informed-decision/workplans/INFD-WP-0007-decision-lifecycle-service.md

id	type	title	domain	repo	status	owner	topic_slug	created	updated	origin	origin_ref	related	state_hub_workstream_id
INFD-WP-0007	workplan	Decision lifecycle service — headless foundation and human UI	infotech	informed-decision	finished	codex	netkingdom	2026-10-04	2026-10-05	demand	Founder 2026-10-04: full decision lifecycle for agents and humans, no per-decision infrastructure rollout, headless foundation and UI at decisions.coulomb.social	INFD-WP-0005 INFD-WP-0006	2b3e04ed-2137-584f-a6c2-f1abb29636fa

Decision lifecycle service

Contract: docs/specs/DecisionLifecycleService.md. This extends the existing memo and intake implementation. INFD-WP-0005 continues to own intake runtime, attribute admission, forwarding and live acceptance. Implementation started on 2026-10-04 at the founder's request. The initial production identity/policy audience is live; broader human binding profiles remain open. The shared service now has a bearer API adapter and optional browser workspace.

Record product direction and architecture

id: INFD-WP-0007-T01
status: done
priority: high
state_hub_task_id: "00829d0e-2daa-5c25-a4e9-e4fd595fb8d4"

Updated INTENT and GOAL; SCOPE explicitly distinguishes requested capabilities from implementation. Spec covers all nine operations, foundation/UI dependency boundary, revision/evidence semantics and acceptance without per-decision deploys.

Specify lifecycle contracts against existing owners

id: INFD-WP-0007-T02
status: done
priority: high
state_hub_task_id: "cde0c932-afce-5bec-8cee-a2f377955b9f"

Define versioned API schemas, application service interfaces, caller/tenant context, source/evaluation/comment companion records, revision concurrency, publication audience, idempotency, errors, limits and result retrieval. Resolve the spec's open identity/publication/source/non-approval binding contracts. Review against existing schema and engine contracts. Residual from INFD-WP-0005: retain separate optional Hub outcome write-back and broader profile contracts; write-back remains disabled until independently admitted. Preserve private intake and current review URLs. Produce a reviewed migration and compatibility plan.

Implement durable headless lifecycle foundation

id: INFD-WP-0007-T03
status: done
priority: high
depends_on: [INFD-WP-0007-T02]
state_hub_task_id: "2a206bc2-cb92-539d-9014-9ba71f70277c"

Implement registration, immutable revisions, source provenance, evaluations, companion comments, publication and result/event retrieval using shared service operations. Reuse the current memo/presentation/disposition core and transactional store/outbox. Migrate existing records without losing evidence. Tests prove concurrency, replay, restart, stale-presentation refusal, human-only disposition and absence of UI imports. No mirrored approval state.

Expose authenticated lifecycle API for agents and humans

id: INFD-WP-0007-T04
status: done
priority: high
depends_on: [INFD-WP-0007-T03]
state_hub_task_id: "65c760da-de7e-5e85-9817-6f3e2b46c8f9"

Add versioned adapters, bounded authorized search/retrieval and durable outcomes. Connect existing intake and policy/identity ports. Test audience, tenant and authorization isolation, conflicting idempotency payloads, result delivery and uncertain external outcomes. The complete agent scenario must run without a UI.

Build the lifecycle workspace at decisions.coulomb.social

id: INFD-WP-0007-T05
status: done
priority: high
depends_on: [INFD-WP-0007-T04]
state_hub_task_id: "a6a7c9a8-760e-52dd-80d3-d36f43f0a86a"

Residual from INFD-WP-0005: review overview listing currently remains exact-record only; define attribute-based discovery with Access Engine while retaining fresh read/act decisions. The lifecycle workspace already lists published records.

Add discovery, authoring, research/evaluation views, publication audience controls, discussion, revision comparison and human review through the shared foundation. Keep agents clearly attributed, acceptance revision-specific and authentication step-up understandable. Verify existing URLs and old records remain usable.

