Pin flex-auth-tenant-engine to the nine-action policy image

CI digest sha256:1bf060e6 (main-f304688) is live. Seven pre-existing
actions still allow; guardrail.read/set match the FLEX-WP-0014 split.
user-engine pin unchanged. Rollback target is sha256:9320df39.

deploy/README.md

@@ -86,7 +86,8 @@ last-known-good digest below.
 
 | Deployment | Last-known-good digest | Policy state |
 | --- | --- | --- |
-| `flex-auth-tenant-engine` | `sha256:9320df394a642eff24da8af4a0ee8886a7bb78b0f14d8ee1deeb30ea8eeeaba7` | **live 2026-08-16** — seven-action policy restored (FLEX-WP-0013); CI-built from `e9911eb` |
+| `flex-auth-tenant-engine` | `sha256:1bf060e61122693ce98359c167cc5fe8bdafc84e097e090eaa71af94d0f27cbc` | **live** — nine-action policy (FLEX-WP-0014), CI-built from `f304688` |
+| `flex-auth-tenant-engine` *(previous)* | `sha256:9320df394a642eff24da8af4a0ee8886a7bb78b0f14d8ee1deeb30ea8eeeaba7` | seven-action policy, FLEX-WP-0013 restore; guardrail actions deny `unknown_action` |
 | `flex-auth-tenant-engine` *(rollback)* | `sha256:c25fc34a6cd7e64d955f8723ec70e176a583d5ae71d76280c4e2d89fba0fe0aa` | four-action policy; lifecycle actions deny `unknown_action` |
 | `flex-auth-user-engine` | `sha256:1f5290376dc5fcf456dc7a785e394d8b90949dabecd1d3e856f38557149bb5f4` | **current** — FLEX-WP-0009-T04, nine fixtures (incl. registration-applicant) verified live 2026-08-16 |
 | `flex-auth-user-engine` *(previous)* | `sha256:a31961c45215aa6baf3bc748c6741ab703c2c8325e61aa7983a355026195e51b` | FLEX-WP-0009-T03, six fixtures verified live 2026-08-10 |

deploy/flex-auth-tenant-engine.yaml

@@ -23,7 +23,7 @@ spec:
         - /opt/flex-auth/examples/tenant-engine/registry_snapshot.json
         - --policy
         - /opt/flex-auth/examples/tenant-engine/policy_package.md
-        image: forgejo.coulomb.social/coulomb/flex-auth@sha256:9320df394a642eff24da8af4a0ee8886a7bb78b0f14d8ee1deeb30ea8eeeaba7
+        image: forgejo.coulomb.social/coulomb/flex-auth@sha256:1bf060e61122693ce98359c167cc5fe8bdafc84e097e090eaa71af94d0f27cbc
         livenessProbe:
           httpGet:
             path: /healthz

examples/tenant-engine/README.md

@@ -110,11 +110,23 @@ unmodified `FlexAuthWriteAuthorizer`:
 | `PUT ...` actor=`flex-auth` | 403 `write_denied` | deny `action_not_granted` |
 | `PUT ...` actor=`ops` | 403 `write_denied` | deny `unknown_subject` |
 
-**In source, not yet in the production image.** The live
-`flex-auth-tenant-engine` Deployment still serves the seven-action
-`sha256:9320df39` pin. A CI-built image from this commit plus a pin
-restore is the remaining step before a live guardrail check succeeds
-against the cluster Service.
+**In production as of 2026-08-16.** The live `flex-auth-tenant-engine`
+Deployment on railiance01 runs
+`sha256:1bf060e61122693ce98359c167cc5fe8bdafc84e097e090eaa71af94d0f27cbc`
+(CI-built from `f304688`, tag `main-f304688`). Probed against the Service
+after pin:
+
+| Request | Effect | Decision |
+| --- | --- | --- |
+| `tenant.create` | allow `write_api_policy_matched` | `decision:ef18e8bbd2dead6a` |
+| `tenant.retire` | allow `write_api_policy_matched` | `decision:996663f6902d0762` |
+| `tenant.guardrail.read` as flex-auth | allow `write_api_policy_matched` | `decision:9b9e540de13cf7cf` |
+| `tenant.guardrail.set` as tenant-engine | allow `write_api_policy_matched` | `decision:20c82bc38501a343` |
+| `tenant.guardrail.set` as flex-auth | deny `action_not_granted` | `decision:a057a7030df65208` |
+| misspelled guardrail | deny `unknown_action` | `decision:18ae70a79c6d47c6` |
+
+Rollback target is `sha256:9320df39` (seven-action). `flex-auth-user-engine`
+was not moved.
 
