tegwick
c3f1dfbc07
Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a05e2e-805b-7042-a750-71f473bceea2
85 lines
2.4 KiB
Markdown
85 lines
2.4 KiB
Markdown
---
|
|
id: APPROVAL-WP-0002
|
|
type: workplan
|
|
title: "Production readiness and consumer adoption"
|
|
domain: infotech
|
|
repo: approval-engine
|
|
status: proposed
|
|
owner: codex
|
|
topic_slug: netkingdom
|
|
created: "2026-09-01"
|
|
updated: "2026-09-01"
|
|
origin: residual
|
|
origin_ref: APPROVAL-WP-0001
|
|
---
|
|
|
|
# APPROVAL-WP-0002 — Production readiness and consumer adoption
|
|
|
|
Move the completed first-cut engine spine into an authenticated, durable,
|
|
observable production service and prove one PEP integration end to end. This is
|
|
the residual production scope deliberately excluded from APPROVAL-WP-0001.
|
|
|
|
The workplan is proposed pending review against the deployment estate and the
|
|
current key-cape, access-engine, audit-core, and secrets-engine contracts.
|
|
|
|
## Authenticate lifecycle mutations and approver evidence
|
|
|
|
```task
|
|
id: APPROVAL-WP-0002-T01
|
|
status: todo
|
|
priority: high
|
|
```
|
|
|
|
Bind create, approval-entry, revoke, supersede, and consume callers to
|
|
authenticated identities. An API-supplied `subject_id`, `actor`, or
|
|
`decision_id` is provenance only until independently authenticated. Keep
|
|
authorization decisions in access-engine and approval doctrine in gate-house.
|
|
|
|
## Harden durable storage and migrations
|
|
|
|
```task
|
|
id: APPROVAL-WP-0002-T02
|
|
status: todo
|
|
priority: high
|
|
```
|
|
|
|
Define the production persistence, backup/restore, migration, concurrency, and
|
|
recovery posture. Prove schema upgrades preserve existing approvals and that
|
|
crash recovery cannot separate mutations from outbox evidence.
|
|
|
|
## Package and deploy the service
|
|
|
|
```task
|
|
id: APPROVAL-WP-0002-T03
|
|
status: todo
|
|
priority: high
|
|
```
|
|
|
|
Add the governed image/deployment surface, health and readiness behavior,
|
|
resource bounds, and fail-closed caller configuration. A local WSGI development
|
|
server is not production evidence.
|
|
|
|
## Wire outbox delivery and reconciliation
|
|
|
|
```task
|
|
id: APPROVAL-WP-0002-T04
|
|
status: todo
|
|
priority: high
|
|
```
|
|
|
|
Deliver the local outbox asynchronously to audit-core, preserve event-id
|
|
deduplication, publish lag/depth signals, emit the declared heartbeat, and prove
|
|
the Gate House reconciliation contract against accepted event counts.
|
|
|
|
## Prove one live PEP consumption path
|
|
|
|
```task
|
|
id: APPROVAL-WP-0002-T05
|
|
status: todo
|
|
priority: high
|
|
```
|
|
|
|
Integrate one protected-system consumer under `GH-DEC-2026-003`: claim before
|
|
decision, CAS consume after ALLOW and before side effect, same-digest retry,
|
|
different-digest conflict, spent-on-failure behavior, and no protected action
|
|
when approval-engine is unavailable.
|