From 96dcbfdfa2be953770c6aae298470af781edc8b9 Mon Sep 17 00:00:00 2001 From: tegwick Date: Mon, 5 Oct 2026 01:14:08 +0200 Subject: [PATCH] Record native authoring and discovery release; complete initial lifecycle delivery Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a10780-6d41-7952-9718-dfbc1f41236f --- SCOPE.md | 26 +++++++++----- deploy/lifecycle/review-policy.candidate.yaml | 2 +- .../2026-10-05-lifecycle-authoring/README.md | 4 ++- .../2026-10-05-lifecycle-discovery/README.md | 35 +++++++++++++++++++ .../native-outcome.json | 1 + .../native-policy.json | 1 + .../native-store.json | 1 + .../public-checks.json | 7 ++++ docs/specs/DecisionLifecycleService.md | 2 +- docs/specs/LifecycleFoundationContract.md | 18 +++++----- docs/specs/LifecycleHTTPContract.md | 4 +-- docs/specs/LifecycleProductionRuntime.md | 7 ++-- docs/specs/LifecycleReviewHandoff.md | 4 +-- docs/specs/LifecycleServiceContract.md | 13 +++---- docs/specs/LifecycleWorkspaceDelivery.md | 13 ++++--- ...INFD-WP-0007-decision-lifecycle-service.md | 18 ++++++++-- 16 files changed, 111 insertions(+), 45 deletions(-) create mode 100644 docs/evidence/2026-10-05-lifecycle-discovery/README.md create mode 100644 docs/evidence/2026-10-05-lifecycle-discovery/native-outcome.json create mode 100644 docs/evidence/2026-10-05-lifecycle-discovery/native-policy.json create mode 100644 docs/evidence/2026-10-05-lifecycle-discovery/native-store.json create mode 100644 docs/evidence/2026-10-05-lifecycle-discovery/public-checks.json diff --git a/SCOPE.md b/SCOPE.md index 5efb3dc..8ee5eb6 100644 --- a/SCOPE.md +++ b/SCOPE.md @@ -9,8 +9,8 @@ The headless lifecycle service and browser workspace are deployed at `decisions.coulomb.social` under the founder-approved initial audience: net-kingdom-admins humans and system:serviceaccount:state-hub:state-hub. -Service image 804d89fb runs schema 5; Access Engine owns lifecycle v1 and -compact-sitting v12 policy decisions. Approval Engine remains the approval-state +Service image 7f5c6cb2 runs schema 5; Access Engine owns lifecycle v1 and +compact-sitting v13 policy decisions. Approval Engine remains the approval-state owner. The UI uses the shared service foundation; the private bearer API listens on 8081 through informed-decision-workload and is absent from public ingress. @@ -24,25 +24,33 @@ Core counts match; prior 24 confirmed submissions were preserved. Human acceptance of source revision 2 is confirmed at 2026-10-04T22:17:19Z, with an exact presentation/disposition link and independent audit reconciliation. -Broader binding profiles and browser discovery remain live tasks in INFD-WP-0007; intake +The initial lifecycle delivery is complete in INFD-WP-0007; broader profiles +and external identity/source integrations are tracked in INFD-WP-0008; intake initial delivery is completed in INFD-WP-0005. Issuer rotation is separately governed under Platform RPF-IN-0004. Automatic Hub resolution write-back remains disabled. Release/cutover procedure: `deploy/lifecycle/README.md`. Native receipts: `docs/evidence/2026-10-05-lifecycle-cutover/`. Earlier statuses below are historical. -## Lifecycle authoring source increment — 2026-10-05 +## Lifecycle authoring and discovery deployed — 2026-10-05 -Implemented but not yet deployed: browser approval/discussion drafts, immutable +Deployed: browser approval/discussion drafts, immutable supporting text documents with required acknowledgments, document/revision comparison, and retained review-request downloads. The private API can retrieve an exact revision's handoff under the existing events permission. These adapters use the headless service; request preparation creates no native approval. -Validation: 669 tests passed (one skipped), followed by 50 focused checks and -16 Chromium checks against actual owner components with synthetic identity. -Evidence: `docs/evidence/2026-10-05-lifecycle-authoring/`. Attribute-based legacy -review discovery and broader binding contracts remain open in INFD-WP-0007. +Review overview discovery now uses recipient-scoped compact-sitting v13 admission; +read and act retain fresh, separate authorization. Native replay verifies list +allow for the retained recipient, another-recipient refusal and stale-read refusal. +This is not a new human login or disposition. + +Validation: 671 tests passed (one skipped), 32 owner policy checks, 