# Deployment gates

The checked-in StatefulSet is a reviewed release input, not evidence of a live
deployment. Replace both image placeholders with the same immutable digest.
SQLite is intentionally limited to one replica, `ReadWriteOnce` storage, and an
`OnDelete` update: never start two writers against a copied database.

Before applying:

1. Register the exact `approval-engine` audience, caller scopes, and service
   clients in KeyCape. Confirm the in-cluster JWKS endpoint and configured
   issuer match the manifest.
2. Register `approval-engine` as an audit-core sender, add matching audit-core
   ingress, and provision `approval-engine-audit` through the credential owner.
   The Secret must contain key `audit-token`; never commit its value.
3. Build and scan the image, replace `REPLACE_WITH_RELEASE_DIGEST`, then run
   `make deploy-dry-run`.
4. Take a verified backup. Roll out by deleting the sole pod, then prove
   readiness, restart persistence, outbox drain, heartbeat, and restore.
5. Enable a caller namespace only by applying label
   `railiance.io/approval-engine-client=true`; JWT scope checks remain the inner
   boundary.

The audit-core receiver-side registration, cadence findings, and accepted-count
reconciliation are tracked by `AUDIT-WP-0009-T04/T06/T09` and cannot be closed
from this repository.