Prepare approved lifecycle authoring release and restore evidence

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a10780-6d41-7952-9718-dfbc1f41236f

deploy/lifecycle/README.md

@@ -168,3 +168,23 @@ Human acceptance is confirmed at 2026-10-04T22:17:19Z and linked to source
 revision 2, the exact presentation and independent audit receipts. Evidence and exact pins are retained
 in docs/evidence/2026-10-05-lifecycle-cutover/. Issuer rotation is a separate
 Platform residual, RPF-IN-0004; it was neither performed nor authorized here.
+
+## Authoring release — 2026-10-05
+
+Founder instruction: “Go on, deploy and implement the rest” (the final word was
+truncated in chat). Authority: ADMINISTER @ realm:kubernetes/railiance01,
+activation=APPROVED. Release source 9bc581a; image
+forgejo.coulomb.social/coulomb/informed-decision@sha256:79aabf37e3920261189996020f84562c27709937f74632582331712d74c5f289.
+This changes only the service image through the manually pinned Argo application;
+policy, credentials, runtime configuration and schema 5 remain unchanged.
+
+669 tests and 16 Chromium checks passed; installed container checks 13/13,
+HIGH/CRITICAL scan findings zero. Fresh production snapshot restored offline
+under the candidate preserves 25 confirmed submissions, 174 delivered outbox
+rows and two lifecycle records/nine events. Protected backup digest:
+5a22f06d5040e55fea46c4317349f9bc984186419616e5df913a4c6c44bf0b19.
+Server dry-run passed; client diff shows image replacement plus Argo tracking
+annotations supplied by Argo at sync. No direct resource apply is intended.
+The existing Recreate strategy prevents two writers; allow a short restart.
+If startup fails, revert the image pin to 804d89fb through Argo (same schema),
+retaining the current database and all post-backup evidence.

deploy/lifecycle/admission.candidate.json

@@ -1,5 +1,5 @@
 {
-  "image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:804d89fb0bb3d691720380eedde4f361133bada717d1773c2eb349004346ebf1",
+  "image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:79aabf37e3920261189996020f84562c27709937f74632582331712d74c5f289",
   "policy": {
     "origin": "http://flex-auth-informed-decision-sitting.flex-auth.svc.cluster.local:8080",
     "package": "informed-decision.compact-sitting",

deploy/lifecycle/service.candidate.json

@@ -96,7 +96,7 @@
             "containers": [
               {
                 "name": "informed-decision",
-                "image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:804d89fb0bb3d691720380eedde4f361133bada717d1773c2eb349004346ebf1",
+                "image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:79aabf37e3920261189996020f84562c27709937f74632582331712d74c5f289",
                 "securityContext": {
                   "allowPrivilegeEscalation": false,
                   "readOnlyRootFilesystem": true,

docs/evidence/2026-10-05-lifecycle-authoring/container.json

@@ -0,0 +1,32 @@
+{
+  "status": "passed",
+  "image_id": "sha256:79aabf37e3920261189996020f84562c27709937f74632582331712d74c5f289",
+  "repo_digests": [
+    "forgejo.coulomb.social/coulomb/informed-decision@sha256:79aabf37e3920261189996020f84562c27709937f74632582331712d74c5f289"
+  ],
+  "checks_passed": 13,
+  "checks": [
+    "installed container entrypoint serves with projected configuration",
+    "non-root read-only runtime has no external network or published port",
+    "private config/database modes enforced; package installer absent",
+    "configured review refuses anonymous access and reports audit-unready status",
+    "private listener refuses anonymous lifecycle access and exposes no browser routes",
+    "public listener exposes no private workload route",
+    "a second writer cannot acquire the active evidence volume",
+    "synthetic uncertain intent and undelivered evidence remain explicit",
+    "consistent backup created while serving; overwrite refused",
+    "SIGTERM closes the serving writer without forced kill",
+    "restart preserves immutable content and unresolved submission without retry",
+    "separate restored volume preserves exact content and unresolved state",
+    "incomplete owner configuration exits before serving"
+  ],
+  "fixture_only": true,
+  "external_network": "none",
+  "content_snapshot_sha256": "8407484f0e8fae97b47a0e0090ebfbfb161cb9726495a32a808a8427a36e3fac",
+  "native_identity_policy_audit_proven": false,
+  "published": false,
+  "deployed": false,
+  "factory_attempts": 0,
+  "paid_model_calls": 0,
+  "cleanup_complete": true
+}

docs/evidence/2026-10-05-lifecycle-authoring/restore.json

@@ -0,0 +1,18 @@
+{
+  "state": {
+    "schema_version": 5,
+    "lifecycle": {
+      "records": 2,
+      "events": 9,
+      "pending": 0
+    },
+    "outbox": {
+      "delivered": 174
+    },
+    "submissions": {
+      "confirmed": 25
+    }
+  },
+  "network": "none",
+  "snapshot_sha256": "5a22f06d5040e55fea46c4317349f9bc984186419616e5df913a4c6c44bf0b19"
+}

docs/evidence/2026-10-05-lifecycle-authoring/scan.json

@@ -0,0 +1,7 @@
+{
+  "scanner": "aquasec/trivy@sha256:62b1e65e8869bc4b4c6aa4fa2b21595256c7c2f6018a9d9ad61caf87187c1969",
+  "artifact": "forgejo.coulomb.social/coulomb/informed-decision:lifecycle-authoring-20261005",
+  "scanned_at": "2026-10-04T22:53:31.398058378Z",
+  "high_critical_findings": 0,
+  "report_sha256": "85414ae3f1dc1785962d43ab7ec9852302b209fba28b5395f21b03e968794137"
+}