coulomb/access-engine
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Prepare renamed Access Engine runtime twins with exact reviewer scope
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
Build and Publish Container Image / build-and-push (push) Successful in 1m2s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade
This commit is contained in:
tegwick 2026-10-11 22:53:54 +02:00
parent 0bc15925e9
commit dd15d8cf3f
26 changed files with 1480 additions and 26 deletions
Download patch file Download diff file Expand all files Collapse all files

439
docs/evidence/2026-10-11-runtime-twins/access-runtime-twins-prepared-receipt-v2.json Normal file
View file

@ -0,0 +1,439 @@
{
"schema": "build-mode-prepared-change-v2",
"workplan": "FLEX-WP-0036",
"task": "FLEX-WP-0036-T05",
"status": "PREPARED_SOURCE_ONLY_NATIVE_RED_BATCH_WAIT",
"target": "access-engine namespace and nine side-by-side releases",
"prerequisites": [
"Single daily red batch disposition authorizes exact nine new TokenReview ServiceAccount bindings",
"Ordered preceding critical-path live evidence by coordinator",
"T03 image compatibility rollout verified on existing pins",
"T04 exact artifact availability and same-digest twin provenance verified",
"Old T05 declared external dependency qualified by coordinator; worker did not inspect wait task",
"Actual live pin inventory/digest and CPU headroom reconciled before server dry-run"
],
"expected_result": "Nine renamed releases Ready; /healthz200; anonymous protected routes401; exact twin image/policy and caller/network scope unchanged",
"abort_owner": "Custodian coordinator acting as Access runtime change owner",
"abort_conditions": [
"Any source/live twin digest or package argv mismatch",
"Any unproven preceding critical-path gate",
"Insufficient headroom or rollout stall",
"New pin cannot TokenReview or cannot match old decision behavior",
"Any changed caller principal, ingress/egress grant or shared durable writer state",
"Any missing exact red-batch authorization for new API principals or recovery revocation scope"
],
"verification": [
"Fresh helm template + server dry-run for exact source revision, namespace and pin manifests",
"Reconcile live nine-pin inventory and image digests against source",
"Ready, healthz200 and anonymous401 each new pin",
"Live authenticated owner allow/deny correspondence with old twin; no consumer switch in T05",
"Read back exact nine bound ServiceAccount subjects and TokenReview-only ClusterRole rules; prove no additional subjects/resources/verbs were admitted"
],
"rollback": "Before execution: no native grants exist to revoke. If the exact red batch is authorized and executed, suspend newly introduced GitOps reconciliation and scale only new access-engine Deployments to zero to stop workloads; this does NOT revoke their TokenReview authority. Rollback must additionally revoke exactly the nine new ClusterRoleBindings through the authorized red-batch recovery scope, retaining prior flex-auth bindings and all namespaces/data. Do not claim scale-zero alone revokes credentials or API authority. Destructive namespace/data deletion remains outside this item.",
"scope_limits": [
"No consumer endpoint/egress flip",
"No live mutation executed",
"No dual repository publication or unproven new image paths claimed",
"No durable writer twins generated",
"Nine new Kubernetes API TokenReview caller grants are explicitly proposed in red batch; no new protected-consumer caller mappings, secret grants or native writes executed"
],
"pins": [
{
"name": "access-engine-application-readback",
"image": "forgejo.coulomb.social/coulomb/flex-auth@sha256:e8c57c18a4a9d5583be099146984f7e9cd881446218b65aeefd7619b18aa9229",