13 installed +container checks, zero HIGH/CRITICAL scan findings and the authoring increment's +16 Chromium checks. Fresh backup/restore and native outcome retrieval preserve +all 25 confirmed submissions. Argo is Synced/Healthy. Evidence: +`docs/evidence/2026-10-05-lifecycle-authoring/` and +`docs/evidence/2026-10-05-lifecycle-discovery/`. ## Status — 2026-09-27 diff --git a/deploy/lifecycle/review-policy.candidate.yaml b/deploy/lifecycle/review-policy.candidate.yaml index cf682aa..ca62e19 100644 --- a/deploy/lifecycle/review-policy.candidate.yaml +++ b/deploy/lifecycle/review-policy.candidate.yaml @@ -128,7 +128,7 @@ spec: type: RuntimeDefault containers: - name: flex-auth - image: forgejo.coulomb.social/coulomb/flex-auth@sha256:bdac62bc3f089cba0df7c35eeb8d0d9b3af2d4bae5e4ea4767516c1ed20b1e99 + image: forgejo.coulomb.social/coulomb/flex-auth@sha256:6c6dc263f4a7f6461e109e133c004c080e8e373acfead8611856c5fb3e44168e imagePullPolicy: IfNotPresent args: - serve diff --git a/docs/evidence/2026-10-05-lifecycle-authoring/README.md b/docs/evidence/2026-10-05-lifecycle-authoring/README.md index d928dc7..1c94982 100644 --- a/docs/evidence/2026-10-05-lifecycle-authoring/README.md +++ b/docs/evidence/2026-10-05-lifecycle-authoring/README.md @@ -1,6 +1,8 @@ # Lifecycle authoring validation — 2026-10-05 -Source implementation evidence; this increment has not been deployed. +Original source validation evidence. This increment was subsequently deployed +as 79aabf37 and retained in discovery release 7f5c6cb2. Native release receipts +are in ../2026-10-05-lifecycle-discovery/. The browser can prepare approval or discussion drafts, append immutable text supporting documents and required acknowledgments, compare revisions, publish, diff --git a/docs/evidence/2026-10-05-lifecycle-discovery/README.md b/docs/evidence/2026-10-05-lifecycle-discovery/README.md new file mode 100644 index 0000000..cebb12e --- /dev/null +++ b/docs/evidence/2026-10-05-lifecycle-discovery/README.md @@ -0,0 +1,35 @@ +# Lifecycle authoring and discovery release — 2026-10-05 + +Founder authorized deployment and the remaining INFD-WP-0007 implementation. +Authority: ADMINISTER @ realm:kubernetes/railiance01, activation=APPROVED. + +- Service source da2c5a7; image 7f5c6cb29c9f70a026bfe30e72934274ddc69261676cf6d476f81dd32812d173. +- Review policy source f234d01; owner CI image 6c6dc263f4a7f6461e109e133c004c080e8e373acfead8611856c5fb3e44168e. +- Owner Helm release flex-auth-informed-decision-sitting revision 13, compact-sitting v13. +- Manual Argo source 9207a5134f92904f3843c200645ced91f247af72; Platform pin db3e13a. +- Argo reports Synced/Healthy; health/readiness 200; public private-API paths 404. +- Store remains schema 5, 25 confirmed submissions, 174 delivered outbox rows, + two lifecycle records/nine events, no pending lifecycle delivery. + +A fresh protected off-cluster backup preceded each rollout. Authoring's offline +restore preserved all counts; discovery changes no schema. Discovery backup SHA256: +8ac7bbe79de7cdcff5ebc9fa8adc9c49498bf8a3298c8fbc9bd7501be1a379bb. +The superseded immutable runtime ConfigMap was pruned through a resource-scoped +Argo operation after the new pod became healthy; its content remains in Git. + +671 Python tests passed (one skip), 32 embedded owner policy tests passed, +owner InformedDecision Go regressions passed, 13 installed container checks +passed. Both artifact scans found zero HIGH/CRITICAL vulnerabilities. The prior +authoring Chromium receipt has 16 passing checks, with synthetic identity. + +Native authenticated service-caller evaluation replays retained human claims +with their original assurance timestamp: recipient listing allows, another +recipient is denied, and read with stale assurance is denied. It records no new +human login or disposition. The actual State Hub workload retrieves the exact +handoff and the previously confirmed human outcome. Only the human's earlier +acceptance is claimed; agent verification never binds. + +Initial release contracts are in LifecycleAdmissionBoundary.md. Expansion work +has live records INFD-WP-0008-T01 through T04, and Platform issuer rotation remains +RPF-IN-0004. No credential rotation, anonymous publication, external identity +admission or non-approval signing profile was enabled here. diff --git a/docs/evidence/2026-10-05-lifecycle-discovery/native-outcome.json