2026-07-23 22:48:05 +02:00
|
|
|
# Work Records — flex-auth
|
|
|
|
|
|
|
|
|
|
> Generated by `statehub fix-consistency` (CUST-WP-0061-T04, work-record
|
|
|
|
|
> stage 3). Do not edit by hand — edit the source file/block listed for
|
|
|
|
|
> each record and re-run fix-consistency to refresh this index. Archived
|
|
|
|
|
> workplans are omitted; closed decisions/intakes/engagements stay listed
|
|
|
|
|
> so recently-resolved work is still visible. [auto]
|
|
|
|
|
|
|
|
|
|
| Kind | ID | Status | Lane | Source |
|
|
|
|
|
| --- | --- | --- | --- | --- |
|
|
|
|
|
| workplan | FLEX-WP-0001 | done | — | workplans/FLEX-WP-0001-repo-intent-and-architecture-baseline.md |
|
|
|
|
|
| workplan | FLEX-WP-0002 | completed | — | workplans/FLEX-WP-0002-standalone-policy-as-code-core.md |
|
|
|
|
|
| workplan | FLEX-WP-0003 | completed | — | workplans/FLEX-WP-0003-markitect-consumer-integration.md |
|
|
|
|
|
| workplan | FLEX-WP-0004 | completed | — | workplans/FLEX-WP-0004-delegated-pdp-and-directory-adapters.md |
|
|
|
|
|
| workplan | FLEX-WP-0005 | done | — | workplans/FLEX-WP-0005-foundations-and-topaz-alignment.md |
|
|
|
|
|
| workplan | FLEX-WP-0006 | finished | — | workplans/FLEX-WP-0006-ops-warden-ssh-signing-policy-gate.md |
|
|
|
|
|
| workplan | FLEX-WP-0007 | finished | — | workplans/FLEX-WP-0007-ops-warden-policy-gate-production-deployment.md |
|
2026-07-23 23:34:04 +02:00
|
|
|
| workplan | FLEX-WP-0008 | finished | — | workplans/FLEX-WP-0008-tenant-engine-consumer-integration.md |
|
2026-08-16 01:18:17 +02:00
|
|
|
| workplan | FLEX-WP-0009 | finished | — | workplans/FLEX-WP-0009-user-engine-production-policy-service.md |
|
Authorize tenant-engine lifecycle actions (FLEX-WP-0010)
Extend the tenant-engine write-API policy package with tenant.update,
tenant.retire, and tenant.reactivate, the three actions TEN-WP-0005
introduced. Until now every lifecycle mutation resolved to deny
unknown_action, blocking TEN-WP-0005-T05 production rollout.
- policy_package.md: three actions in valid_actions and frontmatter;
CARING capabilities extended with EditAny/Archive/Restore
- protected_system_manifest.yaml, subject_manifest.yaml, and the rebuilt
registry_snapshot.json carry all seven actions
- docs/tenant-engine-action-vocabulary.md documents the HTTP surfaces
- 8 new fixture pairs and 5 new Rego tests, including action-drift
guards (tenant.retired, tenant_update -> unknown_action)
T02 decision, recorded in policy_package.md: tenant.retire does NOT get
stricter authorization yet. With one service subject and no assurance
claim in the CheckRequest there is nothing stricter to check, and a
condition the sole caller always satisfies would falsely read as
separate control. Retirement is reversible and non-destructive. Revisit
on KEY-WP-0005 assurance claims or a second operator subject.
Verified: 11/11 Rego tests, 16/16 fixtures, go test ./... green, gofmt
and go vet clean. End-to-end against a live serve with a real
tenant-engine through the unmodified FlexAuthWriteAuthorizer: update
6176c39c2f4d7b15, retire 8a801b8ee8455080, reactivate c64cf3713cecd970
all allow; unregistered actor denied unknown_subject
(59d3e99c6416be89, 403 write_denied).
Handoff revision for TEN-WP-0005-T05: package
tenant-engine.write-api.mutate v1 (ready, caring-0.4.0-rc2).
