INFD-WP-0010-T02: record the founder-run present-existing release (2026-11-01)

The founder ran the release:
- access-engine compact-sitting v14 (Helm revision 14) first, then Argo
  005709a: image ca75f0be, runtime ConfigMap b488b96a0953
- backup ed4469e7, held off-cluster
- health and readiness 200; private routes 404 on the public origin
- store counts unchanged, and an existing memo loaded under v14
- executor-identity probe 503 approval_unreadable; sso/default probe 403
  submitter_unknown

T02 stays open until the executor's present-existing memo is accepted at aal2 and
consumed (NK-WP-0056 pilot).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5502@bnt-lap001
Assistant-Session: 68b3b02f-5d0f-4e71-8421-796f62e50196

docs/evidence/2026-11-01-present-existing-release/release.json

@@ -0,0 +1,57 @@
+{
+  "phase": "release",
+  "task": "INFD-WP-0010-T02",
+  "date": "2026-11-01",
+  "run_by": "founder (net-kingdom coordinator guiding); observations relayed to the owner agent, which recorded them",
+  "runbook": "deploy/lifecycle/RELEASE-INFD-WP-0010-T02.md",
+  "preflight": {
+    "argo_target_revision_before": "312ab97e876e17341bf16f9e95397e14c2ac2720",
+    "argo_status_before": "OutOfSync (known orphan ConfigMap informed-decision-runtime-c81577741a09), Healthy",
+    "image_before": "forgejo.coulomb.social/coulomb/informed-decision@sha256:f5588f496b1f267d07cdc9f5208e6f2f241f74b739c23924b03702dec13a5c23",
+    "service_account_sso_nk_bind_executor": "present",
+    "inspect": {"schema_version": 5, "lifecycle": {"records": 20, "events": 70, "pending": 0},
+                "outbox": {"delivered": 472}, "submissions": {"confirmed": 48}},
+    "server_dry_run": "all objects accepted",
+    "diff": ["image", "new runtime ConfigMap informed-decision-runtime-b488b96a0953 (v14 pin)",
+             "registry ConfigMap: nk-bind-executor row added",
+             "informed-decision-review NetworkPolicy: 8081 peer sso + app.kubernetes.io/name=bounded-executor",
+             "removal of argocd tracking-id annotations only"]
+  },
+  "backup": {
+    "consistent_snapshot": true,
+    "off_cluster_copy": ".private-backups/20261101T132600Z-pre-v14/review.sqlite",
+    "sha256": "ed4469e7f40ae15f19f467d14e22155dfecd25525f31cfd58d6b821687752ab3"
+  },
+  "rollout": {
+    "order": ["access-engine flex-auth-informed-decision-sitting Helm revision 14 (compact-sitting v14) deployed first",
+              "Argo informed-decision targetRevision 005709a37228ba9e6d5a658aada0b62bf49649f5, sync Succeeded, Healthy, rollout complete"],
+    "helm_revision_before": 13,
+    "helm_revision_after": 14,
+    "argo_target_revision_after": "005709a37228ba9e6d5a658aada0b62bf49649f5",
+    "image_after": "forgejo.coulomb.social/coulomb/informed-decision@sha256:ca75f0be03af0bd96a66b08d2949bdc2d16365a93ffabcd6593074b565e8f01b",
+    "runtime_configmap_after": "informed-decision-runtime-b488b96a0953",
+    "policy_pin_after": {"package": "informed-decision.compact-sitting", "version": "v14",
+                         "package_digest": "sha256:8911458f36f1a60598aa19592a2d752a74dffe2617fd86238407ac87bc300fde"}
+  },
+  "verification": {
+    "deployment_image_and_configmap": "ca75f0be... with informed-decision-runtime-b488b96a0953",
+    "public": {"healthz": 200, "readyz": 200, "v1_memos": 404, "v1_decisions": 404},
+    "inspect_after": {"schema_version": 5, "lifecycle": {"records": 20, "events": 70, "pending": 0},
+                      "outbox": {"delivered": 472}, "submissions": {"confirmed": 48}},
+    "v14_pin_match_human": "founder opened an existing memo ('Establish the bounded OpenRouter access role?'); it loaded",
+    "probe_executor_identity_random_uuid": {"service_account": "sso/nk-bind-executor", "label": "app.kubernetes.io/name=bounded-executor",
+                                            "result": "503 approval_unreadable",
+                                            "proves": "NetworkPolicy admits the executor label on 8081; TokenReview with audience informed-decision-intake; registry parses (state-hub row loaded); present_existing profile and envelope validation; reservation released"},
+    "probe_default_service_account": {"service_account": "sso/default", "result": "403 submitter_unknown"},
+    "probe_pods_removed": true,
+    "approval_read_proven_by_probe": false,
+    "executor_egress_policy_to_8081": "live (rapp-bounded-executor)"
+  },
+  "not_claimed": [
+    "a present-existing memo with a real executor-created approval",
+    "a founder aal2 accept of such an approval, or its consumption by the executor (T02 done-when; NK-WP-0056 pilot)",
+    "KeyCape approval:read exercised by this service (the random-UUID probe stops at approval_unreadable)"
+  ],
+  "rollback_reference": "Argo 312ab97e876e17341bf16f9e95397e14c2ac2720 + helm rollback flex-auth-informed-decision-sitting 13; schema 5 retained",
+  "credentials_recorded": false
+}