coulomb/flex-auth
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Pin flex-auth-tenant-engine to the nine-action policy image
All checks were successful
CI Smoke / container-smoke (push) Successful in 1s
Details
CI Smoke / host-smoke (push) Successful in 0s
Details
Build and Publish Container Image / build-and-push (push) Successful in 35s
Details

Browse source 
CI digest sha256:1bf060e6 (main-f304688) is live. Seven pre-existing
actions still allow; guardrail.read/set match the FLEX-WP-0014 split.
user-engine pin unchanged. Rollback target is sha256:9320df39.
This commit is contained in:
tegwick 2026-08-16 09:57:07 +02:00
parent 0da6d3dee2
commit 79582870c0
7 changed files with 47 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

23
workplans/FLEX-WP-0014-tenant-guardrail-policy-actions.md
View file

@ -187,3 +187,26 @@ this commit plus a pin of `flex-auth-tenant-engine` is the remaining
step before a live guardrail check succeeds against the cluster Service.
tenant-engine's own TEN-WP-0006 surface is also not deployed, so the
cluster path is not yet the binding one.
Deployed 2026-08-16 after operator "sync and commit / deploy flex-auth":
CI image `main-f304688` /
`sha256:1bf060e61122693ce98359c167cc5fe8bdafc84e097e090eaa71af94d0f27cbc`
is live on `flex-auth-tenant-engine`. Approval
`8d1efcea-93c7-436b-a749-e5d464e94a33`. Rollback target remains
`sha256:9320df39`. `flex-auth-user-engine` stayed on `sha256:1f529037`.
Live `/v1/check` against the Service:
| Request | Effect | Decision |
| --- | --- | --- |
| `tenant.create` | allow `write_api_policy_matched` | `decision:ef18e8bbd2dead6a` |
| `tenant.retire` | allow `write_api_policy_matched` | `decision:996663f6902d0762` |
| `tenant.guardrail.read` as flex-auth | allow `write_api_policy_matched` | `decision:9b9e540de13cf7cf` |
| `tenant.guardrail.set` as tenant-engine | allow `write_api_policy_matched` | `decision:20c82bc38501a343` |
| `tenant.guardrail.set` as flex-auth | deny `action_not_granted` | `decision:a057a7030df65208` |
| misspelled guardrail | deny `unknown_action` | `decision:18ae70a79c6d47c6` |
| unknown subject | deny `unknown_subject` | `decision:a98c59c6a34f84ad` |
| misspelled lifecycle | deny `unknown_action` | `decision:1b3012abb4e2b27d` |
TEN-WP-0007 can pin the tenant-engine guardrail image. The seven
pre-existing actions still allow.