coulomb/informed-decision
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add lifecycle browser authoring and durable review handoff retrieval

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a10780-6d41-7952-9718-dfbc1f41236f
This commit is contained in:
tegwick 2026-10-05 00:48:07 +02:00
parent 52d372df0b
commit 9bc581a547
20 changed files with 632 additions and 74 deletions
Download patch file Download diff file Expand all files Collapse all files

37
docs/specs/LifecycleProductionRuntime.md
View file

@ -1,8 +1,9 @@
# Initial production runtime candidate
# Initial production runtime
INFD-WP-0007 / INFD-WP-0005. Founder selected net-kingdom-admins humans and
system:serviceaccount:state-hub:state-hub on 2026-10-04. This is a preparation
contract; deployment still requires the concrete rollout approval.
system:serviceaccount:state-hub:state-hub on 2026-10-04. The concrete rollout was approved and accepted on 2026-10-05.
This describes the deployed initial runtime; later artifacts require their own
release verification.
## Identity and listeners
@ -28,11 +29,11 @@ package, version and digest from human review. Only humans can bind via the
existing protected review flow. Access Engine keeps the authorization decision;
Approval Engine keeps authoritative approval state.
## Initial proposal data
## Admitted initial data
`deploy/lifecycle/lifecycle-callers.json` names the exact State Hub account and
platform tenant. The intake registry permits only decision-record class and
net-kingdom-admins, with a proposed cap of 50 new attempts per UTC day. Replays
net-kingdom-admins, with a cap of 50 new attempts per UTC day. Replays
do not spend a second attempt; uncertain creation never automatically reposts.
The cap and routing are configuration, not per-decision deployments.
@ -64,7 +65,7 @@ forwarding route. Queueing is trusted workload execution. New review envelopes
are data operations and do not change deployments. The exact lifecycle snapshot
id/key is preserved without inventing a Hub relationship when serves is absent.
Lost replies replay the same envelope; native-create uncertainty blocks the row.
Native deployment/acceptance still remains open. Notification/write-back receiver
Native deployment and human acceptance passed. Notification/write-back receiver
admission is unchanged; INFD_HUB_WRITEBACK remains off.
The image migrates schema 2 to schema 5 on open. Existing records, presentations,
@ -74,16 +75,16 @@ new evidence, and restore a verified pre-cutover copy on a separate private volu
only under the reviewed recovery plan. An in-flight/unresolved human submission
must be reconciled, never retried or discarded to make rollback convenient.
## Remaining live gates
## Observed acceptance and remaining scope
- CCR-2026-0032 requester projection: current namespace has only the audit
ExternalSecret; requester custody, native identity/path refusals and rotation
evidence remain with RPF-WP-0051.
- FLEX-WP-0033: publish scanned policy artifact; approve exact policy/RBAC/network
objects and native caller/subject allow/refusal tests.
- INFD-WP-0005 / STATE-WP-0096: activate and verify the prepared private State Hub
dispatcher and its projected tokens; retain gated resolution write-back.
- INFD-WP-0007-T06/T07: backup/restore, exact rollout approval, native human review
and independent audit receipts across two decisions and a revision with unchanged
release/configuration pins. Browser packet authoring and broader binding profiles
remain on T05; the supported review handoff profile is documented separately.
CCR-2026-0032 delivery is applied: actual receiving mount/exchange and bounded
identity/path/scope/revocation tests passed. FLEX-WP-0033 and STATE-WP-0096
completed native deployment and human acceptance. INFD-WP-0007-T06/T07 retain
backup/restore, caller isolation, unchanged pins across two records/a revision,
restart retention and independent audit proof. See
../evidence/2026-10-05-lifecycle-cutover/acceptance-summary.json.
Issuer rotation remains separately governed under Platform RPF-IN-0004.
Browser authoring continuation is T05; new source features do not imply a
production update. Wider identity/binding/publication and optional Hub write-back
contracts remain explicit T02 work. No new caller, group or listener is admitted.