coulomb/approval-engine
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Enforce declared human controls at approval binding

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc
This commit is contained in:
tegwick 2026-09-10 19:26:12 +02:00
parent a3c94fb241
commit be1a388a84
17 changed files with 441 additions and 40 deletions
Download patch file Download diff file Expand all files Collapse all files

8
deploy/README.md
View file

@ -13,12 +13,12 @@ pinned at `b51d174`. There is no placeholder left to replace. Both references
MUST stay identical and MUST stay digests — a tag here would let the init
container and the server run different code against one database.
**The pinned image predates schema v4.** The published artifact recorded in
**The pinned image predates schema v5.** The published artifact recorded in
[`docs/image-scan-2026-09-06.md`](../docs/image-scan-2026-09-06.md) carries
`LATEST_SCHEMA_VERSION = 3`; this repository is now at 4
(`entries.principal_type`, see [storage-operations.md](../docs/storage-operations.md)).
`LATEST_SCHEMA_VERSION = 3`; this repository is now at 5
(`entries.principal_type` plus `approvals.human_control`, see [storage-operations.md](../docs/storage-operations.md)).
The pinned pair is self-consistent — that image migrates to 3 and serves 3 — so
nothing is broken by leaving it pinned, but a rollout that must carry approver
nothing is broken by leaving it pinned, but a rollout that must enforce declared human controls or carry approver
principal-type evidence requires cutting a new image at step 3 below. The
`migrate` init container then performs the additive upgrade on the existing
volume; `tests/test_deploy_manifest.py` holds this acknowledgement so the drift