coulomb/access-engine
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

FLEX-WP-0036: binary renamed to access-engine; flex-auth is a stub naming the rename (FLEX-DEC-2026-020)
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details
Build and Publish Container Image / build-and-push (push) Successful in 1m27s
Details

Browse source 
- cmd/flex-auth -> cmd/access-engine; usage and serving lines say access-engine
- cmd/flex-auth: prints the rename and exits 2, with a test
- image: entrypoint /usr/local/bin/access-engine, flex-auth stub alongside;
  live pins pass only args, so their next roll is unaffected
- Makefile, CI, verify-posture, tenancy.yaml, live docs updated; workplans,
  decisions and ADRs left as written
- runtime names (module, audience, k8s, image package, /opt paths) unchanged

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 735967@bnt-lap001
Assistant-Session: 5971967f-77f8-4ced-9e02-c6ef67040ffc
This commit is contained in:
tegwick 2026-10-10 13:26:19 +02:00
parent c284344925
commit 0ced2995ee
36 changed files with 1268 additions and 1178 deletions
Download patch file Download diff file Expand all files Collapse all files

8
examples/ops-warden-fetch/README.md
View file

@ -56,7 +56,7 @@ The readable set is every ops-warden catalog entry with `status: active`,
```bash
python3 tools/gen_ops_warden_fetch.py # rewrites the three generated files
python3 tools/gen_ops_warden_fetch.py --check # exit 1 on drift (tests/stage1.sh runs it)
go run ./cmd/flex-auth test-policy --file examples/ops-warden-fetch/policy_package.md
go run ./cmd/access-engine test-policy --file examples/ops-warden-fetch/policy_package.md
```
`--catalog PATH` overrides the default `~/ops-warden/registry/routing/catalog.yaml`.
@ -67,9 +67,9 @@ baked into the image, so it needs a new image too (`deploy/README.md`).
## Verify
```bash
go run ./cmd/flex-auth test-policy --file examples/ops-warden-fetch/policy_package.md # 6 Rego tests, 15 fixtures
go run ./cmd/flex-auth load-registry -file examples/ops-warden-fetch/registry_snapshot.json
go test ./cmd/flex-auth -run OpsWardenFetch
go run ./cmd/access-engine test-policy --file examples/ops-warden-fetch/policy_package.md # 6 Rego tests, 15 fixtures
go run ./cmd/access-engine load-registry -file examples/ops-warden-fetch/registry_snapshot.json
go test ./cmd/access-engine -run OpsWardenFetch
```
## Not yet deployed

18
examples/ops-warden/README.md
View file

@ -22,13 +22,13 @@ Files:
Run locally:
```bash
flex-auth validate --kind protected-system --file examples/ops-warden/protected_system_manifest.yaml
flex-auth validate --kind resource-manifest --file examples/ops-warden/resource_manifest.yaml
flex-auth validate --kind subject-manifest --file examples/ops-warden/subject_manifest.yaml
flex-auth load-registry --file examples/ops-warden/registry_snapshot.json
flex-auth test-policy --file examples/ops-warden/policy_package.md
flex-auth check --registry examples/ops-warden/registry_snapshot.json --policy examples/ops-warden/policy_package.md --request examples/ops-warden/check_request_allow_adm.json
flex-auth check --registry examples/ops-warden/registry_snapshot.json --policy examples/ops-warden/policy_package.md --request examples/ops-warden/check_request_deny_wrong_tenant.json
access-engine validate --kind protected-system --file examples/ops-warden/protected_system_manifest.yaml
access-engine validate --kind resource-manifest --file examples/ops-warden/resource_manifest.yaml
access-engine validate --kind subject-manifest --file examples/ops-warden/subject_manifest.yaml
access-engine load-registry --file examples/ops-warden/registry_snapshot.json
access-engine test-policy --file examples/ops-warden/policy_package.md
access-engine check --registry examples/ops-warden/registry_snapshot.json --policy examples/ops-warden/policy_package.md --request examples/ops-warden/check_request_allow_adm.json
access-engine check --registry examples/ops-warden/registry_snapshot.json --policy examples/ops-warden/policy_package.md --request examples/ops-warden/check_request_deny_wrong_tenant.json
```
The fixture public-key fingerprints are examples only. Do not put real keys,
@ -44,7 +44,7 @@ changes.
Validate both registries locally:
flex-auth load-registry --file examples/ops-warden/registry_snapshot.json
flex-auth load-registry --file examples/ops-warden/production_registry_snapshot.json
access-engine load-registry --file examples/ops-warden/registry_snapshot.json
access-engine load-registry --file examples/ops-warden/production_registry_snapshot.json
The production sync contract is documented in docs/ops-warden-registry-sync.md.

