Record native authoring and discovery release; complete initial lifecycle delivery

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a10780-6d41-7952-9718-dfbc1f41236f

SCOPE.md

@@ -9,8 +9,8 @@
 The headless lifecycle service and browser workspace are deployed at
 `decisions.coulomb.social` under the founder-approved initial audience:
 net-kingdom-admins humans and system:serviceaccount:state-hub:state-hub.
-Service image 804d89fb runs schema 5; Access Engine owns lifecycle v1 and
-compact-sitting v12 policy decisions. Approval Engine remains the approval-state
+Service image 7f5c6cb2 runs schema 5; Access Engine owns lifecycle v1 and
+compact-sitting v13 policy decisions. Approval Engine remains the approval-state
 owner. The UI uses the shared service foundation; the private bearer API listens
 on 8081 through informed-decision-workload and is absent from public ingress.
 
@@ -24,25 +24,33 @@ Core counts match; prior 24 confirmed submissions were preserved.
 
 Human acceptance of source revision 2 is confirmed at 2026-10-04T22:17:19Z,
 with an exact presentation/disposition link and independent audit reconciliation.
-Broader binding profiles and browser discovery remain live tasks in INFD-WP-0007; intake
+The initial lifecycle delivery is complete in INFD-WP-0007; broader profiles
+and external identity/source integrations are tracked in INFD-WP-0008; intake
 initial delivery is completed in INFD-WP-0005. Issuer rotation is separately governed under Platform
 RPF-IN-0004. Automatic Hub resolution write-back remains disabled.
 
 Release/cutover procedure: `deploy/lifecycle/README.md`. Native receipts:
 `docs/evidence/2026-10-05-lifecycle-cutover/`. Earlier statuses below are historical.
 
-## Lifecycle authoring source increment — 2026-10-05
+## Lifecycle authoring and discovery deployed — 2026-10-05
 
-Implemented but not yet deployed: browser approval/discussion drafts, immutable
+Deployed: browser approval/discussion drafts, immutable
 supporting text documents with required acknowledgments, document/revision
 comparison, and retained review-request downloads. The private API can retrieve
 an exact revision's handoff under the existing events permission. These adapters
 use the headless service; request preparation creates no native approval.
 
-Validation: 669 tests passed (one skipped), followed by 50 focused checks and
-16 Chromium checks against actual owner components with synthetic identity.
-Evidence: `docs/evidence/2026-10-05-lifecycle-authoring/`. Attribute-based legacy
-review discovery and broader binding contracts remain open in INFD-WP-0007.
+Review overview discovery now uses recipient-scoped compact-sitting v13 admission;
+read and act retain fresh, separate authorization. Native replay verifies list
+allow for the retained recipient, another-recipient refusal and stale-read refusal.
+This is not a new human login or disposition.
+
+Validation: 671 tests passed (one skipped), 32 owner policy checks, 13 installed
+container checks, zero HIGH/CRITICAL scan findings and the authoring increment's
+16 Chromium checks. Fresh backup/restore and native outcome retrieval preserve
+all 25 confirmed submissions. Argo is Synced/Healthy. Evidence:
+`docs/evidence/2026-10-05-lifecycle-authoring/` and
+`docs/evidence/2026-10-05-lifecycle-discovery/`.
 
 ## Status — 2026-09-27
 

deploy/lifecycle/review-policy.candidate.yaml

@@ -128,7 +128,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: flex-auth
-          image: forgejo.coulomb.social/coulomb/flex-auth@sha256:bdac62bc3f089cba0df7c35eeb8d0d9b3af2d4bae5e4ea4767516c1ed20b1e99
+          image: forgejo.coulomb.social/coulomb/flex-auth@sha256:6c6dc263f4a7f6461e109e133c004c080e8e373acfead8611856c5fb3e44168e
           imagePullPolicy: IfNotPresent
           args:
             - serve

docs/evidence/2026-10-05-lifecycle-authoring/README.md

@@ -1,6 +1,8 @@
 # Lifecycle authoring validation — 2026-10-05
 
-Source implementation evidence; this increment has not been deployed.
+Original source validation evidence. This increment was subsequently deployed
+as 79aabf37 and retained in discovery release 7f5c6cb2. Native release receipts
+are in ../2026-10-05-lifecycle-discovery/.
 