"caller_auth": {
"mode": "enforce",
"kubernetesURL": "https://10.43.0.1",
"audience": "access-engine"
},
"consumer": {
"isolated": false,
"namespace": "user-engine",
"podName": "user-engine"
},
"request_cpu": "5m",
"request_memory": "32Mi"
},
{
"name": "access-engine-informed-decision-lifecycle",
"image": "forgejo.coulomb.social/coulomb/flex-auth@sha256:e8c57c18a4a9d5583be099146984f7e9cd881446218b65aeefd7619b18aa9229",
"caller_auth": {
"mode": "enforce",
"kubernetesURL": "https://10.43.0.1",
"binding": "informed-decision=system:serviceaccount:informed-decision:review",
"audience": "access-engine"
},
"consumer": {
"isolated": false,
"namespace": "informed-decision",
"podName": "informed-decision"
},
"request_cpu": "5m",
"request_memory": "32Mi"
},
{
"name": "access-engine-informed-decision-sitting",
"image": "forgejo.coulomb.social/coulomb/flex-auth@sha256:bdac62bc3f089cba0df7c35eeb8d0d9b3af2d4bae5e4ea4767516c1ed20b1e99",
"caller_auth": {
"mode": "enforce",
"kubernetesURL": "https://10.43.0.1",
"binding": "informed-decision=system:serviceaccount:informed-decision:review",
"audience": "access-engine"
},
"consumer": {
"isolated": false,
"namespace": "informed-decision",
"podName": "informed-decision"
},
"request_cpu": "5m",
"request_memory": "32Mi"
},
{
"name": "access-engine-informed-decision-t03",
"image": "forgejo.coulomb.social/coulomb/flex-auth@sha256:6600c7a62c36dfb4fbb42590722613827d07ff49875b1f0f4b5de63d8351658d",
"caller_auth": {
"mode": "enforce",
"kubernetesURL": "https://10.43.0.1",
"binding": "informed-decision=system:serviceaccount:informed-decision:review",
"audience": "access-engine"
},
"consumer": {
"isolated": false,
"namespace": "informed-decision",
"podName": "informed-decision"
},
"request_cpu": "5m",
"request_memory": "32Mi"
},
{
"name": "access-engine-ops-warden-fetch",
"image": "forgejo.coulomb.social/coulomb/flex-auth@sha256:419bc37420d0d0a5304a8587448f1fdbf87117fb041fb43081b0449b4a7bb13b",
"caller_auth": {
"mode": "enforce",
"kubernetesURL": "https://10.43.0.1",
"binding": "key-cape=system:serviceaccount:ops-warden:ops-warden",
"extraBindings": [
"railiance-platform=system:serviceaccount:ops-warden:ops-warden"
],
"audience": "access-engine"
},
"consumer": {
"isolated": true
},
"request_cpu": "25m",
"request_memory": "32Mi"
},
{
"name": "access-engine-ops-warden",
"image": "forgejo.coulomb.social/coulomb/flex-auth@sha256:138aa3471c46bca6e814691fa1e6520aedda3dffd743e6b09141ab433afdb64b",
"caller_auth": {
"mode": "enforce",
"kubernetesURL": "https://10.43.0.1",
"binding": "ops-warden=system:serviceaccount:ops-warden:ops-warden",
"audience": "access-engine"
},
"consumer": {
"isolated": true
},
"request_cpu": "25m",
"request_memory": "32Mi"
},
{
"name": "access-engine-secrets-engine",
"image": "forgejo.coulomb.social/coulomb/flex-auth@sha256:05a03a8790c2210c48ea92391441c77ddf640d0cd32f5ec09838f5393171fcbd",
"caller_auth": {
"mode": "enforce",
"kubernetesURL": "https://10.43.0.1",
"binding": "secrets-engine=system:serviceaccount:secrets-engine:secrets-engine",
"audience": "access-engine"
},
"consumer": {
"isolated": false,
"namespace": "secrets-engine",
"podName": "secrets-engine"
},
"request_cpu": "25m",
"request_memory": "32Mi"
},
{
"name": "access-engine-tenant-engine",
"image": "forgejo.coulomb.social/coulomb/flex-auth@sha256:05a03a8790c2210c48ea92391441c77ddf640d0cd32f5ec09838f5393171fcbd",
"caller_auth": {
"mode": "enforce",
"kubernetesURL": "https://10.43.0.1",
"binding": "tenant-engine=system:serviceaccount:tenant-engine:tenant-engine",
"audience": "access-engine"
},
"consumer": {
"isolated": false,