Prove lifecycle without per-decision rollout and prepare live delivery

id: INFD-WP-0007-T06
status: done
priority: high
depends_on: [INFD-WP-0007-T04, INFD-WP-0007-T05]
state_hub_task_id: "aa839bea-cc4c-5ee0-85e7-87c881e8e578"

Run all seven spec acceptance scenarios in an integration environment. Record unchanged image/deployment/policy/config pins across two new decisions and a revision, plus restart durability. Incorporate WP-0005 runtime/admission receipts. Prepare the concrete migration, immutable release, rollback and verification packet before requesting the separately required live rollout approval.

Approved live acceptance

id: INFD-WP-0007-T07
status: done
priority: high
depends_on: [INFD-WP-0007-T06]
state_hub_task_id: "25fa4743-5c7e-5609-9872-7c5971ff62bc"

After explicit approval of the concrete rollout, deploy and obtain native agent-to-human-to-agent evidence at decisions.coulomb.social. Only the human performs acceptance. Update SCOPE from observations and hand any residuals into live work records before marking this plan finished.

First implementation slice — 2026-10-04

docs/specs/LifecycleFoundationContract.md records the implemented T02 storage contract and remaining service/API contracts. T03 begins against that bounded contract while the broader T02 work continues. informed_decision/lifecycle.py provides registration, immutable revisions, attributed sources/evaluations/ comments and event retrieval on the existing Memo and Store. Schema 4 retains mutation events and pending delivery atomically with memo writes and idempotency receipts. Tests cover concurrent revisions, restart/backup, tenant partitioning, rollback, replay, provenance references, schema upgrades and existing human/stale presentation guards. Neither task is complete: application authorization, publication, HTTP/UI and admitted evidence delivery remain in their live tasks. No production route or deployment was changed.

Validation: uv run --extra dev python -m pytest -q — 480 passed, 72 skipped. The system interpreter had dependency-related failures; the project-managed environment passes. git diff --check passes.

Protected application service — 2026-10-04

Added LifecycleService above the repository: verified human-session import, trusted workload-caller interface, fresh PolicyClient observations for every operation/retry, immutable command snapshots, transaction-time authorization guards and post-read expiry checks. Mutation events link the retained policy observation. Existing human disposition and policy action contracts are unchanged. docs/specs/LifecycleServiceContract.md records the proposed lifecycle action names/context and remaining production identity/policy/HTTP/audit admission work. T02/T03 remain in progress; no listener or policy grant was deployed.

Validation: uv run --extra dev python -m pytest -q — 501 passed, 72 skipped; git diff --check passed.

Infrastructure alignment — 2026-10-04

Reviewed current local owner sources and shipped v11 sitting pins; findings are in docs/evidence/2026-10-04-lifecycle-infrastructure-alignment.md. Fixed legacy overview exposure of unpublished lifecycle ids, import bypass of lifecycle revision history, and readiness/admin omission of pending lifecycle evidence. Cross-repo suite with Approval Engine, Audit Core and State Hub source fixtures: 571 passed, 5 skipped. This is source integration evidence, not live cluster verification or new lifecycle policy admission. External runtime/identity/policy/ receiver contracts remain on T02/T03 and WP-0005.

HTTP adapter continuation — 2026-10-04

Started T04 against the implemented application contract while broader T02/T03 work continues. LifecycleAPI provides bearer-authenticated adapter seams for retrieval, event pagination and comments/sources/evaluations, calling the same application service. Closed/bounded JSON, idempotency headers, sanitized errors and cookie refusal are tested. No default authenticator or listener is supplied; public ingress and browser app remain unchanged. Contract and remaining route/ identity/runtime work: docs/specs/LifecycleHTTPContract.md.

HTTP continuation validation: cross-repo suite 585 passed, 5 skipped; a subsequent focused lifecycle/HTTP run also covers content-free admin inspection. git diff --check passed. Runtime remains unmounted pending the named contracts.

