lcp-reference-platform 1.0.0__tar.gz

lcp_reference_platform-1.0.0/.gitignore

@@ -0,0 +1,16 @@
+# macOS
+.DS_Store
+
+# Local tooling artifacts — never published
+.gitnexus/
+.claude/
+graphify-out/
+CLAUDE.md
+.hermes.md
+*.pyc
+__pycache__/
+
+# Local platform/runtime state
+.venv/
+data/
+*.sqlite3

lcp_reference_platform-1.0.0/Dockerfile

@@ -0,0 +1,33 @@
+FROM python:3.12-alpine@sha256:78098ea6a3a9c6a7727a5d4674e4a44e57e01fac878ee9cb4d24a86bd93916ff
+
+ENV PYTHONDONTWRITEBYTECODE=1 \
+    PYTHONUNBUFFERED=1 \
+    PIP_DISABLE_PIP_VERSION_CHECK=1 \
+    PIP_NO_CACHE_DIR=1 \
+    LCP_SCHEMA_DIR=/app/schemas \
+    LCP_DATABASE_PATH=/app/data/lcp.sqlite3 \
+    LCP_HOST=0.0.0.0 \
+    LCP_PORT=8080
+
+WORKDIR /app
+
+COPY schemas /app/schemas
+COPY verticals /app/verticals
+COPY examples/sandbox /app/examples/sandbox
+COPY implementations/reference-platform /app/implementations/reference-platform
+
+RUN python -m pip install --no-cache-dir --upgrade pip 'setuptools>=78.1.1' \
+    && python -m pip install --no-cache-dir -e '/app/implementations/reference-platform[production]' \
+    && adduser -D -u 10001 -h /home/lcp -s /sbin/nologin lcp \
+    && mkdir -p /app/data \
+    && chown -R lcp:lcp /app/data /app/implementations
+
+# The image has no compiler toolchain or application build dependencies. The
+# Kubernetes example additionally enforces read-only rootfs, no privilege
+# escalation, and zero Linux capabilities.
+USER lcp
+
+EXPOSE 8080
+STOPSIGNAL SIGTERM
+
+CMD ["lcp-platform"]

lcp_reference_platform-1.0.0/PKG-INFO

@@ -0,0 +1,22 @@
+Metadata-Version: 2.5
+Name: lcp-reference-platform
+Version: 1.0.0
+Summary: Production-oriented reference platform and router for LCP Lead Context Protocol deployments.
+Project-URL: Documentation, https://github.com/SpearSystems/LCP
+Project-URL: Source, https://github.com/SpearSystems/LCP
+License-Expression: Apache-2.0
+Requires-Python: >=3.10
+Requires-Dist: cryptography>=42.0.0
+Requires-Dist: httpx>=0.27.0
+Requires-Dist: jsonschema>=4.20.0
+Requires-Dist: referencing>=0.35.0
+Provides-Extra: object-storage
+Requires-Dist: boto3>=1.35.0; extra == 'object-storage'
+Requires-Dist: clamd>=1.0.2; extra == 'object-storage'
+Provides-Extra: postgres
+Requires-Dist: psycopg[binary]>=3.2; extra == 'postgres'
+Provides-Extra: production
+Requires-Dist: boto3>=1.35.0; extra == 'production'
+Requires-Dist: clamd>=1.0.2; extra == 'production'
+Requires-Dist: gunicorn>=23.0; extra == 'production'
+Requires-Dist: psycopg[binary]>=3.2; extra == 'production'

