coulomb/flex-auth
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Roll flex-auth-tenant-engine onto the FLEX-WP-0010 policy image
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details

Browse source 
CI-built image from e9911eb, digest
sha256:9320df394a642eff24da8af4a0ee8886a7bb78b0f14d8ee1deeb30ea8eeeaba7,
verified in a throwaway container before pinning and then probed again
against the live Service after rollout:

  tenant.retire    allow write_api_policy_matched  decision:491bbef2db999c02
  tenant.create    allow write_api_policy_matched  decision:fa3ba90e9cccb5aa
  tenant.retired   deny  unknown_action            decision:c5ee185de439ffe5
  unknown subject  deny  unknown_subject           decision:a98c59c6a34f84ad

tenant.retire has flipped from deny unknown_action to allow in
production, which is what TEN-WP-0005-T05 was waiting on.

Only flex-auth-tenant-engine was rolled. flex-auth-user-engine stays
pinned to a31961c4 -- its policy is unchanged and there is no reason to
move it. Previous tenant-engine digest kept in the runbook as the
rollback target.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
tegwick 2026-08-11 10:41:25 +02:00
parent e9911eb77f
commit 3dc6223cc2
4 changed files with 11 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

4
WORK-RECORDS.md
View file

@ -18,6 +18,7 @@
| workplan | FLEX-WP-0008 | finished | — | workplans/FLEX-WP-0008-tenant-engine-consumer-integration.md |
| workplan | FLEX-WP-0009 | active | — | workplans/FLEX-WP-0009-user-engine-production-policy-service.md |
| workplan | FLEX-WP-0010 | finished | — | workplans/FLEX-WP-0010-tenant-lifecycle-policy-actions.md |
| workplan | FLEX-WP-0011 | proposed | — | workplans/FLEX-WP-0011-railiance-staged-promotion-overlay.md |
| task | FLEX-WP-0001-T001 | done | — | workplans/FLEX-WP-0001-repo-intent-and-architecture-baseline.md |
| task | FLEX-WP-0001-T002 | done | — | workplans/FLEX-WP-0001-repo-intent-and-architecture-baseline.md |
| task | FLEX-WP-0001-T003 | done | — | workplans/FLEX-WP-0001-repo-intent-and-architecture-baseline.md |
@ -70,3 +71,6 @@
| task | FLEX-WP-0010-T02 | done | — | workplans/FLEX-WP-0010-tenant-lifecycle-policy-actions.md |
| task | FLEX-WP-0010-T03 | done | — | workplans/FLEX-WP-0010-tenant-lifecycle-policy-actions.md |
| task | FLEX-WP-0010-T04 | done | — | workplans/FLEX-WP-0010-tenant-lifecycle-policy-actions.md |
| task | FLEX-WP-0011-T01 | todo | — | workplans/FLEX-WP-0011-railiance-staged-promotion-overlay.md |
| task | FLEX-WP-0011-T02 | todo | — | workplans/FLEX-WP-0011-railiance-staged-promotion-overlay.md |
| task | FLEX-WP-0011-T03 | todo | — | workplans/FLEX-WP-0011-railiance-staged-promotion-overlay.md |

3
deploy/README.md
View file

@ -83,7 +83,8 @@ last-known-good digest below.
| Deployment | Last-known-good digest | Policy state |
| --- | --- | --- |
| `flex-auth-tenant-engine` | `sha256:c25fc34a6cd7e64d955f8723ec70e176a583d5ae71d76280c4e2d89fba0fe0aa` | four-action policy, pre-FLEX-WP-0010 (lifecycle actions deny `unknown_action`) |
| `flex-auth-tenant-engine` | `sha256:9320df394a642eff24da8af4a0ee8886a7bb78b0f14d8ee1deeb30ea8eeeaba7` | **current** — seven-action policy, FLEX-WP-0010, CI-built from `e9911eb`, live 2026-08-11 |
| `flex-auth-tenant-engine` *(previous)* | `sha256:c25fc34a6cd7e64d955f8723ec70e176a583d5ae71d76280c4e2d89fba0fe0aa` | four-action policy, pre-FLEX-WP-0010 (lifecycle actions deny `unknown_action`) |
| `flex-auth-user-engine` | `sha256:a31961c45215aa6baf3bc748c6741ab703c2c8325e61aa7983a355026195e51b` | FLEX-WP-0009-T03, six fixtures verified live 2026-08-10 |
Rolling back the tenant-engine service to `c25fc34a…` restores fail-closed

2
deploy/flex-auth-tenant-engine.yaml
View file

@ -23,7 +23,7 @@ spec:
- /opt/flex-auth/examples/tenant-engine/registry_snapshot.json
- --policy
- /opt/flex-auth/examples/tenant-engine/policy_package.md
image: forgejo.coulomb.social/coulomb/flex-auth@sha256:c25fc34a6cd7e64d955f8723ec70e176a583d5ae71d76280c4e2d89fba0fe0aa
image: forgejo.coulomb.social/coulomb/flex-auth@sha256:9320df394a642eff24da8af4a0ee8886a7bb78b0f14d8ee1deeb30ea8eeeaba7
livenessProbe:
httpGet:
path: /healthz

4
workplans/FLEX-WP-0011-railiance-staged-promotion-overlay.md
View file

@ -15,6 +15,7 @@ related_workplans:
- RAIL-BS-WP-0006
created: "2026-08-11"
updated: "2026-08-11"
state_hub_workstream_id: "b17c3296-f8ae-4f61-bcf7-41ac80bacd47"
---
# FLEX-WP-0011 - Bring flex-auth under the railiance staged-promotion contract
@ -62,6 +63,7 @@ policy rollouts.
id: FLEX-WP-0011-T01
status: todo
priority: medium
state_hub_task_id: "edc7fee5-b78d-4a5c-a773-42c5b39d0019"
```
Write `railiance/app.toml` against schema `railiance.app.v1`, using
@ -88,6 +90,7 @@ set is accepted.
id: FLEX-WP-0011-T02
status: todo
priority: medium
state_hub_task_id: "5283bc1f-88c3-431b-a9ea-4a900a3e5885"
```
Prove `stage deploy`, `stage observe`, `stage promote`, and `stage rollback`
@ -104,6 +107,7 @@ evidence ids are recorded here.
id: FLEX-WP-0011-T03
status: todo
priority: low
state_hub_task_id: "bebd6ed9-9145-4fc0-bdc8-cac669643c62"
```
`the-custodian/docs/coulombcore-drain-placement-plan.md` row 23 lists