coulomb/informed-decision
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add lifecycle browser authoring and durable review handoff retrieval

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a10780-6d41-7952-9718-dfbc1f41236f
This commit is contained in:
tegwick 2026-10-05 00:48:07 +02:00
parent 52d372df0b
commit 9bc581a547
20 changed files with 632 additions and 74 deletions
Download patch file Download diff file Expand all files Collapse all files

27
docs/specs/LifecycleHTTPContract.md
View file

@ -1,8 +1,9 @@
# Lifecycle HTTP adapter — registration, revisions and collaboration
2026-10-04; INFD-WP-0007-T04, in progress. `LifecycleAPI` is an unmounted WSGI
adapter over `LifecycleService`. It starts no listener and adds no route to the
existing browser app or public ingress.
2026-10-05; INFD-WP-0007. `LifecycleAPI` is a WSGI adapter over
`LifecycleService`, mounted on the admitted private 8081 listener. It adds no
route to public ingress. The direct retained-handoff GET is a source addition
awaiting a separate release; the other routes below are deployed.
| Method and path | Input | Result |
| --- | --- | --- |
@ -11,6 +12,7 @@ existing browser app or public ingress.
| `POST /v1/decisions` | `memo`, optional `documents` | Register an unbound version-one memo and return event/record/revision/resource receipt |
| `POST /v1/decisions/{id}/revisions` | `memo`, `expected_version`, `summary`, optional `documents` | Compare-and-append successor revision; same receipt shape |
| `POST /v1/decisions/{id}/review-requests` | `version`, `options` per LifecycleReviewHandoff | Durable request receipt and exact intake envelope |
| `GET /v1/decisions/{id}/review-requests` | Required positive `version` | Exact retained request receipt/envelope, checked as `lifecycle.events`; no submission |
| `GET /v1/decisions/{id}/outcomes` | Required positive `version` | Correlated review/disposition evidence and submission state |
| `GET /v1/decisions/{id}` | Optional positive integer `version` | Existing Memo JSON for the current or specified revision |
| `GET /v1/decisions/{id}/events` | Optional `after` sequence cursor, `limit` 1–100 | `{"events": [...]}` ordered by sequence; use last returned sequence for next page |
@ -28,8 +30,8 @@ revision numbers and truncated bodies are rejected. Disposition routes are not e
Authentication runs before routing or reading a mutation body. The composition
must explicitly supply a bearer-token verifier returning an authenticated
`Caller`. There is no default or testing fallback. Cookies are not credentials
for this adapter; its future human browser integration must provide a separately
reviewed session/CSRF boundary or admitted bearer identity. Neither the intake SA
for this adapter; the browser workspace uses the separate
verified session/CSRF adapter. Neither the intake SA
audience nor the browser's approval-engine access token is implicitly admitted.
Every handled command invokes the shared policy-consuming service. Clients cannot
@ -44,13 +46,12 @@ identity, 403 policy denial, 404 unavailable record/route, 405 unsupported metho
service or unusable policy evidence. Raw exception text and credentials are never
returned. Upstream raw diagnostics are not forwarded.
T04 remains in progress: admitted workload authenticators and API listener
composition. The browser workspace uses verified sessions through a separate
adapter (see LifecycleWorkspaceDelivery.md). Current
tests use the real service/repository/PolicyClient with synthetic authenticator
and PDP transport; they establish adapter behavior, not live identity admission.
Runtime must not expose this adapter before lifecycle policy and independent
event-delivery contracts are accepted and readiness can be satisfied.
The deployed runtime authenticates the selected State Hub service account using
Kubernetes TokenReview and the lifecycle audience. See LifecycleProductionRuntime.md.
Human workspace forms use verified KeyCape sessions through a separate adapter.
Native admission, negative identity tests and initial human acceptance are
recorded in ../evidence/2026-10-05-lifecycle-cutover/. New clients still require
owner-reviewed admission; this contract does not widen identity or listeners.
## Memo commands and packet custody
@ -72,7 +73,7 @@ Idempotency-Key. Register/revise receipts include a relative API resource link
`/v1/decisions/{id}?version={version}` and a `workspace_url` at
`https://decisions.coulomb.social/decisions/{id}?version={version}`. The latter
is an authorized authoring workspace, not a binding review link. The API remains
unmounted. Search cursors are caller/tenant/query scoped, expire after five
private. Search cursors are caller/tenant/query scoped, expire after five
minutes and are invalidated on process restart. Every page rechecks policy.
Each document has exactly `digest`, `media_type`, `content_base64`. At most 100