tegwick
c084600082
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a10780-6d41-7952-9718-dfbc1f41236f
89 lines
5.3 KiB
Markdown
89 lines
5.3 KiB
Markdown
# Initial production runtime candidate
|
|
|
|
INFD-WP-0007 / INFD-WP-0005. Founder selected net-kingdom-admins humans and
|
|
system:serviceaccount:state-hub:state-hub on 2026-10-04. This is a preparation
|
|
contract; deployment still requires the concrete rollout approval.
|
|
|
|
## Identity and listeners
|
|
|
|
The same process/store serves browser routes on 8080 and private workload routes
|
|
on 8081. Only the public listener is behind decisions.coulomb.social. A separate
|
|
ClusterIP and exact State Hub namespace AND app-label ingress expose 8081.
|
|
`/v1/decisions` uses a projected token with audience informed-decision-lifecycle;
|
|
`/v1/memos` uses a different token with audience informed-decision-intake. Neither
|
|
route accepts a browser cookie. Browser authoring retains KeyCape sessions,
|
|
CSRF and origin checking. The private listener exposes no browser routes.
|
|
|
|
Every workload request performs Kubernetes TokenReview over CA- and
|
|
hostname-verified HTTPS with a freshly read rotating reviewer credential. The
|
|
review service needs only create on tokenreviews, not token creation or Secret
|
|
read. The API-server audience is used for its reviewer token. Workload UID and
|
|
subject come from TokenReview; tenant comes from the reloadable exact-account
|
|
registry. JWT expiry is read only after TokenReview verifies that same token.
|
|
Callers expire within 30 seconds or token expiry, whichever is earlier.
|
|
|
|
The registry is identity registration, not an action permit. Every operation
|
|
still requires a fresh external PDP decision. The lifecycle PDP has a distinct
|
|
package, version and digest from human review. Only humans can bind via the
|
|
existing protected review flow. Access Engine keeps the authorization decision;
|
|
Approval Engine keeps authoritative approval state.
|
|
|
|
## Initial proposal data
|
|
|
|
`deploy/lifecycle/lifecycle-callers.json` names the exact State Hub account and
|
|
platform tenant. The intake registry permits only decision-record class and
|
|
net-kingdom-admins, with a proposed cap of 50 new attempts per UTC day. Replays
|
|
do not spend a second attempt; uncertain creation never automatically reposts.
|
|
The cap and routing are configuration, not per-decision deployments.
|
|
|
|
The review-group recipient is the existing platform-root KeyCape subject found
|
|
in previously bound review records. This is the initial single recipient; group
|
|
membership alone does not turn every admin into that bound principal. Expanding
|
|
to multiple human recipients needs a reviewed binding contract. The default
|
|
legacy registries remain empty; only the reviewed release ConfigMap mounts the
|
|
initial proposal. Directory group verification remains independent of this map.
|
|
|
|
Registry volumes use no subPath and reload on each request. Requester custody is
|
|
read-only at `/var/run/secrets/informed-decision/requester/client-secret`, matching
|
|
CCR-2026-0032. No secret value is copied into release files or SQLite. Kubernetes
|
|
Secret objects are not emitted by the renderer.
|
|
|
|
## Evidence and compatibility
|
|
|
|
Runtime options enable lifecycle audit delivery, intake audit/notification
|
|
delivery and verified intake metadata for human review. The latter reloads the
|
|
live Approval Engine object, checks its binding pin, requester informed-decision
|
|
and human_control=true before the PDP call. Store guards recheck retained intake
|
|
metadata at the mutation boundary. A valid-looking UUID/digest alone is not proof.
|
|
|
|
State Hub now has a private explicitly queued dispatcher (STATE-WP-0096), with a
|
|
separate standard-library-only image and PVC. It uses the selected existing
|
|
service account and distinct projected lifecycle/intake tokens; its transport
|
|
reads only the intake token. The Hub public API does not gain a credentialed
|
|
forwarding route. Queueing is trusted workload execution. New review envelopes
|
|
are data operations and do not change deployments. The exact lifecycle snapshot
|
|
id/key is preserved without inventing a Hub relationship when serves is absent.
|
|
Lost replies replay the same envelope; native-create uncertainty blocks the row.
|
|
Native deployment/acceptance still remains open. Notification/write-back receiver
|
|
admission is unchanged; INFD_HUB_WRITEBACK remains off.
|
|
|
|
The image migrates schema 2 to schema 5 on open. Existing records, presentations,
|
|
dispositions, submissions and outbox evidence must survive. Rollback to the old
|
|
image against the migrated database is forbidden: stop the new writer, retain all
|
|
new evidence, and restore a verified pre-cutover copy on a separate private volume
|
|
only under the reviewed recovery plan. An in-flight/unresolved human submission
|
|
must be reconciled, never retried or discarded to make rollback convenient.
|
|
|
|
## Remaining live gates
|
|
|
|
- CCR-2026-0032 requester projection: current namespace has only the audit
|
|
ExternalSecret; requester custody, native identity/path refusals and rotation
|
|
evidence remain with RPF-WP-0051.
|
|
- FLEX-WP-0033: publish scanned policy artifact; approve exact policy/RBAC/network
|
|
objects and native caller/subject allow/refusal tests.
|
|
- INFD-WP-0005 / STATE-WP-0096: activate and verify the prepared private State Hub
|
|
dispatcher and its projected tokens; retain gated resolution write-back.
|
|
- INFD-WP-0007-T06/T07: backup/restore, exact rollout approval, native human review
|
|
and independent audit receipts across two decisions and a revision with unchanged
|
|
release/configuration pins. Browser packet authoring and broader binding profiles
|
|
remain on T05; the supported review handoff profile is documented separately.
|