coulomb/glas-harness
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
glas-harness/history/2026-09-06-174000-production-deployment.md
tegwick 4608f10632
All checks were successful
ci / validate (push) Successful in 2m26s
Details
docs: record production policy deployment and remaining approval gates 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a0726e-5232-73f2-aaca-2c05ceb62efb
2026-09-06 19:45:40 +02:00

2.7 KiB
Raw Blame History

Production deployment result — 2026-09-06

User authorized production deployment. The dedicated secrets-engine policy service is deployed; the complete approval/credential chain is not activated.

Deployed

  • Helm release flex-auth-secrets-engine, namespace flex-auth, revision 1.
  • Image forgejo.coulomb.social/coulomb/flex-auth at sha256:89086c02c74a931068423e70937d03df7850fa0db9c63e70be56b3558f1756af, verified against CI tag main-dd3ce4c before application.
  • Policy secrets-engine.catalog-lane.lifecycle v1.
  • Endpoint http://flex-auth-secrets-engine.flex-auth.svc.cluster.local:8080.
  • Available 1/1; caller-auth warn per FLEX-WP-0021-T04. This mode does not enforce authenticated caller identity. Ingress requires the secrets-engine namespace and app.kubernetes.io/name=secrets-engine pod label.
  • Helm lint and server dry-run passed. Five published Check fixtures returned two allows (rotate, dual-control destroy) and three denies (unknown subject, missing destroy claim, unknown revoke action). These are policy evaluations, not actual protected actions or approval consumption.
  • Network probes verified allowed identity access after initial propagation retry, plus wrong-label and wrong-namespace denial across retries. All six temporary pods and the local port-forward were removed.
  • Existing ops-warden, user-engine and tenant-engine Deployment specs compared equal before/after. New secrets-engine namespace retained for future consumer.
  • Deployment input lives in flex-auth/values/secrets-engine.yaml; first-install rollback is removal of only this dedicated Helm release.

Remaining production gates

approval-engine is not deployed. Live preflight found:

  1. The two required KeyCape clients are absent; confidential client credentials and audience/scope validation are still needed.
  2. audit-core sender scope registers only user-engine. Approval sender registration, token custody and ingress are still needed.
  3. Store tenant platform, requested client tenant:coulomb and PDP tenant:platform differ. Owner contracts must align before exact tenant verification can pass.
  4. The approval image still needs a built/scanned immutable release digest.

Corrected approval-engine's deployment issuer to https://kc.coulomb.social and JWKS service DNS to keycape.sso.svc.cluster.local, matching observed live configuration. No KeyCape client, audit registry or secret custody was mutated. No secret values were emitted and no Anthropic key was read.

Live records: FLEX-WP-0021-T04 done, T05 awaiting consumer adoption/handoff; APPROVAL-WP-0002-T01/T03/T04 remain gated; SECRETS-WP-0009-T03 and GLAS-WP-0012-T02 remain waiting. The local Glas profile stays blocked. This partial deployment must not be described as a production Claude run.