From 77161fe796a77c21369f293653069ea8b325d5c8 Mon Sep 17 00:00:00 2001 From: tegwick Date: Thu, 5 Nov 2026 08:24:08 +0100 Subject: [PATCH] Route review group net-kingdom-admins to admin (founder decision c9bedd9c, interim) platform-root is build-mode only; present-existing memos addressed to platform-root were invisible to admin, the approver the bounded executor's admission names (net-kingdom NK-WP-0056-T06). Routing by component responsibility is designed in net-kingdom NK-WP-0057. Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 523928@bnt-lap001 Assistant-Session: 6c737afb-9c14-4152-9f02-477214b9c350 --- deploy/lifecycle/README.md | 7 +++++++ deploy/lifecycle/registries.candidate.json | 2 +- deploy/lifecycle/review-groups.json | 2 +- 3 files changed, 9 insertions(+), 2 deletions(-) diff --git a/deploy/lifecycle/README.md b/deploy/lifecycle/README.md index f2ba86a..915725a 100644 --- a/deploy/lifecycle/README.md +++ b/deploy/lifecycle/README.md @@ -35,6 +35,13 @@ policy caller identity, backup restoration or a human disposition. - Initial intake permits decision-record / net-kingdom-admins, 50 new attempts per UTC day, with the existing platform-root recipient. Other admins may collaborate; this does not silently make them the bound recipient. +- 2026-11-05, founder decision (State Hub `c9bedd9c`, option A): review group + `net-kingdom-admins` is routed to `uid=admin,ou=people,dc=netkingdom,dc=local` + instead of `platform-root`. `platform-root` is build-mode only. Present-existing + memos for `admin`'s approvals (NK-WP-0056-T06) were invisible to `admin`. Existing + memos keep their recipient; registries reload per request, no restart. This is + interim: who routes decisions and how, by component responsibility, is designed + in net-kingdom NK-WP-0057, including what informed-decision provides for routing. The policy chart retains the owner's existing port-only API-server egress (443/6443). The consumer's new API-server egress is address-specific. CARING is diff --git a/deploy/lifecycle/registries.candidate.json b/deploy/lifecycle/registries.candidate.json index 9b7ebb2..d6a2117 100644 --- a/deploy/lifecycle/registries.candidate.json +++ b/deploy/lifecycle/registries.candidate.json @@ -11,6 +11,6 @@ "data": { "lifecycle-callers.json": "{\n \"system:serviceaccount:state-hub:state-hub\": {\n \"tenant\": \"tenant:platform\"\n }\n}\n", "intake-submitters.json": "{\n \"system:serviceaccount:state-hub:state-hub\": {\n \"submitter_id\": \"state-hub\",\n \"memo_classes\": [\n \"decision-record\"\n ],\n \"review_groups\": [\n \"net-kingdom-admins\"\n ],\n \"daily_limit\": 50\n },\n \"system:serviceaccount:sso:nk-bind-executor\": {\n \"submitter_id\": \"nk-bind-executor\",\n \"memo_classes\": [\n \"bounded-execution\"\n ],\n \"review_groups\": [\n \"net-kingdom-admins\"\n ],\n \"daily_limit\": 10,\n \"present_existing\": {\n \"approval_actor\": \"service:nk-bind-executor\",\n \"actions\": [\n \"bounded-execution\"\n ]\n }\n }\n}\n", - "review-groups.json": "{\n \"net-kingdom-admins\": {\n \"subject\": \"uid=platform-root,ou=people,dc=netkingdom,dc=local\",\n \"display_name\": \"Platform reviewer\"\n }\n}\n" + "review-groups.json": "{\n \"net-kingdom-admins\": {\n \"subject\": \"uid=admin,ou=people,dc=netkingdom,dc=local\",\n \"display_name\": \"Platform reviewer\"\n }\n}\n" } } diff --git a/deploy/lifecycle/review-groups.json b/deploy/lifecycle/review-groups.json index 23d57ff..9a8fc1a 100644 --- a/deploy/lifecycle/review-groups.json +++ b/deploy/lifecycle/review-groups.json @@ -1,6 +1,6 @@ { "net-kingdom-admins": { - "subject": "uid=platform-root,ou=people,dc=netkingdom,dc=local", + "subject": "uid=admin,ou=people,dc=netkingdom,dc=local", "display_name": "Platform reviewer" } }