coulomb/access-engine
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

FLEX-WP-0036: binary renamed to access-engine; flex-auth is a stub naming the rename (FLEX-DEC-2026-020)
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details
Build and Publish Container Image / build-and-push (push) Successful in 1m27s
Details

Browse source 
- cmd/flex-auth -> cmd/access-engine; usage and serving lines say access-engine
- cmd/flex-auth: prints the rename and exits 2, with a test
- image: entrypoint /usr/local/bin/access-engine, flex-auth stub alongside;
  live pins pass only args, so their next roll is unaffected
- Makefile, CI, verify-posture, tenancy.yaml, live docs updated; workplans,
  decisions and ADRs left as written
- runtime names (module, audience, k8s, image package, /opt paths) unchanged

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 735967@bnt-lap001
Assistant-Session: 5971967f-77f8-4ced-9e02-c6ef67040ffc
This commit is contained in:
tegwick 2026-10-10 13:26:19 +02:00
parent c284344925
commit 0ced2995ee
36 changed files with 1268 additions and 1178 deletions
Download patch file Download diff file Expand all files Collapse all files

16
examples/qonto-assistant/README.md
View file

@ -14,8 +14,8 @@ separate; see `policy_package.md`'s scope note).
| `subject_manifest.yaml` | Registered callers: an agent-harness session identity and the founder's human identity, both in `group:qonto-assistant-readers` |
| `policy_package.md` | Rego rules + embedded tests gating the read action |
| `policy_fixtures.yaml` | Allow/deny request/decision pairs, referenced by `policy_package.md`'s frontmatter |
| `registry_snapshot.json` | Merged `systems`/`subjects`/`groups` snapshot assembled from the two manifests above, loadable by `flex-auth serve`/`check`/`load-registry` |
| `check_request_allow_read.json`, `check_request_deny_wrong_tenant.json` | Standalone example requests for `flex-auth check` |
| `registry_snapshot.json` | Merged `systems`/`subjects`/`groups` snapshot assembled from the two manifests above, loadable by `access-engine serve`/`check`/`load-registry` |
| `check_request_allow_read.json`, `check_request_deny_wrong_tenant.json` | Standalone example requests for `access-engine check` |
**No `resource_manifest.yaml`** — like tenant-engine's tenants, `qonto-assistant`
doesn't have a fixed enumerable resource inventory to register; the single
@ -26,26 +26,26 @@ gate.
## Verified
```bash
go build -o bin/flex-auth ./cmd/flex-auth
go build -o bin/access-engine ./cmd/access-engine
# Rego rules + embedded tests + fixtures, all pass:
bin/flex-auth test-policy -file examples/qonto-assistant/policy_package.md
bin/access-engine test-policy -file examples/qonto-assistant/policy_package.md
# Registry loads cleanly:
bin/flex-auth load-registry -file examples/qonto-assistant/registry_snapshot.json
bin/access-engine load-registry -file examples/qonto-assistant/registry_snapshot.json
# Individual requests via the CLI:
bin/flex-auth check \
bin/access-engine check \
-registry examples/qonto-assistant/registry_snapshot.json \
-policy examples/qonto-assistant/policy_package.md \
-request examples/qonto-assistant/check_request_allow_read.json
# End-to-end over real HTTP: a live `flex-auth serve` loaded with this exact
# End-to-end over real HTTP: a live `access-engine serve` loaded with this exact
# registry+policy, hit by qonto-assistant's actual FlexAuthCheckClient (not
# a mock) -- see qonto-assistant/tests/test_flex_auth_client.py and
# tests/test_live_authorization_gate.py, and the manual curl walkthrough
# below:
bin/flex-auth serve -addr 127.0.0.1:9099 \
bin/access-engine serve -addr 127.0.0.1:9099 \
-registry examples/qonto-assistant/registry_snapshot.json \
-policy examples/qonto-assistant/policy_package.md
# from another shell: