coulomb/access-engine
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Accept both PDP token audiences while preserving caller bindings

Browse source 
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade
This commit is contained in:
tegwick 2026-10-11 21:30:47 +02:00
parent 3d44f0f9d9
commit 21d4e20696
5 changed files with 329 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

21
workplans/FLEX-WP-0036-runtime-rename-access-engine.md
View file

@ -115,7 +115,7 @@ current source must now come from `./cmd/access-engine`.
```task
id: FLEX-WP-0036-T03
status: todo
status: progress
priority: high
depends_on: [FLEX-WP-0036-T01]
state_hub_task_id: "487525e5-c89e-586e-8e9b-54ac6da0804e"
@ -126,8 +126,23 @@ and caller bindings accept both `resource.system` values. Decision records
must still state which value the request carried, so nothing is rewritten
silently. Add tests for both values on every pin's package.
Gate: tests; a new image rolled to the existing `flex-auth-*` pins with the
founder's go.
Gate: tests; a new image rolled to the existing `flex-auth-*` pins through
reviewed reversible blue execution under
`the-custodian/canon/standards/build-mode-change-authorization_v0.1.md`.
The ordered live prerequisite must be verified before rollout.
2026-10-11 source preparation: bounded compatibility accepts both exact PDP
audiences in Kubernetes TokenReview and records an actually reviewed spelling.
Custom audiences, installed service principals and protected-consumer system
bindings retain their existing meanings. All nine current pins authenticate both
audiences; eight enforcement packages retain their fixture outcomes, canonical
request bindings and original `resource.system` spelling. The ninth pin is the
separate application-readback route, whose installed binding is
`application-readback`, not a protected-system grant. There is no current
PDP-self resource lane in these pin packages; the old inventory's
`flex-auth-policy-check` example is a policy-routing lane outside this secret
fetch package. No new self-lane or caller grant is created to fill that absence.
T03 remains progress until the new image and ordered live checks are proven.
## Rename the source