lcp_reference_platform-1.0.0/README.md

@@ -0,0 +1,248 @@
+# LCP Reference Platform
+
+Production-oriented reference HTTP platform and router for the Lead Context
+Protocol. It accepts publisher leads, applies buyer offers, runs the
+ping/bid/post flow, persists state, and delivers signed webhooks with retries.
+
+This is an implementation foundation, not a hosted exchange. Production
+operators must still provide TLS termination, secret management, database
+backups, observability, access control, retention policies, and deployment
+hardening.
+
+## Components
+
+- SQLite persistence for local/single-node use and a Postgres backend for multi-node production; replaceable through the `Store` boundary.
+- HTTP intake for `lead`, `call`, `bid`, and lifecycle `event` messages.
+- Declarative publisher form mapping with versioned brand/flow normalization and audit digests.
+- Encrypted out-of-band attachment upload/download for contracts, evidence, and call records, with a local AES-GCM backend and production S3-compatible/SSE-KMS adapter, residency controls, and fail-closed ClamAV scanning.
+- Structured call payable evaluation and per-offer monthly quota reporting.
+- JSON Schema and strict ping-safe validation.
+- Bearer API-key and HMAC authentication.
+- Deterministic offer matching and auction selection.
+- At-least-once buyer webhook delivery.
+- Standalone delivery worker for multi-process deployments.
+- WSGI entry point for a production HTTP process manager.
+- Admin CLI for credentials, offers, and controlled lead erasure.
+
+See [the implementation decisions](../../docs/IMPLEMENTATION-DECISIONS.md) for
+matching, signing, retry, and sandbox behavior. See the
+[supply-chain security guide](../../docs/SUPPLY-CHAIN-SECURITY.md) for package,
+image, and release controls, and the [container verification guide](../../docs/CONTAINER-SUPPLY-CHAIN.md)
+for signing, provenance, and admission enforcement.
+
+## Install
+
+From the repository root:
+
+```bash
+# Local/single-node profile.
+python3 -m pip install -e implementations/reference-platform
+export LCP_SCHEMA_DIR="$PWD/schemas"
+export LCP_DATABASE_PATH="$PWD/data/lcp.sqlite3"
+# Generate once, store securely, and reuse for this database:
+# python3 -c 'import base64,secrets; print(base64.urlsafe_b64encode(secrets.token_bytes(32)).decode())'
+export LCP_PII_ENCRYPTION_KEY="<persisted-urlsafe-base64-32-byte-key>"
+
+# Production profile.
+python3 -m pip install -e 'implementations/reference-platform[production]'
+export LCP_DATABASE_URL='postgresql://lcp_app:<password>@postgres.internal:5432/lcp?sslmode=verify-full'
+export LCP_PII_ENCRYPTION_KEY='<urlsafe-base64-32-byte-key>'
+```
+
+The package targets Python 3.10+. The `[production]` extra adds Gunicorn, Psycopg, boto3, and the ClamAV client
+for the Postgres/WSGI/object-storage deployment profile. Configure
+`LCP_ATTACHMENT_DIRECTORY`, `LCP_MAX_ATTACHMENT_BYTES`, and
+`LCP_ALLOWED_ATTACHMENT_CONTENT_TYPES` for the reference file backend. For
+multi-node production, use `LCP_ATTACHMENT_BACKEND=s3` with an SSE-KMS key,
+explicit residency, and a private ClamAV service; see
+[the attachment deployment guide](../../docs/MVA-ATTACHMENTS.md).
+
+## Validate a real Postgres deployment
+
+The repository's normal CI runs the reference-platform suite against a fresh
+Postgres 16 service, including encrypted intake, duplicate idempotency, and
+privacy erasure. To run the same test locally, provision an isolated
+throwaway database, install the Postgres extra, and set its URL:
+
+```bash
+python3 -m pip install -e 'implementations/reference-platform[production]'
+export LCP_TEST_POSTGRES_URL='postgresql://lcp_test:<password>@127.0.0.1:5432/lcp_test'
+PYTHONPATH=implementations/reference-platform \
+  python3 -m unittest discover -s implementations/reference-platform/tests -v
+```
+
+Never point the integration test at a shared or production database. The test
+creates its own uniquely named tenants and IDs but does not perform a full
+schema reset.
+
+## Configure credentials and offers
+
+Do not put production credentials in source control. For local setup, add a
+publisher and buyer credential with least-privilege scopes:
+
+```bash
+lcp-platform-admin credential upsert \
+  --sender-id publisher_001 \
+  --tenant-id publisher_tenant \
+  --scope lead:submit --scope lead:read \
+  --hmac-secret publisher-secret
+
+lcp-platform-admin credential upsert \
+  --sender-id buyer_001 \
+  --tenant-id buyer_tenant \
+  --scope bid:submit --scope lead:read \
+  --hmac-secret buyer-secret
+```
+
+Create an offer file:
+
+```json
+{
+  "offer_id": "mortgage-au",
+  "buyer_id": "buyer_001",
+  "active": true,
+  "routing_mode": "auction",
+  "vertical": "mortgage",
+  "countries": ["AU"],
+  "floor_price_cents": 1500,
+  "currency": "AUD",
+  "require_consent_evidence": true,
+  "require_verified_phone": true,
+  "reject_incentivized": true,
+  "max_spam_risk_score": 25,
+  "daily_cap": 100,
+  "ping_timeout_seconds": 30,
+  "webhook_url": "https://buyer.example/lcp/webhook"
+}
+```
+
+Validate and store it:
+
+```bash
