Plan user-engine production authorization

workplans/FLEX-WP-0009-user-engine-production-policy-service.md

@@ -0,0 +1,89 @@
+---
+id: FLEX-WP-0009
+type: workplan
+title: "Provide production authorization for user-engine"
+domain: infotech
+repo: flex-auth
+status: ready
+owner: codex
+topic_slug: netkingdom
+created: "2026-08-08"
+updated: "2026-08-08"
+depends_on:
+  - NK-WP-0024
+state_hub_workstream_id: "45756b89-feba-45f5-a24a-63a1119254bf"
+---
+
+# FLEX-WP-0009 - user-engine production authorization
+
+Provide the cluster-local flex-auth policy-decision service required by the
+user-engine portal. The consumer contract is
+net-kingdom/docs/user-engine-platform-expansion-contract.md.
+
+## T01 - Pin the protected-system vocabulary
+
+```task
+id: FLEX-WP-0009-T01
+status: todo
+priority: high
+state_hub_task_id: "e940c5a3-ecb4-43d3-9554-2bfb422ec56d"
+```
+
+Add a user-engine protected-system manifest, resource manifests, subject
+fixtures, and check-request fixtures. Cover self, tenant-admin, and
+platform-admin actions over user, membership, invitation, tenant, recovery,
+and outbox resources. Unknown resources/actions and cross-tenant requests must
+deny.
+
+Done when all manifests validate and the vocabulary matches the action and
+resource strings emitted by user-engine.
+
+## T02 - Implement and verify the policy package
+
+```task
+id: FLEX-WP-0009-T02
+status: todo
+priority: high
+state_hub_task_id: "6e0fe708-d7ff-411f-a64d-84a1692a6e11"
+```
+
+Implement policy-as-code for self-only mutations, tenant-admin authority
+within one tenant, and platform-admin authority for tenant creation, recovery,
+outbox delivery, and replay. Include allow, deny, missing-role, target-user
+mismatch, cross-tenant, malformed-context, and stale-policy fixtures.
+
+Done when fixture evaluation is deterministic, default deny is proven, and
+decision envelopes contain stable decision IDs and policy provenance.
+
+## T03 - Deploy the cluster-local service
+
+```task
+id: FLEX-WP-0009-T03
+status: todo
+priority: high
+state_hub_task_id: "f8293230-136d-4f2d-8d3f-bb9840ea7e63"
+```
+
+Publish an immutable flex-auth image and deploy a namespaced Service at
+http://flex-auth.flex-auth.svc.cluster.local:8080. Apply least-privilege
+security context, readiness/liveness probes, resource limits, default-deny
+NetworkPolicy, and ingress restricted to approved protected systems.
+
+Done when user-engine can reach POST /v1/check, an unrelated namespace
+cannot, and restart/rollback procedures are documented.
+
+## T04 - Hand back production evidence
+
+```task
+id: FLEX-WP-0009-T04
+status: todo
+priority: high
+state_hub_task_id: "97b931e9-ac5b-46c7-a462-e23c0c18c4f4"
+```
+
+Run live allow, deny, service-unavailable, and cross-tenant probes from the
+user-engine namespace. Record only non-secret decision IDs, effects, reasons,
+policy version, and correlation IDs. Send completion evidence to NK-WP-0024.
+
+Done when user-engine can replace its local authorization bridge without an
+availability bypass and the deployed failure matrix remains fail closed.