coulomb/access-engine
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

FLEX-WP-0037: register ops-warden actor agt-custodian in the production registry
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details
Build and Publish Container Image / build-and-push (push) Successful in 57s
Details

Browse source 
Add agt-custodian (WARDEN-WP-0045) to examples/ops-warden/production_registry_snapshot.json
so flex-auth-ops-warden stops refusing it with unknown_actor_resource (CUST-WP-0073-T02).
Additions only; regenerated-inventory drift (agt-rehearsal, adm/codex zone fields) not taken.
Tests cover own-principal proceed and foreign-principal disallowed_principal.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 605711@bnt-lap001
Assistant-Session: 1f5e2256-181f-49ed-b7b1-a1c34bf37a61
This commit is contained in:
tegwick 2026-10-20 22:58:36 +02:00
parent a310f3fe35
commit 9132f9b677
5 changed files with 233 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

32
cmd/access-engine/main_test.go
View file

@ -285,7 +285,7 @@ func TestRunLoadRegistryOpsWardenProduction(t *testing.T) {
if err := json.Unmarshal(stdout.Bytes(), &result); err != nil {
t.Fatalf("unmarshal load-registry output: %v; stdout = %s", err, stdout.String())
}
if result["subjects"] != float64(4) || result["relationships"] != float64(4) || result["resource_manifests"] != float64(1) {
if result["subjects"] != float64(5) || result["relationships"] != float64(5) || result["resource_manifests"] != float64(1) {
t.Fatalf("load-registry result = %+v; want production actor registry counts", result)
}
}
@ -336,6 +336,36 @@ func TestOpsWardenProductionRegistryActors(t *testing.T) {
wantEffect: api.DecisionEffectAuditOnly,
wantReason: "advisory_would_signing_policy_matched",
},
{
name: "custodian agent proceeds with its own principal while zone is unknown",
subjectID: "agt-custodian",
actor: "agt-custodian",
actorType: "agt",
principal: "agt-custodian",
ttlHours: 12,
wantEffect: api.DecisionEffectAuditOnly,
wantReason: "advisory_would_signing_policy_matched",
},
{
name: "custodian agent IAM subject proceeds while zone is unknown",
subjectID: "iam:agt-custodian",
actor: "agt-custodian",
actorType: "agt",
principal: "agt-custodian",
ttlHours: 1,
wantEffect: api.DecisionEffectAuditOnly,
wantReason: "advisory_would_signing_policy_matched",
},
{
name: "custodian agent unknown principal is not matched",
subjectID: "agt-custodian",
actor: "agt-custodian",
actorType: "agt",
principal: "adm-full",
ttlHours: 1,
wantEffect: api.DecisionEffectAuditOnly,
wantReason: "advisory_would_disallowed_principal",
},
{
name: "admin actor allow",
subjectID: "adm-example",