coulomb/flex-auth
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Restore flex-auth-tenant-engine to the seven-action policy image
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
Build and Publish Container Image / build-and-push (push) Successful in 32s
Details

Browse source 
FLEX-WP-0013. Production had been rolled back to sha256:c25fc34a
(four actions), so tenant.update / tenant.retire / tenant.reactivate
denied unknown_action. Re-pin and apply the previously-live
sha256:9320df39 image (e9911eb). Live probe after restore: all seven
actions allow; misspelled action and unknown subject still deny.
user-engine pin unchanged. TEN-WP-0006 guardrail actions not added.
This commit is contained in:
tegwick 2026-08-16 02:36:56 +02:00
parent 728b2abed1
commit 87f114f036
6 changed files with 181 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

21
examples/tenant-engine/README.md
View file

@ -74,11 +74,22 @@ covered by fixture and by
driven through the client, which only ever emits the seven registered strings
— which is the property the guard exists to protect.
**Not yet in production.** The policy package is baked into the container
image, so the deployed `flex-auth-tenant-engine` Deployment still serves the
pre-FLEX-WP-0010 four-action policy — probed 2026-08-10, `tenant.retire`
returns deny `unknown_action` there. A new image built from this commit and
rolled out is the remaining step before a live lifecycle mutation succeeds.
**In production as of FLEX-WP-0013 (2026-08-16).** The live
`flex-auth-tenant-engine` Deployment on railiance01 runs
`sha256:9320df394a642eff24da8af4a0ee8886a7bb78b0f14d8ee1deeb30ea8eeeaba7`
(CI-built from `e9911eb`). Probed against the Service after restore:
| Action | Effect | Decision |
| --- | --- | --- |
| `tenant.create` | allow `write_api_policy_matched` | `decision:2a94b9ee0dcb4050` |
| `tenant.update` | allow `write_api_policy_matched` | `decision:422fe875467610fb` |
| `tenant.retire` | allow `write_api_policy_matched` | `decision:799301d3443fd6a4` |
| `tenant.reactivate` | allow `write_api_policy_matched` | `decision:4160478ca5499457` |
| `tenant.retired` (typo) | deny `unknown_action` | `decision:30946c43cbe80bfc` |
| unregistered subject | deny `unknown_subject` | `decision:7b107e73cf16fab9` |
Rollback target is `sha256:c25fc34a…` (four-action). TEN-WP-0006 guardrail
actions are **not** in this image.
## Related