coulomb/informed-decision
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Prepare matching service and policy pins for review discovery

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a10780-6d41-7952-9718-dfbc1f41236f
This commit is contained in:
tegwick 2026-10-05 01:05:54 +02:00
parent da2c5a720f
commit 9207a5134f
7 changed files with 323 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

22
deploy/lifecycle/README.md
View file

@ -188,3 +188,25 @@ annotations supplied by Argo at sync. No direct resource apply is intended.
The existing Recreate strategy prevents two writers; allow a short restart.
If startup fails, revert the image pin to 804d89fb through Argo (same schema),
retaining the current database and all post-backup evidence.
## Named-recipient discovery release — 2026-10-05
Same founder instruction authorizes this INFD-WP-0007 continuation. Service source
da2c5a7, image 7f5c6cb29c9f70a026bfe30e72934274ddc69261676cf6d476f81dd32812d173;
owner policy source f234d01, image
6c6dc263f4a7f6461e109e133c004c080e8e373acfead8611856c5fb3e44168e.
Compact-sitting v13 digest:
sha256:31be5985c0c1e6b0c3a039ed7310d1e94daf523a94f6d926e6e8d759d3711873.
Update the existing owner review Helm release through its values, then sync the
matching service image/config through Argo. During the short pin transition,
review fails closed; no policy fallback is enabled. Existing exact mandates and
fifteen-minute read/act assurance remain. Attribute listing now requires the
named recipient, admitted class/submitter/group and live approval evidence, with
the existing twelve-hour list assurance window. No broader audience is admitted.
671 tests (one skipped), 32 embedded owner checks, owner regressions and 13
container checks pass. Both scans have zero HIGH/CRITICAL findings. Fresh
schema-5 backup: 8ac7bbe79de7cdcff5ebc9fa8adc9c49498bf8a3298c8fbc9bd7501be1a379bb.
Rollback, if needed: owner Helm prior revision 12 and Argo source dfcef87 together,
retaining the current schema-5 database. Evidence: docs/evidence/2026-10-05-lifecycle-discovery/.

6
deploy/lifecycle/admission.candidate.json
View file

@ -1,10 +1,10 @@
{
"image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:79aabf37e3920261189996020f84562c27709937f74632582331712d74c5f289",
"image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:7f5c6cb29c9f70a026bfe30e72934274ddc69261676cf6d476f81dd32812d173",
"policy": {
"origin": "http://flex-auth-informed-decision-sitting.flex-auth.svc.cluster.local:8080",
"package": "informed-decision.compact-sitting",
"version": "v12",
"package_digest": "sha256:c5387f7d198dc39ab5967e0c218ce05cc779693565c8875e3035e45ec002a2db",
"version": "v13",
"package_digest": "sha256:31be5985c0c1e6b0c3a039ed7310d1e94daf523a94f6d926e6e8d759d3711873",
"pod_name": "flex-auth-informed-decision-sitting"
},
"keycape_egress_ips": [

