informed-decision/deploy/lifecycle/README.md

# INFD-WP-0007 production candidate

Prepared 2026-10-04 for the founder-selected initial audience: net-kingdom-admins
humans and system:serviceaccount:state-hub:state-hub. **Deployed under founder approval on 2026-10-05 (Europe/Berlin).**

| Artifact | Immutable reference |
| --- | --- |
| Service | forgejo.coulomb.social/coulomb/informed-decision@sha256:804d89fb0bb3d691720380eedde4f361133bada717d1773c2eb349004346ebf1 |
| Access Engine | forgejo.coulomb.social/coulomb/flex-auth@sha256:bdac62bc3f089cba0df7c35eeb8d0d9b3af2d4bae5e4ea4767516c1ed20b1e99 |
| Lifecycle package | informed-decision.lifecycle v1, sha256:cee6a79f74e81d0d389a2c2e2451a92be3434ea9dfcee4986e8c7e6cfdbb1827 |
| Human review package | informed-decision.compact-sitting v12, sha256:c5387f7d198dc39ab5967e0c218ce05cc779693565c8875e3035e45ec002a2db |

`admission.candidate.json` renders `service.candidate.json` using
`tools/render_deployment.py`. `registries.candidate.json` projects the three
sibling JSON registries. The policy YAML is Helm-rendered from Access Engine's
FLEX-WP-0033 candidate values; it is a review artifact, not a second deployment
owner. Existing Helm releases must be updated through their owning workflow.
The original 25 objects and the three dispatcher objects passed Kubernetes
server dry-run against railiance01.
No Secret is included. Dry-run does not test reachability, credential delivery,
policy caller identity, backup restoration or a human disposition.

## Approved live changes

- Replace the service's image and immutable runtime ConfigMap, retaining its
  public Service/Ingress, single writer, Recreate strategy and existing PVC.
- Enable `/decisions` and lifecycle audit delivery; keep private API on 8081.
- Add the exact State Hub peer, API-server egress, CA/token projection and only
  create-tokenreviews RBAC for informed-decision/review.
- Mount the proposed reloadable registries and Platform's exact read-only
  requester Secret projection, without subPath.
- Add a separate lifecycle PDP and change the sitting PDP to the v12 package.
  Review retains all v11 exact mandates and 15-minute KeyCape MFA; lifecycle
  authoring uses a 12-hour MFA window. Agents cannot accept.
- Initial intake permits decision-record / net-kingdom-admins, 50 new attempts
  per UTC day, with the existing platform-root recipient. Other admins may
  collaborate; this does not silently make them the bound recipient.

The policy chart retains the owner's existing port-only API-server egress
(443/6443). The consumer's new API-server egress is address-specific. CARING is
advisory and consumer fact attribution is unsigned, as in the existing reviewed
contract; neither is presented as a newly enforced control.

## Pre-cutover gates

1. RPF-WP-0051 / CCR-2026-0032 requester delivery is applied: store Valid and
   ExternalSecret SecretSynced; native candidate-image identity/path/scope,
   projection and reader-revocation proofs pass. Verify the receiving service's
   actual mount during cutover. Issuer rotation is a separate governed operation,
   excluded from this initial delivery by the Platform lane contract; no rotation
   or predecessor-revocation evidence is claimed here.
2. INFD-WP-0005-T08 / STATE-WP-0096: the private dispatcher and separate
   lifecycle/intake token projections are prepared in dispatcher.candidate.json.
   Deploy after intake prerequisites. Explicit enqueue requires trusted workload
   execution; there is no new public delegate endpoint. Confirm notification
   receiver reachability; keep resolution write-back disabled.
3. Refresh live image/config pins and unresolved-entry counts; complete the
   backup/restore steps below; obtain explicit approval of this concrete rollout.
   INFD-WP-0007-T07 and CCR-2026-0032 require this distinct go.

## Cutover and recovery procedure

Before migrating, close new review traffic through the owning ingress workflow,
let active requests finish, and inspect the current schema-2 writer read-only.
The observed baseline was 24 confirmed submissions, 158 delivered outbox rows,
zero unresolved entries; these counts are not a future maintenance-window gate.
Retain the exact current Deployment, Service, runtime ConfigMap, Helm values and
all related policy pins. Do not include credentials in the evidence packet.