+lcp-platform-admin offer upsert --file offer.json
+
+# Controlled privacy operation; verify the legal request and retain the audit record.
+lcp-platform-admin privacy erase-lead --lead-id lead_abc123 --actor-id privacy_operator
+```
+
+Offer management is intentionally an operator/admin concern. The public LCP
+surface exposes active offers through `GET /v1/lcp/offers`.
+
+## Run locally
+
+For a single-process local deployment, the HTTP server and delivery worker run
+together:
+
+```bash
+export LCP_REQUIRE_AUTH=true
+# Keep this key in a secret manager for any non-test deployment.
+# Generate once, store securely, and reuse for this database:
+# python3 -c 'import base64,secrets; print(base64.urlsafe_b64encode(secrets.token_bytes(32)).decode())'
+export LCP_PII_ENCRYPTION_KEY="<persisted-urlsafe-base64-32-byte-key>"
+lcp-platform
+```
+
+The default listener is `127.0.0.1:8080`. Configure `LCP_HOST`, `LCP_PORT`,
+and the other settings in `lcp_platform/config.py` through environment
+variables.
+
+## Production process layout
+
+For a production deployment, run the HTTP application and delivery worker
+under a process supervisor:
+
+```text
+TLS reverse proxy
+       ↓
+WSGI/HTTP application processes  ←→  shared database
+       ↑
+Delivery worker process
+```
+
+The WSGI entry point is `lcp_platform.wsgi:application`. With the
+`[production]` extra, a typical process command is:
+
+```bash
+gunicorn --bind 0.0.0.0:8080 --workers 3 --threads 4 \
+  --access-logfile - lcp_platform.wsgi:application
+```
+
+Run `lcp-platform-worker` as a separate supervised process. Place the
+application behind TLS; the included threaded server is intended for local
+operation and smoke tests.
+
+SQLite is appropriate for a single-node deployment or controlled starting
+point. Use a compatible production store implementation when operating at
+multiple nodes or high throughput.
+
+## HTTP endpoints
+
+| Method | Path | Purpose |
+|---|---|---|
+| `POST` | `/v1/lcp/leads` | Publisher lead intake (direct or offer-routed) |
+| `POST` | `/v1/lcp/calls` | Publisher call intake |
+| `POST` | `/v1/lcp/bids` | Buyer bid submission |
+| `POST` | `/v1/lcp/events` | Call outcomes and lifecycle/payable updates |
+| `POST` | `/v1/lcp/attachments` | Authenticated scanned/encrypted binary upload |
+| `GET` | `/v1/lcp/attachments/{attachment_id}` | Authenticated attachment download |
+| `GET` | `/v1/lcp/offers/{offer_id}/quota` | Monthly payable quota and pacing report |
+| `GET` | `/v1/lcp/leads/{lead_id}` | Lead status and lifecycle |
+| `GET` | `/health/live` | Unauthenticated process liveness |
+| `GET` | `/health/ready` | Database-backed readiness |
+| `GET` | `/v1/lcp/capabilities` | Capability discovery |
+| `GET` | `/v1/lcp/offers` | Active offer discovery |
+| `GET` | `/v1/lcp/schemas/{name}` | Schema discovery |
+
+The complete transport contract is [api/lcp-openapi.yaml](../../api/lcp-openapi.yaml).
+
+## Tenant and credential model
+
+Every sender has a tenant ID and scopes. Examples include `lead:submit`,
+`lead:read`, `bid:submit`, `event:submit`, `attachment:write`, `offer:read`,
+and `platform:admin`. Lead status is
+only visible to the submitting sender, an authorized buyer that received the
+lead, or a platform administrator. Offers are routed within the configured
+`LCP_ROUTING_TENANT_ID` and are not writable through participant endpoints.
+
+Production credentials should be mounted from a secret manager using
+`LCP_SECRETS_FILE`; the database-backed credential path is intended for local
+administration. Production startup also requires `LCP_PII_ENCRYPTION_KEY`, a
+URL-safe base64 encoding of a random 32-byte AES-GCM key. Persisted lead,
+ping, bid, post, and event envelopes are encrypted and authenticated before
+being written to SQLite or Postgres. Store that key in a KMS/HSM-backed secret
+manager and plan an explicit re-encryption migration before rotating it.
+
+## Authentication
+
+HMAC requests use:
+
+```text
+<timestamp>\n<idempotency-key>\n<raw-request-body>
+```
+
+The exact byte sequence is signed with HMAC-SHA256. Requests carry
+`X-LCP-Timestamp`, `X-LCP-Idempotency-Key`, `X-LCP-Signature`, and
+`X-LCP-Sender-Id`. The default replay window is five minutes.
+
+Bearer requests use `Authorization: Bearer <token>` and still carry the
+sender and idempotency headers for mutating operations.
+
+## Package publishing
+
+A repository-level GitHub Actions workflow can publish the SDK, MCP adapter,
+and reference platform to PyPI through Trusted Publishing on `v*` tags. Each
+package must first be configured as a PyPI Trusted Publisher; no long-lived
+PyPI token is stored in the repository.
+
+## Sandbox parity
+
+The Docker sandbox uses this same platform package, schemas, matcher, auth,
+and delivery worker. It uses a separate test database and should only receive
+synthetic test messages marked with `X-LCP-Test: true` and envelope `test: true`.
+
+```bash
+docker compose -f implementations/reference-platform/docker-compose.yml up --build
+```
+
+See [examples/sandbox/README.md](../../examples/sandbox/README.md) for a
+publisher/offer/buyer smoke test.

lcp_reference_platform-1.0.0/docker-compose.yml

@@ -0,0 +1,34 @@
+services:
+  lcp-platform-sandbox:
+    build:
+      context: ../..
+      dockerfile: implementations/reference-platform/Dockerfile
+    environment:
+      LCP_DATABASE_PATH: /app/data/sandbox.sqlite3
+      LCP_REQUIRE_AUTH: "false"
+      LCP_TEST_MODE: "true"
+      LCP_ALLOW_INSECURE_WEBHOOKS: "true"
+      LCP_PLATFORM_ID: sandbox_platform
+      LCP_SCHEMA_DIR: /app/schemas
+    command: >-
+      sh -c "lcp-platform-admin credential upsert --sender-id buyer_sandbox
+      --hmac-secret sandbox-buyer-secret &&
+      lcp-platform-admin offer upsert --file /app/examples/sandbox/offer.json &&
+      lcp-platform"
+    ports:
+      - "8080:8080"
+    volumes:
+      - lcp-sandbox-data:/app/data
+
+  buyer-sandbox:
+    build:
+      context: ../..
+      dockerfile: implementations/reference-platform/Dockerfile
+    environment:
+      LCP_PLATFORM_URL: http://lcp-platform-sandbox:8080
+    command: ["python", "/app/examples/sandbox/buyer.py"]
+    depends_on:
+      - lcp-platform-sandbox
+
+volumes:
+  lcp-sandbox-data:

lcp_reference_platform-1.0.0/kubernetes/README.md

@@ -0,0 +1,94 @@
+# Kubernetes deployment example
+
+These manifests demonstrate a cloud-neutral Kubernetes shape for the LCP
+reference platform. They are intentionally not a complete turnkey production
+cluster configuration.
+
+## Before applying
+
+1. Build and publish the reference-platform image to your registry.
+2. Provide a supported Postgres service; do not run the database in this
+   example for production.
+3. Provide an approved RWX attachment volume or replace the reference file
+   backend with a residency-controlled object-store adapter.
+4. Copy `secret.example.yaml` to a private, access-controlled Secret manifest
+   or use External Secrets/KMS integration.
+5. Replace the example image, database URL, tenant ID, resource limits,
+   namespaces, network policies, ingress, and residency controls.
+6. Configure a production WSGI server or adapt the image entry point to the
+   organization's process manager.
+7. Publish the image through the signed container workflow, resolve its digest,
+   and replace the example image reference with that digest.
+8. Add a TLS ingress/WAF and private egress policy.
+
+## Apply
+
+```bash
+kubectl create namespace lcp
+kubectl apply -n lcp -f secret.example.yaml   # replace with a real secret workflow
+kubectl apply -n lcp -f pvc.example.yaml       # use approved RWX storage or an object-store adapter
+kubectl apply -n lcp -f configmap.yaml
+kubectl apply -n lcp -f deployment.yaml
+kubectl apply -n lcp -f service.yaml
+kubectl apply -n lcp -f pod-disruption-budget.yaml
+# Optional; tune against queue age and database capacity before applying.
+kubectl apply -n lcp -f hpa.example.yaml
+```
+
+The API and worker are separate deployments. Both use the same image and
+configuration; only the entry point differs. The worker needs access to the
+same Postgres database but does not need a public Service.
+
+## Production additions
+
+- `pvc.example.yaml` for the reference encrypted attachment directory. A
+  multi-zone production deployment should prefer an object-store adapter with
+  customer-managed encryption and explicit residency controls.
+- `network-policy.example.yaml` restricting database and buyer egress.
+- `pod-disruption-budget.yaml` and multi-zone scheduling.
+- `hpa.example.yaml`, extended with queue-age and database-capacity signals.
+- External Secrets/KMS and key rotation, including controlled re-encryption of persisted envelopes.
+- Ingress TLS, WAF, DDoS protection, and request-size limits.
+- Postgres HA, backups, encryption, and restore drills.
+- Centralized redacted logs, metrics, traces, and alerts.
+- Image signing, admission policy, SBOM verification, and vulnerability scans.
+- `verify-images-kyverno.example.yaml` — optional Kyverno enforcement for
+  keyless signatures, SLSA provenance, and CycloneDX SBOM attestations.
+- `tests/verify-images/` — CI fixtures proving unsigned, wrong-workflow,
+  missing-provenance, and missing-SBOM images are rejected.
+
+See [container signing and provenance verification](../../../docs/CONTAINER-SUPPLY-CHAIN.md)
+for Cosign/GitHub verification commands and cloud-neutral admission guidance.
+
+## Policy test fixtures
+
+The `tests/verify-images/` fixture uses Kyverno's public verification-test
+images and expects rejection for four negative cases:
+
+- an unsigned image;
+- an image signed by a different workflow/identity;
+- an image without the required SLSA provenance attestation; and
+- an image without the required CycloneDX SBOM attestation.
+
+Run it with the Kyverno CLI and registry access:
+
+```bash
+kyverno test implementations/reference-platform/kubernetes/tests/verify-images \
+  --registry --detailed-results
+```
+
+The GitHub test workflow installs Kyverno CLI `v1.18.2`, verifies its pinned
+Linux archive with the release's Sigstore bundle, and then runs this fixture.
+Keep that version and verification identity under review when upgrading the
+policy engine or its CLI.
+
+The fixture is a policy-behavior test, not a substitute for a live admission
+test against the organization's registry, Kyverno version, credentials, and
+network policy.
+
+The CI `admission` job also creates a disposable, pinned kind cluster, installs
+Kyverno from a digest-checked release manifest, applies these policies in
+`Enforce` mode, and submits the four fixtures through the Kubernetes API server
+with server-side dry runs. It fails unless Kyverno rejects the unsigned,
+wrong-workflow, missing-provenance, and missing-SBOM cases through the live
+admission webhook.

