informed-decision/docs/evidence/2026-10-10-lifecycle-consumer-pin-repair.md

Lifecycle consumer pin repair — 2026-10-10

Initial preparation is retained below. The config-only repair was approved and verified live on 2026-10-11; the dated execution appendix distinguishes it from the separate, unpublished purpose-hardening image. No human disposition is claimed. Root agent observed native State Hub POST /v1/decisions returning HTTP 503 invalid_decision, and read only fixed runtime policy fields: lifecycle package informed-decision.lifecycle, version v1, digest sha256:cee6a79f74e81d0d389a2c2e2451a92be3434ea9dfcee4986e8c7e6cfdbb1827. The provider owner pin is now version v2, digest sha256:da01e045fc108adec6b489e5d51f7e57366793016c5a64776963780a6aae457c.

Access Engine pkg/api/canonical.go defines and emits only envelope contract flex-auth.decision-record.v1. FLEX-WP-0035 adds advisory binding purpose readback; enforcement binding purpose stays absent. Lifecycle policy version v2 must not be mistaken for envelope contract version v2. Informed Decision's existing exact package/version/digest check correctly refuses a stale pin. Readiness does not prove that a consumer pin matches a provider release.

Root's sanitized native provider probe returned HTTP 200, envelope contract flex-auth.decision-record.v1, binding purpose absent, matched policy version v2, provenance lifecycle package v2/da01e045, and submitted digest match true. Consumer runtime remained v1/cee6a79. Native pod Ready=1 and image 7f5c6cb. Reported CPU requested headroom: 3460m/4000m (86% allocated); this repair retains 5m request and Recreate, and does not add a concurrent pod.

Exact proposed action

Stable proposal: INFD-WP-0009-T02/config-repin-v1. Update the lifecycle pin in deploy/lifecycle/admission.candidate.json and deploy/lifecycle/service.candidate.json. Replace immutable runtime ConfigMap informed-decision-runtime-c81577741a09 with informed-decision-runtime-6c221878d051, and update the Deployment's configuration volume reference to the new name. Same namespace and service. The runtime JSON differs only in lifecycle version/digest.

Service image remains forgejo.coulomb.social/coulomb/informed-decision@sha256:7f5c6cb29c9f70a026bfe30e72934274ddc69261676cf6d476f81dd32812d173. The existing image needs no source parser patch to consume this owner policy. Local inspected service source HEAD is bee5ad9af60ab21bcc88423307ce02cc2ab5631b; local provider source HEAD is f5fad7c2851708be41c82891430deffe5f4af0ac. No schema migration, credentials, review-policy pin, audience or network change. Initial lifecycle repair does not implement expansion INFD-WP-0008.

Verification

Real Access Engine HTTP component with synthetic caller custody, current owner lifecycle fixture and existing PolicyClient: three tests passed (one collaboration flow, two stale-pin regressions). Each stale version or digest produces exact 503 invalid_decision, writes no memo/lifecycle event, then succeeds with the exact current owner pin. This proves restoring compatible policy pins suffices; no parser relaxation is needed. Staged ConfigMap exactly matches the established renderer output for the repinned admission input; retained customizations in the existing Deployment are preserved.

Before execution: retain exact live Deployment, old runtime ConfigMap, current image digest and database evidence counts; verify live runtime JSON differs from candidate only as reviewed. Run server-side dry-run and diff through the current owner GitOps release path and retain their results. Check railiance01 headroom: existing request is 5m CPU, unchanged; Recreate stops the single writer first. Expect a brief interruption. No concurrent writer is admitted.

After execution: verify exact same image and new ConfigMap reference, rollout completion and readyz; prove native State Hub registration/publication with stable write keys and retained provider observations/receipts. Ready alone is insufficient. Human acceptance remains a separate human act.

Rollback and risk

Rollback: restore the old Deployment configuration volume reference and its retained immutable ConfigMap through the same GitOps path. Preserve the existing schema-5 database and any new evidence; do not restore an old database merely to revert policy pins. The old pin intentionally returns to fail-closed 503 against the v2 provider; coordinate owner rollback only if the provider itself must be reverted. No provider rollback belongs to this proposal.

No cloud/resource expansion or paid inference; expected incremental cost EUR 0. Risk: brief service interruption and continued refusal if the runtime provider pin differs; verification stops closure until native receipts exist.

Source hashes

See 2026-10-10-lifecycle-consumer-pin-repair.sources.json for exact original and proposed release artifact SHA-256 values. Supervisor approval, approved digest, executed digest and verified outcome must be recorded by the root executor; this packet supplies preparation only.

Separate source hardening (not in config-only live proposal)

PolicyClient now explicitly refuses advisory or malformed binding purpose; only absence or the exact empty string is the canonical enforcement form. Current service image 7f5c6cb does not contain this patch. Unit coverage includes nine purpose variants; a real provider allow envelope with unchanged binding digest, package pins and TTL is injected with purpose=readback and must refuse the write, then the original enforcement response succeeds. These tests cover the missing consumer guard without accepting an unpublished envelope v2 contract. INFD-WP-0009-T04 retains separate image preparation/native release work. T02's same-image config repair remains unchanged.

Validation after source hardening: 73 policy/purpose, real-provider component and deployment-render tests passed; 21 lifecycle-service checks passed. Review controller component checks (53) require its other owner binary and were skipped; they are not counted as verified. No live hardening rollout is claimed.

Config-only execution appendix — 2026-10-11

Founder approved exact revision 7db8485ffecdebfabd77a9daec085553c74bf0bf. The existing manual Argo Application synced only the new runtime ConfigMap and Deployment, with prune disabled. Application Succeeded/Healthy; generation24 observed24 Ready1 and /readyz200 were verified. Lifecycle consumer version v2/da01e045 and unchanged service image7f5c6cb were observed. Native State Hub registration/publication succeeded with stable write keys; review delivery later completed after correcting a separate caller packet-validation error. Custodian retains exact approval, rendered digest, executed JSON patch, outcomes and rollback in docs/evidence/2026-10-10-security-consolidation/. Original preparation hashes above remain historical evidence, not rewritten approval.

Purpose-hardening T04 preparation now has a built, scanned local image and synthetic installed/backup checks in 2026-10-11-purpose-hardening/README.md. That image is neither published nor deployed; config-only approval does not cover it.