coulomb/flex-auth
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Enforce verified secrets-engine operator caller identity
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a0726e-5232-73f2-aaca-2c05ceb62efb
This commit is contained in:
tegwick 2026-09-06 23:38:36 +02:00
parent 74216643eb
commit 6e3dfaeb41
5 changed files with 64 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

15
docs/operator-caller-access-path.md
View file

@ -1,6 +1,6 @@
# Operator caller access path
**Status:** design published, live receipts outstanding
**Status:** revision 3 enforces adopted caller; positive and all four negative live checks pass
**Opened by:** `glas-harness` (`GLAS-WP-0015`, 2026-09-06), carried by `FLEX-WP-0023`
**Supersedes:** the workload assumption in `FLEX-WP-0021-T04`
@ -206,3 +206,16 @@ So a decision record proves the *subject* was allowed. It cannot prove the
between "this decision permits the action" and "this caller was permitted to
obtain this decision". Recorded as `FLEX-DEC-2026-009`; it is a gap in
flex-auth's own §17 contract, not in the deployment.
## Live execution update — 2026-09-06
The earlier absent-SA and warn-mode observations above are historical design
findings. Glas created the bound identity from
`deploy/secrets-engine-operator-caller.yaml`, proved adoption with no warnings,
and upgraded the dedicated pin to Helm revision 3 / enforce. Positive request and N1–N4 pass, including an actually expired issued token
(401) followed by a fresh token (200). The temporary forward is closed.
See FLEX-WP-0023 and glas-harness/docs/evidence/GLAS-WP-0015-caller-auth-2026-09-06.json.
No other consumer deployment changed. Recreate a loopback-only forward and mint
a fresh bounded token for each authorized operator session; the verification
forward is temporary and is not the runtime endpoint after cleanup.