informed-decision/workplans/INFD-WP-0009-lifecycle-consumer-pin-repair.md

id	type	title	domain	repo	status	owner	topic_slug	created	updated	flavor	depends_on	related	state_hub_workstream_id
INFD-WP-0009	workplan	Repair lifecycle consumer pin after Access Engine v2 policy release	infotech	informed-decision	finished	codex	netkingdom	2026-10-10	2026-10-11	implementation		FLEX-WP-0035 INFD-WP-0007	77eaeabf-0644-595f-b3d5-1168e6a294c4

Diagnose and prepare exact config repair

id: INFD-WP-0009-T01
status: done
priority: high
state_hub_task_id: "5c30c308-8fe2-5956-b0c1-66c80bcb07e9"

Native State Hub lifecycle submission returns HTTP 503 invalid_decision. The service remains Ready but its configured lifecycle package is v1/cee6a79; Access Engine lifecycle provider now runs v2/da01e045 after FLEX-WP-0035. The envelope contract remains flex-auth.decision-record.v1; this is a policy pin mismatch, not an envelope compatibility migration. Keep exact package, version and digest enforcement. Source preparation and regression evidence are in docs/evidence/2026-10-10-lifecycle-consumer-pin-repair.md.

Release and verify the config-only repair

id: INFD-WP-0009-T02
status: done
priority: high
needs_human: false
state_hub_task_id: "1e6684d7-7676-5c70-b701-9dad124b4f07"

Apply only the reviewed immutable runtime ConfigMap and Deployment reference through the existing owner GitOps path after exact scoped supervisor approval. Image, schema, credentials, audience and review policy remain pinned. Retain server dry-run/diff, readiness and native State Hub register/publish receipts; retry with stable write keys, do not infer success from readiness. Root agent owns live evidence and approval recording. This is a repair of the shipped initial lifecycle, separate from INFD-WP-0008 expansion.

Verified 2026-10-11: founder approved exact config-only revision 7db8485ffecdebfabd77a9daec085553c74bf0bf. Manual Argo Application operation synced only informed-decision-runtime-6c221878d051 and Deployment, prune false. Application Succeeded/Healthy; generation24 observed24 Ready1; /readyz200; consumer v2/da01e045 and unchanged image7f5c6cb verified. Native lifecycle registration and publication succeeded (events28/29). A later review request rejected packet validation; this separate caller error does not undo verified authoring. Custodian evidence records original approval, execution and rollback: docs/evidence/2026-10-10-security-consolidation/infd-pin-repair-preflight.json.

Explicitly reject advisory purpose at consumer boundary

id: INFD-WP-0009-T03
status: done
priority: medium
state_hub_task_id: "ee798d7d-5e60-5247-9c9b-285a7f65cf11"

PolicyClient now validates binding purpose: absent or exact empty string only; readback and malformed purposes are refused. Nine purpose variants and a real provider response contamination test preserve the binding, pin, expiry and obligations gates. This task covers source implementation and regression tests. At source implementation time the runtime image lacked this patch. Service build/native release belongs to T04, separate from the config-only T02 repair.

Release the advisory-purpose source correction

id: INFD-WP-0009-T04
status: done
priority: medium
state_hub_task_id: "0e1bb868-7bc2-5d4d-953c-e0edaf660ad0"

Build and scan a new service image including T03, retain provenance and backup compatibility evidence, prepare a separate scoped image proposal, and verify native binding/refusal after the owner's approved release. Do not fold an image change into the config-only T02 proposal. The pre-release runtime baseline was exact7f5c6cb.

Historical local preparation 2026-10-11: narrow single-module image overlay on immutable running 7f5c6cb; exact source policy SHA-256 9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62. Local image/index b8b58944786015a5375304241c149d1dab885eb539d6d8945f56b01a3c2bc821 is built and retained, unpublished and undeployed. Base layer prefix and runtime configuration are preserved; installed-image 10 purpose variants pass; 13 container checks include restart and synthetic consistent backup/restore. A fresh Trivy database scan has zero HIGH/CRITICAL findings, with its Alpine EOL warning retained. See docs/evidence/2026-10-11-purpose-hardening/README.md. Remaining gates: source-bound registry publication and exact digest verification, fresh native snapshot/restore compatibility, owner GitOps server dry-run/diff, separate scoped supervisor approval and native post-release binding/refusal. No release approval or actual production-data restore is inferred from fixtures.

