coulomb/access-engine
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

FLEX-WP-0037: pin flex-auth-ops-warden to main-9132f9b (agt-custodian registry)
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
values/ops-warden.yaml and its generated twin values/access-engine/ops-warden.yaml
move from sha256:138aa347 (main-3de72fe, rollback target) to
sha256:f7c04991a54ebc5fd2a55939e2f68efc7400a51f8773fb6703487833c65b3893.
No Argo application; rollout is an attended helm upgrade (FLEX-WP-0037-T03).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 605711@bnt-lap001
Assistant-Session: 1f5e2256-181f-49ed-b7b1-a1c34bf37a61
This commit is contained in:
tegwick 2026-10-20 23:03:48 +02:00
parent 9132f9b677
commit b429dcba8a
5 changed files with 16 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

2
WORK-RECORDS.md
View file

@ -226,7 +226,7 @@
| task | FLEX-WP-0036-T07 | todo | — | workplans/FLEX-WP-0036-runtime-rename-access-engine.md |
| task | FLEX-WP-0036-T08 | todo | — | workplans/FLEX-WP-0036-runtime-rename-access-engine.md |
| task | FLEX-WP-0037-T01 | done | — | workplans/FLEX-WP-0037-ops-warden-agt-custodian-actor.md |
| task | FLEX-WP-0037-T02 | progress | — | workplans/FLEX-WP-0037-ops-warden-agt-custodian-actor.md |
| task | FLEX-WP-0037-T02 | done | — | workplans/FLEX-WP-0037-ops-warden-agt-custodian-actor.md |
| task | FLEX-WP-0037-T03 | wait | — | workplans/FLEX-WP-0037-ops-warden-agt-custodian-actor.md |
| intake | FLEX-IN-0001 | closed | — | intakes/intakes.md |
| intake | FLEX-IN-0002 | closed | — | intakes/intakes.md |

3
deploy/README.md
View file

@ -100,7 +100,8 @@ last-known-good digest below.
| `flex-auth-tenant-engine` *(previous)* | `sha256:1bf060e61122693ce98359c167cc5fe8bdafc84e097e090eaa71af94d0f27cbc` | nine-action policy (FLEX-WP-0014), CI-built from `f304688` |
| `flex-auth-tenant-engine` *(previous)* | `sha256:9320df394a642eff24da8af4a0ee8886a7bb78b0f14d8ee1deeb30ea8eeeaba7` | seven-action policy, FLEX-WP-0013 restore; guardrail actions deny `unknown_action` |
| `flex-auth-tenant-engine` *(previous)* | `sha256:c25fc34a6cd7e64d955f8723ec70e176a583d5ae71d76280c4e2d89fba0fe0aa` | four-action policy; lifecycle actions deny `unknown_action` |
| `flex-auth-ops-warden` | `sha256:138aa3471c46bca6e814691fa1e6520aedda3dffd743e6b09141ab433afdb64b` | **live isolated enforce** — ops-warden production registry (FLEX-WP-0016), CI `main-3de72fe`, A2 probe 2026-08-19 |
| `flex-auth-ops-warden` *(pinned, pending attended upgrade)* | `sha256:f7c04991a54ebc5fd2a55939e2f68efc7400a51f8773fb6703487833c65b3893` | registry adds `agt-custodian` (FLEX-WP-0037, WARDEN-WP-0045), CI `main-9132f9b`, 2026-10-20 |
| `flex-auth-ops-warden` | `sha256:138aa3471c46bca6e814691fa1e6520aedda3dffd743e6b09141ab433afdb64b` | **live isolated enforce / rollback target** — ops-warden production registry (FLEX-WP-0016), CI `main-3de72fe`, A2 probe 2026-08-19 |
| `flex-auth-user-engine` | `sha256:138aa3471c46bca6e814691fa1e6520aedda3dffd743e6b09141ab433afdb64b` | **live** — caller-auth **enforce** (FLEX-WP-0015-T02), CI `main-3de72fe`, A2 probe 2026-08-19 |
| `flex-auth-user-engine` *(previous)* | `sha256:1f5290376dc5fcf456dc7a785e394d8b90949dabecd1d3e856f38557149bb5f4` | FLEX-WP-0009-T04, nine fixtures (incl. registration-applicant) verified live 2026-08-16 |
| `flex-auth-user-engine` *(previous)* | `sha256:a31961c45215aa6baf3bc748c6741ab703c2c8325e61aa7983a355026195e51b` | FLEX-WP-0009-T03, six fixtures verified live 2026-08-10 |

2
values/access-engine/ops-warden.yaml
View file

@ -2,7 +2,7 @@
name: access-engine-ops-warden
image:
repository: forgejo.coulomb.social/coulomb/flex-auth
digest: sha256:138aa3471c46bca6e814691fa1e6520aedda3dffd743e6b09141ab433afdb64b
digest: sha256:f7c04991a54ebc5fd2a55939e2f68efc7400a51f8773fb6703487833c65b3893
args:
- serve
- --addr

2
values/ops-warden.yaml
View file

@ -5,7 +5,7 @@
name: flex-auth-ops-warden
image:
repository: forgejo.coulomb.social/coulomb/flex-auth
digest: sha256:138aa3471c46bca6e814691fa1e6520aedda3dffd743e6b09141ab433afdb64b
digest: sha256:f7c04991a54ebc5fd2a55939e2f68efc7400a51f8773fb6703487833c65b3893
args:
- serve
- --addr

12
workplans/FLEX-WP-0037-ops-warden-agt-custodian-actor.md
View file

@ -60,7 +60,7 @@ agt actor in this fixture).
```task
id: FLEX-WP-0037-T02
status: progress
status: done
priority: high
```
@ -73,6 +73,16 @@ current pin `sha256:138aa3471c46bca6e814691fa1e6520aedda3dffd743e6b09141ab433afd
flex-auth has no Argo Application; the pin is applied by an attended Helm
upgrade, so a pushed pin does not deploy by itself.
Result: CI `build-and-push` for `9132f9b` succeeded; `main-9132f9b` =
`sha256:f7c04991a54ebc5fd2a55939e2f68efc7400a51f8773fb6703487833c65b3893`. The
snapshot extracted from the image layer has the same sha256 as the committed
fixture (`5ee90a82…`). `values/ops-warden.yaml` now pins that digest. Note the
previous pin was built from `main-3de72fe` (2026-08), so this roll also carries
every code change since then; the same image line already serves the fetch pin.
The generated runtime twin `values/access-engine/ops-warden.yaml`
(`access-engine-ops-warden`, FLEX-WP-0036) was regenerated with
`tools/gen_runtime_twins.py` to the same digest; `tests/stage1.sh` passes.
## Attended rollout and smoke
```task