coulomb/access-engine
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Complete renamed image source and verify bounded consumer migration readiness
Some checks failed
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details
Build and Publish Container Image / build-and-push (push) Failing after 1m2s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade
This commit is contained in:
tegwick 2026-10-11 23:25:19 +02:00
parent dd15d8cf3f
commit 16ca97b277
13 changed files with 455 additions and 19 deletions
Download patch file Download diff file Expand all files Collapse all files

29
docs/runtime-rename-inventory.md
View file

@ -106,3 +106,32 @@ Live pins: `flex-auth-informed-decision-lifecycle`, `-sitting`, `-t03`.
Requested after T01 fixes the target names, so each owner gets one message
with the exact new URL and audience: `ops-warden`, `secrets-engine`,
`user-engine` with `net-kingdom`, `tenant-engine`, and `informed-decision`.
## Deterministic consumer readiness check (2026-10-11, T06)
Run `python3 tools/verify_runtime_consumer_migration.py --estate-root /home/worsch`.
The class parses only the bounded public inventory source paths as YAML/JSON,
TOML or Python literal strings, excludes comments and records file SHA256s.
It emits exact old/new pin origins, source-owner handoff responsibilities and
source migration phases. It never marks native readiness or closes a task.
Unsigned completion flags, source URL strings and a missing log are not live
proof. Operator configuration, ops-bridge ClusterIP tunnels and Secrets CLI
runtime selection remain owner evidence requirements; no private operator
configuration or credentials are read by this tool.
The 2026-10-11 re-derivation found remaining owner source work for ops-warden,
secrets-engine, user-engine with net-kingdom, tenant-engine and informed-decision.
No new endpoint appeared in these bounded files. The five owner handoffs are
prepared by the report, not sent or claimed acknowledged. Source owners first
retain old egress while adding the new namespace, then change one consumer's
endpoint and projected audience after T02/T05 and ordered live prerequisites.
Each new pin needs authenticated allow/deny and exact deployed revision/digest
correspondence; old-twin logs need an explicit observation interval and
no-traffic/soak evidence before old egress removal or T07 retirement.
The earlier `flex-auth-policy-check` catalogue example is a policy routing lane,
not a secret-fetch package lane. Its naming migration does not authorize adding
PDP-self resource systems to packages that govern other protected consumers.
T05's nine new TokenReview ServiceAccount grants are a separate red daily-batch
item. This report does not authorize those grants or the consumer changes.