Registration and revision API — 2026-10-04

Continued T04 with POST /v1/decisions and POST /v1/decisions/{id}/revisions, using closed typed decoding of the existing Memo dataclasses. Added bounded base64 packet uploads, verified digests and atomic packet/memo/event writes. New records must supply packet bytes; revisions can reuse only their current packet's digests. The shared service snapshots and authorizes the whole command. Receipts include stable relative API revision links. Tests cover end-to-end registration/replay/revision, malformed nested values, forged approval pins, packet corruption, cross-record digest reuse and rollback on queue failure. The adapter remains unmounted; T02/T03/T04 remain in progress.

Validation: cross-repository suite 598 passed, 5 skipped; subsequent HTTP tests include shared L0/L3 decoding and preservation of requires_new_bind. git diff --check passed. No live deployment or authentication admission.

Workspace, publication and independent evidence — 2026-10-04

Continued T02–T06 with revision-specific explicit publication audiences, policy record facts and race guards, bounded authorized search with opaque scoped cursors, and packet retrieval. Added a human workspace through the same service: create, research/evaluate, comment, publish, compare and refine. API receipts include workspace links. Existing session, CSRF and origin protections are reused.

Runtime optionally composes a separately pinned lifecycle policy; the deployment renderer produces corresponding exact network proposals. Opt-in lifecycle audit commitments use the existing outbox, real receiver receipts, retries, heartbeats and reconciliation. Tests cover lost replies, restart, audience races, denial, HTML escaping, form replay and unchanged configuration across two new decisions and a revision. The full cross-repository suite passes: 623 passed, 5 skipped.

T05/T06 are in progress, not complete. Live tasks retain: admitted lifecycle PDP policy and workload identity/listener (T02/T04), human review/binding handoff and broader authoring UI (T03/T05), full acceptance scenarios, immutable release and rollback packet (T06), separately approved live rollout (T07). Source metadata entry is implemented; automated fetching/retention is not. No deployment occurred. Delivery and activation contract: docs/specs/LifecycleWorkspaceDelivery.md.

Revision-specific human review handoff — 2026-10-04

T02–T06 continued with policy-authorized review requests, immutable source-to-intake snapshots and authorized outcome retrieval. Intake checks exact retained envelope, designated submitter and current source revision before creation and loading. Existing uncertainty/replay behavior is reused. Source revisions invalidate old review actions; in-flight/unresolved human entries prevent source revision. Protected review pages show the source revision, and the lifecycle workspace links ready reviews and displays evidence without caching approval validity.

The real Approval Engine/Audit Core source integration test creates and accepts a snapshot of source revision two, correlates the confirmed human answer and delivers evidence. Test identities and PDP transport are synthetic. Supported profile and limits: docs/specs/LifecycleReviewHandoff.md. Production admission, private forwarding, broader profiles/browser packet authoring, release/rollback and approved live delivery remain on T02/T04/T05/T06/T07 and WP-0005. No task is marked complete solely from source integration, and no rollout occurred.

Validation for this continuation: full cross-repository suite 634 passed, 5 skipped; git diff --check passed. Schema-4 upgrade preserves existing records and marks schema 5 to fence older readers. Implementation decision logged as State Hub ccb2e110-6032-4259-a402-989415a8d9fe (not a rollout approval).

First production audience and runtime candidate — 2026-10-04

Founder selected net-kingdom-admins humans and the State Hub workload. Added the private 8081 composition with fresh CA-verified TokenReview and exact workload registration, shared-store public/private serving and guarded attribute review. A revision's editor now remains authorized to its unpublished successor through immutable revision_by facts. Actual Access Engine HTTP integration proves this with the separately pinned lifecycle policy (FLEX-WP-0033).

Published immutable service/policy candidates and retained the reviewable packet at deploy/lifecycle/README.md. Both scans have zero HIGH/CRITICAL findings after fixing service JWT pins and inherited Access Engine Go/OPA/telemetry dependencies. All 25 Kubernetes objects passed server dry-run; 662 service/component tests pass (1 skipped), as do 13 installed-container checks. Access Engine full regression and candidate package validations pass. Tests are not native custody proof.

