Implement lifecycle workspace publication and audit delivery

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a10780-6d41-7952-9718-dfbc1f41236f

tools/render_deployment.py

@@ -12,12 +12,7 @@ SHA = re.compile(r'sha256:[0-9a-f]{64}')
 LABEL = {'app.kubernetes.io/name': NAME}
 
 
-def render(inputs):
-    if not isinstance(inputs,dict) or (set(inputs)-{'ordinary_approval_ids'})!={'image','policy','keycape_egress_ips','storage_class'}:
-        raise ValueError('exact image, policy, KeyCape egress IPs and storage class inputs required')
-    if not re.fullmatch(r'forgejo\.coulomb\.social/coulomb/informed-decision@sha256:[0-9a-f]{64}',inputs['image']):
-        raise ValueError('immutable Informed Decision registry digest required')
-    policy=inputs['policy']
+def validate_policy(policy):
     if not isinstance(policy,dict) or set(policy)!={'origin','package','version','package_digest','pod_name'}:
         raise ValueError('exact policy endpoint, package pins and pod selector required')
     if not re.fullmatch(r'http://[a-z0-9-]+\.flex-auth\.svc\.cluster\.local:8080',policy['origin']):
@@ -27,6 +22,15 @@ def render(inputs):
     if not SHA.fullmatch(policy['package_digest']) or any(
         not re.fullmatch(r'[A-Za-z0-9][A-Za-z0-9._-]{0,127}',policy[key]) for key in ['package','version']):
         raise ValueError('exact policy package/version/digest required')
+
+
+def render(inputs):
+    if not isinstance(inputs,dict) or (set(inputs)-{'ordinary_approval_ids','lifecycle_policy','lifecycle_delivery'})!={'image','policy','keycape_egress_ips','storage_class'}:
+        raise ValueError('exact image, policy, KeyCape egress IPs and storage class inputs required')
+    if not re.fullmatch(r'forgejo\.coulomb\.social/coulomb/informed-decision@sha256:[0-9a-f]{64}',inputs['image']):
+        raise ValueError('immutable Informed Decision registry digest required')
+    policy=inputs['policy']
+    validate_policy(policy)
     if not re.fullmatch(r'[a-z0-9][a-z0-9.-]{0,62}',inputs['storage_class']):
         raise ValueError('explicit storage class required')
     ips=inputs['keycape_egress_ips']
@@ -51,6 +55,18 @@ def render(inputs):
             raise ValueError('exact ordinary approval ids required')
         config['ordinary_approval_ids']=sorted(ids)
     config['policy']['caller_token_file']='/var/run/secrets/informed-decision/policy/token'
+    lifecycle=inputs.get('lifecycle_policy')
+    if 'lifecycle_policy' in inputs:
+        validate_policy(lifecycle)
+        if lifecycle['package']==policy['package'] or inputs.get('lifecycle_delivery') is not True:
+            raise ValueError('separate lifecycle policy and explicit lifecycle delivery required')
+        config['lifecycle_policy']={key:lifecycle[key] for key in ['origin','package','version','package_digest']}
+        config['lifecycle_policy']['caller_token_file']=config['policy']['caller_token_file']
+    if 'lifecycle_delivery' in inputs:
+        if type(inputs['lifecycle_delivery']) is not bool:
+            raise ValueError('lifecycle delivery must be boolean')
+        config['lifecycle_delivery']=inputs['lifecycle_delivery']
+
     raw=json.dumps(config,sort_keys=True,separators=(',',':'))
     config_name=NAME+'-runtime-'+hashlib.sha256(raw.encode()).hexdigest()[:12]
     def obj(api,kind,name,**values):
@@ -103,7 +119,7 @@ def render(inputs):
                                'podSelector':{'matchLabels':{'k8s-app':'kube-dns'}}}],
                        'ports':[{'protocol':'UDP','port':53},{'protocol':'TCP','port':53}]},
                       {'to':[peer('approval-engine','approval-engine'),peer('audit-core','audit-core'),
-                             peer('flex-auth',policy['pod_name'])],'ports':http},
+                             peer('flex-auth',policy['pod_name'])]+([peer('flex-auth',lifecycle['pod_name'])] if lifecycle else []),'ports':http},
                       # Traefik's observed websecure target is 8443. Include
                       # its exact peer for CNI enforcement after Service DNAT.
                       {'to':[peer('kube-system','traefik')],'ports':[{'protocol':'TCP','port':8443}]},
@@ -111,9 +127,10 @@ def render(inputs):
     # Counterparty proposals travel in the review packet. Neither the existing
     # Approval Engine namespace gate nor other Flex callers admits this pod.
     # Audit Core already owns its prepared exact informed-decision ingress.
-    for namespace,name,task in [('approval-engine','approval-engine','APPROVAL-WP-0002-T01'),
-                                ('flex-auth',policy['pod_name'],'INFD-WP-0001-T08 policy-owner return')]:
-        item=obj('networking.k8s.io/v1','NetworkPolicy',NAME+'-review-ingress',spec={
+    for namespace,name,task in ([('approval-engine','approval-engine','APPROVAL-WP-0002-T01'),
+                                ('flex-auth',policy['pod_name'],'INFD-WP-0001-T08 policy-owner return')]
+                               + ([('flex-auth',lifecycle['pod_name'],'INFD-WP-0007 lifecycle policy-owner return')] if lifecycle else [])):
+        item=obj('networking.k8s.io/v1','NetworkPolicy',NAME+('-lifecycle-ingress' if task.startswith('INFD-WP-0007') else '-review-ingress'),spec={
             'podSelector':{'matchLabels':{'app.kubernetes.io/name':name}},'policyTypes':['Ingress'],
             'ingress':[{'from':[{'namespaceSelector':{'matchLabels':{'kubernetes.io/metadata.name':NAME}},
                 'podSelector':{'matchLabels':{**LABEL,'app.kubernetes.io/component':'review'}}}],'ports':http}]})