FLEX-WP-0036: propose runtime rename flex-auth -> access-engine (side by side, consumers switch one at a time)
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 735967@bnt-lap001 Assistant-Session: 5971967f-77f8-4ced-9e02-c6ef67040ffc
This commit is contained in:
parent
40437ae618
commit
0bc10b4b42
1 changed files with 205 additions and 0 deletions
205
workplans/FLEX-WP-0036-runtime-rename-access-engine.md
Normal file
205
workplans/FLEX-WP-0036-runtime-rename-access-engine.md
Normal file
|
|
@ -0,0 +1,205 @@
|
|||
---
|
||||
id: FLEX-WP-0036
|
||||
type: workplan
|
||||
title: "Runtime rename: flex-auth to access-engine, run side by side, consumers switch one at a time"
|
||||
domain: infotech
|
||||
repo: access-engine
|
||||
status: proposed
|
||||
owner: claude
|
||||
topic_slug: netkingdom
|
||||
created: "2026-10-10"
|
||||
updated: "2026-10-10"
|
||||
origin: demand
|
||||
origin_ref: founder 2026-10-10 ("the relicts are too disorienting")
|
||||
related: [FLEX-WP-0020]
|
||||
---
|
||||
|
||||
`FLEX-WP-0020` renamed the repository only. `FLEX-DEC-2026-013` kept every
|
||||
runtime name as `flex-auth` and deferred a product/runtime rebrand to "a later
|
||||
workplan after soak". This is that workplan. The founder asked for it on
|
||||
2026-10-10 because a repo called `access-engine` that deploys, builds, logs and
|
||||
authenticates as `flex-auth` disorients every agent that works on it.
|
||||
`FLEX-WP-0020-T11` (the soak) is still open. This plan does not wait for it to
|
||||
start drafting, but T06 onward must not apply until T11 closes.
|
||||
|
||||
## What is renamed
|
||||
|
||||
| Surface | Today | Target | Who has to act |
|
||||
| --- | --- | --- | --- |
|
||||
| Kubernetes namespace | `flex-auth` | `access-engine` | operator |
|
||||
| Deployments, Services, SAs, NetworkPolicies, Helm releases | `flex-auth-<consumer>` (9 pins) | `access-engine-<consumer>` | operator |
|
||||
| TokenReview ClusterRoleBindings | `flex-auth-*-tokenreviewer` (9) | `access-engine-*-tokenreviewer` | operator |
|
||||
| Service DNS consumers call | `flex-auth-<c>.flex-auth.svc.cluster.local.` | `access-engine-<c>.access-engine.svc.cluster.local.` | each consumer |
|
||||
| Consumer egress NetworkPolicies | name namespace `flex-auth` | `access-engine` | `informed-decision`, `tenant-engine`, `user-engine` (net-kingdom `sso-mfa/k8s`) |
|
||||
| Caller token audience | `flex-auth` | `access-engine` | PDP first, then each consumer |
|
||||
| `resource.system` naming the PDP itself | `flex-auth` (ops-warden lane `flex-auth-policy-check`) | `access-engine` | PDP first, then ops-warden (`FLEX-DEC-2026-015`) |
|
||||
| Container package | `coulomb/flex-auth` | `coulomb/access-engine` | this repo + Forgejo operator |
|
||||
| Helm chart | `charts/flex-auth` | `charts/access-engine` | this repo |
|
||||
| Go module, `cmd/`, binary | `github.com/netkingdom/flex-auth`, `flex-auth` | `.../access-engine`, `access-engine` | this repo; external callers of the binary |
|
||||
| Env vars | `FLEX_AUTH_*` | `ACCESS_ENGINE_*` | this repo |
|
||||
| Prose: SCOPE, INTENT, docs, canon, routing catalog | `flex-auth` | `access-engine` | this repo, net-kingdom, ops-warden |
|
||||
|
||||
Not renamed: the `FLEX-WP-`, `FLEX-DEC-` and `FLEX-IN-` id prefixes, all State
|
||||
Hub UUIDs, and historical records (decision logs, archived workplans, decision
|
||||
records already emitted). Each of those names what existed at the time it was
|
||||
written.
