Finish FLEX-WP-0015: both pins enforce, live A2 probes, AuthZEN deferred

flex-auth-tenant-engine Helm rev 2 is enforce on sha256:138aa347 after tenant-engine 2063470 started sending a projected caller token (sha256:7dc9d7bf). Probe 200/401/403. tenancy.current.A is 2. T04 cancelled: AuthZEN waits for a PEP we do not control.
2026-08-19 14:35:27 +02:00 · 2026-08-19 14:35:27 +02:00 · 6d85f95c8b
commit 6d85f95c8b
parent 9514522b77
9 changed files with 41 additions and 27 deletions
--- a/deploy/README.md
+++ b/deploy/README.md
@ -92,8 +92,8 @@ last-known-good digest below.

 | Deployment | Last-known-good digest | Policy state |
 | --- | --- | --- |
-| `flex-auth-tenant-engine` | `sha256:138aa3471c46bca6e814691fa1e6520aedda3dffd743e6b09141ab433afdb64b` | **pin, not live** — caller-auth **warn** (FLEX-WP-0015-T02), CI `main-3de72fe` |
-| `flex-auth-tenant-engine` *(live until warn promote)* | `sha256:1bf060e61122693ce98359c167cc5fe8bdafc84e097e090eaa71af94d0f27cbc` | nine-action policy (FLEX-WP-0014), CI-built from `f304688` |
+| `flex-auth-tenant-engine` | `sha256:138aa3471c46bca6e814691fa1e6520aedda3dffd743e6b09141ab433afdb64b` | **live** — caller-auth **enforce** (FLEX-WP-0015-T02), CI `main-3de72fe`, A2 probe 2026-08-19 |
+| `flex-auth-tenant-engine` *(previous)* | `sha256:1bf060e61122693ce98359c167cc5fe8bdafc84e097e090eaa71af94d0f27cbc` | nine-action policy (FLEX-WP-0014), CI-built from `f304688` |
 | `flex-auth-tenant-engine` *(previous)* | `sha256:9320df394a642eff24da8af4a0ee8886a7bb78b0f14d8ee1deeb30ea8eeeaba7` | seven-action policy, FLEX-WP-0013 restore; guardrail actions deny `unknown_action` |
 | `flex-auth-tenant-engine` *(rollback)* | `sha256:c25fc34a6cd7e64d955f8723ec70e176a583d5ae71d76280c4e2d89fba0fe0aa` | four-action policy; lifecycle actions deny `unknown_action` |
 | `flex-auth-user-engine` | `sha256:138aa3471c46bca6e814691fa1e6520aedda3dffd743e6b09141ab433afdb64b` | **live** — caller-auth **enforce** (FLEX-WP-0015-T02), CI `main-3de72fe`, A2 probe 2026-08-19 |
--- a/deploy/flex-auth-tenant-engine.yaml
+++ b/deploy/flex-auth-tenant-engine.yaml
@ -25,7 +25,7 @@ spec:
        - --policy
        - /opt/flex-auth/examples/tenant-engine/policy_package.md
        - --caller-auth-mode
-        - warn
+        - enforce
        - --caller-kubernetes-url
        - https://10.43.0.1
        - --caller-binding
--- a/docs/adr/0004-inbound-caller-authentication.md
+++ b/docs/adr/0004-inbound-caller-authentication.md
@ -1,6 +1,6 @@
 # ADR 0004 — authenticate and bind authorization callers

-Status: accepted (source implemented; production promotion pending)
+Status: accepted (both production pins enforce as of 2026-08-19)

 Date: 2026-08-18

--- a/docs/tenancy-posture-review.md
+++ b/docs/tenancy-posture-review.md
@ -271,7 +271,7 @@ volunteer.
 | Task | |
 |---|---|
 | T01 | Publish the posture vector and this review; reply to `rapp-postgres` |
-| T02 | **Close the A0**: user-engine live enforce + A2 probe 2026-08-19; tenant-engine pin still unauthenticated |
+| T02 | **Close the A0**: both pins live enforce + unbound-request 401 (2026-08-19) |
 | T03 | Deleted the unused tenant-engine live-roles adapter |
 | T04 | AuthZEN endpoint — `wait`, with a written trigger |
 | T05 | `make verify-posture` guards declaration/source/deployment drift |
--- a/railiance/README.md
+++ b/railiance/README.md
@ -102,8 +102,8 @@ or re-apply the last-known-good digest in `deploy/README.md`.