 The browser can prepare approval or discussion drafts, append immutable text
 supporting documents and required acknowledgments, compare revisions, publish,

docs/evidence/2026-10-05-lifecycle-discovery/README.md

@@ -0,0 +1,35 @@
+# Lifecycle authoring and discovery release — 2026-10-05
+
+Founder authorized deployment and the remaining INFD-WP-0007 implementation.
+Authority: ADMINISTER @ realm:kubernetes/railiance01, activation=APPROVED.
+
+- Service source da2c5a7; image 7f5c6cb29c9f70a026bfe30e72934274ddc69261676cf6d476f81dd32812d173.
+- Review policy source f234d01; owner CI image 6c6dc263f4a7f6461e109e133c004c080e8e373acfead8611856c5fb3e44168e.
+- Owner Helm release flex-auth-informed-decision-sitting revision 13, compact-sitting v13.
+- Manual Argo source 9207a5134f92904f3843c200645ced91f247af72; Platform pin db3e13a.
+- Argo reports Synced/Healthy; health/readiness 200; public private-API paths 404.
+- Store remains schema 5, 25 confirmed submissions, 174 delivered outbox rows,
+  two lifecycle records/nine events, no pending lifecycle delivery.
+
+A fresh protected off-cluster backup preceded each rollout. Authoring's offline
+restore preserved all counts; discovery changes no schema. Discovery backup SHA256:
+8ac7bbe79de7cdcff5ebc9fa8adc9c49498bf8a3298c8fbc9bd7501be1a379bb.
+The superseded immutable runtime ConfigMap was pruned through a resource-scoped
+Argo operation after the new pod became healthy; its content remains in Git.
+
+671 Python tests passed (one skip), 32 embedded owner policy tests passed,
+owner InformedDecision Go regressions passed, 13 installed container checks
+passed. Both artifact scans found zero HIGH/CRITICAL vulnerabilities. The prior
+authoring Chromium receipt has 16 passing checks, with synthetic identity.
+
+Native authenticated service-caller evaluation replays retained human claims
+with their original assurance timestamp: recipient listing allows, another
+recipient is denied, and read with stale assurance is denied. It records no new
+human login or disposition. The actual State Hub workload retrieves the exact
+handoff and the previously confirmed human outcome. Only the human's earlier
+acceptance is claimed; agent verification never binds.
+
+Initial release contracts are in LifecycleAdmissionBoundary.md. Expansion work
+has live records INFD-WP-0008-T01 through T04, and Platform issuer rotation remains
+RPF-IN-0004. No credential rotation, anonymous publication, external identity
+admission or non-approval signing profile was enabled here.

docs/evidence/2026-10-05-lifecycle-discovery/native-outcome.json

@@ -0,0 +1 @@
+{"handoff_retrieved": true, "review_memo_id": "review-0d55a416-178c-46f5-b74b-b9b668390448", "human_dispositions": 1, "confirmed": true}

docs/evidence/2026-10-05-lifecycle-discovery/native-policy.json

@@ -0,0 +1 @@
+{"proof": "native authenticated service caller; replay of retained human claims with original assurance timestamp; no new human login or disposition", "policy_version": "v13", "policy_digest": "sha256:31be5985c0c1e6b0c3a039ed7310d1e94daf523a94f6d926e6e8d759d3711873", "results": {"retained_recipient_list": "allow", "other_recipient_list": "policy_denied", "stale_assurance_read": "policy_denied"}}

docs/evidence/2026-10-05-lifecycle-discovery/native-store.json

@@ -0,0 +1 @@
+{"schema_version": 5, "lifecycle": {"records": 2, "events": 9, "pending": 0}, "outbox": {"delivered": 174}, "submissions": {"confirmed": 25}}

docs/evidence/2026-10-05-lifecycle-discovery/public-checks.json

@@ -0,0 +1,7 @@
+{
+  "/healthz": 200,
+  "/readyz": 200,
+  "/v1/decisions": 404,
+  "/v1/memos": 404,
+  "/decisions": 401
+}

docs/specs/DecisionLifecycleService.md

@@ -2,7 +2,7 @@
 
 Status: initial audience deployed and human-accepted on 2026-10-05.
 This is the product contract, including wider capabilities not yet delivered.
-LifecycleHTTPContract.md names the implemented routes and source-only additions;
+LifecycleHTTPContract.md names the implemented and deployed routes;
 SCOPE.md and the workplan distinguish current delivery from remaining work.
 Workplan: `INFD-WP-0007`; intake prerequisite: `INFD-WP-0005`.
 

docs/specs/LifecycleFoundationContract.md

@@ -83,17 +83,17 @@ adapter stages immutable `informed-decision.lifecycle` commitments into the
 existing transactional outbox and clears pending obligations only after a receiver
 receipt. Content remains in local custody; the independent commitment contains
 its digest and existence assertion. Readiness refuses while lifecycle delivery
-is pending. See `LifecycleWorkspaceDelivery.md` for the platform tenant boundary,
-retries, heartbeats and outstanding production admission.
+is pending. The adapter is deployed for the initial audience. See
+`LifecycleWorkspaceDelivery.md` for the platform tenant boundary, retries and
+heartbeats.
 
