informed-decision/deploy/lifecycle/README.md

INFD-WP-0007 production candidate

Prepared 2026-10-04 for the founder-selected initial audience: net-kingdom-admins humans and system:serviceaccount:state-hub:state-hub. Not deployed.

Artifact	Immutable reference
Service	forgejo.coulomb.social/coulomb/informed-decision@sha256:2768bd1da3e651cc0be2d0f1ae6eea1af4eb057b31ef63ebb03b004c2ed76c3d
Access Engine	forgejo.coulomb.social/coulomb/flex-auth@sha256:bdac62bc3f089cba0df7c35eeb8d0d9b3af2d4bae5e4ea4767516c1ed20b1e99
Lifecycle package	informed-decision.lifecycle v1, sha256:cee6a79f74e81d0d389a2c2e2451a92be3434ea9dfcee4986e8c7e6cfdbb1827
Human review package	informed-decision.compact-sitting v12, sha256:c5387f7d198dc39ab5967e0c218ce05cc779693565c8875e3035e45ec002a2db

admission.candidate.json renders service.candidate.json using tools/render_deployment.py. registries.candidate.json projects the three sibling JSON registries. The policy YAML is Helm-rendered from Access Engine's FLEX-WP-0033 candidate values; it is a review artifact, not a second deployment owner. Existing Helm releases must be updated through their owning workflow. The original 25 objects and the three dispatcher objects passed Kubernetes server dry-run against railiance01. No Secret is included. Dry-run does not test reachability, credential delivery, policy caller identity, backup restoration or a human disposition.

Proposed live changes

• Replace the service's image and immutable runtime ConfigMap, retaining its public Service/Ingress, single writer, Recreate strategy and existing PVC.
• Enable /decisions and lifecycle audit delivery; keep private API on 8081.
• Add the exact State Hub peer, API-server egress, CA/token projection and only create-tokenreviews RBAC for informed-decision/review.
• Mount the proposed reloadable registries and Platform's exact read-only requester Secret projection, without subPath.
• Add a separate lifecycle PDP and change the sitting PDP to the v12 package. Review retains all v11 exact mandates and 15-minute KeyCape MFA; lifecycle authoring uses a 12-hour MFA window. Agents cannot accept.
• Initial intake permits decision-record / net-kingdom-admins, 50 new attempts per UTC day, with the existing platform-root recipient. Other admins may collaborate; this does not silently make them the bound recipient.

The policy chart retains the owner's existing port-only API-server egress (443/6443). The consumer's new API-server egress is address-specific. CARING is advisory and consumer fact attribution is unsigned, as in the existing reviewed contract; neither is presented as a newly enforced control.

Pre-cutover gates

1. RPF-WP-0051 / CCR-2026-0032: complete the already prepared requester delivery under its separate live go, with exact identity/path negative proofs and mounted-file refresh/rotation evidence. Only the audit ExternalSecret was present in the live namespace at inspection.
2. INFD-WP-0005-T08 / STATE-WP-0096: the private dispatcher and separate lifecycle/intake token projections are prepared in dispatcher.candidate.json. Deploy after intake prerequisites. Explicit enqueue requires trusted workload execution; there is no new public delegate endpoint. Confirm notification receiver reachability; keep resolution write-back disabled.
3. Refresh live image/config pins and unresolved-entry counts; complete the backup/restore steps below; obtain explicit approval of this concrete rollout. INFD-WP-0007-T07 and CCR-2026-0032 require this distinct go.

Cutover and recovery procedure

Before migrating, close new review traffic through the owning ingress workflow, let active requests finish, and inspect the current schema-2 writer read-only. The observed baseline was 24 confirmed submissions, 158 delivered outbox rows, zero unresolved entries; these counts are not a future maintenance-window gate. Retain the exact current Deployment, Service, runtime ConfigMap, Helm values and all related policy pins. Do not include credentials in the evidence packet.

Use the existing running image's installed informed-decision-admin backup to create a unique SQLite consistent snapshot in a private directory. Copy the backup to independently protected custody, record its digest, and verify a restore on a separate private volume before cutover. Close the old writer before starting the schema-5 image. Local synthetic restore proof is retained in the evidence directory; it does not replace this production data restoration check.

Deploy admitted owner policy/custody prerequisites, then the service candidate. Verify /healthz, /readyz, pending/blocked counts, actual audience isolation, wrong-caller refusals and public/private route separation. Exercise two new records and a revision without changing image/config/package pins. Only a human may finish review. Correlate the native Approval Engine entry and independent Audit Core receipts; restart and retrieve the same immutable evidence.

If validation fails, stop the candidate and retain its database plus all new receipts. Never start the old schema-2 image on the schema-5 database. Rollback requires the verified pre-cutover copy on a separate volume and reconciliation of every post-cutover external effect before resuming writes. An uncertain submission stays unresolved; do not retry or discard it to enable rollback. The prior image is in ../sitting-admission.json and remains a reference, not an instruction to downgrade the live database.

Validation evidence

docs/evidence/2026-10-04-lifecycle-release/ retains container checks, bounded scan summaries and policy validation. Service: 662 passed, 1 skipped with owner components; 13 container checks passed, including restart and backup/restore. Both artifact scans contain zero HIGH/CRITICAL findings. Actual evaluator tests cover first-audience collaboration across revisions and verify unchanged package pins; authentication custody in those tests is synthetic. Native activation and broader browser packet/binding profiles remain explicit workplan tasks.

The final Access Engine pin is the Forgejo image built from commit d2d0b6f (run https://forgejo.coulomb.social/coulomb/access-engine/actions/runs/316). It supersedes the locally built candidate for the proposed deployment.

Private State Hub dispatcher continuation

The dispatcher is a separate Recreate workload with 5m CPU / 24Mi memory requests, one private 1Gi PVC, no Service/Ingress, and the existing state-hub service account. Its only egress is DNS and the exact informed-decision peer on 8081. Projected lifecycle and intake tokens each expire after 600 seconds. The dispatcher reads only the intake token and never binds. Its pod omits app=state-hub, so it is not selected by the existing Hub API Service.

Image: forgejo.coulomb.social/coulomb/state-hub-memo-dispatch@sha256:410fb6b6c9fd7a7ee0b63d727fd3249fb3ae13943421d6a5ce88b7ad2520bd2f Source: State Hub 4a59b23, built by the dedicated Forgejo workflow. Source integration proves queue/restart/lost-reply handling (one create, replayed receipt), subsequent human acceptance and independent audit delivery. All identity and credential inputs in that test are synthetic. Native acceptance remains open.

There is no new service-image build for this continuation. The service suite now passes 663 tests (1 skipped); State Hub forwarding/notification tests pass 28.