From 0bc10b4b42877d4dcfb6e763ab31f517f69766b7 Mon Sep 17 00:00:00 2001 From: tegwick Date: Sat, 10 Oct 2026 13:12:16 +0200 Subject: [PATCH] FLEX-WP-0036: propose runtime rename flex-auth -> access-engine (side by side, consumers switch one at a time) Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 735967@bnt-lap001 Assistant-Session: 5971967f-77f8-4ced-9e02-c6ef67040ffc --- ...EX-WP-0036-runtime-rename-access-engine.md | 205 ++++++++++++++++++ 1 file changed, 205 insertions(+) create mode 100644 workplans/FLEX-WP-0036-runtime-rename-access-engine.md diff --git a/workplans/FLEX-WP-0036-runtime-rename-access-engine.md b/workplans/FLEX-WP-0036-runtime-rename-access-engine.md new file mode 100644 index 0000000..0a1400d --- /dev/null +++ b/workplans/FLEX-WP-0036-runtime-rename-access-engine.md @@ -0,0 +1,205 @@ +--- +id: FLEX-WP-0036 +type: workplan +title: "Runtime rename: flex-auth to access-engine, run side by side, consumers switch one at a time" +domain: infotech +repo: access-engine +status: proposed +owner: claude +topic_slug: netkingdom +created: "2026-10-10" +updated: "2026-10-10" +origin: demand +origin_ref: founder 2026-10-10 ("the relicts are too disorienting") +related: [FLEX-WP-0020] +--- + +`FLEX-WP-0020` renamed the repository only. `FLEX-DEC-2026-013` kept every +runtime name as `flex-auth` and deferred a product/runtime rebrand to "a later +workplan after soak". This is that workplan. The founder asked for it on +2026-10-10 because a repo called `access-engine` that deploys, builds, logs and +authenticates as `flex-auth` disorients every agent that works on it. +`FLEX-WP-0020-T11` (the soak) is still open. This plan does not wait for it to +start drafting, but T06 onward must not apply until T11 closes. + +## What is renamed + +| Surface | Today | Target | Who has to act | +| --- | --- | --- | --- | +| Kubernetes namespace | `flex-auth` | `access-engine` | operator | +| Deployments, Services, SAs, NetworkPolicies, Helm releases | `flex-auth-` (9 pins) | `access-engine-` | operator | +| TokenReview ClusterRoleBindings | `flex-auth-*-tokenreviewer` (9) | `access-engine-*-tokenreviewer` | operator | +| Service DNS consumers call | `flex-auth-.flex-auth.svc.cluster.local.` | `access-engine-.access-engine.svc.cluster.local.` | each consumer | +| Consumer egress NetworkPolicies | name namespace `flex-auth` | `access-engine` | `informed-decision`, `tenant-engine`, `user-engine` (net-kingdom `sso-mfa/k8s`) | +| Caller token audience | `flex-auth` | `access-engine` | PDP first, then each consumer | +| `resource.system` naming the PDP itself | `flex-auth` (ops-warden lane `flex-auth-policy-check`) | `access-engine` | PDP first, then ops-warden (`FLEX-DEC-2026-015`) | +| Container package | `coulomb/flex-auth` | `coulomb/access-engine` | this repo + Forgejo operator | +| Helm chart | `charts/flex-auth` | `charts/access-engine` | this repo | +| Go module, `cmd/`, binary | `github.com/netkingdom/flex-auth`, `flex-auth` | `.../access-engine`, `access-engine` | this repo; external callers of the binary | +| Env vars | `FLEX_AUTH_*` | `ACCESS_ENGINE_*` | this repo | +| Prose: SCOPE, INTENT, docs, canon, routing catalog | `flex-auth` | `access-engine` | this repo, net-kingdom, ops-warden | + +Not renamed: the `FLEX-WP-`, `FLEX-DEC-` and `FLEX-IN-` id prefixes, all State +Hub UUIDs, and historical records (decision logs, archived workplans, decision +records already emitted). Each of those names what existed at the time it was +written. + +## Rules for every task + +1. **Run side by side, never rename in place.** Renaming a namespace, Service + or audience in place cuts off every consumer still using the old name. That + is a fail-closed outage nobody decided on. Each new `access-engine-*` pin is + started next to its `flex-auth-*` twin at the same image digest, and the + twin is retired only after its consumer has switched. +2. **The PDP accepts the new value before any consumer sends it** + (`FLEX-DEC-2026-015`): ship acceptance of both values first, then let + consumers flip, then retire the old value. +3. **One consumer at a time.