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-10 20:52:10 +02:00
|
|
|
| workplan | FLEX-WP-0010 | finished | — | workplans/FLEX-WP-0010-tenant-lifecycle-policy-actions.md |
|
2026-08-16 09:46:41 +02:00
|
|
|
| workplan | FLEX-WP-0011 | finished | — | workplans/FLEX-WP-0011-railiance-staged-promotion-overlay.md |
|
2026-08-16 01:18:17 +02:00
|
|
|
| workplan | FLEX-WP-0012 | proposed | — | workplans/FLEX-WP-0012-credential-grant-authorization-surface.md |
|
2026-08-16 02:37:48 +02:00
|
|
|
| workplan | FLEX-WP-0013 | finished | — | workplans/FLEX-WP-0013-restore-seven-action-tenant-engine-pin.md |
|
2026-08-16 02:47:13 +02:00
|
|
|
| workplan | FLEX-WP-0014 | finished | — | workplans/FLEX-WP-0014-tenant-guardrail-policy-actions.md |
|
2026-08-17 22:04:04 +02:00
|
|
|
| workplan | FLEX-WP-0015 | active | — | workplans/FLEX-WP-0015-tenancy-posture-conformance.md |
|
2026-07-23 22:48:05 +02:00
|
|
|
| task | FLEX-WP-0001-T001 | done | — | workplans/FLEX-WP-0001-repo-intent-and-architecture-baseline.md |
|
|
|
|
|
| task | FLEX-WP-0001-T002 | done | — | workplans/FLEX-WP-0001-repo-intent-and-architecture-baseline.md |
|
|
|
|
|
| task | FLEX-WP-0001-T003 | done | — | workplans/FLEX-WP-0001-repo-intent-and-architecture-baseline.md |
|
|
|
|
|
| task | FLEX-WP-0001-T004 | done | — | workplans/FLEX-WP-0001-repo-intent-and-architecture-baseline.md |
|
|
|
|
|
| task | FLEX-WP-0002-T001 | done | — | workplans/FLEX-WP-0002-standalone-policy-as-code-core.md |
|
|
|
|
|
| task | FLEX-WP-0002-T002 | done | — | workplans/FLEX-WP-0002-standalone-policy-as-code-core.md |
|
|
|
|
|
| task | FLEX-WP-0002-T003 | done | — | workplans/FLEX-WP-0002-standalone-policy-as-code-core.md |
|
|
|
|
|
| task | FLEX-WP-0002-T004 | done | — | workplans/FLEX-WP-0002-standalone-policy-as-code-core.md |
|
|
|
|
|
| task | FLEX-WP-0002-T005 | done | — | workplans/FLEX-WP-0002-standalone-policy-as-code-core.md |
|
|
|
|
|
| task | FLEX-WP-0002-T006 | done | — | workplans/FLEX-WP-0002-standalone-policy-as-code-core.md |
|
|
|
|
|
| task | FLEX-WP-0002-T007 | done | — | workplans/FLEX-WP-0002-standalone-policy-as-code-core.md |
|
|
|
|
|
| task | FLEX-WP-0002-T008 | done | — | workplans/FLEX-WP-0002-standalone-policy-as-code-core.md |
|
|
|
|
|
| task | FLEX-WP-0003-T001 | done | — | workplans/FLEX-WP-0003-markitect-consumer-integration.md |
|
|
|
|
|
| task | FLEX-WP-0003-T002 | done | — | workplans/FLEX-WP-0003-markitect-consumer-integration.md |
|
|
|
|
|
| task | FLEX-WP-0003-T003 | done | — | workplans/FLEX-WP-0003-markitect-consumer-integration.md |
|
|
|
|
|
| task | FLEX-WP-0003-T004 | done | — | workplans/FLEX-WP-0003-markitect-consumer-integration.md |
|
|
|
|
|
| task | FLEX-WP-0003-T005 | done | — | workplans/FLEX-WP-0003-markitect-consumer-integration.md |
|
|
|
|
|
| task | FLEX-WP-0003-T006 | done | — | workplans/FLEX-WP-0003-markitect-consumer-integration.md |
|
|
|
|
|
| task | FLEX-WP-0004-T001 | done | — | workplans/FLEX-WP-0004-delegated-pdp-and-directory-adapters.md |
|
|
|
|
|
| task | FLEX-WP-0004-T002 | done | — | workplans/FLEX-WP-0004-delegated-pdp-and-directory-adapters.md |