"namespace": "tenant-engine",
"podName": "tenant-engine"
},
"request_cpu": "25m",
"request_memory": "32Mi"
},
{
"name": "access-engine-user-engine",
"image": "forgejo.coulomb.social/coulomb/flex-auth@sha256:138aa3471c46bca6e814691fa1e6520aedda3dffd743e6b09141ab433afdb64b",
"caller_auth": {
"mode": "enforce",
"kubernetesURL": "https://10.43.0.1",
"binding": "user-engine=system:serviceaccount:user-engine:user-engine",
"audience": "access-engine"
},
"consumer": {
"isolated": false,
"namespace": "user-engine",
"podName": "user-engine"
},
"request_cpu": "25m",
"request_memory": "32Mi"
}
],
"classification": {
"source_preparation": "blue reversible local source work",
"native_namespace_and_pins": "red access-scope expansion: new ServiceAccounts receive Kubernetes TokenReview API create authority",
"reason": "Equality of verb sets does not establish equality of principals; nine new bound subjects can now create tokenreviews.",
"approval_route": "one item in the single daily red batch; no per-item founder request"
},
"supersedes": {
"path": "/tmp/access-runtime-twins-prepared-receipt.json",
"sha256": "ddf0d366afa3330ab753079dc6e4c122559b3bb2b9c6e38faf72d23f8a09127d",
"reason": "First prepared receipt incorrectly classified new TokenReview principals as blue based on role-verb parity."
},
"new_access_scope": [
{
"subject": {
"kind": "ServiceAccount",
"namespace": "access-engine",
"name": "access-engine-application-readback",
"authenticated_username": "system:serviceaccount:access-engine:access-engine-application-readback"
},
"binding": "access-engine-application-readback-tokenreviewer",
"role": {
"kind": "ClusterRole",
"name": "access-engine-application-readback-tokenreviewer"
},
"capability": {
"apiGroups": [
"authentication.k8s.io"
],
"resources": [
"tokenreviews"
],
"verbs": [
"create"
]
},
"scope": "cluster-scoped TokenReview API create; not a secrets-read grant or protected-consumer impersonation grant"
},
{
"subject": {
"kind": "ServiceAccount",
"namespace": "access-engine",
"name": "access-engine-informed-decision-lifecycle",
"authenticated_username": "system:serviceaccount:access-engine:access-engine-informed-decision-lifecycle"
},
"binding": "access-engine-informed-decision-lifecycle-tokenreviewer",
"role": {
"kind": "ClusterRole",
"name": "access-engine-informed-decision-lifecycle-tokenreviewer"
},
"capability": {
"apiGroups": [
"authentication.k8s.io"
],
"resources": [
"tokenreviews"
],
"verbs": [
"create"
]
},
"scope": "cluster-scoped TokenReview API create; not a secrets-read grant or protected-consumer impersonation grant"
},
{
"subject": {
"kind": "ServiceAccount",
"namespace": "access-engine",
"name": "access-engine-informed-decision-sitting",
"authenticated_username": "system:serviceaccount:access-engine:access-engine-informed-decision-sitting"
},
"binding": "access-engine-informed-decision-sitting-tokenreviewer",
"role": {
"kind": "ClusterRole",
"name": "access-engine-informed-decision-sitting-tokenreviewer"
},
"capability": {
"apiGroups": [
"authentication.k8s.io"
],
"resources": [
"tokenreviews"
],
"verbs": [
"create"
]
},
"scope": "cluster-scoped TokenReview API create; not a secrets-read grant or protected-consumer impersonation grant"
},
{
"subject": {
"kind": "ServiceAccount",
"namespace": "access-engine",
"name": "access-engine-informed-decision-t03",
"authenticated_username": "system:serviceaccount:access-engine:access-engine-informed-decision-t03"
},
"binding": "access-engine-informed-decision-t03-tokenreviewer",
"role": {
"kind": "ClusterRole",
"name": "access-engine-informed-decision-t03-tokenreviewer"
},
"capability": {
"apiGroups": [
"authentication.k8s.io"
