tegwick
9bc581a547
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a10780-6d41-7952-9718-dfbc1f41236f
80 lines
4.7 KiB
Markdown
80 lines
4.7 KiB
Markdown
# Lifecycle workspace and delivery
|
|
|
|
2026-10-05; INFD-WP-0007-T02/T05. Initial workspace deployed; document
|
|
authoring and review-request preparation are implemented for the next release.
|
|
|
|
## Human workspace
|
|
|
|
With `lifecycle_policy` configured, the signed-in home links to `/decisions`.
|
|
The workspace uses the same headless service as the API. Existing KeyCape
|
|
sessions establish identity; existing origin and CSRF checks protect forms.
|
|
Users can search, prepare a draft, record source metadata and evaluations,
|
|
comment, publish to explicit members/groups, refine, compare consecutive
|
|
revisions and download authorized packet entries. Source content is not fetched.
|
|
The next release adds short text documents and optional required highlights
|
|
through immutable revisions. Large or binary packets continue to use the API. All forms receive fresh policy checks;
|
|
rendering a button grants no authority.
|
|
|
|
Publication records an audience for one revision. Access Engine determines access
|
|
using authenticated identity and retained record facts. Publication creates no
|
|
approval and no human disposition. New revisions require their own publication.
|
|
The workspace exposes authorized outcomes and a protected human review link
|
|
when an exact revision handoff has been loaded by intake. Drafts without that
|
|
handoff remain unavailable for acceptance. See LifecycleReviewHandoff.md.
|
|
|
|
## Runtime and deployment inputs
|
|
|
|
The optional runtime `lifecycle_policy` object requires exactly `origin`,
|
|
`package`, `version`, `package_digest`, `caller_token_file`. Its package must
|
|
differ from the review package. No default policy or identity fallback exists.
|
|
The optional boolean `lifecycle_delivery` defaults to false. Configure both
|
|
for an admitted workspace with evidence delivery.
|
|
|
|
The deployment renderer accepts the same separate policy pins plus `pod_name`,
|
|
requires explicit `lifecycle_delivery: true` with that package, and generates
|
|
exact egress and an owner-review ingress proposal. It references the existing
|
|
mounted workload policy credential path; this does not authorize that workload
|
|
for a new package. Existing admission inputs render without lifecycle changes.
|
|
The deployed private API has its own admitted TokenReview verifier and separate
|
|
listener; browser sessions are not bearer credentials there.
|
|
|
|
## Independent evidence
|
|
|
|
On an enabled audit tick, up to 100 pending mutations are staged as immutable
|
|
`informed-decision.lifecycle` commitments in the existing outbox. The event UUID
|
|
is the delivery identity. Commitment metadata includes memo id, revision,
|
|
operation, a content digest and an existence assertion. The digest covers the
|
|
retained event and historical memo. Advisory text stays in source custody;
|
|
commitment delivery does not provide independent content reconstructability.
|
|
|
|
Pending obligations clear only after the outbox retains a receiver reference.
|
|
Lost replies retry with the same identity. The existing worker supplies bounded
|
|
delivery, reconciliation and a 24-hour lifecycle heartbeat. Undelivered evidence
|
|
keeps runtime readiness false. The current sink/reconciliation identity is
|
|
platform-scoped; other tenants fail closed at staging. Multi-tenant receiver
|
|
admission is not claimed. Kubernetes traffic readiness behavior is unchanged.
|
|
|
|
Tests use the actual local Audit Core receiver contract, including deduplication
|
|
and reconciliation. The agent-to-human collaboration scenario creates two
|
|
records, publishes/comments/refines and drains five events with unchanged runtime
|
|
configuration bytes. Its identity and PDP transport are synthetic. It proves
|
|
source behavior, not deployed workload authority or all seven acceptance cases.
|
|
|
|
## Delivery boundary and continuation
|
|
|
|
The initial rollout passed native agent-to-human-to-agent acceptance, restart
|
|
retention, public/private isolation and Audit Core reconciliation. See
|
|
../evidence/2026-10-05-lifecycle-cutover/. Those receipts describe the deployed
|
|
804d89fb image; they do not prove the next source increment is live.
|
|
|
|
Browser authoring now exposes explicit approval/discussion draft types, document
|
|
addition with required acknowledgment, packet/highlight comparisons, and durable
|
|
review-request preparation/download. The adapter calls only the shared service;
|
|
no store access, local permit or automatic privileged forwarding is introduced.
|
|
LifecycleReviewHandoff.md specifies the shared retrieval and profile contract.
|
|
|
|
Review overview discovery remains exact-record-only under compact-sitting v12.
|
|
The lifecycle workspace discovers authorized records and exposes their outcomes.
|
|
A later change to legacy overview discovery needs an Access Engine contract,
|
|
not a consumer-side policy bypass. Broader binding profiles, external identities,
|
|
source connectors and optional Hub write-back remain T02/T05 work.
|