coulomb/access-engine
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Prepare renamed Access Engine runtime twins with exact reviewer scope
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
Build and Publish Container Image / build-and-push (push) Successful in 1m2s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade
This commit is contained in:
tegwick 2026-10-11 22:53:54 +02:00
parent 0bc15925e9
commit dd15d8cf3f
26 changed files with 1480 additions and 26 deletions
Download patch file Download diff file Expand all files Collapse all files

20
workplans/FLEX-WP-0036-runtime-rename-access-engine.md
View file

@ -181,7 +181,7 @@ args reference.
```task
id: FLEX-WP-0036-T05
status: todo
status: wait
priority: medium
depends_on: [FLEX-WP-0036-T03, FLEX-WP-0036-T04]
state_hub_task_id: "13b93d7a-8341-5c76-9ae8-0f36b45b10fc"
@ -197,6 +197,24 @@ that each twin pair runs the same digest.
Gate: every new pin Ready, `/healthz` 200, anonymous requests 401; founder go.
Blocked on `FLEX-WP-0020-T11` closing.
2026-10-11: native wait qualified once against existing `depends_on` T03/T04:
coordinator must prove predecessor image rollout on existing pins before any
new namespace/pin creation. No wait-task inspection or new grant was needed.
Actual source preparation adds the renamed chart, exact-content generated twins,
explicit audience/reviewer paths and render/fixture correspondence checks.
Twins retain the exact existing image repository/digest and policy argv; these
are migration compatibility details until an identical digest is published under
the renamed repository and the baked new paths are proven. No namespace or
release has been created by this preparation. Local source preparation is reversible blue work under
`the-custodian/canon/standards/build-mode-change-authorization_v0.1.md`.
Native rollout creates nine new ServiceAccount subjects bound to cluster-scoped
`create` on `authentication.k8s.io/tokenreviews`; matching the prior role's verbs
does not make those new principals an unchanged access scope. It is one red
access-scope-expansion item in the single daily batch, including exact binding
revocation recovery. No per-item founder request is needed. The first prepared
blue receipt is preserved as superseded by the classification correction; no
native action occurred. T03/T04 and ordered predecessor gates remain unchanged.
## Consumers switch over, one at a time
```task