coulomb/access-engine
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

SCOPE: record FLEX-WP-0037 agt-custodian registry rollout (revision 3)
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 605711@bnt-lap001
Assistant-Session: 1f5e2256-181f-49ed-b7b1-a1c34bf37a61
This commit is contained in:
tegwick 2026-10-21 00:04:43 +02:00
parent cf360d6211
commit c130b7d739
1 changed files with 7 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

7
SCOPE.md
View file

@ -144,6 +144,13 @@ in-cluster ops-warden pin and moved it to `callerAuth.mode: enforce` once
ops-warden adopted a calling identity (`WARDEN-WP-0031`): anonymous `/v1/check`
is 401, a token bound to another protected system is 403.
`FLEX-WP-0037` (2026-10-20) added the supervised-agent actor `agt-custodian`
to the ops-warden production registry fixture (`9132f9b`, pin `b429dcb`). An
attended `helm upgrade` of `flex-auth-ops-warden` rolled it out as revision 3,
with image `sha256:f7c04991…`; the rollback target is revision 2. The registry is
baked into the image, so adding an actor needs a new image and a helm upgrade,
not just a config change.
Production `policy.enabled` is **deliberately off, and is not coming back as a
boolean.** ops-warden's `ADR-0009` (2026-08-22, superseding `ADR-0006`) settles it:
`policy.enabled` is one repo-wide flag, and with `fail_closed: true` it makes