lcp_reference_platform-1.0.0/kubernetes/configmap.yaml

@@ -0,0 +1,21 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: lcp-platform-config
+data:
+  LCP_SCHEMA_DIR: /app/schemas
+  LCP_REQUIRE_AUTH: "true"
+  LCP_ALLOW_INSECURE_WEBHOOKS: "false"
+  LCP_PLATFORM_ID: platform_001
+  LCP_ROUTING_TENANT_ID: default
+  LCP_REPLAY_WINDOW_SECONDS: "300"
+  LCP_MAX_BODY_BYTES: "2000000"
+  LCP_MAX_HEADER_BYTES: "16384"
+  LCP_MAX_WEBHOOK_RESPONSE_BYTES: "262144"
+  LCP_RATE_LIMIT_PER_MINUTE: "600"
+  LCP_WEBHOOK_TIMEOUT_SECONDS: "10"
+  LCP_MAX_DELIVERY_ATTEMPTS: "5"
+  LCP_WORKER_INTERVAL_SECONDS: "1"
+  LCP_ATTACHMENT_DIRECTORY: /var/lib/lcp/attachments
+  LCP_MAX_ATTACHMENT_BYTES: "104857600"
+  LCP_ALLOWED_ATTACHMENT_CONTENT_TYPES: application/pdf,image/jpeg,image/png,image/webp,text/plain,application/msword,application/vnd.openxmlformats-officedocument.wordprocessingml.document