16
examples/qonto-assistant/README.md
View file

@ -14,8 +14,8 @@ separate; see `policy_package.md`'s scope note).
| `subject_manifest.yaml` | Registered callers: an agent-harness session identity and the founder's human identity, both in `group:qonto-assistant-readers` |
| `policy_package.md` | Rego rules + embedded tests gating the read action |
| `policy_fixtures.yaml` | Allow/deny request/decision pairs, referenced by `policy_package.md`'s frontmatter |
| `registry_snapshot.json` | Merged `systems`/`subjects`/`groups` snapshot assembled from the two manifests above, loadable by `flex-auth serve`/`check`/`load-registry` |
| `check_request_allow_read.json`, `check_request_deny_wrong_tenant.json` | Standalone example requests for `flex-auth check` |
| `registry_snapshot.json` | Merged `systems`/`subjects`/`groups` snapshot assembled from the two manifests above, loadable by `access-engine serve`/`check`/`load-registry` |
| `check_request_allow_read.json`, `check_request_deny_wrong_tenant.json` | Standalone example requests for `access-engine check` |
**No `resource_manifest.yaml`** — like tenant-engine's tenants, `qonto-assistant`
doesn't have a fixed enumerable resource inventory to register; the single
@ -26,26 +26,26 @@ gate.
## Verified
```bash
go build -o bin/flex-auth ./cmd/flex-auth
go build -o bin/access-engine ./cmd/access-engine
# Rego rules + embedded tests + fixtures, all pass:
bin/flex-auth test-policy -file examples/qonto-assistant/policy_package.md
bin/access-engine test-policy -file examples/qonto-assistant/policy_package.md
# Registry loads cleanly:
bin/flex-auth load-registry -file examples/qonto-assistant/registry_snapshot.json
bin/access-engine load-registry -file examples/qonto-assistant/registry_snapshot.json
# Individual requests via the CLI:
bin/flex-auth check \
bin/access-engine check \
-registry examples/qonto-assistant/registry_snapshot.json \
-policy examples/qonto-assistant/policy_package.md \
-request examples/qonto-assistant/check_request_allow_read.json
# End-to-end over real HTTP: a live `flex-auth serve` loaded with this exact
# End-to-end over real HTTP: a live `access-engine serve` loaded with this exact
# registry+policy, hit by qonto-assistant's actual FlexAuthCheckClient (not
# a mock) -- see qonto-assistant/tests/test_flex_auth_client.py and
# tests/test_live_authorization_gate.py, and the manual curl walkthrough
# below:
bin/flex-auth serve -addr 127.0.0.1:9099 \
bin/access-engine serve -addr 127.0.0.1:9099 \
-registry examples/qonto-assistant/registry_snapshot.json \
-policy examples/qonto-assistant/policy_package.md
# from another shell:

10
examples/railiance-platform/README.md
View file

@ -10,9 +10,9 @@ integration shapes must emit `requested_ttl_seconds` as a positive number;
duration strings such as `15m` are rejected rather than guessed.
```bash
go run ./cmd/flex-auth load-registry --file examples/railiance-platform/registry_snapshot.json
go run ./cmd/flex-auth test-policy --file examples/railiance-platform/policy_package.md
go run ./cmd/flex-auth check --registry examples/railiance-platform/registry_snapshot.json --policy examples/railiance-platform/policy_package.md --request examples/railiance-platform/check_request_allow.json
go run ./cmd/flex-auth check --registry examples/railiance-platform/registry_snapshot.json --policy examples/railiance-platform/policy_package.md --request examples/railiance-platform/check_request_deny_unknown.json
go run ./cmd/flex-auth check --registry examples/railiance-platform/registry_snapshot.json --policy examples/railiance-platform/policy_package.md --request examples/railiance-platform/check_request_deny_wrong_tenant.json
go run ./cmd/access-engine load-registry --file examples/railiance-platform/registry_snapshot.json
go run ./cmd/access-engine test-policy --file examples/railiance-platform/policy_package.md
go run ./cmd/access-engine check --registry examples/railiance-platform/registry_snapshot.json --policy examples/railiance-platform/policy_package.md --request examples/railiance-platform/check_request_allow.json
go run ./cmd/access-engine check --registry examples/railiance-platform/registry_snapshot.json --policy examples/railiance-platform/policy_package.md --request examples/railiance-platform/check_request_deny_unknown.json
go run ./cmd/access-engine check --registry examples/railiance-platform/registry_snapshot.json --policy examples/railiance-platform/policy_package.md --request examples/railiance-platform/check_request_deny_wrong_tenant.json
```

4
examples/secrets-engine/README.md
View file

@ -21,8 +21,8 @@ Read that before changing any action string here.
## Verify
```bash
go run ./cmd/flex-auth validate -kind policy -file examples/secrets-engine/policy_package.md
go run ./cmd/flex-auth load-registry -file examples/secrets-engine/registry_snapshot.json
go run ./cmd/access-engine validate -kind policy -file examples/secrets-engine/policy_package.md
go run ./cmd/access-engine load-registry -file examples/secrets-engine/registry_snapshot.json
```
28 Rego tests and 32 fixtures.

2
examples/secrets-engine/replay/README.md
View file

@ -15,7 +15,7 @@ to verify its digest join (`627810b`) unchanged. `FLEX-WP-0021-T03`.
Regenerate either with:
```bash
go run ./cmd/flex-auth check \
go run ./cmd/access-engine check \
-policy examples/secrets-engine/policy_package.md \
-registry examples/secrets-engine/registry_snapshot.json \
-request examples/secrets-engine/check_request_allow_rotate.json

