coulomb/informed-decision
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Align lifecycle persistence with review isolation and runtime health

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a10780-6d41-7952-9718-dfbc1f41236f
This commit is contained in:
tegwick 2026-10-04 18:34:40 +02:00
parent b2a4b863a8
commit f0e9341650
8 changed files with 102 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

35
docs/evidence/2026-10-04-lifecycle-infrastructure-alignment.md Normal file
View file

@ -0,0 +1,35 @@
# Lifecycle and existing infrastructure alignment
Source review on 2026-10-04, INFD-WP-0007-T02/T03. No cluster inspection or
deployment occurred. Sources: access-engine `c0f3f25`, approval-engine `17f2225`,
audit-core `f1035a8`, railiance-platform `267814b`; local informed-decision
`deploy/sitting-admission.json` pins compact-sitting v11.
| Boundary | Finding and disposition |
| --- | --- |
| Store/schema | Lifecycle shares schema 4 and existing memo evidence; schema 1–3 migration/restart/backup tests pass. Legacy `save_memo` could write registered revisions without lifecycle events; it now refuses those ids. |
| Legacy UI | `memos_for` previously selected unpublished lifecycle records by named reviewer. Overview could show their ids as unavailable before authorization. Registered lifecycle records are now excluded pending explicit publication/review integration. Existing legacy review records remain eligible. |
| Runtime/audit | New pending events were invisible to readiness and admin inspection. Readiness now refuses immediately on pending lifecycle evidence; inspection reports record/event/pending counts without content. Receiver delivery remains unimplemented and pending rows are retained. |
| Access Engine | Current compact-sitting v11 contains exact-record human review and an attribute-admission branch with empty submitter/class sets. It does not admit `lifecycle.*`. Shared PolicyClient response validation is reused; a deployed review pin is not a lifecycle policy grant. |
| Approval Engine | Unbound registration creates no approval and cannot consume or accept one. Existing real-engine presentation/entry tests pass; publishing a lifecycle revision for binding still needs an explicit integration contract. |
| Identity | Human caller import reuses authenticated KeyCape session provenance. Workload lifecycle identity has only a trusted application interface; the private intake audience is not authorization for a new API. No issuer/audience/tenant claim is invented. |
| Platform | Source-phase requester composition still needs private listener/runtime configuration and CA-verified TokenReview. Platform's dependency-requirements file explicitly separates that source work from later native custody/rollout approval. Lifecycle HTTP development does not satisfy WP-0005-T05. |
Validation command:
```sh
INFD_APPROVAL_ENGINE_SOURCE=/home/worsch/approval-engine \
INFD_AUDIT_CORE_SOURCE=/home/worsch/audit-core \
INFD_STATE_HUB_SOURCE=/home/worsch/state-hub \
uv run --extra dev python -m pytest -q
```
Result before subsequent HTTP adapter development: **571 passed, 5 skipped**.
These use actual owner source APIs with synthetic identity/custody; they do not
prove native policy admission, live issuer custody or cluster routing. Lifecycle
policy admission and new event receiver/delivery contracts remain live work under
WP-0007-T02/T03; private intake runtime/admission delivery remains WP-0005.
Schema rollback requires a pre-upgrade database backup and reconciliation of any
subsequent writes. Simply deploying a schema-3 binary against schema 4 is not a
supported rollback. No production migration or image change was performed.

4
docs/specs/LifecycleFoundationContract.md
View file

@ -81,7 +81,9 @@ Pending lifecycle events are durable local obligations. They are not emitted as
invented Audit Core event types or reported delivered. The existing review audit
queue remains unchanged. Before exposure, T02/T03 must settle receiver admission,
payload/privacy, delivery retries and readiness accounting for the new queue.
The existing readiness check does not account for it yet.
Runtime readiness now refuses while lifecycle events remain pending, and the
admin inspection command reports content-free lifecycle counts. No events are
marked delivered without the future admitted receiver adapter.
## Remaining contracts