No live change or human binding was performed. T02–T06 remain in progress for native contracts, State Hub production forwarding, browser packet/binding profiles and complete live acceptance. T07 still requires concrete rollout go. CCR-2026-0032 / RPF-WP-0051 owns requester delivery; INFD-WP-0005-T08 owns State Hub forwarding/token projections. The exact chosen identity is no longer an open question. Rollback must retain new evidence and must not run a schema-2 reader on the migrated schema-5 database.

Private dispatcher production continuation — 2026-10-04

STATE-WP-0096 now supplies the prepared private State Hub worker and audience projections. No credentialed forwarding route is exposed through the unauthenticated Hub API. Fixed a consumer contract mismatch: immutable lifecycle review envelopes may omit serves and retain their review-UUID idempotency key. Integration proves lost-reply/restart recovery without duplicate native approval, followed by human review and independent audit. Validation: 663 passed, 1 skipped; 28 Hub tests. The exact three worker objects are added to deploy/lifecycle. Native credentials, rollout approval and human acceptance remain the next gates; no live mutation.

Requester delivery approval — 2026-10-04

Founder approved the concrete CCR-2026-0032 requester delivery. Platform a7bc33b records the approved exact packet and contained metadata command. Owner source readiness is accepted under RPF-WP-0051-T02; T03 awaits the founder terminal OIDC/MFA and native delivery evidence. No live credentials were read or changed by this session. INFD-WP-0007-T07 still owns separate service cutover acceptance.

Native requester delivery — 2026-10-04

Founder completed the attended metadata helper with exit 0; retained receipt confirms metadata_verified. Platform deployed the exact three delivery objects via dedicated manual ArgoCD application at 4332c39 after server dry-run/diff. Sync succeeded, but ESO validation fails with 403 on auth/token/lookup-self. Prepared narrow self-token lookup/read and revoke/update amendment at Platform e84b68d, consistent with existing ESO readers. Fourteen helper tests pass. Founder approved the exact two self-token permissions; Platform bbb016f records the amended approval. Fresh attended execution is pending. Native delivery is not ready and the lifecycle service has not been rolled out.

Native custody and production-data restore ready — 2026-10-04

Amended attended metadata and all native requester proofs passed. KeyCape requires Basic client authentication; fixed requester at 03f18d8 with regression coverage for special-character encoding. Final image 804d89fb passes 664 tests/ one skipped, 13 container checks, zero HIGH/CRITICAL scan and server dry-run. Production online snapshot restore into a separate offline volume migrated schema 2 to 5 preserving 24 submissions/158 delivered outbox rows. Protected off-cluster snapshot retained; refresh during cutover. Proof resources removed.

Requester metadata approval is complete. T07 still awaits exact service/PDP/ worker cutover approval and subsequent native agent-human-agent acceptance. Issuer rotation is separately governed under Platform's lane contract and was not performed or claimed by the initial delivery proof.

Approved production cutover — 2026-10-05

Founder approved packet 70dc3b9 (decision d2eaa2e9-6d11-4676-a07f-e3b7e59a88e3). Public traffic was briefly closed, a final consistent schema-2 snapshot retained off-cluster (SHA-256 b0346c42434cdc375eaa591f4bffeb62b9b2e19bf589a92501c96626142670e6), and owner Helm releases deployed before the schema-5 service. Public health and readiness pass after reopening. All 24 confirmed prior submissions survive. The actual receiving requester projection is read-only 0440 and signed create-only exchange passes. Platform delivery is accepted; separate issuer rotation evidence is tracked as RPF-IN-0004, not authorized by this cutover.

Manual, pinned Argo applications own the service and private State Hub dispatcher. The worker's native startup exposed Kubernetes inherited setgid; State Hub 1321361 adds a same-image non-root queue initializer, with nine regression tests. It normalizes only an empty owned 2700 directory; existing unsafe/nonempty custody is refused. Public ingress still targets only the browser listener.

Native selected-workload operations registered two records, recorded research, evaluation and comment, revised and published one record, then queued its retained review envelope. Missing credentials, crossed audiences and an unregistered service account with the correct audience return 401; public API routes return 404. All four deployment templates/generations remain unchanged across the decision operations and controlled service/dispatcher pod recreation. Retrieval returns revision 2 and the same receipt; re-enqueue is replay with one delivered queue row, not a second approval. Independent Audit Core counts match, pending 0.