|
|
|
|
|
| task | FLEX-WP-0004-T003 | done | — | workplans/FLEX-WP-0004-delegated-pdp-and-directory-adapters.md |
|
|
|
|
|
| task | FLEX-WP-0004-T004 | done | — | workplans/FLEX-WP-0004-delegated-pdp-and-directory-adapters.md |
|
|
|
|
|
| task | FLEX-WP-0004-T005 | done | — | workplans/FLEX-WP-0004-delegated-pdp-and-directory-adapters.md |
|
|
|
|
|
| task | FLEX-WP-0004-T006 | done | — | workplans/FLEX-WP-0004-delegated-pdp-and-directory-adapters.md |
|
|
|
|
|
| task | FLEX-WP-0005-T001 | done | — | workplans/FLEX-WP-0005-foundations-and-topaz-alignment.md |
|
|
|
|
|
| task | FLEX-WP-0005-T002 | done | — | workplans/FLEX-WP-0005-foundations-and-topaz-alignment.md |
|
|
|
|
|
| task | FLEX-WP-0005-T003 | done | — | workplans/FLEX-WP-0005-foundations-and-topaz-alignment.md |
|
|
|
|
|
| task | FLEX-WP-0005-T004 | done | — | workplans/FLEX-WP-0005-foundations-and-topaz-alignment.md |
|
|
|
|
|
| task | FLEX-WP-0005-T005 | done | — | workplans/FLEX-WP-0005-foundations-and-topaz-alignment.md |
|
|
|
|
|
| task | FLEX-WP-0005-T006 | done | — | workplans/FLEX-WP-0005-foundations-and-topaz-alignment.md |
|
|
|
|
|
| task | FLEX-WP-0006-T01 | done | — | workplans/FLEX-WP-0006-ops-warden-ssh-signing-policy-gate.md |
|
|
|
|
|
| task | FLEX-WP-0006-T02 | done | — | workplans/FLEX-WP-0006-ops-warden-ssh-signing-policy-gate.md |
|
|
|
|
|
| task | FLEX-WP-0006-T03 | done | — | workplans/FLEX-WP-0006-ops-warden-ssh-signing-policy-gate.md |
|
|
|
|
|
| task | FLEX-WP-0006-T04 | done | — | workplans/FLEX-WP-0006-ops-warden-ssh-signing-policy-gate.md |
|
|
|
|
|
| task | FLEX-WP-0006-T05 | done | — | workplans/FLEX-WP-0006-ops-warden-ssh-signing-policy-gate.md |
|
|
|
|
|
| task | FLEX-WP-0007-T01 | done | — | workplans/FLEX-WP-0007-ops-warden-policy-gate-production-deployment.md |
|
|
|
|
|
| task | FLEX-WP-0007-T02 | done | — | workplans/FLEX-WP-0007-ops-warden-policy-gate-production-deployment.md |
|
|
|
|
|
| task | FLEX-WP-0007-T03 | done | — | workplans/FLEX-WP-0007-ops-warden-policy-gate-production-deployment.md |
|
|
|
|
|
| task | FLEX-WP-0007-T04 | done | — | workplans/FLEX-WP-0007-ops-warden-policy-gate-production-deployment.md |
|
|
|
|
|
| task | FLEX-WP-0007-T05 | done | — | workplans/FLEX-WP-0007-ops-warden-policy-gate-production-deployment.md |
|
2026-07-23 23:06:28 +02:00
|
|
|
| task | FLEX-WP-0008-T01 | done | — | workplans/FLEX-WP-0008-tenant-engine-consumer-integration.md |
|
|
|
|
|
| task | FLEX-WP-0008-T02 | done | — | workplans/FLEX-WP-0008-tenant-engine-consumer-integration.md |
|
2026-07-23 23:34:04 +02:00
|
|
|
| task | FLEX-WP-0008-T03 | done | — | workplans/FLEX-WP-0008-tenant-engine-consumer-integration.md |
|
|
|
|
|
| task | FLEX-WP-0008-T04 | done | — | workplans/FLEX-WP-0008-tenant-engine-consumer-integration.md |
|
Authorize tenant-engine lifecycle actions (FLEX-WP-0010)
Extend the tenant-engine write-API policy package with tenant.update,
tenant.retire, and tenant.reactivate, the three actions TEN-WP-0005
introduced. Until now every lifecycle mutation resolved to deny
unknown_action, blocking TEN-WP-0005-T05 production rollout.