-## Remaining contracts
+## Delivery boundary
 
-T02 remains in progress: production identity/policy composition, versioned HTTP schemas,
-production publication audience policy, incomplete drafts, non-cluster workload identity,
-legacy record enrollment, source fetching/retention, live independent evidence delivery
-and non-approval binding integration. T03 is started with this persistence slice;
-it is not complete. T04/T05 continue to own HTTP and UI exposure. Native runtime
-intake and admission remain with `INFD-WP-0005`.
+T02/T03/T04/T05 are complete for the initial production audience. The contracts
+are specified in `LifecycleAdmissionBoundary.md`; foundation, HTTP and browser
+adapters are deployed. Native intake admission is completed in INFD-WP-0005.
+Expansion beyond these explicit limits is tracked in INFD-WP-0008. Legacy imported
+records keep their existing review route and cannot be taken over by registration.
 
 Packet command extension: optional `documents` carries digest/media_type/base64
 content, verified and written in the same transaction as the memo/event. New

docs/specs/LifecycleHTTPContract.md

@@ -2,8 +2,8 @@
 
 2026-10-05; INFD-WP-0007. `LifecycleAPI` is a WSGI adapter over
 `LifecycleService`, mounted on the admitted private 8081 listener. It adds no
-route to public ingress. The direct retained-handoff GET is a source addition
-awaiting a separate release; the other routes below are deployed.
+route to public ingress. All routes below, including direct retained-handoff
+retrieval, are deployed in service image 7f5c6cb2.
 
 | Method and path | Input | Result |
 | --- | --- | --- |

docs/specs/LifecycleProductionRuntime.md

@@ -85,6 +85,7 @@ restart retention and independent audit proof. See
 ../evidence/2026-10-05-lifecycle-cutover/acceptance-summary.json.
 
 Issuer rotation remains separately governed under Platform RPF-IN-0004.
-Browser authoring continuation is T05; new source features do not imply a
-production update. Wider identity/binding/publication and optional Hub write-back
-contracts remain explicit T02 work. No new caller, group or listener is admitted.
+Browser authoring and named-recipient discovery are deployed in service image
+7f5c6cb2 with owner compact-sitting v13 (FLEX-WP-0034). Initial contracts are
+explicit in LifecycleAdmissionBoundary.md; broader expansion and optional Hub
+write-back are tracked in INFD-WP-0008. No new caller, group or listener is admitted.

docs/specs/LifecycleReviewHandoff.md

@@ -1,8 +1,8 @@
 # Revision-specific lifecycle review handoff
 
 2026-10-05; INFD-WP-0007-T02/T05. The initial handoff is deployed and
-human-accepted; browser document authoring and direct handoff retrieval below
-are the next source increment, not yet deployed.
+human-accepted. Browser document authoring and direct handoff retrieval below
+are deployed in service image 7f5c6cb2; discovery uses owner compact-sitting v13.
 
 ## Headless contract
 

docs/specs/LifecycleServiceContract.md

@@ -96,20 +96,17 @@ never local permissions. Human acceptance requires the separate existing
 presentation/disposition path; the source handoff now follows LifecycleReviewHandoff.md. The selected State Hub dispatcher forwards explicit requests; broader review
 profiles remain open.
 
-Before enabling a listener, T02/T04 must provide: reviewed lifecycle PDP package
-and action/context fixtures; admitted human/workload identity adapters; closed
-HTTP schemas with canonical URLs and request limits; service admission and
-publication audience contracts; lifecycle audit receiver admission and readiness
-accounting. Test fixtures exercise the real PolicyClient against synthetic policy
-transport. They are not evidence of a deployed lifecycle policy grant.
-
+The initial listener, owner PDP package, identity adapters, bounded HTTP schemas,
+publication audience and independent audit delivery are deployed and verified.
+Synthetic component evidence and native cutover/release receipts remain separate;
+see LifecycleAdmissionBoundary.md and the dated evidence directories.
 
