coulomb/informed-decision
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

INFD-WP-0010-T02: release candidate for present_existing with compact-sitting v14

Browse source 
Candidate files: review policy pin v14 (sha256:8911458f...), the
nk-bind-executor present_existing registry row (daily limit 10), and an
8081 ingress peer for exactly sso + app.kubernetes.io/name=bounded-executor.
The state-hub row is unchanged and outcome_read stays off. The image pin
stays at the live f5588f49 because no owner-CI full-service image exists
yet; the founder runbook (deploy/lifecycle/RELEASE-INFD-WP-0010-T02.md)
gates the release on it. Adds a side-effect-free present_existing probe
and release tests. Nothing applied.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5502@bnt-lap001
Assistant-Session: 68b3b02f-5d0f-4e71-8421-796f62e50196
This commit is contained in:
tegwick 2026-11-01 11:25:46 +01:00
parent 3b7031ae39
commit 0ef57537ac
9 changed files with 457 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

13
workplans/INFD-WP-0010-present-existing-and-proportionate-decisions.md
View file

@ -95,6 +95,19 @@ prepared `approval:read` (`82b471f`, source only); the sitting-requester checks
consume (commit `12311d1`). The v14 pin is not in the candidate files: by this repo's release convention the pin
moves together with the image in the founder-run release commit.
**2026-11-01, release candidate (founder approval relayed by the net-kingdom coordinator).** KeyCape
`approval:read` is live (key-cape `82b471f`, hub decision `21a557a9`). Candidate files now carry the v14 pin
(`admission.candidate.json`, re-rendered `service.candidate.json`; runtime ConfigMap `…b488b96a0953`), the
`system:serviceaccount:sso:nk-bind-executor` present_existing row (`bounded-execution`, `net-kingdom-admins`,
daily limit 10), and an 8081 ingress peer for exactly `sso` + `app.kubernetes.io/name=bounded-executor`. The state-hub
row is unchanged and outcome_read stays off (T05). The founder runbook covers the order relative to access-engine v14,
verification (including the side-effect-free `tools/present_existing_probe.py`) and rollback to Argo `312ab97` / Helm
revision 13: `deploy/lifecycle/RELEASE-INFD-WP-0010-T02.md`. Tests: 704 passed, 83 skipped (`.venv`).
**Blocked on the image:** no owner CI workflow builds the full service image. Only the policy.py and zlib overlay
workflows exist; purpose-overlay run 5 failed by design on the changed `policy.py` hash. The image pin is therefore
still the live `f5588f49…`, and the candidate must not be synced until the pin is replaced by an owner-CI full image
that keeps zlib ≥ 1.3.2-r1. Nothing applied.
Then here: the policy pin, a registry row, a release, and a native proof with synthetic BEA content. Optional: for
`bounded-execution`, require a packet item whose digest equals `target.admission_digest`, once the admission
digest's canonical form is confirmed.