.forgejo/workflows/service-image.yaml builds Containerfile from the pushed
commit's tarball and pushes forgejo.coulomb.social/coulomb/informed-decision
:main-<short sha>, then reports the immutable digest. Before pushing it
checks the zlib floor, the runtime smoke (tools/zlib_overlay/check_runtime.py)
and that the installed modules equal the commit's source.
Containerfile builds the wheel in-image (hash-pinned setuptools in
requirements-build.lock) and installs the zlib overlay's hash-pinned,
Alpine-signed zlib-1.3.2-r1 package offline, failing below 1.3.2-r1, so the
live image's zlib fix cannot regress. Overlay workflows are unchanged.
Local build: 13/13 container checks, zlib 1.3.2-r1, source manifest match.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5502@bnt-lap001
Assistant-Session: 68b3b02f-5d0f-4e71-8421-796f62e50196
Candidate files: review policy pin v14 (sha256:8911458f...), the
nk-bind-executor present_existing registry row (daily limit 10), and an
8081 ingress peer for exactly sso + app.kubernetes.io/name=bounded-executor.
The state-hub row is unchanged and outcome_read stays off. The image pin
stays at the live f5588f49 because no owner-CI full-service image exists
yet; the founder runbook (deploy/lifecycle/RELEASE-INFD-WP-0010-T02.md)
gates the release on it. Adds a side-effect-free present_existing probe
and release tests. Nothing applied.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5502@bnt-lap001
Assistant-Session: 68b3b02f-5d0f-4e71-8421-796f62e50196
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5502@bnt-lap001
Assistant-Session: 68b3b02f-5d0f-4e71-8421-796f62e50196
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5502@bnt-lap001
Assistant-Session: 68b3b02f-5d0f-4e71-8421-796f62e50196
Founder decisions relayed 2026-11-01: GH-DEC-2026-026 accepted as drafted
(unblocks S4 doctrine; S4 now waits only on access-engine policy), and the
hub pulls decision outcomes through its STATE-WP-0096 dispatch worker.
S3 re-scoped: GET /v1/memos/{id}/outcome on the private listener returns
informed-decision.decision-outcome v1 for memos the caller posed, only for
a submitter row with outcome_read: true. Read-only and value-free.
T05 (enable after STATE-WP-0101) and T06 (retire push write-back) added.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5502@bnt-lap001
Assistant-Session: 68b3b02f-5d0f-4e71-8421-796f62e50196
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5502@bnt-lap001
Assistant-Session: 68b3b02f-5d0f-4e71-8421-796f62e50196
A registered submitter with a present_existing profile may pose a memo that
pins an approval it created itself in approval-engine. Intake verifies the
object read-only (requested, no entries, human_control, actor == profile
actor, digest == memo, binding == intent, required_count 1, unexpired, one
memo per approval) and never creates, enters or consumes. The recorded
requester reaches review and the access-engine context. Existing submitters
are unchanged.
Answer doc accepts S1 (profile, not route; packet carries the admission),
S4 in principle (waits on gate-house classes and policy) and S3 (exists
behind INFD_HUB_WRITEBACK). Workplan INFD-WP-0010 proposed.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5502@bnt-lap001
Assistant-Session: 68b3b02f-5d0f-4e71-8421-796f62e50196
state-hub d61ba32 accepts requires_new_bind, required_ack, and sealed.
The p01 cross-repo check now expects a delivered pose that keeps those
bools. T08 stays waiting on the service account, grant, and T05/T06.
Assistant: grok
Assistant-Session: 01a10286-9185-7bb2-b411-89cf6ab4c0c6
