informed-decision/docs/requester-workload-owner-review.md

# Requester workload owner source review — 2026-10-04

Owning task: INFD-WP-0005-T05. Platform request:
2c1507b2-b361-4ef9-b5d4-3245014c7c52, thread
f84637fa-2355-4971-a2dc-7f1fd01710a8. Reviewed platform source:
6b91d510395215d178d60ee8884e7fc00930a0cf, proposed CCR-2026-0032.

## Source binding acceptance

The founder-approved namespace trust boundary matches the existing create-only
requester registration. Accept the dedicated ESO auth identity
informed-decision/informed-decision-eso, audience openbao, exact-path policy,
900-second reader limits and namespace-restricted store for owner integration.
The receiving review pod keeps ServiceAccount review and UID/GID/fsGroup 10001.
Accept the required read-only 0440 projected key client-secret at
/var/run/secrets/informed-decision/requester/client-secret, without subPath.
No new issuer registration, custody seed, scope, browser route or human act is
introduced. This is source acceptance; it does not confirm live auth claims.

## Implemented composition seam

informed_decision/requester.py implements RequesterTokenProvider and
compose_intake. The provider reopens bounded projected custody per exchange,
never strips/caches the secret or caches access tokens, and requests exactly
approval:create through fixed HTTPS /token. TLS validation, five-second timeouts,
response bounds, proxy suppression and redirect refusal use JSONTransport.
RS256 signature verification against the fixed /jwks pins issuer, sole audience
approval-engine, sub informed-decision, tenant tenant:platform, service principal,
exact requester role and exact create scope. JWT lifetime must be positive and
at most 900 seconds. Failure exposes only a fixed refusal string.
The existing issuer is https://kc.coulomb.social; owner configuration must use
that exact origin (no discovery or caller-selected URL).

compose_intake binds this callback to IntakeApprovalClient and joins the existing
IntakeService ledger with a supplied TokenReview transport and reviewed registries.
It starts no listener and supplies no transport implementation for TokenReview.
No runtime JSON setting or deployment entrypoint consumes this factory yet.

Focused offline verification: 37 tests pass across requester, intake service and
bounded transport. Synthetic projected-file replacement changes the next exchange;
missing custody sends no exchange. Wrong identity, tenant, service profile,
scopes, issuer, audience, signature, expiry and excessive lifetime refuse.
This proves local behavior, not deployed projection or issuer rotation.

## Remaining technical deliveries

1. Compose the separate private intake listener in the process lifecycle and
   explicit runtime config. Implement bounded, authenticated TokenReview using
   API-server CA validation. Review API RBAC and submitter token audience.
2. Verify ESO's actual TokenRequest permission for the dedicated auth account;
   retain boolean/identity receipt. Review exact private Service, NetworkPolicy,
   projected registries and submitter grants. Keep it absent from public ingress.
3. Build and publish the final owner image only after composition is complete;
   retain immutable registry manifest digest, rendered configuration digest and
   owner source revision. None exists for this new provider yet. Existing deployed
   image/config references cannot be claimed to contain it.
4. Owner acceptance of receiving verification/abort attendance remains required.
   This worker owns source review only, and cannot assign a human attendance role.

## Bounded native proof and abort plan

Before promotion, record exact ESO auth role, effective policy and all TTL bounds;
prove SecretSynced, exact file projection and safe annotation metadata with the
platform maintained helper. Refuse sibling data GET, parent metadata LIST, wrong
namespace/account/audience. Obtain one create-only service exchange and native
approve/read/consume refusal. Keep proof to non-secret identities, counts,
digests, timestamps and capability booleans.

Coordinated issuer rotation must prove the actual mounted-file refresh reaches
this callback and the predecessor ceases working. File replacement in an offline
test is not issuer rotation/revocation evidence. Check reader expiry/revocation,
materialized credential persistence and attended admin cleanup separately.
The runtime verifier/abort operator must retain these receipts; do not print a
Secret, bearer token, accessor, annotations, upstream body or raw child error.

On partial failure, stop, retain non-secret actual state and reconcile; never
repost an unresolved approval create. Platform abort withdraws the new projection
and disables/revokes only the new ESO reader via reviewed admin custody. Target
Secret removal is separate because Retain preserves it. The owner rollback uses
the prior admitted image/config and closes the new private listener. Existing
issuer, browser and attended requester lanes remain independent.

## Human decisions

No repeated design decision is needed for this accepted boundary. The remaining
human action is separate founder approval of the final concrete live packet and
named verification/abort attendance, after these technical gaps are closed.
No live apply, credential read, rotation, issuer mutation or deployment occurred.


## Runtime acceptance update — 2026-10-04

The private listener, CA-verified TokenReview, rotating file-backed requester,
attribute consumer and durable State Hub dispatch are now composed and tested.
The service image remains the scanned 2768bd1 candidate in deploy/lifecycle;
State Hub worker is the CI-built 410fb6b candidate. This closes the source/runtime
composition gap only. The live CCR remains proposed; its current SHA256 is
ab4cd7c15192ebe98e17b0c40a188ae67616c63cc796d9b807adba7c39f2edb3.
No new design decision is requested. Exact live delivery approval, attended
OpenBao login, native custody/rotation proof and cutover acceptance remain.

## Exact delivery approval recorded — 2026-10-04

Founder answered "I approve" to the final requester delivery packet. Platform
commit a7bc33b records approved CCR-2026-0032 and the reviewed intended binding;
approved CCR SHA256 is
c54dd86fd1bd754e64b135f02cac8d9a8f4db314cb3ca44c9645565aa816eee7.
A fresh explicit SubjectAccessReview confirms the current external-secrets
controller can create tokens for informed-decision/informed-decision-eso. No
token was minted. Native account auth and delivery remain to be proven.

The owner metadata child accepts the approved source and exact digest offline.
The founder must run Platform's updated attended checklist in their terminal.
No repeated requester-delivery approval is needed. Native metadata application,
ESO delivery, negative checks and cleanup receipts are pending; the broader
lifecycle cutover and issuer rotation still require their separate reviewed scope.

## Native requester accepted for cutover preparation — 2026-10-04

The founder's amended attended run succeeded. Store Valid, ExternalSecret
SecretSynced, no duplicate Secret annotation. Real temporary workloads proved
exact identity/policy/TTL, wrong account/namespace/audience and sibling/list
refusals, 0440 exact-field projection, signed create-only exchange and excess
scope refusals. Reader revoked and post-revoke lookup denied; temporary resources
removed. Image 804d89fb contains the required KeyCape Basic-auth fix at 03f18d8.
Receipts are in docs/evidence/2026-10-04-lifecycle-release/.

Production receiving-pod projection remains part of cutover acceptance. The
Platform lane explicitly excludes issuer rotation from initial delivery; that
separate operation still needs its coordinated changed-file/predecessor proof.
No rotation evidence is inferred from the current projection match.