coulomb/approval-engine
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Deploy approval service and verify native persistence and audit

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a09cbb-87c6-7900-a145-4ce53ba9f1a6
This commit is contained in:
tegwick 2026-09-14 01:08:50 +02:00
parent a0a602976e
commit d710bf0088
6 changed files with 151 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

19
workplans/APPROVAL-WP-0002-production-readiness-and-consumer-adoption.md
View file

@ -342,11 +342,28 @@ retry-attempt state, and migration/backup/atomicity tests are in place.
```task
id: APPROVAL-WP-0002-T03
status: wait
status: done
priority: high
state_hub_task_id: "f0aa2e6d-19e6-5b43-886c-efa4e3de5f22"
```
**Completed 2026-09-14 during SECRETS-WP-0010-T03.** Existing service registration
and audit custody had already passed owner acceptance; their stale absence was
not carried forward. Deployed the pinned schema-v5 image with the existing ESO
projection. Added exact KeyCape JWKS ingress, disabled unused SA token mounting,
and set a 25m CPU request to fit the node's measured remaining reservation
(500m limit unchanged; observed 1m CPU/20Mi). All 156 tests and six changed-manifest
checks pass. Native ready/schema/integrity/JWKS, anonymous/invalid-bearer refusal,
heartbeat acknowledgment and zero-pending outbox pass. Replaced the pod and
verified persistence; made an online 0600 backup, independently copied/checked
it and opened an isolated restore with the actual engine. Live DB not overwritten.
Receipt: `docs/evidence/2026-09-14-approval-engine-deployment.json`. T05 retains
the real PEP claim/check/consume and human/caller admission. Long-term backup
retention and independent receiver archive evidence remain operational/owner
follow-up, not implied by this initial restore exercise.
Add the governed image/deployment surface, health and readiness behavior,
resource bounds, and fail-closed caller configuration. A local WSGI development
server is not production evidence.