**Current image: pinned, published and deployed (2026-10-15).** Both `image:`
references carry
`sha256:16e5d222d58e179f4836f649e8f8128321a8b644d29dc426b4d21a65ff97845d`
(source `a786b061da4d7730c0827cf4919ab9206aed6d3e`). Migration and server
use identical immutable pins. The scanned image has zero HIGH/CRITICAL findings.
The deployed artifact carries schema v5 and predates schema v6 in this source.
Schema v6 records verified `entries.tenant_source`; it requires a new scanned,
published image, identical migration/server pins, backup and an approved rollout.
The existing deployed image records:
`entries.principal_type` and explicit `approvals.human_control`. Its release scan
found zero HIGH/CRITICAL vulnerabilities. Disposable on-disk v4-to-v5 migration,
negative service/agent binding, human binding/consumption and restart persistence
passed inside the non-root container with no network and a read-only root.
See [the image evidence](../docs/evidence/2026-09-10-human-control-image.json).
This is artifact evidence; native identity, audit delivery and production restore
remain deployment gates. Never roll the old v3 image over a v5 database; use the
matching verified pre-migration backup for rollback.
The founder-approved NK-WP-0035 release moved schema v5 to v6 and retained the
hourly heartbeat setting. A fresh verified online backup and independent 0600
copy preceded the controlled sole-pod replacement. The new image also opened
and migrated an isolated production backup with unchanged record counts.
Native readiness and v6 integrity pass; 54 approvals and 47 entries were
preserved with zero pending outbox rows. Source defaults and interval settings
alone do not establish elapsed-hour or independent receiver acceptance.
Receipts: `net-kingdom/docs/evidence/2026-10-15-cadence-adoption/` files
`approval-engine-pre-schema6-backup.json`, `approval-engine-v6-isolated-restore.json`
and `approval-engine-schema6-rollout.json`.
Schema v6 records verified `entries.tenant_source`; it does not infer legacy
provenance. The prior v5 image was
`sha256:251941a5cb2724b57cc32cff6b693b1ab0be695bee4f56f02d51961189c0fa49`.
It refuses a v6 store: rollback requires the matching verified pre-v6 backup
and the stopped-single-writer restore procedure in `docs/storage-operations.md`.
The earlier September v5 release evidence remains historical at
[the image evidence](../docs/evidence/2026-09-10-human-control-image.json).
The existing KeyCape consumer registration and CCR-2026-0021 audit projection
were already verified by their owners. Live inspection confirmed the projection

4
deploy/approval-engine.yaml
View file

@ -45,7 +45,7 @@ spec:
seccompProfile: {type: RuntimeDefault}
initContainers:
- name: migrate
image: forgejo.coulomb.social/coulomb/approval-engine@sha256:251941a5cb2724b57cc32cff6b693b1ab0be695bee4f56f02d51961189c0fa49
image: forgejo.coulomb.social/coulomb/approval-engine@sha256:16e5d222d58e179f4836f649e8f8128321a8b644d29dc426b4d21a65ff97845d
args: ["migrate", "--db", "/data/approvals.sqlite"]
securityContext:
allowPrivilegeEscalation: false
@ -56,7 +56,7 @@ spec:
- {name: tmp, mountPath: /tmp}
containers:
- name: approval-engine
image: forgejo.coulomb.social/coulomb/approval-engine@sha256:251941a5cb2724b57cc32cff6b693b1ab0be695bee4f56f02d51961189c0fa49
image: forgejo.coulomb.social/coulomb/approval-engine@sha256:16e5d222d58e179f4836f649e8f8128321a8b644d29dc426b4d21a65ff97845d
args:
- serve
- --production