5 commits

Author	SHA1	Message	Date
tegwick	3cb1cfaedf	Implement local decision delivery and reconcile blocked workplan requirements ... Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a1046e-fcad-7ea3-bf36-361fc8d679e8	2026-10-04 11:40:37 +02:00
tegwick	02b15a7f72	access-engine: secret-read evaluator for warden fetch checks (CUST-WP-0075) ... Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 3775@bnt-lap001 Assistant-Session: cfacb6a5-ad5b-4f79-ac67-053e3b0d34a3	2026-10-03 08:57:11 +02:00
tegwick	b2431e3cad	Enforce caller-auth on flex-auth-user-engine and record the live A2 probe ... Helm-adopted the kubectl-managed user-engine pin, promoted sha256:138aa347 warn then enforce. Reviewer volume needs fsGroup 65532; reviewer tokens must use the API default audiences or TokenReview 401s on this k3s. Live probe from user-engine-8569d7cb87-fp7px: 200 / 401 / 403. tenant-engine is unchanged. tenancy.current.A stays 0 until that pin moves.	2026-08-19 14:00:53 +02:00
tegwick	fa278674c1	Pin caller-auth digest in warn on independently rollable overlay pins ... The sanctioned Helm chart could not promote ADR 0004 at all, and the emergency manifests selected enforce. That made a FLEX-WP-0011 apply either a no-op or a global 401. First production pin is now warn, per consumer, on CI digest sha256:138aa347… . Enforce stays a later per-consumer flip so USER-WP-0023-T03 can close without waiting on tenant-engine.	2026-08-19 12:31:08 +02:00
tegwick	1d58f13eb8	Add Railiance staged-promotion overlay for flex-auth ... FLEX-WP-0011 T01/T02: railiance.app.v1 contract, independently pinned Helm values for tenant-engine and user-engine, isolated canary cycle (deploy/observe/promote/rollback), and emergency kubectl path retained. T03 waits on the custodian drain-plan row.	2026-08-16 01:32:31 +02:00