approval-engine/workplans/APPROVAL-WP-0002-production-readiness-and-consumer-adoption.md

id	type	title	domain	repo	status	owner	topic_slug	created	updated	origin	origin_ref
APPROVAL-WP-0002	workplan	Production readiness and consumer adoption	infotech	approval-engine	proposed	codex	netkingdom	2026-09-01	2026-09-01	residual	APPROVAL-WP-0001

APPROVAL-WP-0002 — Production readiness and consumer adoption

Move the completed first-cut engine spine into an authenticated, durable, observable production service and prove one PEP integration end to end. This is the residual production scope deliberately excluded from APPROVAL-WP-0001.

The workplan is proposed pending review against the deployment estate and the current key-cape, access-engine, audit-core, and secrets-engine contracts.

Authenticate lifecycle mutations and approver evidence

id: APPROVAL-WP-0002-T01
status: todo
priority: high

Bind create, approval-entry, revoke, supersede, and consume callers to authenticated identities. An API-supplied subject_id, actor, or decision_id is provenance only until independently authenticated. Keep authorization decisions in access-engine and approval doctrine in gate-house.

Harden durable storage and migrations

id: APPROVAL-WP-0002-T02
status: todo
priority: high

Define the production persistence, backup/restore, migration, concurrency, and recovery posture. Prove schema upgrades preserve existing approvals and that crash recovery cannot separate mutations from outbox evidence.

Package and deploy the service

id: APPROVAL-WP-0002-T03
status: todo
priority: high

Add the governed image/deployment surface, health and readiness behavior, resource bounds, and fail-closed caller configuration. A local WSGI development server is not production evidence.

Wire outbox delivery and reconciliation

id: APPROVAL-WP-0002-T04
status: todo
priority: high

Deliver the local outbox asynchronously to audit-core, preserve event-id deduplication, publish lag/depth signals, emit the declared heartbeat, and prove the Gate House reconciliation contract against accepted event counts.

Prove one live PEP consumption path

id: APPROVAL-WP-0002-T05
status: todo
priority: high

Integrate one protected-system consumer under GH-DEC-2026-003: claim before decision, CAS consume after ALLOW and before side effect, same-digest retry, different-digest conflict, spent-on-failure behavior, and no protected action when approval-engine is unavailable.