informed-decision/workplans/INFD-WP-0007-decision-lifecycle-service.md

---
id: INFD-WP-0007
type: workplan
title: "Decision lifecycle service — headless foundation and human UI"
domain: infotech
repo: informed-decision
status: finished
owner: codex
topic_slug: netkingdom
created: "2026-10-04"
updated: "2026-10-05"
origin: demand
origin_ref: "Founder 2026-10-04: full decision lifecycle for agents and humans, no per-decision infrastructure rollout, headless foundation and UI at decisions.coulomb.social"
related:
  - INFD-WP-0005
  - INFD-WP-0006
state_hub_workstream_id: "2b3e04ed-2137-584f-a6c2-f1abb29636fa"
---

# Decision lifecycle service

Contract: `docs/specs/DecisionLifecycleService.md`. This extends the existing
memo and intake implementation. `INFD-WP-0005` continues to own intake runtime,
attribute admission, forwarding and live acceptance. Implementation started on
2026-10-04 at the founder's request. The initial production identity/policy audience is live; broader human binding profiles remain
open. The shared service now has a bearer API adapter and optional browser workspace.

## Record product direction and architecture

```task
id: INFD-WP-0007-T01
status: done
priority: high
state_hub_task_id: "00829d0e-2daa-5c25-a4e9-e4fd595fb8d4"
```

Updated INTENT and GOAL; SCOPE explicitly distinguishes requested capabilities
from implementation. Spec covers all nine operations, foundation/UI dependency
boundary, revision/evidence semantics and acceptance without per-decision deploys.

## Specify lifecycle contracts against existing owners

```task
id: INFD-WP-0007-T02
status: done
priority: high
state_hub_task_id: "cde0c932-afce-5bec-8cee-a2f377955b9f"
```

Define versioned API schemas, application service interfaces, caller/tenant
context, source/evaluation/comment companion records, revision concurrency,
publication audience, idempotency, errors, limits and result retrieval. Resolve
the spec's open identity/publication/source/non-approval binding contracts.
Review against existing schema and engine contracts. Residual from INFD-WP-0005:
retain separate optional Hub outcome write-back and broader profile contracts;
write-back remains disabled until independently admitted. Preserve private intake
and current review URLs. Produce a reviewed migration and compatibility plan.

## Implement durable headless lifecycle foundation

```task
id: INFD-WP-0007-T03
status: done
priority: high
depends_on: [INFD-WP-0007-T02]
state_hub_task_id: "2a206bc2-cb92-539d-9014-9ba71f70277c"
```

Implement registration, immutable revisions, source provenance, evaluations,
companion comments, publication and result/event retrieval using shared service
operations. Reuse the current memo/presentation/disposition core and transactional
store/outbox. Migrate existing records without losing evidence. Tests prove
concurrency, replay, restart, stale-presentation refusal, human-only disposition
and absence of UI imports. No mirrored approval state.

## Expose authenticated lifecycle API for agents and humans

```task
id: INFD-WP-0007-T04
status: done
priority: high
depends_on: [INFD-WP-0007-T03]
state_hub_task_id: "65c760da-de7e-5e85-9817-6f3e2b46c8f9"
```

Add versioned adapters, bounded authorized search/retrieval and durable outcomes.
Connect existing intake and policy/identity ports. Test audience, tenant and
authorization isolation, conflicting idempotency payloads, result delivery and
uncertain external outcomes. The complete agent scenario must run without a UI.

## Build the lifecycle workspace at decisions.coulomb.social

```task
id: INFD-WP-0007-T05
status: done
priority: high
depends_on: [INFD-WP-0007-T04]
state_hub_task_id: "a6a7c9a8-760e-52dd-80d3-d36f43f0a86a"
```

Residual from INFD-WP-0005: review overview listing currently remains exact-record
only; define attribute-based discovery with Access Engine while retaining fresh
read/act decisions. The lifecycle workspace already lists published records.

Add discovery, authoring, research/evaluation views, publication audience controls,
discussion, revision comparison and human review through the shared foundation.
Keep agents clearly attributed, acceptance revision-specific and authentication
step-up understandable. Verify existing URLs and old records remain usable.