Use the existing running image's installed `informed-decision-admin backup` to
create a unique SQLite consistent snapshot in a private directory. Copy the
backup to independently protected custody, record its digest, and verify a
restore on a separate private volume before cutover. Close the old writer before
starting the schema-5 image. Local synthetic restore proof is retained in the
evidence directory; it does not replace this production data restoration check.

Deploy admitted owner policy/custody prerequisites, then the service candidate.
Verify `/healthz`, `/readyz`, pending/blocked counts, actual audience isolation,
wrong-caller refusals and public/private route separation. Exercise two new
records and a revision without changing image/config/package pins. Only a human
may finish review. Correlate the native Approval Engine entry and independent
Audit Core receipts; restart and retrieve the same immutable evidence.

If validation fails, stop the candidate and retain its database plus all new
receipts. **Never start the old schema-2 image on the schema-5 database.** Rollback
requires the verified pre-cutover copy on a separate volume and reconciliation
of every post-cutover external effect before resuming writes. An uncertain
submission stays unresolved; do not retry or discard it to enable rollback.
The prior image is in ../sitting-admission.json and remains a reference, not an
instruction to downgrade the live database.

## Validation evidence

`docs/evidence/2026-10-04-lifecycle-release/` retains container checks, bounded
scan summaries and policy validation. Service: 662 passed, 1 skipped with owner
components; 13 container checks passed, including restart and backup/restore.
Both artifact scans contain zero HIGH/CRITICAL findings. Actual evaluator tests
cover first-audience collaboration across revisions and verify unchanged package
pins; authentication custody in those tests is synthetic. Native activation and
broader browser packet/binding profiles remain explicit workplan tasks.

The final Access Engine pin is the Forgejo image built from commit d2d0b6f
(run https://forgejo.coulomb.social/coulomb/access-engine/actions/runs/316).
It supersedes the locally built candidate for the proposed deployment.


## Private State Hub dispatcher continuation

The dispatcher is a separate Recreate workload with 5m CPU / 24Mi memory requests,
one private 1Gi PVC, no Service/Ingress, and the existing state-hub service account.
Its only egress is DNS and the exact informed-decision peer on 8081. Projected
lifecycle and intake tokens each expire after 600 seconds. The dispatcher reads
only the intake token and never binds. Its pod omits app=state-hub, so it is not
selected by the existing Hub API Service.

Image: forgejo.coulomb.social/coulomb/state-hub-memo-dispatch@sha256:410fb6b6c9fd7a7ee0b63d727fd3249fb3ae13943421d6a5ce88b7ad2520bd2f
Source: State Hub 4a59b23, built by the dedicated Forgejo workflow.
Source integration proves queue/restart/lost-reply handling (one create, replayed
receipt), subsequent human acceptance and independent audit delivery. All identity
and credential inputs in that test are synthetic. Native acceptance remains open.

There is no new service-image build for this continuation. The service suite now
passes 663 tests (1 skipped); State Hub forwarding/notification tests pass 28.

## Final requester and restore proof — 2026-10-04

Service image 804d89fb (source 03f18d8) supersedes 2768bd1 after native testing
found KeyCape requires client_secret_basic. Credentials are form-encoded before
Basic encoding; requests retain the exact create-only scope and full signature/
identity verification. The candidate passes 664 tests (one skipped), 13 installed
container checks and a zero HIGH/CRITICAL scan. Its server dry-run passed.

Actual production snapshot restore was exercised offline in a separate Docker
volume with the candidate. Migration from schema 2 to 5 preserved 24 confirmed
submissions and 158 delivered outbox rows; lifecycle starts empty. The disposable
volume was removed. Original snapshot is retained off-cluster under ignored
.private-backups/20261004-pre-lifecycle (0700 parent, 0600 file), with a copy in
the live PVC's private directory. Refresh the snapshot after closing writes for
cutover; this online drill is not the final maintenance-window backup.

The requester proof's eight temporary resources were removed. No native approval
was created, consumed or human-bound by these tests. The actual review service and State Hub dispatcher were subsequently rolled out
under explicit founder approval; see the native cutover record below.