b/docs/evidence/2026-10-05-lifecycle-discovery/native-outcome.json new file mode 100644 index 0000000..6cf0033 --- /dev/null +++ b/docs/evidence/2026-10-05-lifecycle-discovery/native-outcome.json @@ -0,0 +1 @@ +{"handoff_retrieved": true, "review_memo_id": "review-0d55a416-178c-46f5-b74b-b9b668390448", "human_dispositions": 1, "confirmed": true} diff --git a/docs/evidence/2026-10-05-lifecycle-discovery/native-policy.json b/docs/evidence/2026-10-05-lifecycle-discovery/native-policy.json new file mode 100644 index 0000000..b27605c --- /dev/null +++ b/docs/evidence/2026-10-05-lifecycle-discovery/native-policy.json @@ -0,0 +1 @@ +{"proof": "native authenticated service caller; replay of retained human claims with original assurance timestamp; no new human login or disposition", "policy_version": "v13", "policy_digest": "sha256:31be5985c0c1e6b0c3a039ed7310d1e94daf523a94f6d926e6e8d759d3711873", "results": {"retained_recipient_list": "allow", "other_recipient_list": "policy_denied", "stale_assurance_read": "policy_denied"}} diff --git a/docs/evidence/2026-10-05-lifecycle-discovery/native-store.json b/docs/evidence/2026-10-05-lifecycle-discovery/native-store.json new file mode 100644 index 0000000..692f08c --- /dev/null +++ b/docs/evidence/2026-10-05-lifecycle-discovery/native-store.json @@ -0,0 +1 @@ +{"schema_version": 5, "lifecycle": {"records": 2, "events": 9, "pending": 0}, "outbox": {"delivered": 174}, "submissions": {"confirmed": 25}} diff --git a/docs/evidence/2026-10-05-lifecycle-discovery/public-checks.json b/docs/evidence/2026-10-05-lifecycle-discovery/public-checks.json new file mode 100644 index 0000000..9fa60db --- /dev/null +++ b/docs/evidence/2026-10-05-lifecycle-discovery/public-checks.json @@ -0,0 +1,7 @@ +{ + "/healthz": 200, + "/readyz": 200, + "/v1/decisions": 404, + "/v1/memos": 404, + "/decisions": 401 +} diff --git a/docs/specs/DecisionLifecycleService.md b/docs/specs/DecisionLifecycleService.md index a7e714d..dd8432a 100644 --- a/docs/specs/DecisionLifecycleService.md +++ b/docs/specs/DecisionLifecycleService.md @@ -2,7 +2,7 @@ Status: initial audience deployed and human-accepted on 2026-10-05. This is the product contract, including wider capabilities not yet delivered. -LifecycleHTTPContract.md names the implemented routes and source-only additions; +LifecycleHTTPContract.md names the implemented and deployed routes; SCOPE.md and the workplan distinguish current delivery from remaining work. Workplan: `INFD-WP-0007`; intake prerequisite: `INFD-WP-0005`. diff --git a/docs/specs/LifecycleFoundationContract.md b/docs/specs/LifecycleFoundationContract.md index eb1e9eb..6e0ae8e 100644 --- a/docs/specs/LifecycleFoundationContract.md +++ b/docs/specs/LifecycleFoundationContract.md @@ -83,17 +83,17 @@ adapter stages immutable `informed-decision.lifecycle` commitments into the existing transactional outbox and clears pending obligations only after a receiver receipt. Content remains in local custody; the independent commitment contains its digest and existence assertion. Readiness refuses while lifecycle delivery -is pending. See `LifecycleWorkspaceDelivery.md` for the platform tenant boundary, -retries, heartbeats and outstanding production admission. +is pending. The adapter is deployed for the initial audience. See +`LifecycleWorkspaceDelivery.md` for the platform tenant boundary, retries and +heartbeats. -## Remaining contracts +## Delivery boundary -T02 remains in progress: production identity/policy composition, versioned HTTP schemas, -production publication audience policy, incomplete drafts, non-cluster workload identity, -legacy record enrollment, source fetching/retention, live independent evidence delivery -and non-approval binding integration. T03 is started with this persistence slice; -it is not complete. T04/T05 continue to own HTTP and UI exposure. Native runtime -intake and admission remain with `INFD-WP-0005`. +T02/T03/T04/T05 are complete for the initial production audience. The contracts +are specified in `LifecycleAdmissionBoundary.md`; foundation, HTTP and browser +adapters are deployed. Native intake admission is completed in INFD-WP-0005. +Expansion beyond these explicit limits is tracked in INFD-WP-0008. Legacy imported +records keep their existing review route and cannot be taken over by registration. Packet command extension: optional `documents` carries digest/media_type/base64 content, verified and written in the same transaction as the memo/event. New diff --git a/docs/specs/LifecycleHTTPContract.md b/docs/specs/LifecycleHTTPContract.md index 88554ec..a16704b 100644 --- a/docs/specs/LifecycleHTTPContract.md +++ b/docs/specs/LifecycleHTTPContract.md @@ -2,8 +2,8 @@ 2026-10-05; INFD-WP-0007. `LifecycleAPI` is a WSGI adapter over `LifecycleService`, mounted on the admitted private 8081 listener. It adds no -route to public ingress. The direct retained-handoff GET is a source addition -awaiting a separate release; the other routes below are deployed. +route to public ingress. All routes below, including direct retained-handoff +retrieval, are deployed in service image 7f5c6cb2. | Method and path | Input | Result | | --- | --- | --- | diff --git a/docs/specs/LifecycleProductionRuntime.md b/docs/specs/LifecycleProductionRuntime.md index 9efd08a..7c8a734 100644 --- a/docs/specs/LifecycleProductionRuntime.md +++ b/docs/specs/LifecycleProductionRuntime.md @@ -85,6 +85,7 @@ restart retention and independent audit proof. See ../evidence/2026-10-05-lifecycle-cutover/acceptance-summary.json. Issuer rotation remains separately governed under Platform RPF-IN-0004. -Browser authoring continuation is T05; new source features do not imply a -production update. Wider identity/binding/publication and optional Hub write-back -contracts remain explicit T02 work. No new caller, group or listener is admitted. +Browser authoring and named-recipient discovery are deployed in service image +7f5c6cb2 with owner compact-sitting v13 (FLEX-WP-0034). Initial contracts are +explicit in LifecycleAdmissionBoundary.md; broader expansion and optional Hub +write-back are tracked in INFD-WP-0008. No new caller, group or listener is admitted. diff --git a/docs/specs/LifecycleReviewHandoff.md b/docs/specs/LifecycleReviewHandoff.md index fb6d5f5..2a79333 100644 --- a/docs/specs/LifecycleReviewHandoff.md +++ b/docs/specs/LifecycleReviewHandoff.md @@ -1,8 +1,8 @@ # Revision-specific lifecycle review handoff 2026-10-05; INFD-WP-0007-T02/T05. The initial handoff is deployed and -human-accepted; browser document authoring and direct handoff retrieval below -are the next source increment, not yet deployed. +human-accepted. Browser document authoring and direct handoff retrieval below +are deployed in service image 7f5c6cb2; discovery uses owner compact-sitting v13. ## Headless contract diff --git a/docs/specs/LifecycleServiceContract.md b/docs/specs/LifecycleServiceContract.md index 86d5473..d2a8b27 100644 --- a/docs/specs/LifecycleServiceContract.md +++ b/docs/specs/LifecycleServiceContract.md @@ -96,20 +96,17 @@ never local permissions. Human acceptance requires the separate existing presentation/disposition path; the source handoff now follows LifecycleReviewHandoff.md. The selected State Hub dispatcher forwards explicit requests; broader review profiles remain open. -Before enabling a listener, T02/T04 must provide: reviewed lifecycle PDP package -and action/context fixtures; admitted human/workload identity adapters; closed -HTTP schemas with canonical URLs and request limits; service admission and -publication audience contracts; lifecycle audit receiver admission and readiness -accounting. Test fixtures exercise the real PolicyClient against synthetic policy -transport. They are not evidence of a deployed lifecycle policy grant. - +The initial listener, owner PDP package, identity adapters, bounded HTTP schemas, +publication audience and independent audit delivery are deployed and verified. +Synthetic component evidence and native cutover/release receipts remain separate; +see LifecycleAdmissionBoundary.md and the dated evidence directories. Production candidate record facts also include `revision_by`, the immutable actor of the requested revision. This lets its editor retain access to an unpublished successor after refining a published decision. Original authorship remains `registered_by`; both facts participate in the same transaction/read race guard. -The next source increment adds `review_handoff(caller, memo_id, version)`, a +The deployed service provides `review_handoff(caller, memo_id, version)`, a revision-specific read of the exact immutable request under `lifecycle.events`. It reuses the event permission and post-read currency checks, adds no