tegwick
96dcbfdfa2
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a10780-6d41-7952-9718-dfbc1f41236f
91 lines
5.4 KiB
Markdown
91 lines
5.4 KiB
Markdown
# Initial production runtime
|
|
|
|
INFD-WP-0007 / INFD-WP-0005. Founder selected net-kingdom-admins humans and
|
|
system:serviceaccount:state-hub:state-hub on 2026-10-04. The concrete rollout was approved and accepted on 2026-10-05.
|
|
This describes the deployed initial runtime; later artifacts require their own
|
|
release verification.
|
|
|
|
## Identity and listeners
|
|
|
|
The same process/store serves browser routes on 8080 and private workload routes
|
|
on 8081. Only the public listener is behind decisions.coulomb.social. A separate
|
|
ClusterIP and exact State Hub namespace AND app-label ingress expose 8081.
|
|
`/v1/decisions` uses a projected token with audience informed-decision-lifecycle;
|
|
`/v1/memos` uses a different token with audience informed-decision-intake. Neither
|
|
route accepts a browser cookie. Browser authoring retains KeyCape sessions,
|
|
CSRF and origin checking. The private listener exposes no browser routes.
|
|
|
|
Every workload request performs Kubernetes TokenReview over CA- and
|
|
hostname-verified HTTPS with a freshly read rotating reviewer credential. The
|
|
review service needs only create on tokenreviews, not token creation or Secret
|
|
read. The API-server audience is used for its reviewer token. Workload UID and
|
|
subject come from TokenReview; tenant comes from the reloadable exact-account
|
|
registry. JWT expiry is read only after TokenReview verifies that same token.
|
|
Callers expire within 30 seconds or token expiry, whichever is earlier.
|
|
|
|
The registry is identity registration, not an action permit. Every operation
|
|
still requires a fresh external PDP decision. The lifecycle PDP has a distinct
|
|
package, version and digest from human review. Only humans can bind via the
|
|
existing protected review flow. Access Engine keeps the authorization decision;
|
|
Approval Engine keeps authoritative approval state.
|
|
|
|
## Admitted initial data
|
|
|
|
`deploy/lifecycle/lifecycle-callers.json` names the exact State Hub account and
|
|
platform tenant. The intake registry permits only decision-record class and
|
|
net-kingdom-admins, with a cap of 50 new attempts per UTC day. Replays
|
|
do not spend a second attempt; uncertain creation never automatically reposts.
|
|
The cap and routing are configuration, not per-decision deployments.
|
|
|
|
The review-group recipient is the existing platform-root KeyCape subject found
|
|
in previously bound review records. This is the initial single recipient; group
|
|
membership alone does not turn every admin into that bound principal. Expanding
|
|
to multiple human recipients needs a reviewed binding contract. The default
|
|
legacy registries remain empty; only the reviewed release ConfigMap mounts the
|
|
initial proposal. Directory group verification remains independent of this map.
|
|
|
|
Registry volumes use no subPath and reload on each request. Requester custody is
|
|
read-only at `/var/run/secrets/informed-decision/requester/client-secret`, matching
|
|
CCR-2026-0032. No secret value is copied into release files or SQLite. Kubernetes
|
|
Secret objects are not emitted by the renderer.
|
|
|
|
## Evidence and compatibility
|
|
|
|
Runtime options enable lifecycle audit delivery, intake audit/notification
|
|
delivery and verified intake metadata for human review. The latter reloads the
|
|
live Approval Engine object, checks its binding pin, requester informed-decision
|
|
and human_control=true before the PDP call. Store guards recheck retained intake
|
|
metadata at the mutation boundary. A valid-looking UUID/digest alone is not proof.
|
|
|
|
State Hub now has a private explicitly queued dispatcher (STATE-WP-0096), with a
|
|
separate standard-library-only image and PVC. It uses the selected existing
|
|
service account and distinct projected lifecycle/intake tokens; its transport
|
|
reads only the intake token. The Hub public API does not gain a credentialed
|
|
forwarding route. Queueing is trusted workload execution. New review envelopes
|
|
are data operations and do not change deployments. The exact lifecycle snapshot
|
|
id/key is preserved without inventing a Hub relationship when serves is absent.
|
|
Lost replies replay the same envelope; native-create uncertainty blocks the row.
|
|
Native deployment and human acceptance passed. Notification/write-back receiver
|
|
admission is unchanged; INFD_HUB_WRITEBACK remains off.
|
|
|
|
The image migrates schema 2 to schema 5 on open. Existing records, presentations,
|
|
dispositions, submissions and outbox evidence must survive. Rollback to the old
|
|
image against the migrated database is forbidden: stop the new writer, retain all
|
|
new evidence, and restore a verified pre-cutover copy on a separate private volume
|
|
only under the reviewed recovery plan. An in-flight/unresolved human submission
|
|
must be reconciled, never retried or discarded to make rollback convenient.
|
|
|
|
## Observed acceptance and remaining scope
|
|
|
|
CCR-2026-0032 delivery is applied: actual receiving mount/exchange and bounded
|
|
identity/path/scope/revocation tests passed. FLEX-WP-0033 and STATE-WP-0096
|
|
completed native deployment and human acceptance. INFD-WP-0007-T06/T07 retain
|
|
backup/restore, caller isolation, unchanged pins across two records/a revision,
|
|
restart retention and independent audit proof. See
|
|
../evidence/2026-10-05-lifecycle-cutover/acceptance-summary.json.
|
|
|
|
Issuer rotation remains separately governed under Platform RPF-IN-0004.
|
|
Browser authoring and named-recipient discovery are deployed in service image
|
|
7f5c6cb2 with owner compact-sitting v13 (FLEX-WP-0034). Initial contracts are
|
|
explicit in LifecycleAdmissionBoundary.md; broader expansion and optional Hub
|
|
write-back are tracked in INFD-WP-0008. No new caller, group or listener is admitted.
|