informed-decision/docs/specs/LifecycleProductionRuntime.md

# Initial production runtime candidate

INFD-WP-0007 / INFD-WP-0005. Founder selected net-kingdom-admins humans and
system:serviceaccount:state-hub:state-hub on 2026-10-04. This is a preparation
contract; deployment still requires the concrete rollout approval.

## Identity and listeners

The same process/store serves browser routes on 8080 and private workload routes
on 8081. Only the public listener is behind decisions.coulomb.social. A separate
ClusterIP and exact State Hub namespace AND app-label ingress expose 8081.
`/v1/decisions` uses a projected token with audience informed-decision-lifecycle;
`/v1/memos` uses a different token with audience informed-decision-intake. Neither
route accepts a browser cookie. Browser authoring retains KeyCape sessions,
CSRF and origin checking. The private listener exposes no browser routes.

Every workload request performs Kubernetes TokenReview over CA- and
hostname-verified HTTPS with a freshly read rotating reviewer credential. The
review service needs only create on tokenreviews, not token creation or Secret
read. The API-server audience is used for its reviewer token. Workload UID and
subject come from TokenReview; tenant comes from the reloadable exact-account
registry. JWT expiry is read only after TokenReview verifies that same token.
Callers expire within 30 seconds or token expiry, whichever is earlier.

The registry is identity registration, not an action permit. Every operation
still requires a fresh external PDP decision. The lifecycle PDP has a distinct
package, version and digest from human review. Only humans can bind via the
existing protected review flow. Access Engine keeps the authorization decision;
Approval Engine keeps authoritative approval state.

## Initial proposal data

`deploy/lifecycle/lifecycle-callers.json` names the exact State Hub account and
platform tenant. The intake registry permits only decision-record class and
net-kingdom-admins, with a proposed cap of 50 new attempts per UTC day. Replays
do not spend a second attempt; uncertain creation never automatically reposts.
The cap and routing are configuration, not per-decision deployments.

The review-group recipient is the existing platform-root KeyCape subject found
in previously bound review records. This is the initial single recipient; group
membership alone does not turn every admin into that bound principal. Expanding
to multiple human recipients needs a reviewed binding contract. The default
legacy registries remain empty; only the reviewed release ConfigMap mounts the
initial proposal. Directory group verification remains independent of this map.

Registry volumes use no subPath and reload on each request. Requester custody is
read-only at `/var/run/secrets/informed-decision/requester/client-secret`, matching
CCR-2026-0032. No secret value is copied into release files or SQLite. Kubernetes
Secret objects are not emitted by the renderer.

## Evidence and compatibility

Runtime options enable lifecycle audit delivery, intake audit/notification
delivery and verified intake metadata for human review. The latter reloads the
live Approval Engine object, checks its binding pin, requester informed-decision
and human_control=true before the PDP call. Store guards recheck retained intake
metadata at the mutation boundary. A valid-looking UUID/digest alone is not proof.

State Hub now has a private explicitly queued dispatcher (STATE-WP-0096), with a
separate standard-library-only image and PVC. It uses the selected existing
service account and distinct projected lifecycle/intake tokens; its transport
reads only the intake token. The Hub public API does not gain a credentialed
forwarding route. Queueing is trusted workload execution. New review envelopes
are data operations and do not change deployments. The exact lifecycle snapshot
id/key is preserved without inventing a Hub relationship when serves is absent.
Lost replies replay the same envelope; native-create uncertainty blocks the row.
Native deployment/acceptance still remains open. Notification/write-back receiver
admission is unchanged; INFD_HUB_WRITEBACK remains off.

The image migrates schema 2 to schema 5 on open. Existing records, presentations,
dispositions, submissions and outbox evidence must survive. Rollback to the old
image against the migrated database is forbidden: stop the new writer, retain all
new evidence, and restore a verified pre-cutover copy on a separate private volume
only under the reviewed recovery plan. An in-flight/unresolved human submission
must be reconciled, never retried or discarded to make rollback convenient.

## Remaining live gates

- CCR-2026-0032 requester projection: current namespace has only the audit
  ExternalSecret; requester custody, native identity/path refusals and rotation
  evidence remain with RPF-WP-0051.
- FLEX-WP-0033: publish scanned policy artifact; approve exact policy/RBAC/network
  objects and native caller/subject allow/refusal tests.
- INFD-WP-0005 / STATE-WP-0096: activate and verify the prepared private State Hub
  dispatcher and its projected tokens; retain gated resolution write-back.
- INFD-WP-0007-T06/T07: backup/restore, exact rollout approval, native human review
  and independent audit receipts across two decisions and a revision with unchanged
  release/configuration pins. Browser packet authoring and broader binding profiles
  remain on T05; the supported review handoff profile is documented separately.