coulomb/access-engine
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
access-engine/docs/runtime-rename-inventory.md
tegwick f758381cea
All checks were successful
CI Smoke / host-smoke (push) Successful in 1s
Details
CI Smoke / container-smoke (push) Successful in 6s
Details
Build and Publish Container Image / build-and-push (push) Successful in 1m23s
Details
FLEX-WP-0036: Go module is github.com/netkingdom/access-engine; T02 consumer inventory 
- module path renamed (no external importers); golangci local-prefixes
- ACCESS_ENGINE_RUN_TOPAZ_INTEGRATION replaces FLEX_AUTH_RUN_TOPAZ_INTEGRATION
- README title and identity paragraph reflect the landed renames
- docs/runtime-rename-inventory.md: per-consumer references by kind and order
- chart name, image package and /opt paths deliberately left for T05

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 735967@bnt-lap001
Assistant-Session: 5971967f-77f8-4ced-9e02-c6ef67040ffc
2026-10-10 15:29:00 +02:00

5.1 KiB
Raw Blame History

Runtime rename inventory (FLEX-WP-0036-T02)

Derived 2026-10-10 by searching each consumer checkout for flex-auth and FLEX_AUTH in code and config (.py .go .yaml .yml .toml .json .sh .ts). Git, venv, history and archived paths are excluded. Tests are listed only where they run the binary. Historical evidence and batch files under docs/ are counted but are not to be rewritten: they record what was live at the time.

Re-derive before T06 with the same search. This is a snapshot, not a register.

What a consumer has to change, by kind

Kind Breaks if changed before the PDP accepts it? Order
Service URL flex-auth-<c>.flex-auth.svc… Yes: the new name resolves only once T05 has run T05, then the consumer
Egress NetworkPolicy naming namespace flex-auth Yes: drops traffic to the old pin Add access-engine, switch, then remove flex-auth
Projected-token audience flex-auth Yes: 401 until T03 accepts access-engine T03, then the consumer
resource.system / owner_repo = flex-auth Yes: not_applicable, i.e. deny (FLEX-DEC-2026-015) T03, then the consumer
Consumer-owned env var names (<C>_FLEX_AUTH_URL …) No: the consumer's own vocabulary Consumer's choice; not required
Builds or runs our binary Already changed (FLEX-DEC-2026-020): the stub exits 2 Consumer builds ./cmd/access-engine

Per consumer

ops-warden

Live pins: flex-auth-ops-warden (sign), flex-auth-ops-warden-fetch.

  • URLs: examples/warden.production.example.yaml (sign and fetch); live config under the operator. Workstation tunnels flex-auth-ops-warden-railiance01 (:19090) and flex-auth-ops-warden-fetch-railiance01 (:19091) in ops-bridge tunnels.yaml point at ClusterIPs, which change with the new Services.
  • Audience: examples/warden.production.example.yaml.
  • resource.system: lane flex-auth-policy-check, owner_repo: flex-auth in registry/routing/catalog.yaml.
  • Binary: scripts/policy_gate_production_smoke.sh (FLEX_AUTH_BIN, default /tmp/flex-auth).
  • Also: scripts/build_flex_auth_registry.py, scripts/check_flex_auth_manifest_coverage.py, pep-stance.yaml, layer.yaml, tenancy.yaml, and src/warden/{policy,access,caller_identity}.py. These are names, not runtime addresses.

secrets-engine

Live pin: flex-auth-secrets-engine.

  • URLs appear in docs and tests only. secrets-engine is a CLI, and its operator access path is still open (FLEX-WP-0023).
  • Binary: tools/exercise_approval_identity.py builds ./cmd/flex-auth (notified 2026-10-10, message ad4b1b3e).
  • pep-stance.yaml names the PDP.

user-engine (deployment sources in net-kingdom)

Live pins: flex-auth-user-engine (check), flex-auth-application-readback.

  • URL, audience and egress: net-kingdom/sso-mfa/k8s/user-engine/runtime.yaml (USER_ENGINE_FLEX_AUTH_URL, token audience flex-auth, egress namespace flex-auth), plus the readback URL promised on 2026-10-10 (message 5460cee2).
  • Env vars: USER_ENGINE_FLEX_AUTH_{URL,TOKEN_FILE,TIMEOUT} and USER_ENGINE_READBACK_TOKEN_FILE in src/user_engine/runtime.py and adapters/local.py. These are the consumer's own names.

tenant-engine

Live pin: flex-auth-tenant-engine.

  • URL, audience and egress: deploy/base/tenant-engine.yaml, railiance/app.toml.
  • Env vars: TENANT_ENGINE_FLEX_AUTH_{URL,TOKEN_FILE,TIMEOUT_SECONDS} in src/tenant_engine/config.py; pep-stance.yaml.

informed-decision

Live pins: flex-auth-informed-decision-lifecycle, -sitting, -t03.

  • URLs and audience: deploy/sitting-admission.json, deploy/t03-admission.json, deploy/lifecycle/{admission,service}.candidate.json, and tools/render_deployment.py. The live egress policy informed-decision-review names namespace flex-auth.
  • Binary: tests/browser_fixture.py, tests/test_lifecycle_policy_component.py, tests/test_review_component.py and tests/test_lifecycle_review.py take INFD_FLEX_AUTH_BINARY / INFD_FLEX_AUTH_SOURCE. A binary built from current source must come from ./cmd/access-engine. Doc docs/protected-browser-review.md notified (message 9b15c762).
  • docs/batches/** and docs/evidence/** are historical. Leave them.

net-kingdom

  • Owns user-engine's deployment source (above).
  • runbooks/protected-system-flex-auth/pack.yaml and docs/tutorials/protected-system-flex-auth.md run go run ./cmd/flex-auth (notified, message e2f1aac9).

Others with references, not consumers of a pin

  • state-hub/repository_rename_workplan.py: tooling from FLEX-WP-0020.
  • railiance-platform/scripts/credential.py: FLEX_AUTH_{URL,PATH,SUBJECT_TYPES}. Check whether it calls a live pin before T06.
  • the-custodian: docs only.
  • Hub repo record local_path is /home/worsch/flex-auth, but the checkout is /home/worsch/access-engine (FLEX-WP-0020-T11 residual).

Owner handoffs

Requested after T01 fixes the target names, so each owner gets one message with the exact new URL and audience: ops-warden, secrets-engine, user-engine with net-kingdom, tenant-engine, and informed-decision.