Retire stale decision placeholder ownership before lifecycle cutover

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a10780-6d41-7952-9718-dfbc1f41236f

docs/informed-decision-origin.md

@@ -1,3 +1,18 @@
+# Current origin ownership — 2026-10-04
+
+The founder approved INFD-WP-0007 lifecycle cutover. Runtime Deployment, Service,
+PVC, config and workload routes are owned by informed-decision deploy/lifecycle
+through a pinned manual ArgoCD application. This repository retains Namespace,
+Ingress, HTTPS redirect and certificate. The obsolete placeholder deployment
+definition is removed so reapplying the origin cannot revert the service.
+
+Use railiance01 (92.205.62.239), not the retired config-hosteurope tunnel. Runtime
+recovery follows informed-decision/deploy/lifecycle/README.md; never reintroduce
+the placeholder or downgrade a schema-5 database with an older image. Existing
+Ingress remains one Prefix route to informed-decision:80.
+
+The record below is founding origin history, not the current recovery procedure.
+
 # decisions.coulomb.social — origin for the informed-decision approver surface
 
 **Status:** applied and live. `https://decisions.coulomb.social/` answers 200

manifests/informed-decision-origin.yaml

@@ -1,173 +1,8 @@
-# Origin holder for decisions.coulomb.social.
-#
-# `informed-decision` (INFD-WP-0001-T07) must publish an exact OIDC redirect URI
-# to key-cape: https://decisions.coulomb.social/auth/callback. Redirect URIs match
-# byte-exactly at /authorize, so the origin has to be real before the registration
-# is submitted — a host that resolves but does not answer over TLS fails the same
-# way a wrong hostname does, only later and less legibly.
-#
-# The approver UI itself does not exist yet (INFD-WP-0001-T08, the walking
-# skeleton, is still gated on approval-engine and on intake INFD-IN-0003). This
-# placeholder exists solely so the host answers and cert-manager can issue.
-# When the real surface lands it replaces this Deployment/Service behind the same
-# Service name, and this file shrinks to the Namespace.
+# Runtime is owned by informed-decision deploy/lifecycle under its manual ArgoCD app.
+# This origin owner retains only namespace, ingress, redirect and certificate.
 apiVersion: v1
 kind: Namespace
 metadata:
   name: informed-decision
   labels:
     app.kubernetes.io/part-of: informed-decision
----
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: informed-decision-placeholder
-  namespace: informed-decision
-  labels:
-    app.kubernetes.io/name: informed-decision
-    app.kubernetes.io/component: placeholder
-data:
-  index.html: |
-    <!doctype html>
-    <html lang="en">
-      <head>
-        <meta charset="utf-8">
-        <meta name="viewport" content="width=device-width, initial-scale=1">
-        <meta name="robots" content="noindex, nofollow">
-        <title>Decisions — Railiance</title>
-        <style>
-          :root { color-scheme: light dark; }
-          body {
-            margin: 0; min-height: 100vh;
-            display: flex; align-items: center; justify-content: center;
-            font: 16px/1.6 system-ui, -apple-system, "Segoe UI", sans-serif;
-            background: #f7f7f5; color: #1a1a19;
-          }
-          @media (prefers-color-scheme: dark) {
-            body { background: #14140f; color: #e8e8e3; }
-          }
-          main { max-width: 34rem; padding: 2rem 1.5rem; }
-          h1 { font-size: 1.5rem; margin: 0 0 .5rem; }
-          p { margin: 0 0 .75rem; }
-          .eyebrow {
-            text-transform: uppercase; letter-spacing: .08em;
-            font-size: .75rem; opacity: .6; margin-bottom: .25rem;
-          }
-        </style>
-      </head>
-      <body>
-        <main>
-          <p class="eyebrow">Railiance</p>
-          <h1>Decisions</h1>
-          <p>
-            This host is reserved for the <strong>informed-decision</strong>
-            approver surface. The service is not deployed yet.
-          </p>
-          <p>
-            The origin is live so that its OIDC redirect URI can be registered
-            against a host that actually answers.
-          </p>
-        </main>
-      </body>
-    </html>
-  # nginx serves the page on 8080 so the container needs no root.
-  default.conf: |
-    server {
-      listen 8080;
-      server_name _;
-      root /usr/share/nginx/html;
-      index index.html;
-      location = /healthz {
-        access_log off;
-        add_header Content-Type text/plain;
-        return 200 'ok';
-      }
-      location / {
-        try_files $uri $uri/ /index.html;
-      }
-    }
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: informed-decision
-  namespace: informed-decision
-  labels:
-    app.kubernetes.io/name: informed-decision
-    app.kubernetes.io/component: placeholder
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: informed-decision
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/name: informed-decision
-        app.kubernetes.io/component: placeholder
-    spec:
-      securityContext:
-        runAsNonRoot: true
-        runAsUser: 101
-        runAsGroup: 101
-        seccompProfile:
-          type: RuntimeDefault
-      containers:
-        - name: nginx
-          image: nginxinc/nginx-unprivileged:1.27-alpine
-          ports:
-            - name: http
-              containerPort: 8080
-          securityContext:
-            allowPrivilegeEscalation: false
-            readOnlyRootFilesystem: true
-            capabilities:
-              drop: [ALL]
-          readinessProbe:
-            httpGet: { path: /healthz, port: http }
-            initialDelaySeconds: 2
-            periodSeconds: 10
-          livenessProbe:
-            httpGet: { path: /healthz, port: http }
-            initialDelaySeconds: 10
-            periodSeconds: 30
-          resources:
-            requests: { cpu: 10m, memory: 24Mi }
-            limits: { memory: 64Mi }
-          volumeMounts:
-            - name: content
-              mountPath: /usr/share/nginx/html/index.html
-              subPath: index.html
-              readOnly: true
-            - name: content
-              mountPath: /etc/nginx/conf.d/default.conf
-              subPath: default.conf
-              readOnly: true
-            - name: cache
-              mountPath: /var/cache/nginx
-            - name: run
-              mountPath: /tmp
-      volumes:
-        - name: content
-          configMap:
-            name: informed-decision-placeholder
-        - name: cache
-          emptyDir: {}
-        - name: run
-          emptyDir: {}
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: informed-decision
-  namespace: informed-decision
-  labels:
-    app.kubernetes.io/name: informed-decision
-spec:
-  type: ClusterIP
-  selector:
-    app.kubernetes.io/name: informed-decision
-  ports:
-    - name: http
-      port: 80
-      targetPort: http