 Production candidate record facts also include `revision_by`, the immutable actor
 of the requested revision. This lets its editor retain access to an unpublished
 successor after refining a published decision. Original authorship remains
 `registered_by`; both facts participate in the same transaction/read race guard.
 
-The next source increment adds `review_handoff(caller, memo_id, version)`, a
+The deployed service provides `review_handoff(caller, memo_id, version)`, a
 revision-specific read of the exact immutable request under `lifecycle.events`.
 It reuses the event permission and post-read currency checks, adds no grant, and
 never forwards or regenerates the envelope. See LifecycleReviewHandoff.md.

docs/specs/LifecycleWorkspaceDelivery.md

@@ -65,7 +65,8 @@ source behavior, not deployed workload authority or all seven acceptance cases.
 The initial rollout passed native agent-to-human-to-agent acceptance, restart
 retention, public/private isolation and Audit Core reconciliation. See
 ../evidence/2026-10-05-lifecycle-cutover/. Those receipts describe the deployed
-804d89fb image; they do not prove the next source increment is live.
+initial 804d89fb image. Authoring/discovery release 7f5c6cb2 is separately
+verified in ../evidence/2026-10-05-lifecycle-discovery/.
 
 Browser authoring now exposes explicit approval/discussion draft types, document
 addition with required acknowledgment, packet/highlight comparisons, and durable
@@ -73,17 +74,15 @@ review-request preparation/download. The adapter calls only the shared service;
 no store access, local permit or automatic privileged forwarding is introduced.
 LifecycleReviewHandoff.md specifies the shared retrieval and profile contract.
 
-Review overview discovery remains exact-record-only under compact-sitting v12.
 The lifecycle workspace discovers authorized records and exposes their outcomes.
-A later change to legacy overview discovery needs an Access Engine contract,
-not a consumer-side policy bypass. Broader binding profiles, external identities,
-source connectors and optional Hub write-back remain T02/T05 work.
+Broader profiles, external identities, source connectors and optional Hub
+write-back are explicit expansion work in INFD-WP-0008.
 
-## Named-recipient review discovery — source continuation
+## Named-recipient review discovery — deployed
 
 The adapter now carries retained intake facts and the immutable memo recipient
 for list decisions. It verifies native approval requester, human control and
 binding digest before the PDP call. Access Engine compact-sitting v13 checks the
 recipient and existing class/submitter/group admission with the twelve-hour list
 window; read and act remain separate fifteen-minute decisions. Missing evidence
-hides that row. This continuation requires the matching owner pin at release.
+hides that row. Matching owner v13 and consumer pins are deployed and verified.

workplans/INFD-WP-0007-decision-lifecycle-service.md

@@ -4,7 +4,7 @@ type: workplan
 title: "Decision lifecycle service — headless foundation and human UI"
 domain: infotech
 repo: informed-decision
-status: active
+status: finished
 owner: codex
 topic_slug: netkingdom
 created: "2026-10-04"
@@ -92,7 +92,7 @@ uncertain external outcomes. The complete agent scenario must run without a UI.
 
 ```task
 id: INFD-WP-0007-T05
-status: progress
+status: done
 priority: high
 depends_on: [INFD-WP-0007-T04]
 state_hub_task_id: "a6a7c9a8-760e-52dd-80d3-d36f43f0a86a"
@@ -407,3 +407,17 @@ Hub write-back. T05 implements named-recipient review discovery in the consumer
 and Access Engine FLEX-WP-0034 v13, with fresh read/act checks retained. Validation
 671 passed, one skipped; 32 owner embedded policy checks plus owner regressions.
 Discovery release and final native checks remain in progress.
+
+## Initial production scope complete — 2026-10-05
+
+T05 discovery is deployed with source 9207a51, service image 7f5c6cb2 and owner
+v13 image 6c6dc263/Helm revision 13. Native caller policy replay confirms named
+recipient list, other-recipient denial and stale-read denial. Existing human
+acceptance remains confirmed and retrievable by the admitted State Hub workload.
+Public health/readiness pass, private API paths return 404 publicly, store counts
+remain intact and Argo is Synced/Healthy. No new human answer is claimed.
+
+All seven tasks are complete for the selected initial production audience and
+organizational approval profile. Residuals were created before closure as
+INFD-WP-0008-T01/T02/T03/T04. Platform issuer rotation remains RPF-IN-0004.
+Evidence: docs/evidence/2026-10-05-lifecycle-discovery/.