|
||||
|
||||
## Rules for every task
|
||||
|
||||
1. **Run side by side, never rename in place.** Renaming a namespace, Service
|
||||
or audience in place cuts off every consumer still using the old name. That
|
||||
is a fail-closed outage nobody decided on. Each new `access-engine-*` pin is
|
||||
started next to its `flex-auth-*` twin at the same image digest, and the
|
||||
twin is retired only after its consumer has switched.
|
||||
2. **The PDP accepts the new value before any consumer sends it**
|
||||
(`FLEX-DEC-2026-015`): ship acceptance of both values first, then let
|
||||
consumers flip, then retire the old value.
|
||||
3. **One consumer at a time.** Each consumer switches on its own schedule and
|
||||
under its own owner's work record. This plan records the handoff id and
|
||||
waits for evidence. It never closes a task owned by another repo.
|
||||
4. **Every live step needs the founder's go**, per pin, as T04 of
|
||||
`FLEX-WP-0035` did.
|
||||
|
||||
## Decide the target names and supersede the retain table
|
||||
|
||||
```task
|
||||
id: FLEX-WP-0036-T01
|
||||
status: todo
|
||||
priority: high
|
||||
```
|
||||
|
||||
Record `FLEX-DEC-2026-020`: runtime names move to `access-engine`, following
|
||||
the table above. It supersedes the runtime rows of `FLEX-DEC-2026-013`. Fix
|
||||
the namespace, release and DNS pattern, the audience value, and the
|
||||
`resource.system` value. Settle the binary question: rename it outright, or
|
||||
ship `access-engine` with a `flex-auth` alias for one release.
|
||||
|
||||
Gate: decision accepted by the founder.
|
||||
|
||||
## Inventory every consumer reference and open handoffs
|
||||
|
||||
```task
|
||||
id: FLEX-WP-0036-T02
|
||||
status: todo
|
||||
priority: high
|
||||
depends_on: [FLEX-WP-0036-T01]
|
||||
```
|
||||
|
||||
For each consumer, list every place that names the runtime: URL, audience,
|
||||
egress policy, routing catalog entries, scripts, tests, stance maps, and the
|
||||
`resource.system` value. Known consumers: `ops-warden` (two pins, plus
|
||||
`flex-auth-policy-check`, registry and manifest scripts), `secrets-engine`,
|
||||
`user-engine` (two pins: check and readback), `tenant-engine`,
|
||||
`informed-decision` (lifecycle, sitting and t03 pins), and `net-kingdom`
|
||||
(`sso-mfa/k8s/**`). Also check the State Hub, `state-hub` CLI and
|
||||
`railiance-fabric` discovery for runtime names. Request one work-record id
|
||||
from each owner.
|
||||
|
||||
Gate: `docs/runtime-rename-inventory.md` with one row per reference and an
|
||||
owner handoff id per consumer.
|
||||
|
||||
## Make the PDP accept both names
|
||||
|
||||
```task
|
||||
id: FLEX-WP-0036-T03
|
||||
status: todo
|
||||
priority: high
|
||||
depends_on: [FLEX-WP-0036-T01]
|
||||
```
|
||||
|
||||
Caller auth accepts `access-engine` and `flex-auth` audiences, and packages
|
||||
and caller bindings accept both `resource.system` values. Decision records
|
||||
must still state which value the request carried, so nothing is rewritten
|
||||
silently. Add tests for both values on every pin's package.
|
||||
|
||||
Gate: tests; a new image rolled to the existing `flex-auth-*` pins with the
|
||||
founder's go.