20
examples/tenant-engine/README.md
View file

@ -12,8 +12,8 @@ protected-system consumer, gating its own write API
| `subject_manifest.yaml` | Two registered callers: `tenant-engine` (all nine actions) and `flex-auth` (read-only on `tenant.guardrail.read`) |
| `policy_package.md` | Rego rules + embedded tests gating the write API. v3 states the tenant relation (`TEN-DEC-2026-002`, `FLEX-DEC-2026-016`): `tenant` is the target record and must equal `resource.id` (`tenant_not_target` otherwise); the scope is cross-tenant by design |
| `policy_fixtures.yaml` | Allow/deny request/decision pairs, referenced by `policy_package.md`'s frontmatter. `tenant` varies across four tenants so the suite reports on the field |
| `registry_snapshot.json` | Merged `systems`/`subjects`/`groups` snapshot assembled from the two manifests above, loadable by `flex-auth serve`/`check`/`load-registry` |
| `check_request_allow_create.json`, `check_request_deny_unknown_subject.json`, `check_request_allow_retire.json`, `check_request_deny_misspelled_lifecycle.json`, `check_request_allow_guardrail_read.json`, `check_request_allow_guardrail_set.json`, `check_request_deny_guardrail_set_as_reader.json`, `check_request_deny_misspelled_guardrail.json`, `check_request_deny_tenant_not_target.json` | Standalone example requests for `flex-auth check` |
| `registry_snapshot.json` | Merged `systems`/`subjects`/`groups` snapshot assembled from the two manifests above, loadable by `access-engine serve`/`check`/`load-registry` |
| `check_request_allow_create.json`, `check_request_deny_unknown_subject.json`, `check_request_allow_retire.json`, `check_request_deny_misspelled_lifecycle.json`, `check_request_allow_guardrail_read.json`, `check_request_allow_guardrail_set.json`, `check_request_deny_guardrail_set_as_reader.json`, `check_request_deny_misspelled_guardrail.json`, `check_request_deny_tenant_not_target.json` | Standalone example requests for `access-engine check` |
**No `resource_manifest.yaml`** — unlike ops-warden's fixed SSH-certificate
inventory, `tenant-engine`'s resources (tenants) are created dynamically.
@ -23,26 +23,26 @@ omission, not an oversight.
## Verified
```bash
go build -o bin/flex-auth ./cmd/flex-auth
go build -o bin/access-engine ./cmd/access-engine
# Rego rules + embedded tests + fixtures, all pass:
bin/flex-auth test-policy -file examples/tenant-engine/policy_package.md
bin/access-engine test-policy -file examples/tenant-engine/policy_package.md
# Registry loads cleanly:
bin/flex-auth load-registry -file examples/tenant-engine/registry_snapshot.json
