Package protected review runtime and prepare deployment admission

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc

workplans/INFD-WP-0001-founding-specs-and-approver-ui-ownership.md

@@ -623,6 +623,50 @@ not be silently claimed by the bounded factory profile. The exact operational
 setup and remaining limits are in `docs/protected-browser-review.md`.
 T08 remains `progress`; no residual has been hidden by finishing the workplan.
 
+2026-09-11 — **container and deployment candidate prepared and exercised.**
+`Containerfile` and hashed dependency lock build the installed wheel on the
+digest-pinned Alpine base. The runtime has no package installer, runs as 10001
+on a read-only root filesystem, and copies bounded projected configuration into
+owned ephemeral 0600 storage. It keeps private persistent evidence at 0700/0600
+and takes a process-lifetime lock before opening the serving runtime. This
+preserves the store's checks despite Kubernetes projected-file ownership and
+prevents a second service from sharing its evidence volume.
+
+The installed custody CLI creates SQLite-consistent backups and reports only
+schema/delivery/submission counts. Eleven real-container checks passed with no
+external network or published port: restart and restore onto a second volume
+preserved exact content, undelivered evidence and a synthetic unresolved intent.
+All created containers/volumes were removed. The full suite passes 371 tests
+(27 added). Runtime files in the image match all 22 source modules; dependencies
+match the hashed lock. Trivy returned zero HIGH/CRITICAL findings; its Alpine
+lifecycle-list warning is retained in the receipt.
+
+The final lifecycle check exposed a real PID-1 shutdown defect: the first image
+needed a forced kill (exit 137). An explicit SIGTERM handler now lets Waitress
+drain and the audit pump stop; the final image exits cleanly within 15 seconds.
+Recreate rollout and the 45-second pod termination window retain one writer.
+
+The renderer prepares a Recreate Deployment, scoped projected caller token,
+immutable runtime config, PVC/Service and exact network rules. Kubernetes serving
+health remains separate from audit acceptance readiness, preserving refusal/
+recovery access during an audit outage. The source now includes exact ingress
+proposals for Approval Engine and the admitted PDP, because the existing caller
+rules do not automatically admit this pod. No namespace-wide caller label is
+added and no Secret, RBAC, policy assignment or Ingress is created.
+
+Seven objects passed server dry-run in their exact namespaces. The eighth,
+Approval Engine ingress, found its namespace absent. Its unchanged policy shape
+passed in a representative existing namespace; that is schema validation only.
+Observed Traefik label/websecure port, KeyCape public IP and local-path storage
+were used to make the candidate concrete, not to claim CNI or custody proof.
+
+Evidence: `docs/evidence/2026-09-11-container-candidate.json`; operating packet:
+`deploy/README.md`. The image is local and unpublished. T08 stays `progress` for
+the admitted native policy/caller/assignments, AUDIT-WP-0009-T11 custody, image
+publication, owner service/namespace and exact peer admission, registration and
+real human/deployed binding, platform backup/restore and product acceptance.
+No cluster apply, native secret read, factory attempt or paid call occurred.
+
 ## Known risks
 
 - **T02 is a hard gate.** Writing the blueprint before the layer ruling risks