coulomb/informed-decision
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Prepare authenticated lifecycle runtime and production release candidate

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a10780-6d41-7952-9718-dfbc1f41236f
This commit is contained in:
tegwick 2026-10-04 21:40:19 +02:00
parent f3b71b1521
commit 4f546ae3b1
41 changed files with 2598 additions and 52 deletions
Download patch file Download diff file Expand all files Collapse all files

18
workplans/INFD-WP-0005-frictionless-decision-intake.md
View file

@ -113,7 +113,7 @@ status: wait
priority: high
blocked_on: message-from:railiance-platform
needs_human: true
blocking_reason: "Founder-approved ESO binding/mount accepted for source integration; private listener and CA-verified TokenReview runtime composition, immutable image/config, native custody proof and separate live go remain"
blocking_reason: "Founder-approved ESO binding/mount accepted for source integration; private listener and CA-verified TokenReview runtime composed and tested; native custody proof and separate live go remain"
state_hub_task_id: "3b0f536c-e8ee-5493-b663-2f60f5f429ad"
decision_id: "0d6792b6-59e4-4fa0-887a-c4e51ea8e131"
```
@ -130,7 +130,7 @@ id: INFD-WP-0005-T06
status: wait
priority: high
blocked_on: message-from:access-engine
blocking_reason: "Attribute admission branch and generated submitter/class sets are access-engine's change (msg 306bcdd2); deploy needs founder go"
blocking_reason: "Consumer implemented; FLEX-WP-0033 prepares v12 State Hub / decision-record admission; native verification and concrete rollout approval remain"
state_hub_task_id: "c03016da-a795-5c5c-b86e-0ce9afc67be6"
```
@ -167,7 +167,7 @@ id: INFD-WP-0005-T08
status: wait
priority: medium
blocked_on: message-from:state-hub
blocking_reason: "state-hub must choose the actual SA and supply reviewed grant/runtime forwarding (msg e30dea31), alongside T05/T06"
blocking_reason: "Founder selected system:serviceaccount:state-hub:state-hub; production token projection and runtime forwarding remain, alongside T05/T06"
state_hub_task_id: "ce2b36b4-ef82-53b7-aee7-e0063855370b"
```
@ -259,3 +259,15 @@ private listener, CA-verified TokenReview transport, ESO TokenRequest check,
immutable owner image/config and native rotation/revocation proof remain.
T05 stays wait and the wider human decision stays open for the concrete live
packet. No live action, credential retrieval or issuer mutation occurred.
## Production runtime preparation — 2026-10-04
Private intake/lifecycle listeners, CA-verified TokenReview, rotating requester
projection composition and attribute-admission consumer checks are implemented.
Founder selected net-kingdom-admins humans and the State Hub workload. Initial
registries are review candidates under deploy/lifecycle; the empty legacy
registries and live runtime remain unchanged. T05/T06 remain waiting on native
custody and policy deployment; T08 still needs the State Hub production forwarder,
not merely its dev fixture. See docs/specs/LifecycleProductionRuntime.md and
FLEX-WP-0033 for exact boundaries.

25
workplans/INFD-WP-0007-decision-lifecycle-service.md
View file

@ -249,3 +249,28 @@ Validation for this continuation: full cross-repository suite **634 passed,
5 skipped**; `git diff --check` passed. Schema-4 upgrade preserves existing
records and marks schema 5 to fence older readers. Implementation decision logged
as State Hub `ccb2e110-6032-4259-a402-989415a8d9fe` (not a rollout approval).
## First production audience and runtime candidate — 2026-10-04
Founder selected net-kingdom-admins humans and the State Hub workload. Added the
private 8081 composition with fresh CA-verified TokenReview and exact workload
registration, shared-store public/private serving and guarded attribute review.
A revision's editor now remains authorized to its unpublished successor through
immutable revision_by facts. Actual Access Engine HTTP integration proves this
with the separately pinned lifecycle policy (FLEX-WP-0033).
Published immutable service/policy candidates and retained the reviewable packet
at deploy/lifecycle/README.md. Both scans have zero HIGH/CRITICAL findings after
fixing service JWT pins and inherited Access Engine Go/OPA/telemetry dependencies.
All 25 Kubernetes objects passed server dry-run; 662 service/component tests pass
(1 skipped), as do 13 installed-container checks. Access Engine full regression
and candidate package validations pass. Tests are not native custody proof.
No live change or human binding was performed. T02–T06 remain in progress for
native contracts, State Hub production forwarding, browser packet/binding
profiles and complete live acceptance. T07 still requires concrete rollout go.
CCR-2026-0032 / RPF-WP-0051 owns requester delivery; INFD-WP-0005-T08 owns State
Hub forwarding/token projections. The exact chosen identity is no longer an open
question. Rollback must retain new evidence and must not run a schema-2 reader
on the migrated schema-5 database.