],
"resources": [
"tokenreviews"
],
"verbs": [
"create"
]
},
"scope": "cluster-scoped TokenReview API create; not a secrets-read grant or protected-consumer impersonation grant"
},
{
"subject": {
"kind": "ServiceAccount",
"namespace": "access-engine",
"name": "access-engine-ops-warden-fetch",
"authenticated_username": "system:serviceaccount:access-engine:access-engine-ops-warden-fetch"
},
"binding": "access-engine-ops-warden-fetch-tokenreviewer",
"role": {
"kind": "ClusterRole",
"name": "access-engine-ops-warden-fetch-tokenreviewer"
},
"capability": {
"apiGroups": [
"authentication.k8s.io"
],
"resources": [
"tokenreviews"
],
"verbs": [
"create"
]
},
"scope": "cluster-scoped TokenReview API create; not a secrets-read grant or protected-consumer impersonation grant"
},
{
"subject": {
"kind": "ServiceAccount",
"namespace": "access-engine",
"name": "access-engine-ops-warden",
"authenticated_username": "system:serviceaccount:access-engine:access-engine-ops-warden"
},
"binding": "access-engine-ops-warden-tokenreviewer",
"role": {
"kind": "ClusterRole",
"name": "access-engine-ops-warden-tokenreviewer"
},
"capability": {
"apiGroups": [
"authentication.k8s.io"
],
"resources": [
"tokenreviews"
],
"verbs": [
"create"
]
},
"scope": "cluster-scoped TokenReview API create; not a secrets-read grant or protected-consumer impersonation grant"
},
{
"subject": {
"kind": "ServiceAccount",
"namespace": "access-engine",
"name": "access-engine-secrets-engine",
"authenticated_username": "system:serviceaccount:access-engine:access-engine-secrets-engine"
},
"binding": "access-engine-secrets-engine-tokenreviewer",
"role": {
"kind": "ClusterRole",
"name": "access-engine-secrets-engine-tokenreviewer"
},
"capability": {
"apiGroups": [
"authentication.k8s.io"
],
"resources": [
"tokenreviews"
],
"verbs": [
"create"
]
},
"scope": "cluster-scoped TokenReview API create; not a secrets-read grant or protected-consumer impersonation grant"
},
{
"subject": {
"kind": "ServiceAccount",
"namespace": "access-engine",
"name": "access-engine-tenant-engine",
"authenticated_username": "system:serviceaccount:access-engine:access-engine-tenant-engine"
},
"binding": "access-engine-tenant-engine-tokenreviewer",
"role": {
"kind": "ClusterRole",
"name": "access-engine-tenant-engine-tokenreviewer"
},
"capability": {
"apiGroups": [
"authentication.k8s.io"
],
"resources": [
"tokenreviews"
],
"verbs": [
"create"
]
},
"scope": "cluster-scoped TokenReview API create; not a secrets-read grant or protected-consumer impersonation grant"
},
{
"subject": {
"kind": "ServiceAccount",
"namespace": "access-engine",
"name": "access-engine-user-engine",
"authenticated_username": "system:serviceaccount:access-engine:access-engine-user-engine"
},
"binding": "access-engine-user-engine-tokenreviewer",
"role": {
"kind": "ClusterRole",
"name": "access-engine-user-engine-tokenreviewer"
},
"capability": {
"apiGroups": [
"authentication.k8s.io"
],
"resources": [
"tokenreviews"
],
"verbs": [
"create"
]
},
"scope": "cluster-scoped TokenReview API create; not a secrets-read grant or protected-consumer impersonation grant"
}
],
"daily_red_batch_item": {
"id": "FLEX-WP-0036-T05-tokenreview-twins",
"request": "Authorize exact nine access-engine ServiceAccount TokenReview create bindings, together with exact binding revocation recovery; dependent namespace/pin rollout stays gated on T03/T04 and ordered predecessor evidence.",
"new_subject_count": 9,
"scope_list_field": "new_access_scope",
"execution_state": "not executed",
"scope_limits": "No secrets-read grants, protected-consumer mapping expansion, namespace/data deletion or consumer endpoint change."
