From 174095f91d9ee2240d770eb4390ca3acd38559e5 Mon Sep 17 00:00:00 2001 From: tegwick Date: Sun, 4 Oct 2026 23:54:29 +0200 Subject: [PATCH] Retire stale decision placeholder ownership before lifecycle cutover Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a10780-6d41-7952-9718-dfbc1f41236f --- docs/informed-decision-origin.md | 15 +++ manifests/informed-decision-origin.yaml | 169 +----------------------- 2 files changed, 17 insertions(+), 167 deletions(-) diff --git a/docs/informed-decision-origin.md b/docs/informed-decision-origin.md index d58a12c..6c35e31 100644 --- a/docs/informed-decision-origin.md +++ b/docs/informed-decision-origin.md @@ -1,3 +1,18 @@ +# Current origin ownership — 2026-10-04 + +The founder approved INFD-WP-0007 lifecycle cutover. Runtime Deployment, Service, +PVC, config and workload routes are owned by informed-decision deploy/lifecycle +through a pinned manual ArgoCD application. This repository retains Namespace, +Ingress, HTTPS redirect and certificate. The obsolete placeholder deployment +definition is removed so reapplying the origin cannot revert the service. + +Use railiance01 (92.205.62.239), not the retired config-hosteurope tunnel. Runtime +recovery follows informed-decision/deploy/lifecycle/README.md; never reintroduce +the placeholder or downgrade a schema-5 database with an older image. Existing +Ingress remains one Prefix route to informed-decision:80. + +The record below is founding origin history, not the current recovery procedure. + # decisions.coulomb.social — origin for the informed-decision approver surface **Status:** applied and live. `https://decisions.coulomb.social/` answers 200 diff --git a/manifests/informed-decision-origin.yaml b/manifests/informed-decision-origin.yaml index 377bbf8..6dca5a6 100644 --- a/manifests/informed-decision-origin.yaml +++ b/manifests/informed-decision-origin.yaml @@ -1,173 +1,8 @@ -# Origin holder for decisions.coulomb.social. -# -# `informed-decision` (INFD-WP-0001-T07) must publish an exact OIDC redirect URI -# to key-cape: https://decisions.coulomb.social/auth/callback. Redirect URIs match -# byte-exactly at /authorize, so the origin has to be real before the registration -# is submitted — a host that resolves but does not answer over TLS fails the same -# way a wrong hostname does, only later and less legibly. -# -# The approver UI itself does not exist yet (INFD-WP-0001-T08, the walking -# skeleton, is still gated on approval-engine and on intake INFD-IN-0003). This -# placeholder exists solely so the host answers and cert-manager can issue. -# When the real surface lands it replaces this Deployment/Service behind the same -# Service name, and this file shrinks to the Namespace. +# Runtime is owned by informed-decision deploy/lifecycle under its manual ArgoCD app. +# This origin owner retains only namespace, ingress, redirect and certificate. apiVersion: v1 kind: Namespace metadata: name: informed-decision labels: app.kubernetes.io/part-of: informed-decision ---- -apiVersion: v1 -kind: ConfigMap -metadata: - name: informed-decision-placeholder - namespace: informed-decision - labels: - app.kubernetes.io/name: informed-decision - app.kubernetes.io/component: placeholder -data: - index.html: | - - - - - - - Decisions — Railiance - - - -
-

Railiance

-

Decisions

-

- This host is reserved for the informed-decision - approver surface. The service is not deployed yet. -

-

- The origin is live so that its OIDC redirect URI can be registered - against a host that actually answers. -

-
- - - # nginx serves the page on 8080 so the container needs no root. - default.conf: | - server { - listen 8080; - server_name _; - root /usr/share/nginx/html; - index index.html; - location = /healthz { - access_log off; - add_header Content-Type text/plain; - return 200 'ok'; - } - location / { - try_files $uri $uri/ /index.html; - } - } ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - name: informed-decision - namespace: informed-decision - labels: - app.kubernetes.io/name: informed-decision - app.kubernetes.io/component: placeholder -spec: - replicas: 1 - selector: - matchLabels: - app.kubernetes.io/name: informed-decision - template: - metadata: - labels: - app.kubernetes.io/name: informed-decision - app.kubernetes.io/component: placeholder - spec: - securityContext: - runAsNonRoot: true - runAsUser: 101 - runAsGroup: 101 - seccompProfile: - type: RuntimeDefault - containers: - - name: nginx - image: nginxinc/nginx-unprivileged:1.27-alpine - ports: - - name: http - containerPort: 8080 - securityContext: - allowPrivilegeEscalation: false - readOnlyRootFilesystem: true - capabilities: - drop: [ALL] - readinessProbe: - httpGet: { path: /healthz, port: http } - initialDelaySeconds: 2 - periodSeconds: 10 - livenessProbe: - httpGet: { path: /healthz, port: http } - initialDelaySeconds: 10 - periodSeconds: 30 - resources: - requests: { cpu: 10m, memory: 24Mi } - limits: { memory: 64Mi } - volumeMounts: - - name: content - mountPath: /usr/share/nginx/html/index.html - subPath: index.html - readOnly: true - - name: content - mountPath: /etc/nginx/conf.d/default.conf - subPath: default.conf - readOnly: true - - name: cache - mountPath: /var/cache/nginx - - name: run - mountPath: /tmp - volumes: - - name: content - configMap: - name: informed-decision-placeholder - - name: cache - emptyDir: {} - - name: run - emptyDir: {} ---- -apiVersion: v1 -kind: Service -metadata: - name: informed-decision - namespace: informed-decision - labels: - app.kubernetes.io/name: informed-decision -spec: - type: ClusterIP - selector: - app.kubernetes.io/name: informed-decision - ports: - - name: http - port: 80 - targetPort: http