Prepare matching service and policy pins for review discovery

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a10780-6d41-7952-9718-dfbc1f41236f
This commit is contained in:
tegwick 2026-10-05 01:05:54 +02:00
parent da2c5a720f
commit 9207a5134f
7 changed files with 323 additions and 7 deletions

View file

@ -188,3 +188,25 @@ annotations supplied by Argo at sync. No direct resource apply is intended.
The existing Recreate strategy prevents two writers; allow a short restart.
If startup fails, revert the image pin to 804d89fb through Argo (same schema),
retaining the current database and all post-backup evidence.
## Named-recipient discovery release — 2026-10-05
Same founder instruction authorizes this INFD-WP-0007 continuation. Service source
da2c5a7, image 7f5c6cb29c9f70a026bfe30e72934274ddc69261676cf6d476f81dd32812d173;
owner policy source f234d01, image
6c6dc263f4a7f6461e109e133c004c080e8e373acfead8611856c5fb3e44168e.
Compact-sitting v13 digest:
sha256:31be5985c0c1e6b0c3a039ed7310d1e94daf523a94f6d926e6e8d759d3711873.
Update the existing owner review Helm release through its values, then sync the
matching service image/config through Argo. During the short pin transition,
review fails closed; no policy fallback is enabled. Existing exact mandates and
fifteen-minute read/act assurance remain. Attribute listing now requires the
named recipient, admitted class/submitter/group and live approval evidence, with
the existing twelve-hour list assurance window. No broader audience is admitted.
671 tests (one skipped), 32 embedded owner checks, owner regressions and 13
container checks pass. Both scans have zero HIGH/CRITICAL findings. Fresh
schema-5 backup: 8ac7bbe79de7cdcff5ebc9fa8adc9c49498bf8a3298c8fbc9bd7501be1a379bb.
Rollback, if needed: owner Helm prior revision 12 and Argo source dfcef87 together,
retaining the current schema-5 database. Evidence: docs/evidence/2026-10-05-lifecycle-discovery/.