## Prove lifecycle without per-decision rollout and prepare live delivery

```task
id: INFD-WP-0007-T06
status: done
priority: high
depends_on: [INFD-WP-0007-T04, INFD-WP-0007-T05]
state_hub_task_id: "aa839bea-cc4c-5ee0-85e7-87c881e8e578"
```

Run all seven spec acceptance scenarios in an integration environment. Record
unchanged image/deployment/policy/config pins across two new decisions and a
revision, plus restart durability. Incorporate WP-0005 runtime/admission receipts.
Prepare the concrete migration, immutable release, rollback and verification
packet before requesting the separately required live rollout approval.

## Approved live acceptance

```task
id: INFD-WP-0007-T07
status: done
priority: high
depends_on: [INFD-WP-0007-T06]
state_hub_task_id: "25fa4743-5c7e-5609-9872-7c5971ff62bc"
```

After explicit approval of the concrete rollout, deploy and obtain native
agent-to-human-to-agent evidence at decisions.coulomb.social. Only the human
performs acceptance. Update SCOPE from observations and hand any residuals into
live work records before marking this plan finished.

## First implementation slice — 2026-10-04

`docs/specs/LifecycleFoundationContract.md` records the implemented T02 storage
contract and remaining service/API contracts. T03 begins against that bounded
contract while the broader T02 work continues. `informed_decision/lifecycle.py`
provides registration, immutable revisions, attributed sources/evaluations/
comments and event retrieval on the existing Memo and Store. Schema 4 retains
mutation events and pending delivery atomically with memo writes and idempotency
receipts. Tests cover concurrent revisions, restart/backup, tenant partitioning,
rollback, replay, provenance references, schema upgrades and existing human/stale
presentation guards. Neither task is complete: application authorization,
publication, HTTP/UI and admitted evidence delivery remain in their live tasks.
No production route or deployment was changed.

Validation: `uv run --extra dev python -m pytest -q` — 480 passed, 72 skipped.
The system interpreter had dependency-related failures; the project-managed
environment passes. `git diff --check` passes.

## Protected application service — 2026-10-04

Added `LifecycleService` above the repository: verified human-session import,
trusted workload-caller interface, fresh PolicyClient observations for every
operation/retry, immutable command snapshots, transaction-time authorization
guards and post-read expiry checks. Mutation events link the retained policy
observation. Existing human disposition and policy action contracts are unchanged.
`docs/specs/LifecycleServiceContract.md` records the proposed lifecycle action
names/context and remaining production identity/policy/HTTP/audit admission work.
T02/T03 remain in progress; no listener or policy grant was deployed.

Validation: `uv run --extra dev python -m pytest -q` — 501 passed, 72 skipped;
`git diff --check` passed.

## Infrastructure alignment — 2026-10-04

Reviewed current local owner sources and shipped v11 sitting pins; findings are
in `docs/evidence/2026-10-04-lifecycle-infrastructure-alignment.md`. Fixed legacy
overview exposure of unpublished lifecycle ids, import bypass of lifecycle
revision history, and readiness/admin omission of pending lifecycle evidence.
Cross-repo suite with Approval Engine, Audit Core and State Hub source fixtures:
571 passed, 5 skipped. This is source integration evidence, not live cluster
verification or new lifecycle policy admission. External runtime/identity/policy/
receiver contracts remain on T02/T03 and WP-0005.

## HTTP adapter continuation — 2026-10-04

Started T04 against the implemented application contract while broader T02/T03
work continues. `LifecycleAPI` provides bearer-authenticated adapter seams for
retrieval, event pagination and comments/sources/evaluations, calling the same
application service. Closed/bounded JSON, idempotency headers, sanitized errors
and cookie refusal are tested. No default authenticator or listener is supplied;
public ingress and browser app remain unchanged. Contract and remaining route/
identity/runtime work: `docs/specs/LifecycleHTTPContract.md`.

HTTP continuation validation: cross-repo suite 585 passed, 5 skipped; a subsequent
focused lifecycle/HTTP run also covers content-free admin inspection.
`git diff --check` passed. Runtime remains unmounted pending the named contracts.