## Native cutover — 2026-10-05

Approval: State Hub decision d2eaa2e9-6d11-4676-a07f-e3b7e59a88e3.
Service: manual Argo application informed-decision, path deploy/lifecycle,
source b5b5a5a. Dispatcher: manual Argo application state-hub-memo-dispatch,
State Hub source 1321361. Both retain the image digests above. The dispatcher
source adds non-root private-directory initialization for Kubernetes inherited
setgid, with nine passing regression tests. Only empty owned 2700 custody is
normalized; existing nonempty or unsafe custody fails closed.

The final quiesced backup matches the previously restored snapshot digest.
Schema 5 preserves 24 confirmed submissions. Actual receiving-pod credential
exchange and 0440/read-only mount pass. Public /healthz and /readyz return 200;
private /v1/decisions and /v1/memos return 404 on the public origin.

The selected workload created two records and a revision with unchanged
deployment templates/generations and policy pins. Native audience/caller negatives,
private dispatch, notification and independent audit reconciliation pass. Pod
recreation retains the same version and single approval receipt; explicit
re-enqueue is replay. Temporary negative-verification resources were deleted.

Human review remains at /review?memo_id=review-0d55a416-178c-46f5-b74b-b9b668390448.
Human acceptance is confirmed at 2026-10-04T22:17:19Z and linked to source
revision 2, the exact presentation and independent audit receipts. Evidence and exact pins are retained
in docs/evidence/2026-10-05-lifecycle-cutover/. Issuer rotation is a separate
Platform residual, RPF-IN-0004; it was neither performed nor authorized here.

## Authoring release — 2026-10-05

Founder instruction: “Go on, deploy and implement the rest” (the final word was
truncated in chat). Authority: ADMINISTER @ realm:kubernetes/railiance01,
activation=APPROVED. Release source 9bc581a; image
forgejo.coulomb.social/coulomb/informed-decision@sha256:79aabf37e3920261189996020f84562c27709937f74632582331712d74c5f289.
This changes only the service image through the manually pinned Argo application;
policy, credentials, runtime configuration and schema 5 remain unchanged.

669 tests and 16 Chromium checks passed; installed container checks 13/13,
HIGH/CRITICAL scan findings zero. Fresh production snapshot restored offline
under the candidate preserves 25 confirmed submissions, 174 delivered outbox
rows and two lifecycle records/nine events. Protected backup digest:
5a22f06d5040e55fea46c4317349f9bc984186419616e5df913a4c6c44bf0b19.
Server dry-run passed; client diff shows image replacement plus Argo tracking
annotations supplied by Argo at sync. No direct resource apply is intended.
The existing Recreate strategy prevents two writers; allow a short restart.
If startup fails, revert the image pin to 804d89fb through Argo (same schema),
retaining the current database and all post-backup evidence.

## Named-recipient discovery release — 2026-10-05

Same founder instruction authorizes this INFD-WP-0007 continuation. Service source
da2c5a7, image 7f5c6cb29c9f70a026bfe30e72934274ddc69261676cf6d476f81dd32812d173;
owner policy source f234d01, image
6c6dc263f4a7f6461e109e133c004c080e8e373acfead8611856c5fb3e44168e.
Compact-sitting v13 digest:
sha256:31be5985c0c1e6b0c3a039ed7310d1e94daf523a94f6d926e6e8d759d3711873.

Update the existing owner review Helm release through its values, then sync the
matching service image/config through Argo. During the short pin transition,
review fails closed; no policy fallback is enabled. Existing exact mandates and
fifteen-minute read/act assurance remain. Attribute listing now requires the
named recipient, admitted class/submitter/group and live approval evidence, with
the existing twelve-hour list assurance window. No broader audience is admitted.

671 tests (one skipped), 32 embedded owner checks, owner regressions and 13
container checks pass. Both scans have zero HIGH/CRITICAL findings. Fresh
schema-5 backup: 8ac7bbe79de7cdcff5ebc9fa8adc9c49498bf8a3298c8fbc9bd7501be1a379bb.
Rollback, if needed: owner Helm prior revision 12 and Argo source dfcef87 together,
retaining the current schema-5 database. Evidence: docs/evidence/2026-10-05-lifecycle-discovery/.