railiance-apps/docs/informed-decision-origin.md

# Current origin ownership — 2026-10-04

The founder approved INFD-WP-0007 lifecycle cutover. Runtime Deployment, Service,
PVC, config and workload routes are owned by informed-decision deploy/lifecycle
through a pinned manual ArgoCD application. This repository retains Namespace,
Ingress, HTTPS redirect and certificate. The obsolete placeholder deployment
definition is removed so reapplying the origin cannot revert the service.

Use railiance01 (92.205.62.239), not the retired config-hosteurope tunnel. Runtime
recovery follows informed-decision/deploy/lifecycle/README.md; never reintroduce
the placeholder or downgrade a schema-5 database with an older image. Existing
Ingress remains one Prefix route to informed-decision:80.

The record below is founding origin history, not the current recovery procedure.

# decisions.coulomb.social — origin for the informed-decision approver surface

**Status:** applied and live. `https://decisions.coulomb.social/` answers 200
over a valid Let's Encrypt certificate as of 2026-09-10 14:32 UTC.
Last reviewed: 2026-09-10

## Why this host exists before the app does

`informed-decision` owns the browser-facing approver UI that `approval-engine`
deliberately does not contain. Its workplan task `INFD-WP-0001-T07` must publish two strings to `key-cape` — an
OIDC `client_id` and a full callback URI — and cannot do so against a host that
does not answer.

**Correction, 2026-09-11.** An earlier version of this document said the origin
unblocks `key-cape`'s `KEY-WP-0013-T02`, "blocked since 2026-09-08". That is
wrong twice over, and the error came from repeating `informed-decision`'s
workplan prose of 2026-09-09 without checking the source repo. `KEY-WP-0013-T02`
is `done`; so is `T05`, the task that actually carried the human registration.
`key-cape` published the contract shape from its side — including the
`approval:read` scope `informed-decision` asked for and a fix to the `assurance`
object's `at` field — and closed a follow-up (`KEY-WP-0030`) that
`informed-decision` prompted. **Nothing in `key-cape` is waiting on this host.**
What remains is `informed-decision`'s own `T07`, whose acceptance requires the
real origin regardless.

Both strings are now fixed except for the host:

| Field | Value |
| --- | --- |
| `client_id` | `informed-decision-approver` |
| Redirect URI | `https://decisions.coulomb.social/auth/callback` |
| Flow | authorization code + S256 PKCE, public client |
| Scopes | `openid`, `approval:read`, `approval:approve` |

Redirect URIs match byte-exactly at `/authorize`. A registration pointing at a
host that does not answer fails closed at first login and presents as a rejected
approval rather than as a registration defect — which is exactly the failure
`approval-engine` avoided by refusing to invent these strings. So the origin has
to be real before the registration is submitted, and that is S5 work here rather
than in `informed-decision`.

The approver UI itself is `INFD-WP-0001-T08`, still gated on `approval-engine`
`APPROVAL-WP-0002-T01` and on intake `INFD-IN-0003` (the evidence copy must reach
`audit-core` independently of this component). This host therefore ships a
placeholder first and the real surface later.

## What is in the repo

| File | Contents |
| --- | --- |
| `manifests/informed-decision-origin.yaml` | Namespace, placeholder nginx ConfigMap/Deployment/Service on `informed-decision:80` |
| `manifests/informed-decision-ingress.yaml` | Traefik Ingress + `letsencrypt-prod` certificate for `decisions.coulomb.social` |
| `manifests/informed-decision-http-redirect.yaml` | `redirectScheme` Middleware + `web`-entrypoint Ingress, HTTP → HTTPS |

The placeholder is `nginxinc/nginx-unprivileged`, read-only root filesystem,
non-root, `noindex`. When the real surface lands it takes over the same Service
name and the origin file shrinks to the Namespace.

## Deliberate single path rule

The Ingress carries exactly one rule: `/` Prefix to one backend.

`reuse-surface` reported on 2026-07-07 that an Ingress declaring an `Exact`
`/health` rule alongside a catch-all `/` Prefix rule on the same host had the
exact match swallowed by the catch-all — the public health URL returned 404 from
the landing container while the pod was `1/1 Ready` and its own probes passed.
Splitting `/auth`, `/api` and `/` across backends here would reproduce that on a
host whose whole purpose is an exact-match redirect URI. If a second backend ever
becomes necessary, set `traefik.ingress.kubernetes.io/router.priority`
explicitly rather than relying on rule order.