grant, and never forwards or regenerates the envelope. See LifecycleReviewHandoff.md. diff --git a/docs/specs/LifecycleWorkspaceDelivery.md b/docs/specs/LifecycleWorkspaceDelivery.md index e6e284f..32e17dd 100644 --- a/docs/specs/LifecycleWorkspaceDelivery.md +++ b/docs/specs/LifecycleWorkspaceDelivery.md @@ -65,7 +65,8 @@ source behavior, not deployed workload authority or all seven acceptance cases. The initial rollout passed native agent-to-human-to-agent acceptance, restart retention, public/private isolation and Audit Core reconciliation. See ../evidence/2026-10-05-lifecycle-cutover/. Those receipts describe the deployed -804d89fb image; they do not prove the next source increment is live. +initial 804d89fb image. Authoring/discovery release 7f5c6cb2 is separately +verified in ../evidence/2026-10-05-lifecycle-discovery/. Browser authoring now exposes explicit approval/discussion draft types, document addition with required acknowledgment, packet/highlight comparisons, and durable @@ -73,17 +74,15 @@ review-request preparation/download. The adapter calls only the shared service; no store access, local permit or automatic privileged forwarding is introduced. LifecycleReviewHandoff.md specifies the shared retrieval and profile contract. -Review overview discovery remains exact-record-only under compact-sitting v12. The lifecycle workspace discovers authorized records and exposes their outcomes. -A later change to legacy overview discovery needs an Access Engine contract, -not a consumer-side policy bypass. Broader binding profiles, external identities, -source connectors and optional Hub write-back remain T02/T05 work. +Broader profiles, external identities, source connectors and optional Hub +write-back are explicit expansion work in INFD-WP-0008. -## Named-recipient review discovery — source continuation +## Named-recipient review discovery — deployed The adapter now carries retained intake facts and the immutable memo recipient for list decisions. It verifies native approval requester, human control and binding digest before the PDP call. Access Engine compact-sitting v13 checks the recipient and existing class/submitter/group admission with the twelve-hour list window; read and act remain separate fifteen-minute decisions. Missing evidence -hides that row. This continuation requires the matching owner pin at release. +hides that row. Matching owner v13 and consumer pins are deployed and verified. diff --git a/workplans/INFD-WP-0007-decision-lifecycle-service.md b/workplans/INFD-WP-0007-decision-lifecycle-service.md index ca7bdc0..a4ecd4c 100644 --- a/workplans/INFD-WP-0007-decision-lifecycle-service.md +++ b/workplans/INFD-WP-0007-decision-lifecycle-service.md @@ -4,7 +4,7 @@ type: workplan title: "Decision lifecycle service — headless foundation and human UI" domain: infotech repo: informed-decision -status: active +status: finished owner: codex topic_slug: netkingdom created: "2026-10-04" @@ -92,7 +92,7 @@ uncertain external outcomes. The complete agent scenario must run without a UI. ```task id: INFD-WP-0007-T05 -status: progress +status: done priority: high depends_on: [INFD-WP-0007-T04] state_hub_task_id: "a6a7c9a8-760e-52dd-80d3-d36f43f0a86a" @@ -407,3 +407,17 @@ Hub write-back. T05 implements named-recipient review discovery in the consumer and Access Engine FLEX-WP-0034 v13, with fresh read/act checks retained. Validation 671 passed, one skipped; 32 owner embedded policy checks plus owner regressions. Discovery release and final native checks remain in progress. + +## Initial production scope complete — 2026-10-05 + +T05 discovery is deployed with source 9207a51, service image 7f5c6cb2 and owner +v13 image 6c6dc263/Helm revision 13. Native caller policy replay confirms named +recipient list, other-recipient denial and stale-read denial. Existing human +acceptance remains confirmed and retrievable by the admitted State Hub workload. +Public health/readiness pass, private API paths return 404 publicly, store counts +remain intact and Argo is Synced/Healthy. No new human answer is claimed. + +All seven tasks are complete for the selected initial production audience and +organizational approval profile. Residuals were created before closure as +INFD-WP-0008-T01/T02/T03/T04. Platform issuer rotation remains RPF-IN-0004. +Evidence: docs/evidence/2026-10-05-lifecycle-discovery/.