informed-decision/docs/specs/LifecycleProductionRuntime.md

# Initial production runtime

INFD-WP-0007 / INFD-WP-0005. Founder selected net-kingdom-admins humans and
system:serviceaccount:state-hub:state-hub on 2026-10-04. The concrete rollout was approved and accepted on 2026-10-05.
This describes the deployed initial runtime; later artifacts require their own
release verification.

## Identity and listeners

The same process/store serves browser routes on 8080 and private workload routes
on 8081. Only the public listener is behind decisions.coulomb.social. A separate
ClusterIP and exact State Hub namespace AND app-label ingress expose 8081.
`/v1/decisions` uses a projected token with audience informed-decision-lifecycle;
`/v1/memos` uses a different token with audience informed-decision-intake. Neither
route accepts a browser cookie. Browser authoring retains KeyCape sessions,
CSRF and origin checking. The private listener exposes no browser routes.

Every workload request performs Kubernetes TokenReview over CA- and
hostname-verified HTTPS with a freshly read rotating reviewer credential. The
review service needs only create on tokenreviews, not token creation or Secret
read. The API-server audience is used for its reviewer token. Workload UID and
subject come from TokenReview; tenant comes from the reloadable exact-account
registry. JWT expiry is read only after TokenReview verifies that same token.
Callers expire within 30 seconds or token expiry, whichever is earlier.

The registry is identity registration, not an action permit. Every operation
still requires a fresh external PDP decision. The lifecycle PDP has a distinct
package, version and digest from human review. Only humans can bind via the
existing protected review flow. Access Engine keeps the authorization decision;
Approval Engine keeps authoritative approval state.

## Admitted initial data

`deploy/lifecycle/lifecycle-callers.json` names the exact State Hub account and
platform tenant. The intake registry permits only decision-record class and
net-kingdom-admins, with a cap of 50 new attempts per UTC day. Replays
do not spend a second attempt; uncertain creation never automatically reposts.
The cap and routing are configuration, not per-decision deployments.

The review-group recipient is the existing platform-root KeyCape subject found
in previously bound review records. This is the initial single recipient; group
membership alone does not turn every admin into that bound principal. Expanding
to multiple human recipients needs a reviewed binding contract. The default
legacy registries remain empty; only the reviewed release ConfigMap mounts the
initial proposal. Directory group verification remains independent of this map.

Registry volumes use no subPath and reload on each request. Requester custody is
read-only at `/var/run/secrets/informed-decision/requester/client-secret`, matching
CCR-2026-0032. No secret value is copied into release files or SQLite. Kubernetes
Secret objects are not emitted by the renderer.

## Evidence and compatibility

Runtime options enable lifecycle audit delivery, intake audit/notification
delivery and verified intake metadata for human review. The latter reloads the
live Approval Engine object, checks its binding pin, requester informed-decision
and human_control=true before the PDP call. Store guards recheck retained intake
metadata at the mutation boundary. A valid-looking UUID/digest alone is not proof.

State Hub now has a private explicitly queued dispatcher (STATE-WP-0096), with a
separate standard-library-only image and PVC. It uses the selected existing
service account and distinct projected lifecycle/intake tokens; its transport
reads only the intake token. The Hub public API does not gain a credentialed
forwarding route. Queueing is trusted workload execution. New review envelopes
are data operations and do not change deployments. The exact lifecycle snapshot
id/key is preserved without inventing a Hub relationship when serves is absent.
Lost replies replay the same envelope; native-create uncertainty blocks the row.
Native deployment and human acceptance passed. Notification/write-back receiver
admission is unchanged; INFD_HUB_WRITEBACK remains off.

The image migrates schema 2 to schema 5 on open. Existing records, presentations,
dispositions, submissions and outbox evidence must survive. Rollback to the old
image against the migrated database is forbidden: stop the new writer, retain all
new evidence, and restore a verified pre-cutover copy on a separate private volume
only under the reviewed recovery plan. An in-flight/unresolved human submission
must be reconciled, never retried or discarded to make rollback convenient.

## Observed acceptance and remaining scope

CCR-2026-0032 delivery is applied: actual receiving mount/exchange and bounded
identity/path/scope/revocation tests passed. FLEX-WP-0033 and STATE-WP-0096
completed native deployment and human acceptance. INFD-WP-0007-T06/T07 retain
backup/restore, caller isolation, unchanged pins across two records/a revision,
restart retention and independent audit proof. See
../evidence/2026-10-05-lifecycle-cutover/acceptance-summary.json.

Issuer rotation remains separately governed under Platform RPF-IN-0004.
Browser authoring and named-recipient discovery are deployed in service image
7f5c6cb2 with owner compact-sitting v13 (FLEX-WP-0034). Initial contracts are
explicit in LifecycleAdmissionBoundary.md; broader expansion and optional Hub
write-back are tracked in INFD-WP-0008. No new caller, group or listener is admitted.