# Deployment gates

The checked-in StatefulSet is a reviewed release input, not evidence of a live
deployment. SQLite is intentionally limited to one replica, `ReadWriteOnce`
storage, and an `OnDelete` update: never start two writers against a copied
database.

**Image: pinned, published, not rolled out.** Both `image:` references carry
`sha256:251941a5cb2724b57cc32cff6b693b1ab0be695bee4f56f02d51961189c0fa49`
(registry tag `0.1.0-hfact-be1a388`, source `be1a388`). Both references MUST stay
identical immutable digests: migration and server share one database.

The new artifact carries `LATEST_SCHEMA_VERSION = 5`, matching this source:
`entries.principal_type` and explicit `approvals.human_control`. Its release scan
found zero HIGH/CRITICAL vulnerabilities. Disposable on-disk v4-to-v5 migration,
negative service/agent binding, human binding/consumption and restart persistence
passed inside the non-root container with no network and a read-only root.
See [the image evidence](../docs/evidence/2026-09-10-human-control-image.json).
This is artifact evidence; native identity, audit delivery and production restore
remain deployment gates. Never roll the old v3 image over a v5 database; use the
matching verified pre-migration backup for rollback.

Gates 1 and 2 below are the outstanding ones; nothing is deployed today.

Before applying:

1. Register the exact `approval-engine` audience, caller scopes, and service
   clients in KeyCape. Confirm the in-cluster JWKS endpoint and configured
   issuer match the manifest.
2. Register `approval-engine` as an audit-core sender, add matching audit-core
   ingress, and provision `approval-engine-audit` through the credential owner.
   The Secret must contain key `audit-token`; never commit its value.
3. For a new release only: `make image-release` (build, scan, push — the scan
   gate fails the build on any CRITICAL or HIGH, so a failing scan blocks the
   push), then pin both `image:` references to the returned registry digest and
   run `make deploy-dry-run`. The current digest is already pinned; skip to 4
   unless you are cutting a new image.
4. Take a verified backup. Roll out by deleting the sole pod, then prove
   readiness, restart persistence, outbox drain, heartbeat, and restore.
5. Enable a caller namespace only by applying label
   `railiance.io/approval-engine-client=true`; JWT scope checks remain the inner
   boundary.

The audit-core receiver-side registration, cadence findings, and accepted-count
reconciliation are tracked by `AUDIT-WP-0009-T04/T06/T09` and cannot be closed
from this repository.