}
}

190
docs/evidence/2026-10-11-runtime-twins/access-runtime-twins-prepared-receipt.json Normal file
View file

@ -0,0 +1,190 @@
{
"schema": "build-mode-prepared-blue-change-v1",
"workplan": "FLEX-WP-0036",
"task": "FLEX-WP-0036-T05",
"status": "PREPARED_SOURCE_ONLY_NATIVE_WAIT",
"target": "access-engine namespace and nine side-by-side releases",
"prerequisites": [
"Ordered preceding critical-path live evidence by coordinator",
"T03 image compatibility rollout verified on existing pins",
"T04 exact artifact availability and same-digest twin provenance verified",
"Old T05 declared external dependency qualified by coordinator; worker did not inspect wait task",
"Actual live pin inventory/digest and CPU headroom reconciled before server dry-run"
],
"expected_result": "Nine renamed releases Ready; /healthz200; anonymous protected routes401; exact twin image/policy and caller/network scope unchanged",
"abort_owner": "Custodian coordinator acting as Access runtime change owner",
"abort_conditions": [
"Any source/live twin digest or package argv mismatch",
"Any unproven preceding critical-path gate",
"Insufficient headroom or rollout stall",
"New pin cannot TokenReview or cannot match old decision behavior",
"Any changed caller principal, ingress/egress grant or shared durable writer state"
],
"verification": [
"Fresh helm template + server dry-run for exact source revision, namespace and pin manifests",
"Reconcile live nine-pin inventory and image digests against source",
"Ready, healthz200 and anonymous401 each new pin",
"Live authenticated owner allow/deny correspondence with old twin; no consumer switch in T05"
],
"rollback": "Suspend newly introduced GitOps reconciliation and scale only newly created access-engine Deployments to zero. Leave flex-auth releases, namespace, data and caller configuration intact. Do not delete old/new namespaces, RBAC or durable storage in this blue scope; destructive cleanup goes to the red batch.",
"scope_limits": [
"No consumer endpoint/egress flip",
"No live mutation executed",
"No new caller grants or secrets",
"No dual repository publication or unproven new image paths claimed",
"No durable writer twins generated"
],
"pins": [
{
"name": "access-engine-application-readback",
"image": "forgejo.coulomb.social/coulomb/flex-auth@sha256:e8c57c18a4a9d5583be099146984f7e9cd881446218b65aeefd7619b18aa9229",
"caller_auth": {
"mode": "enforce",
"kubernetesURL": "https://10.43.0.1",
"audience": "access-engine"
},
"consumer": {
"isolated": false,
"namespace": "user-engine",
"podName": "user-engine"
},
"request_cpu": "5m",
"request_memory": "32Mi"
},
{
"name": "access-engine-informed-decision-lifecycle",
"image": "forgejo.coulomb.social/coulomb/flex-auth@sha256:e8c57c18a4a9d5583be099146984f7e9cd881446218b65aeefd7619b18aa9229",
"caller_auth": {
"mode": "enforce",
"kubernetesURL": "https://10.43.0.1",
"binding": "informed-decision=system:serviceaccount:informed-decision:review",
"audience": "access-engine"
},
"consumer": {
"isolated": false,
"namespace": "informed-decision",
"podName": "informed-decision"
},
"request_cpu": "5m",
"request_memory": "32Mi"
},
{
"name": "access-engine-informed-decision-sitting",
"image": "forgejo.coulomb.social/coulomb/flex-auth@sha256:bdac62bc3f089cba0df7c35eeb8d0d9b3af2d4bae5e4ea4767516c1ed20b1e99",