lcp_reference_platform-1.0.0/kubernetes/deployment.yaml

@@ -0,0 +1,161 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: lcp-platform-api
+spec:
+  replicas: 3
+  selector:
+    matchLabels:
+      app: lcp-platform-api
+  template:
+    metadata:
+      labels:
+        app: lcp-platform-api
+    spec:
+      serviceAccountName: lcp-platform
+      securityContext:
+        runAsNonRoot: true
+        fsGroup: 10001
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: api
+          image: ghcr.io/replace-me/lcp-reference-platform@sha256:REPLACE_WITH_SIGNED_DIGEST
+          imagePullPolicy: IfNotPresent
+          command: ["gunicorn", "--bind", "0.0.0.0:8080", "--workers", "3", "--threads", "4", "--access-logfile", "-", "lcp_platform.wsgi:application"]
+          ports:
+            - name: http
+              containerPort: 8080
+          envFrom:
+            - configMapRef:
+                name: lcp-platform-config
+          env:
+            - name: LCP_DATABASE_URL
+              valueFrom:
+                secretKeyRef:
+                  name: lcp-platform-secrets
+                  key: LCP_DATABASE_URL
+            - name: LCP_PII_ENCRYPTION_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: lcp-platform-secrets
+                  key: LCP_PII_ENCRYPTION_KEY
+            - name: LCP_SECRETS_FILE
+              value: /run/secrets/lcp/credentials.json
+          volumeMounts:
+            - name: lcp-credentials
+              mountPath: /run/secrets/lcp
+              readOnly: true
+            - name: lcp-attachments
+              mountPath: /var/lib/lcp/attachments
+          readinessProbe:
+            httpGet:
+              path: /health/ready
+              port: http
+            initialDelaySeconds: 5
+            periodSeconds: 10
+          livenessProbe:
+            httpGet:
+              path: /health/live
+              port: http
+            initialDelaySeconds: 15
+            periodSeconds: 20
+          resources:
+            requests:
+              cpu: 250m
+              memory: 256Mi
+            limits:
+              cpu: "2"
+              memory: 1Gi
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            capabilities:
+              drop: ["ALL"]
+      volumes:
+        - name: lcp-credentials
+          secret:
+            secretName: lcp-platform-secrets
+            defaultMode: 0440
+            items:
+              - key: LCP_CREDENTIALS_JSON
+                path: credentials.json
+        - name: lcp-attachments
+          persistentVolumeClaim:
+            claimName: lcp-attachments
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: lcp-platform-worker
+spec:
+  replicas: 2
+  selector:
+    matchLabels:
+      app: lcp-platform-worker
+  template:
+    metadata:
+      labels:
+        app: lcp-platform-worker
+    spec:
+      serviceAccountName: lcp-platform
+      securityContext:
+        runAsNonRoot: true
+        fsGroup: 10001
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: worker
+          image: ghcr.io/replace-me/lcp-reference-platform@sha256:REPLACE_WITH_SIGNED_DIGEST
+          imagePullPolicy: IfNotPresent
+          command: ["lcp-platform-worker"]
+          envFrom:
+            - configMapRef:
+                name: lcp-platform-config
+          env:
+            - name: LCP_DATABASE_URL
+              valueFrom:
+                secretKeyRef:
+                  name: lcp-platform-secrets
+                  key: LCP_DATABASE_URL
+            - name: LCP_PII_ENCRYPTION_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: lcp-platform-secrets
+                  key: LCP_PII_ENCRYPTION_KEY
+            - name: LCP_SECRETS_FILE
+              value: /run/secrets/lcp/credentials.json
+          volumeMounts:
+            - name: lcp-credentials
+              mountPath: /run/secrets/lcp
+              readOnly: true
+            - name: lcp-attachments
+              mountPath: /var/lib/lcp/attachments
+          resources:
+            requests:
+              cpu: 250m
+              memory: 256Mi
+            limits:
+              cpu: "2"
+              memory: 1Gi
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            capabilities:
+              drop: ["ALL"]
+      volumes:
+        - name: lcp-credentials
+          secret:
+            secretName: lcp-platform-secrets
+            defaultMode: 0440
+            items:
+              - key: LCP_CREDENTIALS_JSON
+                path: credentials.json
+        - name: lcp-attachments
+          persistentVolumeClaim:
+            claimName: lcp-attachments
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: lcp-platform

lcp_reference_platform-1.0.0/kubernetes/hpa.example.yaml

@@ -0,0 +1,43 @@
+apiVersion: autoscaling/v2
+kind: HorizontalPodAutoscaler
+metadata:
+  name: lcp-platform-api
+spec:
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name: lcp-platform-api
+  minReplicas: 3
+  maxReplicas: 50
+  behavior:
+    scaleDown:
+      stabilizationWindowSeconds: 300
+  metrics:
+    - type: Resource
+      resource:
+        name: cpu
+        target:
+          type: Utilization
+          averageUtilization: 65
+---
+apiVersion: autoscaling/v2
+kind: HorizontalPodAutoscaler
+metadata:
+  name: lcp-platform-worker
+spec:
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name: lcp-platform-worker
+  minReplicas: 2
+  maxReplicas: 50
+  behavior:
+    scaleDown:
+      stabilizationWindowSeconds: 300
+  metrics:
+    - type: Resource
+      resource:
+        name: cpu
+        target:
+          type: Utilization
+          averageUtilization: 65