coulomb/approval-engine
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Hold the pinned image against the repository's schema

Browse source 
Schema v4 gave the deployment a silent drift surface: the pinned pair is
self-consistent, migrating to 3 and serving 3, while this repository has
moved to 4. That reads as healthy, which makes it worse than an error —
the failure is the assumption that the deployment records approver
principal type.

Document v4 in storage-operations, state in the deploy runbook that the
pin predates it, and add a test that requires the statement whenever the
release record's schema version differs from this repository's. Verified
to fail when the acknowledgement is removed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HyybaE7DUXrWYrhbnESCTe

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 1275879@bnt-lap001
Assistant-Session: eb464208-f821-41b2-bc5a-a6c33d92a8ad
This commit is contained in:
tegwick 2026-09-09 14:38:21 +02:00
parent 92043cfe51
commit fec4eaeb1b
4 changed files with 88 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

16
workplans/APPROVAL-WP-0002-production-readiness-and-consumer-adoption.md
View file

@ -351,6 +351,22 @@ delivery, so a rollout attempted today would fail closed by design and would
prove nothing. **T03 stays `wait`** — on T01's registrations and the audit
credential, not on anything this repo owns.
2026-09-09: schema v4 (`entries.principal_type`, T01) gave this task a new
drift surface, now closed in the only way that survives review. The manifest's
pinned pair is self-consistent — the published artifact migrates to 3 and serves
3 — so nothing fails, and that is exactly the dangerous shape: the deployment
reads healthy while the assumption "the deployment records approver principal
type" is false. `deploy/README.md` now states that the pin predates schema v4
and that carrying the new evidence requires cutting a new image at gate 3, and
`tests/test_deploy_manifest.py::test_pinned_image_schema_drift_is_acknowledged`
holds the statement: while the manifest pins the artifact
`docs/image-scan-2026-09-06.md` describes, that record's schema version must
match this repository or the runbook must say plainly that it does not. Verified
to fail when the acknowledgement is removed. `docs/storage-operations.md` gains
the v4 section (additive `ALTER TABLE`, legacy entries stay `NULL` and are never
back-filled to `human`, downgrade unsupported). T03 stays `wait`: gates 1 and 2
are unchanged and nothing is deployed. 125 tests pass.
## Wire outbox delivery and reconciliation
```task