"caller_auth": {
"mode": "enforce",
"kubernetesURL": "https://10.43.0.1",
"binding": "informed-decision=system:serviceaccount:informed-decision:review",
"audience": "access-engine"
},
"consumer": {
"isolated": false,
"namespace": "informed-decision",
"podName": "informed-decision"
},
"request_cpu": "5m",
"request_memory": "32Mi"
},
{
"name": "access-engine-informed-decision-t03",
"image": "forgejo.coulomb.social/coulomb/flex-auth@sha256:6600c7a62c36dfb4fbb42590722613827d07ff49875b1f0f4b5de63d8351658d",
"caller_auth": {
"mode": "enforce",
"kubernetesURL": "https://10.43.0.1",
"binding": "informed-decision=system:serviceaccount:informed-decision:review",
"audience": "access-engine"
},
"consumer": {
"isolated": false,
"namespace": "informed-decision",
"podName": "informed-decision"
},
"request_cpu": "5m",
"request_memory": "32Mi"
},
{
"name": "access-engine-ops-warden-fetch",
"image": "forgejo.coulomb.social/coulomb/flex-auth@sha256:419bc37420d0d0a5304a8587448f1fdbf87117fb041fb43081b0449b4a7bb13b",
"caller_auth": {
"mode": "enforce",
"kubernetesURL": "https://10.43.0.1",
"binding": "key-cape=system:serviceaccount:ops-warden:ops-warden",
"extraBindings": [
"railiance-platform=system:serviceaccount:ops-warden:ops-warden"
],
"audience": "access-engine"
},
"consumer": {
"isolated": true
},
"request_cpu": "25m",
"request_memory": "32Mi"
},
{
"name": "access-engine-ops-warden",
"image": "forgejo.coulomb.social/coulomb/flex-auth@sha256:138aa3471c46bca6e814691fa1e6520aedda3dffd743e6b09141ab433afdb64b",
"caller_auth": {
"mode": "enforce",
"kubernetesURL": "https://10.43.0.1",
"binding": "ops-warden=system:serviceaccount:ops-warden:ops-warden",
"audience": "access-engine"
},
"consumer": {
"isolated": true
},
"request_cpu": "25m",
"request_memory": "32Mi"
},
{
"name": "access-engine-secrets-engine",
"image": "forgejo.coulomb.social/coulomb/flex-auth@sha256:05a03a8790c2210c48ea92391441c77ddf640d0cd32f5ec09838f5393171fcbd",
"caller_auth": {
"mode": "enforce",
"kubernetesURL": "https://10.43.0.1",
"binding": "secrets-engine=system:serviceaccount:secrets-engine:secrets-engine",
"audience": "access-engine"
},
"consumer": {
"isolated": false,
"namespace": "secrets-engine",
"podName": "secrets-engine"
},
"request_cpu": "25m",
"request_memory": "32Mi"
},
{
"name": "access-engine-tenant-engine",
"image": "forgejo.coulomb.social/coulomb/flex-auth@sha256:05a03a8790c2210c48ea92391441c77ddf640d0cd32f5ec09838f5393171fcbd",
"caller_auth": {
"mode": "enforce",
"kubernetesURL": "https://10.43.0.1",
"binding": "tenant-engine=system:serviceaccount:tenant-engine:tenant-engine",
"audience": "access-engine"
},
"consumer": {
"isolated": false,
"namespace": "tenant-engine",
"podName": "tenant-engine"
},
"request_cpu": "25m",
"request_memory": "32Mi"
},
{
"name": "access-engine-user-engine",
"image": "forgejo.coulomb.social/coulomb/flex-auth@sha256:138aa3471c46bca6e814691fa1e6520aedda3dffd743e6b09141ab433afdb64b",
"caller_auth": {
"mode": "enforce",
"kubernetesURL": "https://10.43.0.1",
"binding": "user-engine=system:serviceaccount:user-engine:user-engine",
"audience": "access-engine"
},
"consumer": {
"isolated": false,
"namespace": "user-engine",
"podName": "user-engine"
},
"request_cpu": "25m",
"request_memory": "32Mi"
}
]
}