** Each consumer switches on its own schedule and + under its own owner's work record. This plan records the handoff id and + waits for evidence. It never closes a task owned by another repo. +4. **Every live step needs the founder's go**, per pin, as T04 of + `FLEX-WP-0035` did. + +## Decide the target names and supersede the retain table + +```task +id: FLEX-WP-0036-T01 +status: todo +priority: high +``` + +Record `FLEX-DEC-2026-020`: runtime names move to `access-engine`, following +the table above. It supersedes the runtime rows of `FLEX-DEC-2026-013`. Fix +the namespace, release and DNS pattern, the audience value, and the +`resource.system` value. Settle the binary question: rename it outright, or +ship `access-engine` with a `flex-auth` alias for one release. + +Gate: decision accepted by the founder. + +## Inventory every consumer reference and open handoffs + +```task +id: FLEX-WP-0036-T02 +status: todo +priority: high +depends_on: [FLEX-WP-0036-T01] +``` + +For each consumer, list every place that names the runtime: URL, audience, +egress policy, routing catalog entries, scripts, tests, stance maps, and the +`resource.system` value. Known consumers: `ops-warden` (two pins, plus +`flex-auth-policy-check`, registry and manifest scripts), `secrets-engine`, +`user-engine` (two pins: check and readback), `tenant-engine`, +`informed-decision` (lifecycle, sitting and t03 pins), and `net-kingdom` +(`sso-mfa/k8s/**`). Also check the State Hub, `state-hub` CLI and +`railiance-fabric` discovery for runtime names. Request one work-record id +from each owner. + +Gate: `docs/runtime-rename-inventory.md` with one row per reference and an +owner handoff id per consumer. + +## Make the PDP accept both names + +```task +id: FLEX-WP-0036-T03 +status: todo +priority: high +depends_on: [FLEX-WP-0036-T01] +``` + +Caller auth accepts `access-engine` and `flex-auth` audiences, and packages +and caller bindings accept both `resource.system` values. Decision records +must still state which value the request carried, so nothing is rewritten +silently. Add tests for both values on every pin's package. + +Gate: tests; a new image rolled to the existing `flex-auth-*` pins with the +founder's go. + +## Rename the source + +```task +id: FLEX-WP-0036-T04 +status: todo +priority: medium +depends_on: [FLEX-WP-0036-T01] +``` + +Go module, `cmd/access-engine`, binary, `ACCESS_ENGINE_*` env vars (read the +old names for one release, with a warning), `charts/access-engine`, and CI +publishing to `coulomb/access-engine`. Publish to `coulomb/flex-auth` too +until T07 is done, so the old pins can still roll back. No runtime change. + +Gate: build, tests and stage-1 render green; CI publishes both packages, and +both resolve to the same digest. + +## Stand up the access-engine namespace next to flex-auth + +```task +id: FLEX-WP-0036-T05 +status: todo +priority: medium +depends_on: [FLEX-WP-0036-T03, FLEX-WP-0036-T04] +``` + +Create the `access-engine` namespace, then one `access-engine-` pin +for each live `flex-auth-` pin. Each new pin runs the same image +digest and package as its twin and gets its own TokenReview binding. Ingress +admits the same consumer as the twin does. Extend +`TestReadbackPinMatchesParticipantPins` to cover the new pins, and add a test +that each twin pair runs the same digest. + +Gate: every new pin Ready, `/healthz` 200, anonymous requests 401; founder go. +Blocked on `FLEX-WP-0020-T11` closing. + +## Consumers switch over, one at a time + +```task +id: FLEX-WP-0036-T06 +status: todo +priority: medium +depends_on: [FLEX-WP-0036-T02, FLEX-WP-0036-T05] +``` + +Each consumer changes its URL, its egress policy (add the new namespace before +removing the old one), its audience and, for ops-warden, `owner_repo`. One row +per consumer in the inventory, closed with that owner's evidence: a live +allow and a live deny against the new pin, and no traffic left on the twin +(from twin logs). + +Gate: every inventory row closed with owner evidence. + +## Retire the flex-auth runtime + +```task +id: FLEX-WP-0036-T07 +status: todo +priority: medium +depends_on: [FLEX-WP-0036-T06] +``` + +After a soak with no traffic on the old pins: uninstall each `flex-auth-*` +release and its TokenReview binding, delete the `flex-auth` namespace, drop +the old audience and `resource.system` from acceptance (`FLEX-DEC-2026-015` +order), and stop publishing `coulomb/flex-auth`. Keep the flattened emergency +manifests in `deploy/` only as rewritten for the new names. + +Gate: founder go; `kubectl get ns flex-auth` NotFound; every consumer's checks +still allow and deny as expected. + +## Prose, canon and layer declaration + +```task +id: FLEX-WP-0036-T08 +status: todo +priority: low +depends_on: [FLEX-WP-0036-T06] +``` + +SCOPE, INTENT and its layer declaration, the conformance doc, the stance +register reviews, `.claude/rules`, the `deploy/` and `railiance/` READMEs, +`railiance/app.toml`, and `ops-warden`'s routing catalog and credential-routing +canon. Raise the canon-naming item (`FLEX-WP-0030` B5) as closed. Historical +records stay as written. + +Gate: `grep -rn flex-auth` over live docs returns only historical records and +deliberate notes about the old name.