- policy_package.md: three actions in valid_actions and frontmatter;
CARING capabilities extended with EditAny/Archive/Restore
- protected_system_manifest.yaml, subject_manifest.yaml, and the rebuilt
registry_snapshot.json carry all seven actions
- docs/tenant-engine-action-vocabulary.md documents the HTTP surfaces
- 8 new fixture pairs and 5 new Rego tests, including action-drift
guards (tenant.retired, tenant_update -> unknown_action)
T02 decision, recorded in policy_package.md: tenant.retire does NOT get
stricter authorization yet. With one service subject and no assurance
claim in the CheckRequest there is nothing stricter to check, and a
condition the sole caller always satisfies would falsely read as
separate control. Retirement is reversible and non-destructive. Revisit
on KEY-WP-0005 assurance claims or a second operator subject.
Verified: 11/11 Rego tests, 16/16 fixtures, go test ./... green, gofmt
and go vet clean. End-to-end against a live serve with a real
tenant-engine through the unmodified FlexAuthWriteAuthorizer: update
6176c39c2f4d7b15, retire 8a801b8ee8455080, reactivate c64cf3713cecd970
all allow; unregistered actor denied unknown_subject
(59d3e99c6416be89, 403 write_denied).
Handoff revision for TEN-WP-0005-T05: package
tenant-engine.write-api.mutate v1 (ready, caring-0.4.0-rc2).
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-10 20:52:10 +02:00
|
|
|
| task | FLEX-WP-0009-T01 | done | — | workplans/FLEX-WP-0009-user-engine-production-policy-service.md |
|
|
|
|
|
| task | FLEX-WP-0009-T02 | done | — | workplans/FLEX-WP-0009-user-engine-production-policy-service.md |
|
|
|
|
|
| task | FLEX-WP-0009-T03 | done | — | workplans/FLEX-WP-0009-user-engine-production-policy-service.md |
|
2026-08-16 01:18:17 +02:00
|
|
|
| task | FLEX-WP-0009-T04 | done | — | workplans/FLEX-WP-0009-user-engine-production-policy-service.md |
|
Authorize tenant-engine lifecycle actions (FLEX-WP-0010)
Extend the tenant-engine write-API policy package with tenant.update,
tenant.retire, and tenant.reactivate, the three actions TEN-WP-0005
introduced. Until now every lifecycle mutation resolved to deny
unknown_action, blocking TEN-WP-0005-T05 production rollout.
- policy_package.md: three actions in valid_actions and frontmatter;
CARING capabilities extended with EditAny/Archive/Restore
- protected_system_manifest.yaml, subject_manifest.yaml, and the rebuilt
registry_snapshot.json carry all seven actions
- docs/tenant-engine-action-vocabulary.md documents the HTTP surfaces
- 8 new fixture pairs and 5 new Rego tests, including action-drift
guards (tenant.retired, tenant_update -> unknown_action)
T02 decision, recorded in policy_package.md: tenant.retire does NOT get
stricter authorization yet. With one service subject and no assurance
claim in the CheckRequest there is nothing stricter to check, and a
condition the sole caller always satisfies would falsely read as
separate control. Retirement is reversible and non-destructive. Revisit
on KEY-WP-0005 assurance claims or a second operator subject.
Verified: 11/11 Rego tests, 16/16 fixtures, go test ./... green, gofmt
and go vet clean. End-to-end against a live serve with a real
tenant-engine through the unmodified FlexAuthWriteAuthorizer: update
6176c39c2f4d7b15, retire 8a801b8ee8455080, reactivate c64cf3713cecd970
all allow; unregistered actor denied unknown_subject
(59d3e99c6416be89, 403 write_denied).
