coulomb/railiance-apps
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

deploy(informed-decision): decisions.coulomb.social live with issued certificate
Some checks failed
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Has been cancelled
Details

Browse source 
Applied the origin manifests with operator approval. Placeholder pod 1/1,
cert-manager issued CN=decisions.coulomb.social from Let's Encrypt (valid to
2026-12-09), and https://decisions.coulomb.social/auth/callback returns 200 over
a verified chain.

This clears step 1 of INFD-WP-0001-T07's dependency table, which has blocked
key-cape's KEY-WP-0013-T02 since 2026-09-08.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EJbh7o7UWF4tQ5jxygnNGu

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 2072522@bnt-lap001
Assistant-Session: 46173adf-7302-4ede-99d6-963b61359928
This commit is contained in:
tegwick 2026-09-10 16:34:24 +02:00
parent c5546ac729
commit 7c2e51ade6
1 changed files with 26 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

30
docs/informed-decision-origin.md
View file

@ -1,6 +1,7 @@
# decisions.coulomb.social — origin for the informed-decision approver surface
**Status:** manifests written and dry-run clean; **not applied**.
**Status:** applied and live. `https://decisions.coulomb.social/` answers 200
over a valid Let's Encrypt certificate as of 2026-09-10 14:32 UTC.
Last reviewed: 2026-09-10
## Why this host exists before the app does
@ -65,7 +66,28 @@ explicitly rather than relying on rule order.
server dry-run cannot create the new one first; see
`DRY_RUN_CREATE_NAMESPACES` in `tools/k8s-server-dry-run.sh`.
## To deploy (operator approval required — not yet given)
## Deployed 2026-09-10
Applied with operator approval. Evidence:
| Check | Result |
| --- | --- |
| Placeholder pod | `1/1 Running`, `/healthz` → `ok` in-pod |
| Certificate `informed-decision-tls` | `Ready=True`, ACME order `valid` |
| Issuer / subject | `CN=decisions.coulomb.social`, Let's Encrypt `YR2` |
| Validity | `2026-09-10` → `2026-12-09` (cert-manager renews) |
| `GET https://decisions.coulomb.social/` | `HTTP/2 200`, chain verify `0` |
| `GET https://decisions.coulomb.social/auth/callback` | `200` — the exact redirect URI resolves |
`/auth/callback` currently returns the placeholder page via the SPA `try_files`
fallback. That is the correct behaviour for now: the origin answers, which is
what the registration needs. The real surface will handle the path when
`INFD-WP-0001-T08` ships.
**`informed-decision` is unblocked to submit `docs/keycape-client-registration.md`
to `key-cape` and close `KEY-WP-0013-T02`.**
## Redeploy / recovery
```bash
export KUBECONFIG=$HOME/.kube/config-hosteurope
@ -76,8 +98,8 @@ kubectl -n informed-decision get certificate informed-decision-tls -w
curl -sSI https://decisions.coulomb.social/ | head -1
```
Only when that `curl` succeeds does `informed-decision` submit
`docs/keycape-client-registration.md` to `key-cape`.
That `curl` succeeded on 2026-09-10, which is the gate `informed-decision` was
waiting on.
**Note on the kubeconfig:** `~/.kube/config-hosteurope` names port `16443`, but
the `k3s-api-railiance01` ops-bridge tunnel currently listens on `16444`.