## Registration and revision API — 2026-10-04

Continued T04 with POST /v1/decisions and POST /v1/decisions/{id}/revisions,
using closed typed decoding of the existing Memo dataclasses. Added bounded
base64 packet uploads, verified digests and atomic packet/memo/event writes.
New records must supply packet bytes; revisions can reuse only their current
packet's digests. The shared service snapshots and authorizes the whole command.
Receipts include stable relative API revision links. Tests cover end-to-end
registration/replay/revision, malformed nested values, forged approval pins,
packet corruption, cross-record digest reuse and rollback on queue failure.
The adapter remains unmounted; T02/T03/T04 remain in progress.

Validation: cross-repository suite 598 passed, 5 skipped; subsequent HTTP tests
include shared L0/L3 decoding and preservation of requires_new_bind.
`git diff --check` passed. No live deployment or authentication admission.

## Workspace, publication and independent evidence — 2026-10-04

Continued T02–T06 with revision-specific explicit publication audiences, policy
record facts and race guards, bounded authorized search with opaque scoped cursors,
and packet retrieval. Added a human workspace through the same service: create,
research/evaluate, comment, publish, compare and refine. API receipts include
workspace links. Existing session, CSRF and origin protections are reused.

Runtime optionally composes a separately pinned lifecycle policy; the deployment
renderer produces corresponding exact network proposals. Opt-in lifecycle audit
commitments use the existing outbox, real receiver receipts, retries, heartbeats
and reconciliation. Tests cover lost replies, restart, audience races, denial,
HTML escaping, form replay and unchanged configuration across two new decisions
and a revision. The full cross-repository suite passes: 623 passed, 5 skipped.

T05/T06 are in progress, not complete. Live tasks retain: admitted lifecycle PDP
policy and workload identity/listener (T02/T04), human review/binding handoff and
broader authoring UI (T03/T05), full acceptance scenarios, immutable release and
rollback packet (T06), separately approved live rollout (T07). Source metadata
entry is implemented; automated fetching/retention is not. No deployment occurred.
Delivery and activation contract: `docs/specs/LifecycleWorkspaceDelivery.md`.

## Revision-specific human review handoff — 2026-10-04

T02–T06 continued with policy-authorized review requests, immutable source-to-intake
snapshots and authorized outcome retrieval. Intake checks exact retained envelope,
designated submitter and current source revision before creation and loading.
Existing uncertainty/replay behavior is reused. Source revisions invalidate old
review actions; in-flight/unresolved human entries prevent source revision.
Protected review pages show the source revision, and the lifecycle workspace
links ready reviews and displays evidence without caching approval validity.

The real Approval Engine/Audit Core source integration test creates and accepts
a snapshot of source revision two, correlates the confirmed human answer and
delivers evidence. Test identities and PDP transport are synthetic. Supported
profile and limits: `docs/specs/LifecycleReviewHandoff.md`. Production admission,
private forwarding, broader profiles/browser packet authoring, release/rollback
and approved live delivery remain on T02/T04/T05/T06/T07 and WP-0005. No task is
marked complete solely from source integration, and no rollout occurred.

Validation for this continuation: full cross-repository suite **634 passed,
5 skipped**; `git diff --check` passed. Schema-4 upgrade preserves existing
records and marks schema 5 to fence older readers. Implementation decision logged
as State Hub `ccb2e110-6032-4259-a402-989415a8d9fe` (not a rollout approval).


## First production audience and runtime candidate — 2026-10-04

Founder selected net-kingdom-admins humans and the State Hub workload. Added the
private 8081 composition with fresh CA-verified TokenReview and exact workload
registration, shared-store public/private serving and guarded attribute review.
A revision's editor now remains authorized to its unpublished successor through
immutable revision_by facts. Actual Access Engine HTTP integration proves this
with the separately pinned lifecycle policy (FLEX-WP-0033).

Published immutable service/policy candidates and retained the reviewable packet
at deploy/lifecycle/README.md. Both scans have zero HIGH/CRITICAL findings after
fixing service JWT pins and inherited Access Engine Go/OPA/telemetry dependencies.
All 25 Kubernetes objects passed server dry-run; 662 service/component tests pass
(1 skipped), as do 13 installed-container checks. Access Engine full regression
and candidate package validations pass. Tests are not native custody proof.

