tegwick
70dc3b969d
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a10780-6d41-7952-9718-dfbc1f41236f
144 lines
8.7 KiB
Markdown
144 lines
8.7 KiB
Markdown
# INFD-WP-0007 production candidate
|
|
|
|
Prepared 2026-10-04 for the founder-selected initial audience: net-kingdom-admins
|
|
humans and system:serviceaccount:state-hub:state-hub. **Not deployed.**
|
|
|
|
| Artifact | Immutable reference |
|
|
| --- | --- |
|
|
| Service | forgejo.coulomb.social/coulomb/informed-decision@sha256:804d89fb0bb3d691720380eedde4f361133bada717d1773c2eb349004346ebf1 |
|
|
| Access Engine | forgejo.coulomb.social/coulomb/flex-auth@sha256:bdac62bc3f089cba0df7c35eeb8d0d9b3af2d4bae5e4ea4767516c1ed20b1e99 |
|
|
| Lifecycle package | informed-decision.lifecycle v1, sha256:cee6a79f74e81d0d389a2c2e2451a92be3434ea9dfcee4986e8c7e6cfdbb1827 |
|
|
| Human review package | informed-decision.compact-sitting v12, sha256:c5387f7d198dc39ab5967e0c218ce05cc779693565c8875e3035e45ec002a2db |
|
|
|
|
`admission.candidate.json` renders `service.candidate.json` using
|
|
`tools/render_deployment.py`. `registries.candidate.json` projects the three
|
|
sibling JSON registries. The policy YAML is Helm-rendered from Access Engine's
|
|
FLEX-WP-0033 candidate values; it is a review artifact, not a second deployment
|
|
owner. Existing Helm releases must be updated through their owning workflow.
|
|
The original 25 objects and the three dispatcher objects passed Kubernetes
|
|
server dry-run against railiance01.
|
|
No Secret is included. Dry-run does not test reachability, credential delivery,
|
|
policy caller identity, backup restoration or a human disposition.
|
|
|
|
## Proposed live changes
|
|
|
|
- Replace the service's image and immutable runtime ConfigMap, retaining its
|
|
public Service/Ingress, single writer, Recreate strategy and existing PVC.
|
|
- Enable `/decisions` and lifecycle audit delivery; keep private API on 8081.
|
|
- Add the exact State Hub peer, API-server egress, CA/token projection and only
|
|
create-tokenreviews RBAC for informed-decision/review.
|
|
- Mount the proposed reloadable registries and Platform's exact read-only
|
|
requester Secret projection, without subPath.
|
|
- Add a separate lifecycle PDP and change the sitting PDP to the v12 package.
|
|
Review retains all v11 exact mandates and 15-minute KeyCape MFA; lifecycle
|
|
authoring uses a 12-hour MFA window. Agents cannot accept.
|
|
- Initial intake permits decision-record / net-kingdom-admins, 50 new attempts
|
|
per UTC day, with the existing platform-root recipient. Other admins may
|
|
collaborate; this does not silently make them the bound recipient.
|
|
|
|
The policy chart retains the owner's existing port-only API-server egress
|
|
(443/6443). The consumer's new API-server egress is address-specific. CARING is
|
|
advisory and consumer fact attribution is unsigned, as in the existing reviewed
|
|
contract; neither is presented as a newly enforced control.
|
|
|
|
## Pre-cutover gates
|
|
|
|
1. RPF-WP-0051 / CCR-2026-0032 requester delivery is applied: store Valid and
|
|
ExternalSecret SecretSynced; native candidate-image identity/path/scope,
|
|
projection and reader-revocation proofs pass. Verify the receiving service's
|
|
actual mount during cutover. Issuer rotation is a separate governed operation,
|
|
excluded from this initial delivery by the Platform lane contract; no rotation
|
|
or predecessor-revocation evidence is claimed here.
|
|
2. INFD-WP-0005-T08 / STATE-WP-0096: the private dispatcher and separate
|
|
lifecycle/intake token projections are prepared in dispatcher.candidate.json.
|
|
Deploy after intake prerequisites. Explicit enqueue requires trusted workload
|
|
execution; there is no new public delegate endpoint. Confirm notification
|
|
receiver reachability; keep resolution write-back disabled.
|
|
3. Refresh live image/config pins and unresolved-entry counts; complete the
|
|
backup/restore steps below; obtain explicit approval of this concrete rollout.
|
|
INFD-WP-0007-T07 and CCR-2026-0032 require this distinct go.
|
|
|
|
## Cutover and recovery procedure
|
|
|
|
Before migrating, close new review traffic through the owning ingress workflow,
|
|
let active requests finish, and inspect the current schema-2 writer read-only.
|
|
The observed baseline was 24 confirmed submissions, 158 delivered outbox rows,
|
|
zero unresolved entries; these counts are not a future maintenance-window gate.
|
|
Retain the exact current Deployment, Service, runtime ConfigMap, Helm values and
|
|
all related policy pins. Do not include credentials in the evidence packet.
