coulomb/flex-auth
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Close FLEX-WP-0009 with live user-engine policy evidence
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
Build and Publish Container Image / build-and-push (push) Successful in 53s
Details

Browse source 
T04 is done: nine fixtures including registration-applicant match the
deployed /v1/check, user-engine is on the fail-closed HTTP adapter, and
the deploy manifest now pins the live digest.
This commit is contained in:
tegwick 2026-08-16 01:16:23 +02:00
parent b74756791a
commit 4dcc69b41b
4 changed files with 64 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

40
workplans/FLEX-WP-0009-user-engine-production-policy-service.md
View file

@ -4,11 +4,11 @@ type: workplan
title: "Provide production authorization for user-engine"
domain: infotech
repo: flex-auth
status: active
status: finished
owner: codex
topic_slug: netkingdom
created: "2026-08-08"
updated: "2026-08-08"
updated: "2026-08-16"
depends_on:
- NK-WP-0024
state_hub_workstream_id: "45756b89-feba-45f5-a24a-63a1119254bf"
@ -87,7 +87,7 @@ behind ingress restricted to the user-engine workload and with no egress.
```task
id: FLEX-WP-0009-T04
status: progress
status: done
priority: high
state_hub_task_id: "97b931e9-ac5b-46c7-a462-e23c0c18c4f4"
```
@ -122,3 +122,37 @@ availability bypass. That cutover is user-engine's decision and remains
gated on the separately owned event and mail receivers. flex-auth has
delivered and re-verified the service side; T04 stays `progress` rather
than being marked done on evidence that only covers half the criterion.
Done 2026-08-16: the consumer-side half is now closed. `NK-WP-0024` is
`finished`; its T01 records that the portal runtime is live on
`FlexAuthHTTPAdapter` (not the local bridge), with
`USER_ENGINE_FLEX_AUTH_URL=http://flex-auth-user-engine.flex-auth.svc.cluster.local:8080`.
The deployed user-engine image is
`sha256:e3b5f65bafc1c0260dfdf2567a52766e67506ceb878a51759a2e9a307c4b5eb8`.
Fresh flex-auth-side probe against the live service
`flex-auth-user-engine.flex-auth.svc.cluster.local:8080` running
`forgejo.coulomb.social/coulomb/flex-auth@sha256:1f5290376dc5fcf456dc7a785e394d8b90949dabecd1d3e856f38557149bb5f4`
(registration-applicant policy included; the in-repo deploy manifest
was still pinned to the older T03 digest and is synced to this one):
| Fixture | Effect / reason | Decision id |
| --- | --- | --- |
| `self-allow` | allow / `self_service` | `decision:27cbab2e5533508a` |
| `tenant-admin-allow` | allow / `tenant_admin` | `decision:350b46fb42989606` |
| `platform-allow` | allow / `platform_operator` | `decision:79334537419466bd` |
| `cross-tenant-deny` | deny / `cross_tenant` | `decision:b3cc0b7e819aecde` |
| `missing-role-deny` | deny / `no_matching_role_or_context` | `decision:818e2249491ef09f` |
| `wrong-system-deny` | deny / `wrong_system` | `decision:5e20697e202aa7c6` |
| `registration-applicant-allow` | allow / `registration_applicant` | `decision:d83fc413afebf2f6` |
| `registration-applicant-membership-deny` | deny / `no_matching_role_or_context` | `decision:4ca487126987f89c` |
| `registration-applicant-wrong-issuer-deny` | deny / `no_matching_role_or_context` | `decision:138c574dee279d23` |
All nine fixtures matched. From the user-engine pod,
`http://flex-auth-user-engine.flex-auth.svc.cluster.local:8080/healthz`
returned HTTP 200. Unavailability from that same namespace is
connection-refused on a closed port and NXDOMAIN on a missing Service
name; `FlexAuthHTTPAdapter` maps those to deny
`authorization service unavailable` (no availability bypass).
Completion evidence sent to `user-engine` and `net-kingdom` (NK-WP-0024).