# FLEX-WP-0035-T04: advisory application access readback for user-engine.
# Founder-approved 2026-10-10. Runs each participant's package from the same
# image digest and path as that participant's own pin (contract §4); the test
# TestReadbackPinMatchesParticipantPins enforces it.
name: flex-auth-application-readback
image:
  repository: forgejo.coulomb.social/coulomb/flex-auth
  digest: sha256:e8c57c18a4a9d5583be099146984f7e9cd881446218b65aeefd7619b18aa9229
args:
- serve-readback
- --addr
- 0.0.0.0:8080
- --registry
- /opt/flex-auth/examples/application-readback/registry_snapshot.json
- --registry
- /opt/flex-auth/examples/informed-decision-lifecycle/registry.json
- --package
- informed-decision=/opt/flex-auth/examples/informed-decision-lifecycle/policy.md
callerAuth:
  mode: enforce
  kubernetesURL: https://10.43.0.1
readback:
  enabled: true
  caller: system:serviceaccount:user-engine:user-engine
consumer:
  isolated: false
  namespace: user-engine
  podName: user-engine
resources:
  requests:
    cpu: 5m
    memory: 32Mi
  limits:
    cpu: 300m
    memory: 192Mi