Deploy approval service and verify native persistence and audit

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a09cbb-87c6-7900-a145-4ce53ba9f1a6

deploy/README.md

@@ -1,11 +1,11 @@
 # Deployment gates
 
-The checked-in StatefulSet is a reviewed release input, not evidence of a live
-deployment. SQLite is intentionally limited to one replica, `ReadWriteOnce`
+The StatefulSet is deployed as of 2026-09-14. The metadata receipt is
+`docs/evidence/2026-09-14-approval-engine-deployment.json`. SQLite is intentionally limited to one replica, `ReadWriteOnce`
 storage, and an `OnDelete` update: never start two writers against a copied
 database.
 
-**Image: pinned, published, not rolled out.** Both `image:` references carry
+**Image: pinned, published and deployed.** Both `image:` references carry
 `sha256:251941a5cb2724b57cc32cff6b693b1ab0be695bee4f56f02d51961189c0fa49`
 (registry tag `0.1.0-hfact-be1a388`, source `be1a388`). Both references MUST stay
 identical immutable digests: migration and server share one database.
@@ -20,9 +20,29 @@ This is artifact evidence; native identity, audit delivery and production restor
 remain deployment gates. Never roll the old v3 image over a v5 database; use the
 matching verified pre-migration backup for rollback.
 
-Gates 1 and 2 below are the outstanding ones; nothing is deployed today.
+The existing KeyCape consumer registration and CCR-2026-0021 audit projection
+were already verified by their owners. Live inspection confirmed the projection
+Ready, exact key name, receiver c82e0442 and existing producer ingress; custody
+was reused without reading or rotating its value. Added the exact namespace AND
+pod-label ingress to KeyCape for JWKS (`deploy/keycape-ingress.yaml`).
 
-Before applying:
+The pod requests 25m CPU/64Mi with unchanged 500m/256Mi limits: the node had
+3975m of its 4000m CPU reserved, so the prior 50m request could not schedule.
+Initial native observation was 1m CPU/20Mi. No other workload was resized.
+Kubernetes token automount is disabled; the service uses no Kubernetes API.
+
+The live service passed schema-v5 integrity, current JWKS reachability, anonymous
+and invalid-bearer 401, first heartbeat delivery with zero pending outbox,
+pod replacement with unchanged persisted outbox, verified online backup and an
+isolated restore opened by the actual engine. An independent 0600 backup copy
+was inspected locally. No live database was overwritten. The initial backup
+copies are test evidence, not a long-term backup schedule or disaster-recovery
+acceptance. Capacity and independent retention remain operational follow-up.
+
+The real PEP adoption is still T05: CCR-2026-0019's operator group/reader,
+requesting identity and real human approval are not supplied by deployment.
+
+For a future reinstall or release:
 
 1. Register the exact `approval-engine` audience, caller scopes, and service
    clients in KeyCape. Confirm the in-cluster JWKS endpoint and configured

deploy/approval-engine.yaml

@@ -35,6 +35,7 @@ spec:
       labels:
         app.kubernetes.io/name: approval-engine
     spec:
+      automountServiceAccountToken: false
       securityContext:
         runAsNonRoot: true
         runAsUser: 10001
@@ -78,7 +79,7 @@ spec:
           ports:
             - {name: http, containerPort: 8080}
           resources:
-            requests: {cpu: 50m, memory: 64Mi}
+            requests: {cpu: 25m, memory: 64Mi}
             limits: {cpu: 500m, memory: 256Mi}
           securityContext:
             allowPrivilegeEscalation: false

deploy/keycape-ingress.yaml

@@ -0,0 +1,21 @@
+# APPROVAL-WP-0002-T03 / SECRETS-WP-0010-T03: exact verifier JWKS peer.
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: allow-approval-engine-to-keycape
+  namespace: sso
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: keycape
+  policyTypes: [Ingress]
+  ingress:
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: approval-engine
+          podSelector:
+            matchLabels:
+              app.kubernetes.io/name: approval-engine
+      ports:
+        - {protocol: TCP, port: 8080}