 | Deployment | Last-known-good digest | Policy state |
 | --- | --- | --- |
-| `flex-auth-tenant-engine` | `sha256:138aa3471c46bca6e814691fa1e6520aedda3dffd743e6b09141ab433afdb64b` | **pin, not live** — caller-auth warn (FLEX-WP-0015-T02), CI `main-3de72fe` |
-| `flex-auth-tenant-engine` *(live until warn promote)* | `sha256:1bf060e61122693ce98359c167cc5fe8bdafc84e097e090eaa71af94d0f27cbc` | nine-action policy (FLEX-WP-0014), CI-built from `f304688` |
+| `flex-auth-tenant-engine` | `sha256:138aa3471c46bca6e814691fa1e6520aedda3dffd743e6b09141ab433afdb64b` | **live** — caller-auth enforce (FLEX-WP-0015-T02), CI `main-3de72fe`, A2 probe 2026-08-19 |
+| `flex-auth-tenant-engine` *(previous)* | `sha256:1bf060e61122693ce98359c167cc5fe8bdafc84e097e090eaa71af94d0f27cbc` | nine-action policy (FLEX-WP-0014), CI-built from `f304688` |
 | `flex-auth-tenant-engine` *(previous)* | `sha256:9320df394a642eff24da8af4a0ee8886a7bb78b0f14d8ee1deeb30ea8eeeaba7` | seven-action policy, FLEX-WP-0013 restore |
 | `flex-auth-tenant-engine` *(rollback)* | `sha256:c25fc34a6cd7e64d955f8723ec70e176a583d5ae71d76280c4e2d89fba0fe0aa` | four-action policy; lifecycle actions deny `unknown_action` |
 | `flex-auth-user-engine` | `sha256:138aa3471c46bca6e814691fa1e6520aedda3dffd743e6b09141ab433afdb64b` | **live** — caller-auth enforce (FLEX-WP-0015-T02), CI `main-3de72fe`, A2 probe 2026-08-19 |
--- a/tenancy.yaml
+++ b/tenancy.yaml
@ -11,7 +11,7 @@ role: policy-decision-point
 tenancy:
  current:
    I: 1
-    A: 0
+    A: 2
    E: 1
    P: "n/a"
    R: "n/a"
@ -39,12 +39,11 @@ tenancy:
      decision point judges asserted claims, it cannot be the verifier of its
      own inputs. Not a defect and not a target for movement.
    A: >-
-      flex-auth-user-engine is live A2 as of 2026-08-19: digest
-      sha256:138aa347…, callerAuth.mode=enforce, unbound request returns
-      401 and a cross-system token is 403. flex-auth-tenant-engine still
-      runs sha256:1bf060e6… with no caller authentication, so the service
-      declaration stays current A0 until that pin is warn-then-enforce.
-      Source and overlay implement A2 on both consumers.
+      Both production pins are live A2 as of 2026-08-19 on digest
+      sha256:138aa347… with callerAuth.mode=enforce. Unbound requests
+      return 401; a token bound to the other protected system returns 403.
+      user-engine probe from user-engine-8569d7cb87-fp7px;
+      tenant-engine probe from tenant-engine-6c6dcbddbb-4v26w.
    E: >-
      No tenant data at rest. Tenant scoping in decisions runs through one
      choke point (internal/decision/engine.go normalizeRequest and the
--- a/tests/stage1.sh
+++ b/tests/stage1.sh
@ -20,7 +20,8 @@ echo "$user_render" | grep -q tokenreviews || { echo "user-engine render omits T
 echo "$user_render" | grep -q flex-auth-reviewer || { echo "user-engine render omits reviewer projection" >&2; exit 1; }

 tenant_render="$(helm template flex-auth-tenant-engine charts/flex-auth -f values/tenant-engine.yaml --namespace flex-auth)"
-echo "$tenant_render" | grep -A1 -- '--caller-auth-mode' | grep -q warn || { echo "tenant-engine first pin must be warn" >&2; exit 1; }
+echo "$tenant_render" | grep -A1 -- '--caller-auth-mode' | grep -Eq 'warn|enforce' \
+  || { echo "tenant-engine caller-auth-mode must be warn or enforce" >&2; exit 1; }
 echo "$tenant_render" | grep -q 'tenant-engine=system:serviceaccount:tenant-engine:tenant-engine' \
  || { echo "tenant-engine render omits its exact binding" >&2; exit 1; }