Publication and release preparation 2026-10-11: actual owner CI task11484/run3 succeeds at source3e4bcb26f8eeaa8c64345c565477b5ac8ccbb168, publishing immutable image763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a. The failed run1/f66 and run2/ace are retained as refinements in the same trial. Anonymous registry readback proves all8base compressed blobs/rootfs unchanged plus only policy.py; legacy media-type/default-config serialization differences are explicit. Pulled published artifact UID10001/GID10001, installed mode0644 and exactpolicy hash, all10purpose forms pass. Full pinned scanner/DB covers 44packages: 0HIGH/CRITICAL, 1fixableMEDIUM CVE-2026-85091 in zlib1.3.2-r0, identical actual current-base scan. This is not a zero-CVE release or estate risk grade. T05 and INFD-RISK-20261011-ZLIB-85091 are live owner follow-through.

The exact separate20document informed-decision packet is prepared and offline typed/intake validated, with no submission or founder disposition claimed. Source candidates differ solely in Deploymentimage and retain ConfigMap6c221878d051/schema5/PVC/identity/policy pins. Fresh read-only serverdryrun/clientdiff pass with sealedUID/fullconfiguration and actualCM/PVC UID/contentchecksum/boundvolume custody; optimizedinterpreters refused. Independent review refinement requires stdlib mode=ro schema5/integrity/count checks before any native/offline admin/Store open (native gate notexecuted); existingmanual Argo remains Healthy/OutOfSync at7db8485, not whole-app reconciled. Remaining gates: independent owner review, actual founder native approval, fresh protected native consistent snapshot/off-cluster custody/offline restore, refresh preflight, exact owner-source pin/Deployment-only manual sync and verified native installed purpose/refusal/lifecycle behavior. Synthetic native placement checks are not new provider authorization evidence. Runtime remains7f5c.

Evidence: docs/evidence/2026-10-11-purpose-image-release/.

Actual approved release and independent verification, 2026-10-11: source c96b0c6d88, fresh version2 founder acceptance, existing-snapshot rescue, isolated actual-data compatibility and disposable cleanup, fresh cutover backup/private exact copy, and Deployment-only manual image763c release are evidenced. Independent read-only reconciliation confirms Ready generation25, exact image/module/config/PVC/controlled Pod, UID/GID10001, schema5/integrity and preserved live counts16records/56events/0pending, 336delivered/43confirmed; healthz/readyz200. Authenticated actual lifecycle.outcomes readback at07:01:37 after Ready07:00:42 traverses installed canonical PDP gates. Installed ten purpose fixtures (two canonical allows/eight refusals) are synthetic, not provider advisory responses. The separate denial probe remains unexecuted. This satisfies the bounded T04 release/consumer verification, without declaring full emission guarantee, all human MFA or a zero-CVE image. Earlier preparation gates above are historical. Original failed drill-copy and final verifier UNCERTAIN remain immutable; no failed phase replay/helper amendment or scored new trial. Argo omitted false prune is independently reconciled to exact approved non-pruning operation; future verifier defect is live unpromoted INFD-IN-0010. T05 remains todo/due2026-10-18, so WP0009 remains active. Review/evidence: docs/reviews/2026-10-11-purpose-native-outcome-product-owner-acceptance.md and docs/evidence/2026-10-11-purpose-native-acceptance/.

Resolve inherited published-image zlib finding

id: INFD-WP-0009-T05
status: done
needs_human: false
intervention_note: "Founder acceptance b5ce337c/disp-cf61c2cf confirmed; exact312/f558 native completion and installed/fresh-scan/provider proof verified. No T05 decision remains pending."
priority: medium
state_hub_task_id: "1743596f-8558-5a6b-afef-4dd5c1e9c0ae"

Owner follow-through INFD-RISK-20261011-ZLIB-85091 tracks actual published base and purpose-overlay scan finding CVE-2026-85091: zlib 1.3.2-r0, fixed 1.3.2-r1, scanner MEDIUM; this is not an estate risk grade. Prepare and verify a separate source-bound base/dependency refresh, then obtain distinct native release approval before changing the workload. Review due 2026-10-18; the date is a manual owner follow-up, with no automatic expiry/rollback controller. T04 cannot be treated as a zero-CVE release or silently include the base fix. Preserve the original detection, pending founder disposition and remediation evidence. Close only after actual installed-package proof and full rescan.

