coulomb/access-engine
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

ADHOC-2026-10-03-T02: record the live fetch pin (steps 1-5 done 2026-10-03); remaining receipts are ops-warden's
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 3s
Details

Browse source 
Also commits fix-consistency writebacks for FLEX-WP-0035/0036.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 735967@bnt-lap001
Assistant-Session: 5971967f-77f8-4ced-9e02-c6ef67040ffc
This commit is contained in:
tegwick 2026-10-10 13:17:59 +02:00
parent e337ba0c6f
commit c284344925
3 changed files with 35 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

13
WORK-RECORDS.md
View file

@ -44,6 +44,7 @@
| workplan | FLEX-WP-0033 | finished | — | workplans/FLEX-WP-0033-informed-decision-lifecycle.md |
| workplan | FLEX-WP-0034 | finished | — | workplans/FLEX-WP-0034-informed-decision-review-discovery.md |
| workplan | FLEX-WP-0035 | active | — | workplans/FLEX-WP-0035-per-identity-application-readback.md |
| workplan | FLEX-WP-0036 | proposed | — | workplans/FLEX-WP-0036-runtime-rename-access-engine.md |
| task | FLEX-WP-ADHOC-2026-10-03-T01 | done | — | workplans/ADHOC-2026-10-03.md |
| task | FLEX-WP-ADHOC-2026-10-03-T02 | wait | — | workplans/ADHOC-2026-10-03.md |
| task | FLEX-WP-0001-T001 | done | — | workplans/FLEX-WP-0001-repo-intent-and-architecture-baseline.md |
@ -204,8 +205,16 @@
| task | FLEX-WP-0035-T01 | done | — | workplans/FLEX-WP-0035-per-identity-application-readback.md |
| task | FLEX-WP-0035-T02 | done | — | workplans/FLEX-WP-0035-per-identity-application-readback.md |
| task | FLEX-WP-0035-T03 | done | — | workplans/FLEX-WP-0035-per-identity-application-readback.md |
| task | FLEX-WP-0035-T04 | wait | — | workplans/FLEX-WP-0035-per-identity-application-readback.md |
| task | FLEX-WP-0035-T05 | wait | — | workplans/FLEX-WP-0035-per-identity-application-readback.md |
| task | FLEX-WP-0035-T04 | done | — | workplans/FLEX-WP-0035-per-identity-application-readback.md |
| task | FLEX-WP-0035-T05 | done | — | workplans/FLEX-WP-0035-per-identity-application-readback.md |
| task | FLEX-WP-0036-T01 | todo | — | workplans/FLEX-WP-0036-runtime-rename-access-engine.md |
| task | FLEX-WP-0036-T02 | todo | — | workplans/FLEX-WP-0036-runtime-rename-access-engine.md |
| task | FLEX-WP-0036-T03 | todo | — | workplans/FLEX-WP-0036-runtime-rename-access-engine.md |
| task | FLEX-WP-0036-T04 | todo | — | workplans/FLEX-WP-0036-runtime-rename-access-engine.md |
| task | FLEX-WP-0036-T05 | todo | — | workplans/FLEX-WP-0036-runtime-rename-access-engine.md |
| task | FLEX-WP-0036-T06 | todo | — | workplans/FLEX-WP-0036-runtime-rename-access-engine.md |
| task | FLEX-WP-0036-T07 | todo | — | workplans/FLEX-WP-0036-runtime-rename-access-engine.md |
| task | FLEX-WP-0036-T08 | todo | — | workplans/FLEX-WP-0036-runtime-rename-access-engine.md |
| intake | FLEX-IN-0001 | closed | — | intakes/intakes.md |
| intake | FLEX-IN-0002 | closed | — | intakes/intakes.md |
| decision | FLEX-DEC-2026-001 | resolved | — | decisions/decisions.md |