|
||||
|
||||
## Rename the source
|
||||
|
||||
```task
|
||||
id: FLEX-WP-0036-T04
|
||||
status: todo
|
||||
priority: medium
|
||||
depends_on: [FLEX-WP-0036-T01]
|
||||
```
|
||||
|
||||
Go module, `cmd/access-engine`, binary, `ACCESS_ENGINE_*` env vars (read the
|
||||
old names for one release, with a warning), `charts/access-engine`, and CI
|
||||
publishing to `coulomb/access-engine`. Publish to `coulomb/flex-auth` too
|
||||
until T07 is done, so the old pins can still roll back. No runtime change.
|
||||
|
||||
Gate: build, tests and stage-1 render green; CI publishes both packages, and
|
||||
both resolve to the same digest.
|
||||
|
||||
## Stand up the access-engine namespace next to flex-auth
|
||||
|
||||
```task
|
||||
id: FLEX-WP-0036-T05
|
||||
status: todo
|
||||
priority: medium
|
||||
depends_on: [FLEX-WP-0036-T03, FLEX-WP-0036-T04]
|
||||
```
|
||||
|
||||
Create the `access-engine` namespace, then one `access-engine-<consumer>` pin
|
||||
for each live `flex-auth-<consumer>` pin. Each new pin runs the same image
|
||||
digest and package as its twin and gets its own TokenReview binding. Ingress
|
||||
admits the same consumer as the twin does. Extend
|
||||
`TestReadbackPinMatchesParticipantPins` to cover the new pins, and add a test
|
||||
that each twin pair runs the same digest.
|
||||
|
||||
Gate: every new pin Ready, `/healthz` 200, anonymous requests 401; founder go.
|
||||
Blocked on `FLEX-WP-0020-T11` closing.
|
||||
|
||||
## Consumers switch over, one at a time
|
||||
|
||||
```task
|
||||
id: FLEX-WP-0036-T06
|
||||
status: todo
|
||||
priority: medium
|
||||
depends_on: [FLEX-WP-0036-T02, FLEX-WP-0036-T05]
|
||||
```
|
||||
|
||||
Each consumer changes its URL, its egress policy (add the new namespace before
|
||||
removing the old one), its audience and, for ops-warden, `owner_repo`. One row
|
||||
per consumer in the inventory, closed with that owner's evidence: a live
|
||||
allow and a live deny against the new pin, and no traffic left on the twin
|
||||
(from twin logs).
|
||||
|
||||
Gate: every inventory row closed with owner evidence.
|
||||
|
||||
## Retire the flex-auth runtime
|
||||
|
||||
```task
|
||||
id: FLEX-WP-0036-T07
|
||||
status: todo
|
||||
priority: medium
|
||||
depends_on: [FLEX-WP-0036-T06]
|
||||
```
|
||||
|
||||
After a soak with no traffic on the old pins: uninstall each `flex-auth-*`
|
||||
release and its TokenReview binding, delete the `flex-auth` namespace, drop
|
||||
the old audience and `resource.system` from acceptance (`FLEX-DEC-2026-015`
|
||||
order), and stop publishing `coulomb/flex-auth`. Keep the flattened emergency
|
||||
manifests in `deploy/` only as rewritten for the new names.
|
||||
|
||||
Gate: founder go; `kubectl get ns flex-auth` NotFound; every consumer's checks
|
||||
still allow and deny as expected.
|
||||
|
||||
## Prose, canon and layer declaration
|
||||
|
||||
```task
|
||||
id: FLEX-WP-0036-T08
|
||||
status: todo
|
||||
priority: low
|
||||
depends_on: [FLEX-WP-0036-T06]
|
||||
```
|
||||
|
||||
SCOPE, INTENT and its layer declaration, the conformance doc, the stance
|
||||
register reviews, `.claude/rules`, the `deploy/` and `railiance/` READMEs,
|
||||
`railiance/app.toml`, and `ops-warden`'s routing catalog and credential-routing
|
||||
canon. Raise the canon-naming item (`FLEX-WP-0030` B5) as closed. Historical
|
||||
records stay as written.
|
||||
|
||||
Gate: `grep -rn flex-auth` over live docs returns only historical records and
|
||||
deliberate notes about the old name.
|
||||
Loading…
Add table
Add a link
Reference in a new issue