Evidence: docs/evidence/2026-10-11-purpose-image-release/inherited-vulnerability-follow-through.json.

2026-10-11 — T05 bounded zlib-only source candidate preparation: Exactcurrent763base andsignedofficialr1/packageindex buildoffline. Actual44package fullscan sameDB baseline1MEDCVE85091→localcandidate0allseverity. Finalfilesystem deltaonlylibz+APKdb;36appfiles/policy9d/world/keys/Python/runtime unchanged. Localcandidate is unpublished/unapproved;4sourcenegative tests+actualbackend and10purpose checks pass. Source/evidence:docs/evidence/2026-10-11-zlib-remediation-candidate/. T05progress/planactive:actualownerCIpublishedprovenance/fullscan/SBOM,distinctnative founderreleaseapproval andactualinstalledr1/runtime/fullrescan still required. NoT04/nativec96/helper/journal/DB/ConfigMap/PVC/identity/policy changes.

Prepared distinct source-only T05 zlib85091 native release packet in docs/evidence/2026-10-11-zlib-image-release/: actual published image f5588f496b1f267d07cdc9f5208e6f2f241f74b739c23924b03702dec13a5c23, full scan zero44packages, fresh image-only candidate and unchanged-baseline rollback server dry-runs. New proposed close-downitem19 manualoutagerecovery term (not approved): freshrootconfirmedpre-releaseacceptancecache, same763/c96 oneDeployment/latestDBpreservingrollback≤30minANDdeadline, forbid401/403/revoked/conflict/mismatch/healthyservice/otherphase/futurereuse; subsequentrevocationuncheckableduringoutage explicitlyrequiresNEWhumanconsent. Product/Platform changed-requested143 reviews and fullbytes retained; typedproviderallowlist omitsfreeform fields, ephemeralPod guard anddeduplicateddocumentdecode tests added. New private drill/cutover custody, no-network schema5 clone, immutable prior T04 helpers/journals, explicitfalse request plus Argo bool-omitempty completion guards and separate post-Ready authenticated canonical lifecycle/PDP proof. Product/Platform exact acknowledgment and NEW founder informed decision still required before protected database/workload action; old T04 approval is excluded. T05 remains progress and risk stays open until actual installed acceptance/native rescan. INFD-IN-0010 remains unpromoted.

Actual T05 completion and workplan closure, 2026-10-11: historical preparation and open-risk/gate statements above describe their then-current state. New confirmed founder acceptanceb5ce337c-5d7d-44fa-864d-706b54039f7c/disposition disp-cf61c2cf-4a7d-4672-8bc2-de2e4641916f at10:40:55Z binds source1 exactmemo5dea and execution revision312ab97e876e17341bf16f9e95397e14c2ac2720. All8 protected drill/copy/offline/cleanup/cutover/copy/release/verify receipts pass. New native imagef558/generation26/Ready1/Pod1153f806 installedzlibr1 and exact file hashes match fresh full44package zero-findings scan10:48, valid at actual11:20 proof. Policy9d/config/schema5/identity/PVC retained, installed10synthetic forms 2allow/8refuse and health200 pass; separate actual canonicalPDP-gated outcomes HTTP20011:20:25 correlated with same Ready Pod/image/source before and after. Live database retained17records/59events/0pending,344delivered/44confirmed. Only one Deployment explicitprune=false released; rollback unused, not a native recovery success. Old T04/R2 failed/UNCERTAIN journals retained. Three new prephase root-clock refusals remain recorded; only root local verified_at clock was corrected with native_observed_at preserved, no approved source amendment or phase replay/new scored trial. INFD-RISK-20261011-ZLIB-85091 resolved by actual installed fixed-package/fullscan proof, with original detection preserved and no Risk Engine/estate grade or future vulnerability guarantee.

All five workplan tasks are now done. Before marking finished, existing live residual INFD-IN-0010 (originresidual,origin_refINFD-WP-0009) remains open and not-promoted in intakes/intakes.md; original approved helper generic reuse correction is not implemented/promoted by T05's separate task-specific actuator. INFD-IN-0009 remains separate class-guarantee evidence work; other intakes are unchanged. No required leftovers are parked only in this closure prose. Review: docs/reviews/2026-10-11-zlib-native-product-owner-acceptance.md. Actual metadata/hash receipts: docs/evidence/2026-10-11-zlib-native-acceptance/.