## Preconditions verified 2026-09-10

- DNS `decisions.coulomb.social` → `92.205.62.239` (same A record as `reuse`).
- `letsencrypt-prod` ClusterIssuer `Ready=True`.
- No existing Ingress claims `decisions.coulomb.social`.
- Server-side dry-run of all five objects against the live API is clean.
  The namespaced four were validated against an existing namespace, since a
  server dry-run cannot create the new one first; see
  `DRY_RUN_CREATE_NAMESPACES` in `tools/k8s-server-dry-run.sh`.

## Deployed 2026-09-10

Applied with operator approval. Evidence:

| Check | Result |
| --- | --- |
| Placeholder pod | `1/1 Running`, `/healthz` → `ok` in-pod |
| Certificate `informed-decision-tls` | `Ready=True`, ACME order `valid` |
| Issuer / subject | `CN=decisions.coulomb.social`, Let's Encrypt `YR2` |
| Validity | `2026-09-10` → `2026-12-09` (cert-manager renews) |
| `GET https://decisions.coulomb.social/` | `HTTP/2 200`, chain verify `0` |
| `GET https://decisions.coulomb.social/auth/callback` | `200` — the exact redirect URI resolves |
| `GET http://decisions.coulomb.social/` | `301`/`308` → HTTPS (added 2026-09-10) |

`/auth/callback` currently returns the placeholder page via the SPA `try_files`
fallback. That is the correct behaviour for now: the origin answers, which is
what the registration needs. The real surface will handle the path when
`INFD-WP-0001-T08` ships.

**`informed-decision` can now submit `docs/keycape-client-registration.md` to
`key-cape`.** That closes its own `INFD-WP-0001-T07`, not a `key-cape` task —
see the correction above.

## Redeploy / recovery

```bash
export KUBECONFIG=$HOME/.kube/config-railiance01
kubectl apply -f manifests/informed-decision-origin.yaml
kubectl apply -f manifests/informed-decision-ingress.yaml
kubectl apply -f manifests/informed-decision-http-redirect.yaml
kubectl -n informed-decision get pods,svc,ingress
kubectl -n informed-decision get certificate informed-decision-tls -w
curl -sSI https://decisions.coulomb.social/ | head -1
```

That `curl` succeeded on 2026-09-10, which is the gate `informed-decision` was
waiting on.

**Note on the kubeconfig:** use `~/.kube/config-railiance01`, which targets the
`k3s-api-railiance01` ops-bridge tunnel on `16444`. The retired
`~/.kube/config-hosteurope` names port `16443`; `bridge check` reports the tunnel
healthy either way, so it does not surface that mismatch.

## HTTP → HTTPS

`manifests/informed-decision-http-redirect.yaml` adds a `redirectScheme`
Middleware plus a `web`-entrypoint Ingress, following the `reuse-surface`
pattern. Applied 2026-09-10.

`http://decisions.coulomb.social/` now returns `308` to HEAD and `301` to GET.
That split is not a defect in this configuration — `reuse.coulomb.social`, which
uses the identical Middleware, behaves the same way. It is Traefik's own
behaviour on this cluster.

The main Ingress stays `websecure`-only; this is a second router on port 80
rather than a change to the first.

### Router priority is load-bearing here

cert-manager solves HTTP-01 by creating a temporary solver Ingress on **this
same host and this same `web` entrypoint**, serving
`/.well-known/acme-challenge/<token>`. A catch-all `/` redirect on that
entrypoint competes with it directly.

Traefik would normally settle this by rule length — the solver's `Path` rule is
much longer than `PathPrefix(/)` — but `reuse-surface`'s 2026-07-07 report is
precisely a case of a specific rule losing to a catch-all when precedence was
left implicit. There the symptom was a 404 someone noticed within the day. Here
it would be a **silently failed renewal about 60 days out**, surfacing as an
expired certificate on the origin backing an OIDC redirect URI — the kind of
failure that presents as a broken login rather than as an expired cert.

So the redirect router pins `traefik.ingress.kubernetes.io/router.priority: "1"`.
Any solver router, using the default computed priority, outbids it.

**Verified by probe, twice, on 2026-09-10.** A throwaway Ingress mimicking the
solver shape (`web` entrypoint, `Exact` acme-challenge path, default priority)
was applied and the challenge path was polled:

| Condition | `/.well-known/acme-challenge/<token>` | `/` |
| --- | --- | --- |
| No solver present | `301` (redirect catches it — correct) | `301` |
| Solver present | `200` (**solver wins**) | `301` |
| Solver removed | `301` | `301` |

Traefik takes 30–60s to converge on Ingress changes, so the flip is not
instant; poll rather than reading a single response. The probe was deleted after
each run and is not in the repo — recreate it from this table if the redirect
or the priority annotation is ever changed.

The next real renewal is due around 2026-11-09. Confirm the certificate's
`notAfter` advances then; that is the only test that exercises the real solver
rather than a probe of its shape.