coulomb/approval-engine
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Retain verified tenant provenance and reconcile production blockers

Browse source 
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a1046e-fdbf-7b93-a267-5f72b9b24526
This commit is contained in:
tegwick 2026-10-04 11:26:32 +02:00
parent 931e0b3249
commit c9ad5c2dd7
12 changed files with 274 additions and 25 deletions
Download patch file Download diff file Expand all files Collapse all files

5
deploy/README.md
View file

@ -10,7 +10,10 @@ database.
(registry tag `0.1.0-hfact-be1a388`, source `be1a388`). Both references MUST stay
identical immutable digests: migration and server share one database.
The new artifact carries `LATEST_SCHEMA_VERSION = 5`, matching this source:
The deployed artifact carries schema v5 and predates schema v6 in this source.
Schema v6 records verified `entries.tenant_source`; it requires a new scanned,
published image, identical migration/server pins, backup and an approved rollout.
The existing deployed image records:
`entries.principal_type` and explicit `approvals.human_control`. Its release scan
found zero HIGH/CRITICAL vulnerabilities. Disposable on-disk v4-to-v5 migration,
negative service/agent binding, human binding/consumption and restart persistence