access-engine/docs/evidence/2026-10-11-runtime-twins/access-runtime-twins-prepared-receipt.json

{
  "schema": "build-mode-prepared-blue-change-v1",
  "workplan": "FLEX-WP-0036",
  "task": "FLEX-WP-0036-T05",
  "status": "PREPARED_SOURCE_ONLY_NATIVE_WAIT",
  "target": "access-engine namespace and nine side-by-side releases",
  "prerequisites": [
    "Ordered preceding critical-path live evidence by coordinator",
    "T03 image compatibility rollout verified on existing pins",
    "T04 exact artifact availability and same-digest twin provenance verified",
    "Old T05 declared external dependency qualified by coordinator; worker did not inspect wait task",
    "Actual live pin inventory/digest and CPU headroom reconciled before server dry-run"
  ],
  "expected_result": "Nine renamed releases Ready; /healthz200; anonymous protected routes401; exact twin image/policy and caller/network scope unchanged",
  "abort_owner": "Custodian coordinator acting as Access runtime change owner",
  "abort_conditions": [
    "Any source/live twin digest or package argv mismatch",
    "Any unproven preceding critical-path gate",
    "Insufficient headroom or rollout stall",
    "New pin cannot TokenReview or cannot match old decision behavior",
    "Any changed caller principal, ingress/egress grant or shared durable writer state"
  ],
  "verification": [
    "Fresh helm template + server dry-run for exact source revision, namespace and pin manifests",
    "Reconcile live nine-pin inventory and image digests against source",
    "Ready, healthz200 and anonymous401 each new pin",
    "Live authenticated owner allow/deny correspondence with old twin; no consumer switch in T05"
  ],
  "rollback": "Suspend newly introduced GitOps reconciliation and scale only newly created access-engine Deployments to zero. Leave flex-auth releases, namespace, data and caller configuration intact. Do not delete old/new namespaces, RBAC or durable storage in this blue scope; destructive cleanup goes to the red batch.",
  "scope_limits": [
    "No consumer endpoint/egress flip",
    "No live mutation executed",
    "No new caller grants or secrets",
    "No dual repository publication or unproven new image paths claimed",
    "No durable writer twins generated"
  ],
  "pins": [
    {
      "name": "access-engine-application-readback",
      "image": "forgejo.coulomb.social/coulomb/flex-auth@sha256:e8c57c18a4a9d5583be099146984f7e9cd881446218b65aeefd7619b18aa9229",
      "caller_auth": {
        "mode": "enforce",
        "kubernetesURL": "https://10.43.0.1",
        "audience": "access-engine"
      },
      "consumer": {
        "isolated": false,
        "namespace": "user-engine",
        "podName": "user-engine"
      },
      "request_cpu": "5m",
      "request_memory": "32Mi"
    },
    {
      "name": "access-engine-informed-decision-lifecycle",
      "image": "forgejo.coulomb.social/coulomb/flex-auth@sha256:e8c57c18a4a9d5583be099146984f7e9cd881446218b65aeefd7619b18aa9229",
      "caller_auth": {
        "mode": "enforce",
        "kubernetesURL": "https://10.43.0.1",
        "binding": "informed-decision=system:serviceaccount:informed-decision:review",
        "audience": "access-engine"
      },
      "consumer": {
        "isolated": false,
        "namespace": "informed-decision",
        "podName": "informed-decision"
      },
      "request_cpu": "5m",
      "request_memory": "32Mi"
    },
    {
      "name": "access-engine-informed-decision-sitting",
      "image": "forgejo.coulomb.social/coulomb/flex-auth@sha256:bdac62bc3f089cba0df7c35eeb8d0d9b3af2d4bae5e4ea4767516c1ed20b1e99",
      "caller_auth": {
        "mode": "enforce",
        "kubernetesURL": "https://10.43.0.1",
        "binding": "informed-decision=system:serviceaccount:informed-decision:review",