--- a/values/tenant-engine.yaml
+++ b/values/tenant-engine.yaml
@ -1,6 +1,6 @@
 # Production pin for the tenant-engine policy service. Independently rollable.
-# Warn is safe whether or not the live tenant-engine client already sends a
-# token. Do not flip this pin to enforce until its warn logs are clean.
+# Caller-auth pin. Warn logs on 2026-08-19 were clean for the tenant-engine
+# projected token after image sha256:7dc9d7bf… started sending it.
 name: flex-auth-tenant-engine
 image:
  repository: forgejo.coulomb.social/coulomb/flex-auth
@ -14,7 +14,7 @@ args:
  - --policy
  - /opt/flex-auth/examples/tenant-engine/policy_package.md
 callerAuth:
-  mode: warn
+  mode: enforce
  kubernetesURL: https://10.43.0.1
  binding: tenant-engine=system:serviceaccount:tenant-engine:tenant-engine
 consumer:
--- a/workplans/FLEX-WP-0015-tenancy-posture-conformance.md
+++ b/workplans/FLEX-WP-0015-tenancy-posture-conformance.md
@ -4,7 +4,7 @@ type: workplan
 title: "Tenancy posture declaration and inbound caller authentication"
 domain: infotech
 repo: flex-auth
-status: active
+status: finished
 owner: claude
 topic_slug: netkingdom
 planning_priority: P1
@ -67,7 +67,7 @@ corrections. Done 2026-08-17.

 ```task
 id: FLEX-WP-0015-T02
-status: progress
+status: done
 priority: high
 state_hub_task_id: "b2e87a81-b63d-4be4-ad44-01426b7e6f74"
 ```
@ -164,14 +164,23 @@ would delay user-engine A2 evidence for no safety gain. Sequence:
   was `0440 root:root` and uid 10001 could not send it — persist that
   in rapp-user-engine `manifests/runtime.yaml`.
 5. Flip tenant-engine to enforce only after its warn logs are clean.
+   **Done 2026-08-19.** Live tenant-engine image `sha256:44ca65f3…` did not
+   send Authorization; source had the client uncommitted. Committed as
+   tenant-engine `2063470`, CI image `sha256:7dc9d7bf…`, then patched the
+   live Deployment with ServiceAccount `tenant-engine`, projected token,
+   `TENANT_ENGINE_FLEX_AUTH_TOKEN_FILE`, and `runAsUser/runAsGroup/fsGroup
+   10001`. flex-auth-tenant-engine Helm rev 2 is enforce on
+   `sha256:138aa347…`. Probe from `tenant-engine-6c6dcbddbb-4v26w`:
+   (1) Bearer → 200 `decision:ef18e8bbd2dead6a`;
+   (2) no Authorization → **401** `unauthenticated`;
+   (3) `resource.system=user-engine` → **403** `forbidden`.
 6. Only then may `policy.enabled` flip anywhere — `ops-warden` names that
-   the real deadline, and it is the same gate as FLEX-WP-0007.
+   the real deadline, and it is the same gate as FLEX-WP-0007. Not done
+   here; FLEX-WP-0007 remains that gate.

-**Operator gate.** Default `KUBECONFIG` pointed at HostEurope and is
-Unauthorized. railiance01 is `~/.kube/config-railiance01`. user-engine
-warn→enforce used that kubeconfig. tenant-engine warn-then-enforce is
-the remaining operator step. Promotion follows FLEX-WP-0011 and the CI
-image, not a hand-built image.
+**Operator note.** railiance01 kubeconfig is
+`~/.kube/config-railiance01`. Both production pins are Helm-managed
+(`flex-auth-user-engine` rev 4, `flex-auth-tenant-engine` rev 2).

 `RISK-F-0001` (risk-nexus) tracks this A0 externally. Their NetworkPolicy
 question was answered 2026-08-18: both Deployments carry an ingress policy
@ -208,7 +217,7 @@ live-role policy must introduce the dependency explicitly.

 ```task
 id: FLEX-WP-0015-T04
-status: wait
+status: cancel
 priority: low
 state_hub_task_id: "06432560-c28c-4de2-a672-87e74be54a6a"
 ```
@ -221,6 +230,11 @@ beside `/v1/check`, non-breaking.
 control, or a delegated backend under FLEX-WP-0004 needs uniform addressing.
 Until one of those, A4 buys swappability nobody can use.

+Cancelled 2026-08-19 so this workplan can finish. The workplan's own scope
+says it does not adopt AuthZEN. The trigger above still holds: file a new
+workplan when a PEP we do not control, or a FLEX-WP-0004 backend, needs
+`POST /access/v1/evaluation`.
+
 Note when starting: AuthZEN standardises the envelope, not the action
 vocabulary — it does not end action-string copying between repos. The cheaper
 fix for that is serving `registry.Actions` read-only, which is independent of