From 4dcc69b41bb6404fd962269fe1caebca6572230b Mon Sep 17 00:00:00 2001 From: tegwick Date: Sun, 16 Aug 2026 01:16:23 +0200 Subject: [PATCH] Close FLEX-WP-0009 with live user-engine policy evidence T04 is done: nine fixtures including registration-applicant match the deployed /v1/check, user-engine is on the fail-closed HTTP adapter, and the deploy manifest now pins the live digest. --- deploy/README.md | 3 +- deploy/flex-auth-user-engine.yaml | 2 +- examples/user-engine/README.md | 24 +++++++++++ ...9-user-engine-production-policy-service.md | 40 +++++++++++++++++-- 4 files changed, 64 insertions(+), 5 deletions(-) diff --git a/deploy/README.md b/deploy/README.md index 3e3f50b..e00614f 100644 --- a/deploy/README.md +++ b/deploy/README.md @@ -85,7 +85,8 @@ last-known-good digest below. | --- | --- | --- | | `flex-auth-tenant-engine` | `sha256:9320df394a642eff24da8af4a0ee8886a7bb78b0f14d8ee1deeb30ea8eeeaba7` | **current** — seven-action policy, FLEX-WP-0010, CI-built from `e9911eb`, live 2026-08-11 | | `flex-auth-tenant-engine` *(previous)* | `sha256:c25fc34a6cd7e64d955f8723ec70e176a583d5ae71d76280c4e2d89fba0fe0aa` | four-action policy, pre-FLEX-WP-0010 (lifecycle actions deny `unknown_action`) | -| `flex-auth-user-engine` | `sha256:a31961c45215aa6baf3bc748c6741ab703c2c8325e61aa7983a355026195e51b` | FLEX-WP-0009-T03, six fixtures verified live 2026-08-10 | +| `flex-auth-user-engine` | `sha256:1f5290376dc5fcf456dc7a785e394d8b90949dabecd1d3e856f38557149bb5f4` | **current** — FLEX-WP-0009-T04, nine fixtures (incl. registration-applicant) verified live 2026-08-16 | +| `flex-auth-user-engine` *(previous)* | `sha256:a31961c45215aa6baf3bc748c6741ab703c2c8325e61aa7983a355026195e51b` | FLEX-WP-0009-T03, six fixtures verified live 2026-08-10 | Rolling back the tenant-engine service to `c25fc34a…` restores fail-closed behaviour for the lifecycle actions — tenant-engine's lifecycle endpoints diff --git a/deploy/flex-auth-user-engine.yaml b/deploy/flex-auth-user-engine.yaml index e973c37..72cde33 100644 --- a/deploy/flex-auth-user-engine.yaml +++ b/deploy/flex-auth-user-engine.yaml @@ -23,7 +23,7 @@ spec: - /opt/flex-auth/examples/user-engine/registry_snapshot.json - --policy - /opt/flex-auth/examples/user-engine/policy_package.md - image: forgejo.coulomb.social/coulomb/flex-auth@sha256:a31961c45215aa6baf3bc748c6741ab703c2c8325e61aa7983a355026195e51b + image: forgejo.coulomb.social/coulomb/flex-auth@sha256:1f5290376dc5fcf456dc7a785e394d8b90949dabecd1d3e856f38557149bb5f4 livenessProbe: httpGet: path: /healthz diff --git a/examples/user-engine/README.md b/examples/user-engine/README.md index 6deadb0..878ea2f 100644 --- a/examples/user-engine/README.md +++ b/examples/user-engine/README.md @@ -11,3 +11,27 @@ Validate with: flex-auth test-policy -file examples/user-engine/policy_package.md flex-auth load-registry -file examples/user-engine/registry_snapshot.json ``` + +## Live production (FLEX-WP-0009-T04, 2026-08-16) + +Service: `flex-auth-user-engine.flex-auth.svc.cluster.local:8080` +Image: `forgejo.coulomb.social/coulomb/flex-auth@sha256:1f5290376dc5fcf456dc7a785e394d8b90949dabecd1d3e856f38557149bb5f4` + +`test-policy` reports 9/9 Rego tests and 9/9 fixtures. The same nine +fixtures were replayed against the deployed `/v1/check` and all matched: + +| Fixture | Effect / reason | Decision id | +| --- | --- | --- | +| `self-allow` | allow / `self_service` | `decision:27cbab2e5533508a` | +| `tenant-admin-allow` | allow / `tenant_admin` | `decision:350b46fb42989606` | +| `platform-allow` | allow / `platform_operator` | `decision:79334537419466bd` | +| `cross-tenant-deny` | deny / `cross_tenant` | `decision:b3cc0b7e819aecde` | +| `missing-role-deny` | deny / `no_matching_role_or_context` | `decision:818e2249491ef09f` | +| `wrong-system-deny` | deny / `wrong_system` | `decision:5e20697e202aa7c6` | +| `registration-applicant-allow` | allow / `registration_applicant` | `decision:d83fc413afebf2f6` | +| `registration-applicant-membership-deny` | deny / `no_matching_role_or_context` | `decision:4ca487126987f89c` | +| `registration-applicant-wrong-issuer-deny` | deny / `no_matching_role_or_context` | `decision:138c574dee279d23` | + +From the user-engine namespace the Service `/healthz` is HTTP 200. +Unavailability is connection-refused / NXDOMAIN; the consumer adapter +denies with `authorization service unavailable`. diff --git a/workplans/FLEX-WP-0009-user-engine-production-policy-service.md b/workplans/FLEX-WP-0009-user-engine-production-policy-service.md index dbf7cdf..dad8aca 100644 --- a/workplans/FLEX-WP-0009-user-engine-production-policy-service.md +++ b/workplans/FLEX-WP-0009-user-engine-production-policy-service.md @@ -4,11 +4,11 @@ type: workplan title: "Provide production authorization for user-engine" domain: infotech repo: flex-auth -status: active +status: finished owner: codex topic_slug: netkingdom created: "2026-08-08" -updated: "2026-08-08" +updated: "2026-08-16" depends_on: - NK-WP-0024 state_hub_workstream_id: "45756b89-feba-45f5-a24a-63a1119254bf" @@ -87,7 +87,7 @@ behind ingress restricted to the user-engine workload and with no egress. ```task id: FLEX-WP-0009-T04 -status: progress +status: done priority: high state_hub_task_id: "97b931e9-ac5b-46c7-a462-e23c0c18c4f4" ``` @@ -122,3 +122,37 @@ availability bypass. That cutover is user-engine's decision and remains gated on the separately owned event and mail receivers. flex-auth has delivered and re-verified the service side; T04 stays `progress` rather than being marked done on evidence that only covers half the criterion. + +Done 2026-08-16: the consumer-side half is now closed. `NK-WP-0024` is +`finished`; its T01 records that the portal runtime is live on +`FlexAuthHTTPAdapter` (not the local bridge), with +`USER_ENGINE_FLEX_AUTH_URL=http://flex-auth-user-engine.flex-auth.svc.cluster.local:8080`. +The deployed user-engine image is +`sha256:e3b5f65bafc1c0260dfdf2567a52766e67506ceb878a51759a2e9a307c4b5eb8`. + +Fresh flex-auth-side probe against the live service +`flex-auth-user-engine.flex-auth.svc.cluster.local:8080` running +`forgejo.coulomb.social/coulomb/flex-auth@sha256:1f5290376dc5fcf456dc7a785e394d8b90949dabecd1d3e856f38557149bb5f4` +(registration-applicant policy included; the in-repo deploy manifest +was still pinned to the older T03 digest and is synced to this one): + +| Fixture | Effect / reason | Decision id | +| --- | --- | --- | +| `self-allow` | allow / `self_service` | `decision:27cbab2e5533508a` | +| `tenant-admin-allow` | allow / `tenant_admin` | `decision:350b46fb42989606` | +| `platform-allow` | allow / `platform_operator` | `decision:79334537419466bd` | +| `cross-tenant-deny` | deny / `cross_tenant` | `decision:b3cc0b7e819aecde` | +| `missing-role-deny` | deny / `no_matching_role_or_context` | `decision:818e2249491ef09f` | +| `wrong-system-deny` | deny / `wrong_system` | `decision:5e20697e202aa7c6` | +| `registration-applicant-allow` | allow / `registration_applicant` | `decision:d83fc413afebf2f6` | +| `registration-applicant-membership-deny` | deny / `no_matching_role_or_context` | `decision:4ca487126987f89c` | +| `registration-applicant-wrong-issuer-deny` | deny / `no_matching_role_or_context` | `decision:138c574dee279d23` | + +All nine fixtures matched. From the user-engine pod, +`http://flex-auth-user-engine.flex-auth.svc.cluster.local:8080/healthz` +returned HTTP 200. Unavailability from that same namespace is +connection-refused on a closed port and NXDOMAIN on a missing Service +name; `FlexAuthHTTPAdapter` maps those to deny +`authorization service unavailable` (no availability bypass). + +Completion evidence sent to `user-engine` and `net-kingdom` (NK-WP-0024).