Handoff revision for TEN-WP-0005-T05: package
tenant-engine.write-api.mutate v1 (ready, caring-0.4.0-rc2).
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-10 20:52:10 +02:00
|
|
|
| task | FLEX-WP-0010-T01 | done | — | workplans/FLEX-WP-0010-tenant-lifecycle-policy-actions.md |
|
|
|
|
|
| task | FLEX-WP-0010-T02 | done | — | workplans/FLEX-WP-0010-tenant-lifecycle-policy-actions.md |
|
|
|
|
|
| task | FLEX-WP-0010-T03 | done | — | workplans/FLEX-WP-0010-tenant-lifecycle-policy-actions.md |
|
|
|
|
|
| task | FLEX-WP-0010-T04 | done | — | workplans/FLEX-WP-0010-tenant-lifecycle-policy-actions.md |
|
2026-08-16 01:33:27 +02:00
|
|
|
| task | FLEX-WP-0011-T01 | done | — | workplans/FLEX-WP-0011-railiance-staged-promotion-overlay.md |
|
|
|
|
|
| task | FLEX-WP-0011-T02 | done | — | workplans/FLEX-WP-0011-railiance-staged-promotion-overlay.md |
|
2026-08-16 09:46:41 +02:00
|
|
|
| task | FLEX-WP-0011-T03 | done | — | workplans/FLEX-WP-0011-railiance-staged-promotion-overlay.md |
|
2026-08-16 01:18:17 +02:00
|
|
|
| task | FLEX-WP-0012-T01 | todo | — | workplans/FLEX-WP-0012-credential-grant-authorization-surface.md |
|
|
|
|
|
| task | FLEX-WP-0012-T02 | todo | — | workplans/FLEX-WP-0012-credential-grant-authorization-surface.md |
|
|
|
|
|
| task | FLEX-WP-0012-T03 | todo | — | workplans/FLEX-WP-0012-credential-grant-authorization-surface.md |
|
|
|
|
|
| task | FLEX-WP-0012-T04 | todo | — | workplans/FLEX-WP-0012-credential-grant-authorization-surface.md |
|
2026-08-16 02:37:48 +02:00
|
|
|
| task | FLEX-WP-0013-T01 | done | — | workplans/FLEX-WP-0013-restore-seven-action-tenant-engine-pin.md |
|
|
|
|
|
| task | FLEX-WP-0013-T02 | done | — | workplans/FLEX-WP-0013-restore-seven-action-tenant-engine-pin.md |
|
|
|
|
|
| task | FLEX-WP-0013-T03 | done | — | workplans/FLEX-WP-0013-restore-seven-action-tenant-engine-pin.md |
|
2026-08-16 02:47:13 +02:00
|
|
|
| task | FLEX-WP-0014-T01 | done | — | workplans/FLEX-WP-0014-tenant-guardrail-policy-actions.md |
|
|
|
|
|
| task | FLEX-WP-0014-T02 | done | — | workplans/FLEX-WP-0014-tenant-guardrail-policy-actions.md |
|
|
|
|
|
| task | FLEX-WP-0014-T03 | done | — | workplans/FLEX-WP-0014-tenant-guardrail-policy-actions.md |
|
|
|
|
|
| task | FLEX-WP-0014-T04 | done | — | workplans/FLEX-WP-0014-tenant-guardrail-policy-actions.md |
|
2026-08-17 22:04:04 +02:00
|
|
|
| task | FLEX-WP-0015-T01 | done | — | workplans/FLEX-WP-0015-tenancy-posture-conformance.md |
|
|
|
|
|
| task | FLEX-WP-0015-T02 | todo | — | workplans/FLEX-WP-0015-tenancy-posture-conformance.md |
|
|
|
|
|
| task | FLEX-WP-0015-T03 | todo | — | workplans/FLEX-WP-0015-tenancy-posture-conformance.md |
|
|
|
|
|
| task | FLEX-WP-0015-T04 | wait | — | workplans/FLEX-WP-0015-tenancy-posture-conformance.md |
|
|
|
|
|
| task | FLEX-WP-0015-T05 | todo | — | workplans/FLEX-WP-0015-tenancy-posture-conformance.md |
|