No live change or human binding was performed. T02–T06 remain in progress for
native contracts, State Hub production forwarding, browser packet/binding
profiles and complete live acceptance. T07 still requires concrete rollout go.
CCR-2026-0032 / RPF-WP-0051 owns requester delivery; INFD-WP-0005-T08 owns State
Hub forwarding/token projections. The exact chosen identity is no longer an open
question. Rollback must retain new evidence and must not run a schema-2 reader
on the migrated schema-5 database.


## Private dispatcher production continuation — 2026-10-04

STATE-WP-0096 now supplies the prepared private State Hub worker and audience
projections. No credentialed forwarding route is exposed through the unauthenticated
Hub API. Fixed a consumer contract mismatch: immutable lifecycle review envelopes
may omit serves and retain their review-UUID idempotency key. Integration proves
lost-reply/restart recovery without duplicate native approval, followed by human
review and independent audit. Validation: 663 passed, 1 skipped; 28 Hub tests.
The exact three worker objects are added to deploy/lifecycle. Native credentials,
rollout approval and human acceptance remain the next gates; no live mutation.

## Requester delivery approval — 2026-10-04

Founder approved the concrete CCR-2026-0032 requester delivery. Platform a7bc33b
records the approved exact packet and contained metadata command. Owner source
readiness is accepted under RPF-WP-0051-T02; T03 awaits the founder terminal
OIDC/MFA and native delivery evidence. No live credentials were read or changed
by this session. INFD-WP-0007-T07 still owns separate service cutover acceptance.

## Native requester delivery — 2026-10-04

Founder completed the attended metadata helper with exit 0; retained receipt
confirms metadata_verified. Platform deployed the exact three delivery objects
via dedicated manual ArgoCD application at 4332c39 after server dry-run/diff.
Sync succeeded, but ESO validation fails with 403 on auth/token/lookup-self.
Prepared narrow self-token lookup/read and revoke/update amendment at Platform
e84b68d, consistent with existing ESO readers. Fourteen helper tests pass.
Founder approved the exact two self-token permissions; Platform bbb016f records
the amended approval. Fresh attended execution is pending. Native delivery is
not ready and the lifecycle service has not been rolled out.

## Native custody and production-data restore ready — 2026-10-04

Amended attended metadata and all native requester proofs passed. KeyCape
requires Basic client authentication; fixed requester at 03f18d8 with regression
coverage for special-character encoding. Final image 804d89fb passes 664 tests/
one skipped, 13 container checks, zero HIGH/CRITICAL scan and server dry-run.
Production online snapshot restore into a separate offline volume migrated
schema 2 to 5 preserving 24 submissions/158 delivered outbox rows. Protected
off-cluster snapshot retained; refresh during cutover. Proof resources removed.

Requester metadata approval is complete. T07 still awaits exact service/PDP/
worker cutover approval and subsequent native agent-human-agent acceptance.
Issuer rotation is separately governed under Platform's lane contract and was
not performed or claimed by the initial delivery proof.

## Approved production cutover — 2026-10-05

Founder approved packet 70dc3b9 (decision d2eaa2e9-6d11-4676-a07f-e3b7e59a88e3).
Public traffic was briefly closed, a final consistent schema-2 snapshot retained
off-cluster (SHA-256 b0346c42434cdc375eaa591f4bffeb62b9b2e19bf589a92501c96626142670e6),
and owner Helm releases deployed before the schema-5 service. Public health and
readiness pass after reopening. All 24 confirmed prior submissions survive.
The actual receiving requester projection is read-only 0440 and signed
create-only exchange passes. Platform delivery is accepted; separate issuer
rotation evidence is tracked as RPF-IN-0004, not authorized by this cutover.

Manual, pinned Argo applications own the service and private State Hub dispatcher.
The worker's native startup exposed Kubernetes inherited setgid; State Hub
1321361 adds a same-image non-root queue initializer, with nine regression tests.
It normalizes only an empty owned 2700 directory; existing unsafe/nonempty custody
is refused. Public ingress still targets only the browser listener.

