informed-decision/docs/specs/LifecycleProductionRuntime.md

Initial production runtime

INFD-WP-0007 / INFD-WP-0005. Founder selected net-kingdom-admins humans and system:serviceaccount:state-hub:state-hub on 2026-10-04. The concrete rollout was approved and accepted on 2026-10-05. This describes the deployed initial runtime; later artifacts require their own release verification.

Identity and listeners

The same process/store serves browser routes on 8080 and private workload routes on 8081. Only the public listener is behind decisions.coulomb.social. A separate ClusterIP and exact State Hub namespace AND app-label ingress expose 8081. /v1/decisions uses a projected token with audience informed-decision-lifecycle; /v1/memos uses a different token with audience informed-decision-intake. Neither route accepts a browser cookie. Browser authoring retains KeyCape sessions, CSRF and origin checking. The private listener exposes no browser routes.

Every workload request performs Kubernetes TokenReview over CA- and hostname-verified HTTPS with a freshly read rotating reviewer credential. The review service needs only create on tokenreviews, not token creation or Secret read. The API-server audience is used for its reviewer token. Workload UID and subject come from TokenReview; tenant comes from the reloadable exact-account registry. JWT expiry is read only after TokenReview verifies that same token. Callers expire within 30 seconds or token expiry, whichever is earlier.

The registry is identity registration, not an action permit. Every operation still requires a fresh external PDP decision. The lifecycle PDP has a distinct package, version and digest from human review. Only humans can bind via the existing protected review flow. Access Engine keeps the authorization decision; Approval Engine keeps authoritative approval state.

Admitted initial data

deploy/lifecycle/lifecycle-callers.json names the exact State Hub account and platform tenant. The intake registry permits only decision-record class and net-kingdom-admins, with a cap of 50 new attempts per UTC day. Replays do not spend a second attempt; uncertain creation never automatically reposts. The cap and routing are configuration, not per-decision deployments.

The review-group recipient is the existing platform-root KeyCape subject found in previously bound review records. This is the initial single recipient; group membership alone does not turn every admin into that bound principal. Expanding to multiple human recipients needs a reviewed binding contract. The default legacy registries remain empty; only the reviewed release ConfigMap mounts the initial proposal. Directory group verification remains independent of this map.

Registry volumes use no subPath and reload on each request. Requester custody is read-only at /var/run/secrets/informed-decision/requester/client-secret, matching CCR-2026-0032. No secret value is copied into release files or SQLite. Kubernetes Secret objects are not emitted by the renderer.

Evidence and compatibility

Runtime options enable lifecycle audit delivery, intake audit/notification delivery and verified intake metadata for human review. The latter reloads the live Approval Engine object, checks its binding pin, requester informed-decision and human_control=true before the PDP call. Store guards recheck retained intake metadata at the mutation boundary. A valid-looking UUID/digest alone is not proof.

State Hub now has a private explicitly queued dispatcher (STATE-WP-0096), with a separate standard-library-only image and PVC. It uses the selected existing service account and distinct projected lifecycle/intake tokens; its transport reads only the intake token. The Hub public API does not gain a credentialed forwarding route. Queueing is trusted workload execution. New review envelopes are data operations and do not change deployments. The exact lifecycle snapshot id/key is preserved without inventing a Hub relationship when serves is absent. Lost replies replay the same envelope; native-create uncertainty blocks the row. Native deployment and human acceptance passed. Notification/write-back receiver admission is unchanged; INFD_HUB_WRITEBACK remains off.

The image migrates schema 2 to schema 5 on open. Existing records, presentations, dispositions, submissions and outbox evidence must survive. Rollback to the old image against the migrated database is forbidden: stop the new writer, retain all new evidence, and restore a verified pre-cutover copy on a separate private volume only under the reviewed recovery plan. An in-flight/unresolved human submission must be reconciled, never retried or discarded to make rollback convenient.

Observed acceptance and remaining scope

CCR-2026-0032 delivery is applied: actual receiving mount/exchange and bounded identity/path/scope/revocation tests passed. FLEX-WP-0033 and STATE-WP-0096 completed native deployment and human acceptance. INFD-WP-0007-T06/T07 retain backup/restore, caller isolation, unchanged pins across two records/a revision, restart retention and independent audit proof. See ../evidence/2026-10-05-lifecycle-cutover/acceptance-summary.json.

Issuer rotation remains separately governed under Platform RPF-IN-0004. Browser authoring continuation is T05; new source features do not imply a production update. Wider identity/binding/publication and optional Hub write-back contracts remain explicit T02 work. No new caller, group or listener is admitted.