bin/access-engine load-registry -file examples/tenant-engine/registry_snapshot.json
# Individual requests via the CLI:
bin/flex-auth check \
bin/access-engine check \
-registry examples/tenant-engine/registry_snapshot.json \
-policy examples/tenant-engine/policy_package.md \
-request examples/tenant-engine/check_request_allow_create.json
# End-to-end over real HTTP: a live `flex-auth serve` loaded with this
# End-to-end over real HTTP: a live `access-engine serve` loaded with this
# exact registry+policy, hit by tenant-engine's actual
# FlexAuthCheckClient/FlexAuthWriteAuthorizer (not a mock) --
# POST /tenants with actor="ops" -> 403 (unknown_subject);
# actor="tenant-engine" -> 201 (write_api_policy_matched).
bin/flex-auth serve -addr 127.0.0.1:9098 \
bin/access-engine serve -addr 127.0.0.1:9098 \
-registry examples/tenant-engine/registry_snapshot.json \
-policy examples/tenant-engine/policy_package.md
# (from tenant-engine's own checkout)
@ -54,7 +54,7 @@ TENANT_ENGINE_FLEX_AUTH_URL=http://127.0.0.1:9098 make run
`test-policy` reports **11/11 Rego tests and 16/16 fixtures passing**, the
registry loads, and `go test ./...` / `gofmt` / `go vet` are clean.
End-to-end over real HTTP: a live `flex-auth serve` on `127.0.0.1:9098`
End-to-end over real HTTP: a live `access-engine serve` on `127.0.0.1:9098`
loaded with this registry and policy, and a real `tenant-engine`
(`TENANT_ENGINE_FLEX_AUTH_URL=http://127.0.0.1:9098`) driven through its
unmodified `FlexAuthWriteAuthorizer` with `Idempotency-Key` and an `If-Match`
@ -96,7 +96,7 @@ Rollback target is `sha256:c25fc34a…` (four-action).
registry loads (2 subjects, 2 groups), and `go test ./...` / `gofmt` /
`go vet` are clean.
End-to-end over real HTTP: a live `flex-auth serve` on `127.0.0.1:9098`
End-to-end over real HTTP: a live `access-engine serve` on `127.0.0.1:9098`
loaded with this registry and policy, and a real `tenant-engine`
(`TENANT_ENGINE_FLEX_AUTH_URL=http://127.0.0.1:9098`) driven through its
unmodified `FlexAuthWriteAuthorizer`:

4
examples/user-engine/README.md
View file

@ -8,8 +8,8 @@ tenant administrators and self-service users may not.
Validate with:
```bash
flex-auth test-policy -file examples/user-engine/policy_package.md
flex-auth load-registry -file examples/user-engine/registry_snapshot.json
access-engine test-policy -file examples/user-engine/policy_package.md
access-engine load-registry -file examples/user-engine/registry_snapshot.json
```
## Live production (FLEX-WP-0009-T04, 2026-08-16)