 ## Related
 

railiance/README.md

@@ -76,7 +76,8 @@ or re-apply the last-known-good digest in `deploy/README.md`.
 
 | Deployment | Last-known-good digest | Policy state |
 | --- | --- | --- |
-| `flex-auth-tenant-engine` | `sha256:9320df394a642eff24da8af4a0ee8886a7bb78b0f14d8ee1deeb30ea8eeeaba7` | **live 2026-08-16** — seven-action policy restored (FLEX-WP-0013) |
+| `flex-auth-tenant-engine` | `sha256:1bf060e61122693ce98359c167cc5fe8bdafc84e097e090eaa71af94d0f27cbc` | **live** — nine-action policy (FLEX-WP-0014), CI-built from `f304688` |
+| `flex-auth-tenant-engine` *(previous)* | `sha256:9320df394a642eff24da8af4a0ee8886a7bb78b0f14d8ee1deeb30ea8eeeaba7` | seven-action policy, FLEX-WP-0013 restore |
 | `flex-auth-tenant-engine` *(rollback)* | `sha256:c25fc34a6cd7e64d955f8723ec70e176a583d5ae71d76280c4e2d89fba0fe0aa` | four-action policy; lifecycle actions deny `unknown_action` |
 | `flex-auth-user-engine` | `sha256:1f5290376dc5fcf456dc7a785e394d8b90949dabecd1d3e856f38557149bb5f4` | FLEX-WP-0009-T04, nine fixtures, live 2026-08-16 |
 | `flex-auth-user-engine` *(previous)* | `sha256:a31961c45215aa6baf3bc748c6741ab703c2c8325e61aa7983a355026195e51b` | FLEX-WP-0009-T03, six fixtures |

railiance/app.toml

@@ -93,7 +93,7 @@ checks = ["stage2-accepted", "rollback-target", "operator-approval"]
 evidence = ["promotion command id", "recorded previous_stable digests", "post-promotion canary /healthz 200"]
 requires_approval = true
 promotion_mode = "release-replace"
-previous_stable = "flex-auth-user-engine@sha256:1f5290376dc5fcf456dc7a785e394d8b90949dabecd1d3e856f38557149bb5f4;flex-auth-tenant-engine@sha256:c25fc34a6cd7e64d955f8723ec70e176a583d5ae71d76280c4e2d89fba0fe0aa"
+previous_stable = "flex-auth-user-engine@sha256:1f5290376dc5fcf456dc7a785e394d8b90949dabecd1d3e856f38557149bb5f4;flex-auth-tenant-engine@sha256:9320df394a642eff24da8af4a0ee8886a7bb78b0f14d8ee1deeb30ea8eeeaba7"
 
 [[checks]]
 id = "unit-tests"

values/tenant-engine.yaml

@@ -2,7 +2,7 @@
 name: flex-auth-tenant-engine
 image:
   repository: forgejo.coulomb.social/coulomb/flex-auth
-  digest: sha256:9320df394a642eff24da8af4a0ee8886a7bb78b0f14d8ee1deeb30ea8eeeaba7
+  digest: sha256:1bf060e61122693ce98359c167cc5fe8bdafc84e097e090eaa71af94d0f27cbc
 args:
   - serve
   - --addr

workplans/FLEX-WP-0014-tenant-guardrail-policy-actions.md

@@ -187,3 +187,26 @@ this commit plus a pin of `flex-auth-tenant-engine` is the remaining
 step before a live guardrail check succeeds against the cluster Service.
 tenant-engine's own TEN-WP-0006 surface is also not deployed, so the
 cluster path is not yet the binding one.
+
+Deployed 2026-08-16 after operator "sync and commit / deploy flex-auth":
+CI image `main-f304688` /
+`sha256:1bf060e61122693ce98359c167cc5fe8bdafc84e097e090eaa71af94d0f27cbc`
+is live on `flex-auth-tenant-engine`. Approval
+`8d1efcea-93c7-436b-a749-e5d464e94a33`. Rollback target remains
+`sha256:9320df39`. `flex-auth-user-engine` stayed on `sha256:1f529037`.
+
+Live `/v1/check` against the Service:
+
+| Request | Effect | Decision |
+| --- | --- | --- |
+| `tenant.create` | allow `write_api_policy_matched` | `decision:ef18e8bbd2dead6a` |
+| `tenant.retire` | allow `write_api_policy_matched` | `decision:996663f6902d0762` |
+| `tenant.guardrail.read` as flex-auth | allow `write_api_policy_matched` | `decision:9b9e540de13cf7cf` |
+| `tenant.guardrail.set` as tenant-engine | allow `write_api_policy_matched` | `decision:20c82bc38501a343` |
+| `tenant.guardrail.set` as flex-auth | deny `action_not_granted` | `decision:a057a7030df65208` |
+| misspelled guardrail | deny `unknown_action` | `decision:18ae70a79c6d47c6` |
+| unknown subject | deny `unknown_subject` | `decision:a98c59c6a34f84ad` |
+| misspelled lifecycle | deny `unknown_action` | `decision:1b3012abb4e2b27d` |
+
+TEN-WP-0007 can pin the tenant-engine guardrail image. The seven
+pre-existing actions still allow.