the-custodian/docs/changes/netkingdom-target-2026-10-16/access-native-plan-review-next/execution-supplement.md

Access native execution proposal supplement

Existing owner work: FLEX-WP-0024-T06. Proposal FLEX24-SIGNER-ROLLOUT-20261016-R1, frozen rollout R2 and Platform packet P4. This supplement completes the Access plan review; it grants no live action and changes no frozen resource, custody scope or protected effect.

Use the exact stop/ready argv in frozen R2 command-plan.proposed.json, with one verified materialized source root at Access dc042022f7c30671cf0a7605cf43ef6d96d04242 and the frozen rollout directory. Verify every archived source/value/render digest first. Image remains independently pinned to 84c78e072c8f3daf2bc3b90f8efc8fbeb16c3cf0 / OCI sha256:09a83b273740133518cc7e7915fb211381e06545d347d2dd1974042525ac981f. No source change or new image is required by this review.

Actual writer paths and the maintenance acknowledgement

Access's writer is the operator executing Helm against release flex-auth-secrets-engine in namespace flex-auth, selecting charts/flex-auth, values/secrets-engine.yaml and the exact stopped/activation overlay. Access/founder acknowledgement must name the executor, absolute start/end, no competing manual Helm/scale/rollout/apply for this release, no in-flight release operation, prior Helm revision/status, and restoration criteria. That acknowledgement establishes the bounded manual window; it does not require proving absence of hypothetical writers across the estate.

Reviewed source has three CI workflows: .forgejo/workflows/image.yaml publishes immutable images using tools/publish-runtime-images.sh; .forgejo/workflows/ci-smoke.yaml probes runners; .github/workflows/ci.yml runs source checks. None performs a workload Helm upgrade or kubectl apply. Do not invent a CI deployment controller or disable unrelated image publication. For any additional actual deployment job identified by the executor, record its job/revision/prior state and hold it for this release during the window.

The dated preflight has no HPA, Job, CronJob, DaemonSet or StatefulSet in flex-auth. The existing Deployment and its UID-owned ReplicaSets remain the known pod writers; keep Kubernetes reconciliation active to implement replicas zero. Platform independently identifies and holds the affected Argo Application sync writers, records their prior state and absence of an in-flight sync, and restores them through its own criteria. Access does not claim that owner disposition. Refresh these known paths at window entry; new actual competing state requires reconciliation before advancing.

deploy/README.md emergency kubectl apply / rollout undo instructions refer to tenant/user consumers. railiance/app.toml generic Helm rollback, canary and previous-stable pins also cover other releases. None is the signer rollback recipe. Tenant/user/canary/readback/informed-decision workloads stay outside this change.

Stop, start and recovery decisions

1. Verify the completed exact founder and owner scope, consumer fence, target identity and current nonsecret release metadata. The existing public receipt admits all seven exact resources through server dry-run, with exact source projection; it observes the old running unsigned 05a workload at Helm revision 4. It does not install the stopped candidate or reserve a window. Do not use revision 4 as the ready transition's rollback target.
2. Start the stop clock immediately before the frozen stop invocation. Use reset-values/no-hooks/wait=false, without atomic. Within 120 seconds establish the installed candidate Deployment replicas zero, observedGeneration caught up, zero desired/status replicas across its UID-owned ReplicaSets, no live or terminating owned/signer-SA/seed-mount pods and no new actual competing writer. Compare the stopped native projection with 8ce375f065552c551538f3acc7300c427407057eeff1d0b43755bfdf8a46169c. Record the new exact deployed stopped Helm revision and its metadata/projection. A Pending WFFC claim is allowed. If stop fails or its state is unknown, keep consumers fenced, do not invoke custody, preserve the partial outcome and reconcile observed state; never auto-start the predecessor.
3. Hold the acknowledged window and repeat the stopped fence/projection immediately before Platform's independently approved custody CAS. Custody key/trust/caller admission, founder identity/expiry and actual window remain unresolved here. Ambiguous custody outcomes preserve evidence and remain fenced; no retry/remint authorization follows.
4. Before start verify the recorded stopped revision is still the latest deployed release, exact candidate configuration matches and no intervening Helm operation exists. The ready command's --atomic --wait --timeout 120s may roll back only to this exact stopped revision. Keep protected consumers fenced. Start an independent readiness clock immediately before the ready invocation: Ready must be observed within 120 seconds including WFFC provisioning/startup. Helm may spend additional time performing its automatic rollback; its return is not proof that the 120-second readiness gate passed. Do not issue a competing Helm stop/rollback while that operation is in flight or assume killing the client cancels server changes. Observe and reconcile the resulting release/workload state before another mutation.
5. A stop/readiness failure or unknown outcome triggers the named abort owner/founder recovery decision within 600 seconds of the failure/deadline, or earlier if the absolute admitted window expires. This is a decision deadline, not permission to restart after expiry or an availability guarantee. The safe decision is continued consumer fence and stopped/unavailable signer; record any unresolved live pod explicitly. No deadline extends custody, trust or action authority.
6. If the ready failure's automatic rollback did not demonstrably restore the stopped state, an independently authorized recovery invocation may use the exact frozen stop command against the same candidate source/config, after the prior Helm operation is reconciled. This resets replicas zero with no waiting on an unbound claim. If an explicit Helm history rollback is chosen instead, verify its recorded target below and retain the same independent 120-second stop observation. Neither path may target revision 4/current05a by assumption.

Explicit history rollback argument shape (not ready for execution until STOPPED_REVISION is observed and approved):

["helm", "rollback", "flex-auth-secrets-engine", "STOPPED_REVISION", "--namespace", "flex-auth", "--wait=false", "--timeout", "120s", "--no-hooks"]

Before this invocation compare the exact target revision to the stopped source projection, immutable image, policy/registry, signing coordinates, PVC and zero replicas using a reviewed allowlisted metadata/projection path. No raw release values, Secret objects, annotations, logs or unfiltered errors enter receipts. No force, cleanup-on-fail, uninstall, delete, cursor reset, unsigned fallback, seed restore or CAS replay. Failed or partial rollback is retained as such; no success by command return alone.

Persistence and acceptance

Recreate, replicas at most one and Linux nonblocking flock provide complementary source controls. Flock is acquired before outbox recovery and held until Close/process exit; deleting writer.lock, recreating paths or bypassing the process would invalidate exclusion. RWO is not a process lock. Native restart, sequence/cursor/signature parity and isolated lock/capacity/unwritable/fsync negative receipts remain acceptance gates; this review does not authorize destructive failure injection against the sole production journal. Their eventual exact safe execution procedure requires separate scoped review.

The journal ceiling is 67108864 bytes, record/atomic batch bound 2097152 bytes and cursor bound 4096 bytes. Commit failure prevents release of every effect; unconfirmed truncate/fsync recovery fences the writer. The 1Gi local-path request is not a hard quota or backup. WFFC binding must produce exact PVC UID/PV name/UID/claimRef/capacity/nodeAffinity; cluster owner separately authorizes and verifies Retain before durable acceptance. Preserve claim, PV, journal, cursor, signatures and receipts across every stop or rollback. No evidence migration to unsigned05a is approved.

Ready and /healthz only prove process availability. Before protected acceptance, require independently admitted public trust/delivery/caller; native lifecycle ALLOW/DENY records and installed Secrets verification; forged/altered/unsigned/wrong-pin/expired/caller negatives; preserved restart evidence and the separately admitted negative tests. No task source is enabled, execute-ccr remains denied, no backend effect or audit receiver acceptance is claimed. EUR0 source review is established; actual spend/risk-loss/outage/evidence-loss authority and all five final external dispositions remain absent.