Native selected-workload operations registered two records, recorded research,
evaluation and comment, revised and published one record, then queued its retained
review envelope. Missing credentials, crossed audiences and an unregistered
service account with the correct audience return 401; public API routes return
404. All four deployment templates/generations remain unchanged across the
decision operations and controlled service/dispatcher pod recreation. Retrieval
returns revision 2 and the same receipt; re-enqueue is replay with one delivered
queue row, not a second approval. Independent Audit Core counts match, pending 0.

Review memo: review-0d55a416-178c-46f5-b74b-b9b668390448; Approval Engine id:
22b30fe7-c565-46f2-8193-d8875975ad9e. Native notification and memo-posed delivery
are settled. Human disposition remains pending; no agent acceptance is claimed.
Evidence: docs/evidence/2026-10-05-lifecycle-cutover/. T07 stays in progress;
broader browser profiles and unresolved spec items remain in T02/T05/T06.

## Native acceptance complete — 2026-10-05

The human accepted at 2026-10-04T22:17:19Z. Native entry correlation:
approval 22b30fe7-c565-46f2-8193-d8875975ad9e, presentation
pres-484c0ef3-0a87-4dbf-aa30-05fd21e19c91, disposition
disp-85ddaab7-8c8d-4bf3-8d39-e0e3c28c1c16, source revision 2.
The selected workload retrieved confirmation; Audit Core counts match and
lifecycle pending is zero. T03/T04/T06/T07 are done for the admitted initial
audience. T02 and T05 remain active for the named broader contracts and UI work.
The first reported review error was a truncated URL missing its final UUID
segment; the complete link passed read, acknowledgment and acceptance checks.

## Browser authoring and retained handoff — 2026-10-05

T05 now implements explicit approval/discussion drafts, immutable supporting
text documents and required acknowledgments, document-aware revision comparison,
and preparation/download of the exact retained review request. T02's service
and HTTP contracts include exact-version handoff retrieval using the existing
events authorization. No additional permission or database migration is needed.
The admitted State Hub workload still submits the request; preparing it does not
create an approval or bind a human. Historical exports remain retrievable while
stale intake is refused. Existing forms retain their previous draft semantics.

Validation: 669 passed, one skipped with actual owner components; final focused
checks 50 passed, two optional checks skipped; Chromium 16 checks passed with
synthetic identity, including mobile and desktop inspection. Evidence is retained
in docs/evidence/2026-10-05-lifecycle-authoring/. This source increment is not yet
released; production remains on the accepted initial cutover image. T02/T05 stay
in progress for broader contracts and attribute-based legacy review discovery.

## Authoring deployed; discovery continuation — 2026-10-05

Founder explicitly requested deployment and the remaining implementation.
ADMINISTER @ realm:kubernetes/railiance01, activation=APPROVED. Authoring image
79aabf37 is live through Argo source dfcef87 and Platform pin 0189965. Both health
endpoints and Argo Synced/Healthy pass. Fresh backup/isolated restore preserved
25 confirmed submissions, 174 delivered outbox rows, two records/nine events.
Native selected-workload GET retrieves the exact retained handoff and confirms
the prior human disposition. No new human acceptance is fabricated.

T02 now records explicit initial contracts in LifecycleAdmissionBoundary.md.
Expansion residuals have live records INFD-WP-0008-T01 through T04: external
identity/publication, connectors/retention controls, non-approval binding, optional
Hub write-back. T05 implements named-recipient review discovery in the consumer
and Access Engine FLEX-WP-0034 v13, with fresh read/act checks retained. Validation
671 passed, one skipped; 32 owner embedded policy checks plus owner regressions.
Discovery release and final native checks remain in progress.

## Initial production scope complete — 2026-10-05

T05 discovery is deployed with source 9207a51, service image 7f5c6cb2 and owner
v13 image 6c6dc263/Helm revision 13. Native caller policy replay confirms named
recipient list, other-recipient denial and stale-read denial. Existing human
acceptance remains confirmed and retrievable by the admitted State Hub workload.
Public health/readiness pass, private API paths return 404 publicly, store counts
remain intact and Argo is Synced/Healthy. No new human answer is claimed.

All seven tasks are complete for the selected initial production audience and
organizational approval profile. Residuals were created before closure as
INFD-WP-0008-T01/T02/T03/T04. Platform issuer rotation remains RPF-IN-0004.
Evidence: docs/evidence/2026-10-05-lifecycle-discovery/.