8
deploy/lifecycle/service.candidate.json
View file

@ -40,7 +40,7 @@
"apiVersion": "v1",
"kind": "ConfigMap",
"metadata": {
"name": "informed-decision-runtime-92d01402eb05",
"name": "informed-decision-runtime-c81577741a09",
"namespace": "informed-decision",
"annotations": {
"informed-decision.coulomb.social/admission": "review-only; INFD-WP-0001-T08"
@ -48,7 +48,7 @@
},
"immutable": true,
"data": {
"runtime.json": "{\"approval_origin\":\"http://approval-engine.approval-engine.svc.cluster.local:8080\",\"audit\":{\"origin\":\"http://audit-core.audit-core.svc.cluster.local:8080\",\"sender_token_file\":\"/var/run/secrets/informed-decision/audit/token\"},\"evidence_db\":\"/data/private/review.sqlite\",\"intake_attributes\":true,\"intake_delivery\":{\"hub_origin\":\"http://state-hub.state-hub.svc.cluster.local:8000\"},\"lifecycle_delivery\":true,\"lifecycle_policy\":{\"caller_token_file\":\"/var/run/secrets/informed-decision/policy/token\",\"origin\":\"http://flex-auth-informed-decision-lifecycle.flex-auth.svc.cluster.local:8080\",\"package\":\"informed-decision.lifecycle\",\"package_digest\":\"sha256:cee6a79f74e81d0d389a2c2e2451a92be3434ea9dfcee4986e8c7e6cfdbb1827\",\"version\":\"v1\"},\"ordinary_approval_ids\":[\"2ce76d7f-01c3-4b63-8476-8d1230679769\",\"c2af4bcf-15b4-4305-aac1-acc7e4dcb099\",\"dc22666a-d5d7-46bc-9490-ebe9fe09dc38\"],\"policy\":{\"caller_token_file\":\"/var/run/secrets/informed-decision/policy/token\",\"origin\":\"http://flex-auth-informed-decision-sitting.flex-auth.svc.cluster.local:8080\",\"package\":\"informed-decision.compact-sitting\",\"package_digest\":\"sha256:c5387f7d198dc39ab5967e0c218ce05cc779693565c8875e3035e45ec002a2db\",\"version\":\"v12\"},\"schema\":\"informed-decision.review-runtime.v1\",\"workload_api\":{\"intake\":{\"groups_file\":\"/workload-registry/review-groups.json\",\"secret_file\":\"/var/run/secrets/informed-decision/requester/client-secret\",\"submitters_file\":\"/workload-registry/intake-submitters.json\"},\"lifecycle_callers_file\":\"/workload-registry/lifecycle-callers.json\",\"token_review\":{\"ca_file\":\"/var/run/secrets/informed-decision/kubernetes/ca.crt\",\"origin\":\"https://kubernetes.default.svc:443\",\"token_file\":\"/var/run/secrets/informed-decision/kubernetes/token\"}}}"
"runtime.json": "{\"approval_origin\":\"http://approval-engine.approval-engine.svc.cluster.local:8080\",\"audit\":{\"origin\":\"http://audit-core.audit-core.svc.cluster.local:8080\",\"sender_token_file\":\"/var/run/secrets/informed-decision/audit/token\"},\"evidence_db\":\"/data/private/review.sqlite\",\"intake_attributes\":true,\"intake_delivery\":{\"hub_origin\":\"http://state-hub.state-hub.svc.cluster.local:8000\"},\"lifecycle_delivery\":true,\"lifecycle_policy\":{\"caller_token_file\":\"/var/run/secrets/informed-decision/policy/token\",\"origin\":\"http://flex-auth-informed-decision-lifecycle.flex-auth.svc.cluster.local:8080\",\"package\":\"informed-decision.lifecycle\",\"package_digest\":\"sha256:cee6a79f74e81d0d389a2c2e2451a92be3434ea9dfcee4986e8c7e6cfdbb1827\",\"version\":\"v1\"},\"ordinary_approval_ids\":[\"2ce76d7f-01c3-4b63-8476-8d1230679769\",\"c2af4bcf-15b4-4305-aac1-acc7e4dcb099\",\"dc22666a-d5d7-46bc-9490-ebe9fe09dc38\"],\"policy\":{\"caller_token_file\":\"/var/run/secrets/informed-decision/policy/token\",\"origin\":\"http://flex-auth-informed-decision-sitting.flex-auth.svc.cluster.local:8080\",\"package\":\"informed-decision.compact-sitting\",\"package_digest\":\"sha256:31be5985c0c1e6b0c3a039ed7310d1e94daf523a94f6d926e6e8d759d3711873\",\"version\":\"v13\"},\"schema\":\"informed-decision.review-runtime.v1\",\"workload_api\":{\"intake\":{\"groups_file\":\"/workload-registry/review-groups.json\",\"secret_file\":\"/var/run/secrets/informed-decision/requester/client-secret\",\"submitters_file\":\"/workload-registry/intake-submitters.json\"},\"lifecycle_callers_file\":\"/workload-registry/lifecycle-callers.json\",\"token_review\":{\"ca_file\":\"/var/run/secrets/informed-decision/kubernetes/ca.crt\",\"origin\":\"https://kubernetes.default.svc:443\",\"token_file\":\"/var/run/secrets/informed-decision/kubernetes/token\"}}}"
}
},
{
@ -96,7 +96,7 @@
"containers": [
{
"name": "informed-decision",
"image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:79aabf37e3920261189996020f84562c27709937f74632582331712d74c5f289",
"image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:7f5c6cb29c9f70a026bfe30e72934274ddc69261676cf6d476f81dd32812d173",
"securityContext": {
"allowPrivilegeEscalation": false,
"readOnlyRootFilesystem": true,
@ -231,7 +231,7 @@
{
"name": "configuration",
"configMap": {
"name": "informed-decision-runtime-92d01402eb05",
"name": "informed-decision-runtime-c81577741a09",
"defaultMode": 292
}
},