16
workplans/ADHOC-2026-10-03.md
View file

@ -56,7 +56,8 @@ id: FLEX-WP-ADHOC-2026-10-03-T02
status: wait
priority: high
needs_human: true
blocking_reason: "Live railiance01 change; founder go needed for CI image digest, helm install and tunnel."
blocked_on: message-from:ops-warden
blocking_reason: "Pin is live (steps 1-5). Remaining: ops-warden token receipts and fetch URL (steps 6-7, WARDEN-WP-0039-T03); founder to resolve decision 877c268b for the install that already ran."
state_hub_task_id: "aa00b29f-fc1a-51e2-a373-0e3c72c1d6f4"
decision_id: "877c268b-2089-42f1-a811-d98f549c1cb2"
```
@ -102,3 +103,16 @@ Decision 877c268b-2089-42f1-a811-d98f549c1cb2 was checked and remains open.
This task and workplan stay blocked on the approved rollout; no live change was
made. Requirements are recorded in
`docs/blocked-task-dependencies-2026-10-04.md`.
2026-10-10 review: the earlier notes are stale. Steps 1-5 were done on
2026-10-03 at 07:17 (`helm history`: `flex-auth-ops-warden-fetch` revision 1),
yet the 2026-10-04 notes still say "no live change was made". Live image
`sha256:419bc374…` matches `values/ops-warden-fetch.yaml`. The Service has
ClusterIP `10.43.151.3`. Tunnel `flex-auth-ops-warden-fetch-railiance01` is
connected on 19091. From the workstation, `/healthz` returns 200 and an
anonymous `/v1/check` returns 401. Nothing in this repo records who approved
the install, and decision `877c268b` is still open, so the founder must resolve
it. Steps 6-7 belong to ops-warden: positive, wrong-owner and fail-closed
receipts with its own token, and `policy.fetch_flex_auth_url`. Its example
config already names the in-cluster URL. The pin log has no decisions in 7
days, so ops-warden has not yet called it.

9
workplans/FLEX-WP-0036-runtime-rename-access-engine.md
View file

@ -12,6 +12,7 @@ updated: "2026-10-10"
origin: demand
origin_ref: founder 2026-10-10 ("the relicts are too disorienting")
related: [FLEX-WP-0020]
state_hub_workstream_id: "af0f8d77-af04-569b-8e79-6c47eb8f1087"
---
`FLEX-WP-0020` renamed the repository only. `FLEX-DEC-2026-013` kept every
@ -66,6 +67,7 @@ written.
id: FLEX-WP-0036-T01
status: todo
priority: high
state_hub_task_id: "4f9a796d-832f-5936-8a34-eb980f6e1b57"
```
Record `FLEX-DEC-2026-020`: runtime names move to `access-engine`, following
@ -83,6 +85,7 @@ id: FLEX-WP-0036-T02
status: todo
priority: high
depends_on: [FLEX-WP-0036-T01]
state_hub_task_id: "8f597899-677e-544b-ad58-26aab2614312"
```
For each consumer, list every place that names the runtime: URL, audience,
@ -105,6 +108,7 @@ id: FLEX-WP-0036-T03
status: todo
priority: high
depends_on: [FLEX-WP-0036-T01]
state_hub_task_id: "487525e5-c89e-586e-8e9b-54ac6da0804e"
```
Caller auth accepts `access-engine` and `flex-auth` audiences, and packages
@ -122,6 +126,7 @@ id: FLEX-WP-0036-T04
status: todo
priority: medium
depends_on: [FLEX-WP-0036-T01]
state_hub_task_id: "ff7fd369-326f-5044-aaa4-96c5f45c80e9"
```
Go module, `cmd/access-engine`, binary, `ACCESS_ENGINE_*` env vars (read the
@ -139,6 +144,7 @@ id: FLEX-WP-0036-T05
status: todo
priority: medium
depends_on: [FLEX-WP-0036-T03, FLEX-WP-0036-T04]
state_hub_task_id: "13b93d7a-8341-5c76-9ae8-0f36b45b10fc"
```
Create the `access-engine` namespace, then one `access-engine-<consumer>` pin
@ -158,6 +164,7 @@ id: FLEX-WP-0036-T06
status: todo
priority: medium
depends_on: [FLEX-WP-0036-T02, FLEX-WP-0036-T05]
state_hub_task_id: "f0470e5c-3ea7-506c-b8bb-3ade0b57ff88"
```
Each consumer changes its URL, its egress policy (add the new namespace before
@ -175,6 +182,7 @@ id: FLEX-WP-0036-T07
status: todo
priority: medium
depends_on: [FLEX-WP-0036-T06]
state_hub_task_id: "e46c9c8e-a114-5c49-b035-22fdbd6a435b"
```
After a soak with no traffic on the old pins: uninstall each `flex-auth-*`
@ -193,6 +201,7 @@ id: FLEX-WP-0036-T08
status: todo
priority: low
depends_on: [FLEX-WP-0036-T06]
state_hub_task_id: "be5440aa-4584-5e4f-9459-242ecf5c7199"
```
SCOPE, INTENT and its layer declaration, the conformance doc, the stance