|
|
|
|
Use the existing running image's installed `informed-decision-admin backup` to
|
|
create a unique SQLite consistent snapshot in a private directory. Copy the
|
|
backup to independently protected custody, record its digest, and verify a
|
|
restore on a separate private volume before cutover. Close the old writer before
|
|
starting the schema-5 image. Local synthetic restore proof is retained in the
|
|
evidence directory; it does not replace this production data restoration check.
|
|
|
|
Deploy admitted owner policy/custody prerequisites, then the service candidate.
|
|
Verify `/healthz`, `/readyz`, pending/blocked counts, actual audience isolation,
|
|
wrong-caller refusals and public/private route separation. Exercise two new
|
|
records and a revision without changing image/config/package pins. Only a human
|
|
may finish review. Correlate the native Approval Engine entry and independent
|
|
Audit Core receipts; restart and retrieve the same immutable evidence.
|
|
|
|
If validation fails, stop the candidate and retain its database plus all new
|
|
receipts. **Never start the old schema-2 image on the schema-5 database.** Rollback
|
|
requires the verified pre-cutover copy on a separate volume and reconciliation
|
|
of every post-cutover external effect before resuming writes. An uncertain
|
|
submission stays unresolved; do not retry or discard it to enable rollback.
|
|
The prior image is in ../sitting-admission.json and remains a reference, not an
|
|
instruction to downgrade the live database.
|
|
|
|
## Validation evidence
|
|
|
|
`docs/evidence/2026-10-04-lifecycle-release/` retains container checks, bounded
|
|
scan summaries and policy validation. Service: 662 passed, 1 skipped with owner
|
|
components; 13 container checks passed, including restart and backup/restore.
|
|
Both artifact scans contain zero HIGH/CRITICAL findings. Actual evaluator tests
|
|
cover first-audience collaboration across revisions and verify unchanged package
|
|
pins; authentication custody in those tests is synthetic. Native activation and
|
|
broader browser packet/binding profiles remain explicit workplan tasks.
|
|
|
|
The final Access Engine pin is the Forgejo image built from commit d2d0b6f
|
|
(run https://forgejo.coulomb.social/coulomb/access-engine/actions/runs/316).
|
|
It supersedes the locally built candidate for the proposed deployment.
|
|
|
|
|
|
## Private State Hub dispatcher continuation
|
|
|
|
The dispatcher is a separate Recreate workload with 5m CPU / 24Mi memory requests,
|
|
one private 1Gi PVC, no Service/Ingress, and the existing state-hub service account.
|
|
Its only egress is DNS and the exact informed-decision peer on 8081. Projected
|
|
lifecycle and intake tokens each expire after 600 seconds. The dispatcher reads
|
|
only the intake token and never binds. Its pod omits app=state-hub, so it is not
|
|
selected by the existing Hub API Service.
|
|
|
|
Image: forgejo.coulomb.social/coulomb/state-hub-memo-dispatch@sha256:410fb6b6c9fd7a7ee0b63d727fd3249fb3ae13943421d6a5ce88b7ad2520bd2f
|
|
Source: State Hub 4a59b23, built by the dedicated Forgejo workflow.
|
|
Source integration proves queue/restart/lost-reply handling (one create, replayed
|
|
receipt), subsequent human acceptance and independent audit delivery. All identity
|
|
and credential inputs in that test are synthetic. Native acceptance remains open.
|
|
|
|
There is no new service-image build for this continuation. The service suite now
|
|
passes 663 tests (1 skipped); State Hub forwarding/notification tests pass 28.
|
|
|
|
## Final requester and restore proof — 2026-10-04
|
|
|
|
Service image 804d89fb (source 03f18d8) supersedes 2768bd1 after native testing
|
|
found KeyCape requires client_secret_basic. Credentials are form-encoded before
|
|
Basic encoding; requests retain the exact create-only scope and full signature/
|
|
identity verification. The candidate passes 664 tests (one skipped), 13 installed
|
|
container checks and a zero HIGH/CRITICAL scan. Its server dry-run passed.
|
|
|
|
Actual production snapshot restore was exercised offline in a separate Docker
|
|
volume with the candidate. Migration from schema 2 to 5 preserved 24 confirmed
|
|
submissions and 158 delivered outbox rows; lifecycle starts empty. The disposable
|
|
volume was removed. Original snapshot is retained off-cluster under ignored
|
|
.private-backups/20261004-pre-lifecycle (0700 parent, 0600 file), with a copy in
|
|
the live PVC's private directory. Refresh the snapshot after closing writes for
|
|
cutover; this online drill is not the final maintenance-window backup.
|
|
|
|
The requester proof's eight temporary resources were removed. No native approval
|
|
was created, consumed or human-bound by these tests. The actual review service
|
|
and State Hub dispatcher have not been rolled out. Concrete cutover approval is
|
|
the remaining gate for the initial audience and artifacts in this packet.
|