Review memo: review-0d55a416-178c-46f5-b74b-b9b668390448; Approval Engine id: 22b30fe7-c565-46f2-8193-d8875975ad9e. Native notification and memo-posed delivery are settled. Human disposition remains pending; no agent acceptance is claimed. Evidence: docs/evidence/2026-10-05-lifecycle-cutover/. T07 stays in progress; broader browser profiles and unresolved spec items remain in T02/T05/T06.

Native acceptance complete — 2026-10-05

The human accepted at 2026-10-04T22:17:19Z. Native entry correlation: approval 22b30fe7-c565-46f2-8193-d8875975ad9e, presentation pres-484c0ef3-0a87-4dbf-aa30-05fd21e19c91, disposition disp-85ddaab7-8c8d-4bf3-8d39-e0e3c28c1c16, source revision 2. The selected workload retrieved confirmation; Audit Core counts match and lifecycle pending is zero. T03/T04/T06/T07 are done for the admitted initial audience. T02 and T05 remain active for the named broader contracts and UI work. The first reported review error was a truncated URL missing its final UUID segment; the complete link passed read, acknowledgment and acceptance checks.

Browser authoring and retained handoff — 2026-10-05

T05 now implements explicit approval/discussion drafts, immutable supporting text documents and required acknowledgments, document-aware revision comparison, and preparation/download of the exact retained review request. T02's service and HTTP contracts include exact-version handoff retrieval using the existing events authorization. No additional permission or database migration is needed. The admitted State Hub workload still submits the request; preparing it does not create an approval or bind a human. Historical exports remain retrievable while stale intake is refused. Existing forms retain their previous draft semantics.

Validation: 669 passed, one skipped with actual owner components; final focused checks 50 passed, two optional checks skipped; Chromium 16 checks passed with synthetic identity, including mobile and desktop inspection. Evidence is retained in docs/evidence/2026-10-05-lifecycle-authoring/. This source increment is not yet released; production remains on the accepted initial cutover image. T02/T05 stay in progress for broader contracts and attribute-based legacy review discovery.

Authoring deployed; discovery continuation — 2026-10-05

Founder explicitly requested deployment and the remaining implementation. ADMINISTER @ realm:kubernetes/railiance01, activation=APPROVED. Authoring image 79aabf37 is live through Argo source dfcef87 and Platform pin 0189965. Both health endpoints and Argo Synced/Healthy pass. Fresh backup/isolated restore preserved 25 confirmed submissions, 174 delivered outbox rows, two records/nine events. Native selected-workload GET retrieves the exact retained handoff and confirms the prior human disposition. No new human acceptance is fabricated.

T02 now records explicit initial contracts in LifecycleAdmissionBoundary.md. Expansion residuals have live records INFD-WP-0008-T01 through T04: external identity/publication, connectors/retention controls, non-approval binding, optional Hub write-back. T05 implements named-recipient review discovery in the consumer and Access Engine FLEX-WP-0034 v13, with fresh read/act checks retained. Validation 671 passed, one skipped; 32 owner embedded policy checks plus owner regressions. Discovery release and final native checks remain in progress.

Initial production scope complete — 2026-10-05

T05 discovery is deployed with source 9207a51, service image 7f5c6cb2 and owner v13 image 6c6dc263/Helm revision 13. Native caller policy replay confirms named recipient list, other-recipient denial and stale-read denial. Existing human acceptance remains confirmed and retrievable by the admitted State Hub workload. Public health/readiness pass, private API paths return 404 publicly, store counts remain intact and Argo is Synced/Healthy. No new human answer is claimed.

All seven tasks are complete for the selected initial production audience and organizational approval profile. Residuals were created before closure as INFD-WP-0008-T01/T02/T03/T04. Platform issuer rotation remains RPF-IN-0004. Evidence: docs/evidence/2026-10-05-lifecycle-discovery/.