        "audience": "access-engine"
      },
      "consumer": {
        "isolated": false,
        "namespace": "informed-decision",
        "podName": "informed-decision"
      },
      "request_cpu": "5m",
      "request_memory": "32Mi"
    },
    {
      "name": "access-engine-informed-decision-t03",
      "image": "forgejo.coulomb.social/coulomb/flex-auth@sha256:6600c7a62c36dfb4fbb42590722613827d07ff49875b1f0f4b5de63d8351658d",
      "caller_auth": {
        "mode": "enforce",
        "kubernetesURL": "https://10.43.0.1",
        "binding": "informed-decision=system:serviceaccount:informed-decision:review",
        "audience": "access-engine"
      },
      "consumer": {
        "isolated": false,
        "namespace": "informed-decision",
        "podName": "informed-decision"
      },
      "request_cpu": "5m",
      "request_memory": "32Mi"
    },
    {
      "name": "access-engine-ops-warden-fetch",
      "image": "forgejo.coulomb.social/coulomb/flex-auth@sha256:419bc37420d0d0a5304a8587448f1fdbf87117fb041fb43081b0449b4a7bb13b",
      "caller_auth": {
        "mode": "enforce",
        "kubernetesURL": "https://10.43.0.1",
        "binding": "key-cape=system:serviceaccount:ops-warden:ops-warden",
        "extraBindings": [
          "railiance-platform=system:serviceaccount:ops-warden:ops-warden"
        ],
        "audience": "access-engine"
      },
      "consumer": {
        "isolated": true
      },
      "request_cpu": "25m",
      "request_memory": "32Mi"
    },
    {
      "name": "access-engine-ops-warden",
      "image": "forgejo.coulomb.social/coulomb/flex-auth@sha256:138aa3471c46bca6e814691fa1e6520aedda3dffd743e6b09141ab433afdb64b",
      "caller_auth": {
        "mode": "enforce",
        "kubernetesURL": "https://10.43.0.1",
        "binding": "ops-warden=system:serviceaccount:ops-warden:ops-warden",
        "audience": "access-engine"
      },
      "consumer": {
        "isolated": true
      },
      "request_cpu": "25m",
      "request_memory": "32Mi"
    },
    {
      "name": "access-engine-secrets-engine",
      "image": "forgejo.coulomb.social/coulomb/flex-auth@sha256:05a03a8790c2210c48ea92391441c77ddf640d0cd32f5ec09838f5393171fcbd",
      "caller_auth": {
        "mode": "enforce",
        "kubernetesURL": "https://10.43.0.1",
        "binding": "secrets-engine=system:serviceaccount:secrets-engine:secrets-engine",
        "audience": "access-engine"
      },
      "consumer": {
        "isolated": false,
        "namespace": "secrets-engine",
        "podName": "secrets-engine"
      },
      "request_cpu": "25m",
      "request_memory": "32Mi"
    },
    {
      "name": "access-engine-tenant-engine",
      "image": "forgejo.coulomb.social/coulomb/flex-auth@sha256:05a03a8790c2210c48ea92391441c77ddf640d0cd32f5ec09838f5393171fcbd",
      "caller_auth": {
        "mode": "enforce",
        "kubernetesURL": "https://10.43.0.1",
        "binding": "tenant-engine=system:serviceaccount:tenant-engine:tenant-engine",
        "audience": "access-engine"
      },
      "consumer": {
        "isolated": false,
        "namespace": "tenant-engine",
        "podName": "tenant-engine"
      },
      "request_cpu": "25m",
      "request_memory": "32Mi"
    },
    {
      "name": "access-engine-user-engine",
      "image": "forgejo.coulomb.social/coulomb/flex-auth@sha256:138aa3471c46bca6e814691fa1e6520aedda3dffd743e6b09141ab433afdb64b",
      "caller_auth": {
        "mode": "enforce",
        "kubernetesURL": "https://10.43.0.1",
        "binding": "user-engine=system:serviceaccount:user-engine:user-engine",
        "audience": "access-engine"
      },
      "consumer": {
        "isolated": false,
        "namespace": "user-engine",
        "podName": "user-engine"
      },
      "request_cpu": "25m",
      "request_memory": "32Mi"
    }
  ]
}