Restore flex-auth-tenant-engine to the seven-action policy image

FLEX-WP-0013. Production had been rolled back to sha256:c25fc34a
(four actions), so tenant.update / tenant.retire / tenant.reactivate
denied unknown_action. Re-pin and apply the previously-live
sha256:9320df39 image (e9911eb). Live probe after restore: all seven
actions allow; misspelled action and unknown subject still deny.
user-engine pin unchanged. TEN-WP-0006 guardrail actions not added.

deploy/README.md

@@ -86,8 +86,8 @@ last-known-good digest below.
 
 | Deployment | Last-known-good digest | Policy state |
 | --- | --- | --- |
-| `flex-auth-tenant-engine` | `sha256:c25fc34a6cd7e64d955f8723ec70e176a583d5ae71d76280c4e2d89fba0fe0aa` | **live 2026-08-16** — four-action policy; `tenant.retire`/`update`/`reactivate` deny `unknown_action` |
+| `flex-auth-tenant-engine` | `sha256:9320df394a642eff24da8af4a0ee8886a7bb78b0f14d8ee1deeb30ea8eeeaba7` | **live 2026-08-16** — seven-action policy restored (FLEX-WP-0013); CI-built from `e9911eb` |
-| `flex-auth-tenant-engine` *(FLEX-WP-0010)* | `sha256:9320df394a642eff24da8af4a0ee8886a7bb78b0f14d8ee1deeb30ea8eeeaba7` | seven-action policy, CI-built from `e9911eb`; ReplicaSet present but scaled to 0 |
+| `flex-auth-tenant-engine` *(rollback)* | `sha256:c25fc34a6cd7e64d955f8723ec70e176a583d5ae71d76280c4e2d89fba0fe0aa` | four-action policy; lifecycle actions deny `unknown_action` |
 | `flex-auth-user-engine` | `sha256:1f5290376dc5fcf456dc7a785e394d8b90949dabecd1d3e856f38557149bb5f4` | **current** — FLEX-WP-0009-T04, nine fixtures (incl. registration-applicant) verified live 2026-08-16 |
 | `flex-auth-user-engine` *(previous)* | `sha256:a31961c45215aa6baf3bc748c6741ab703c2c8325e61aa7983a355026195e51b` | FLEX-WP-0009-T03, six fixtures verified live 2026-08-10 |
 

deploy/flex-auth-tenant-engine.yaml

@@ -23,7 +23,7 @@ spec:
         - /opt/flex-auth/examples/tenant-engine/registry_snapshot.json
         - --policy
         - /opt/flex-auth/examples/tenant-engine/policy_package.md
-        image: forgejo.coulomb.social/coulomb/flex-auth@sha256:c25fc34a6cd7e64d955f8723ec70e176a583d5ae71d76280c4e2d89fba0fe0aa
+        image: forgejo.coulomb.social/coulomb/flex-auth@sha256:9320df394a642eff24da8af4a0ee8886a7bb78b0f14d8ee1deeb30ea8eeeaba7
         livenessProbe:
           httpGet:
             path: /healthz

examples/tenant-engine/README.md

@@ -74,11 +74,22 @@ covered by fixture and by
 driven through the client, which only ever emits the seven registered strings
 — which is the property the guard exists to protect.
 
-**Not yet in production.** The policy package is baked into the container
+**In production as of FLEX-WP-0013 (2026-08-16).** The live
-image, so the deployed `flex-auth-tenant-engine` Deployment still serves the
+`flex-auth-tenant-engine` Deployment on railiance01 runs
-pre-FLEX-WP-0010 four-action policy — probed 2026-08-10, `tenant.retire`
+`sha256:9320df394a642eff24da8af4a0ee8886a7bb78b0f14d8ee1deeb30ea8eeeaba7`
-returns deny `unknown_action` there. A new image built from this commit and
+(CI-built from `e9911eb`). Probed against the Service after restore:
-rolled out is the remaining step before a live lifecycle mutation succeeds.
+
+| Action | Effect | Decision |
+| --- | --- | --- |
+| `tenant.create` | allow `write_api_policy_matched` | `decision:2a94b9ee0dcb4050` |
+| `tenant.update` | allow `write_api_policy_matched` | `decision:422fe875467610fb` |
+| `tenant.retire` | allow `write_api_policy_matched` | `decision:799301d3443fd6a4` |
+| `tenant.reactivate` | allow `write_api_policy_matched` | `decision:4160478ca5499457` |
+| `tenant.retired` (typo) | deny `unknown_action` | `decision:30946c43cbe80bfc` |
+| unregistered subject | deny `unknown_subject` | `decision:7b107e73cf16fab9` |
+
+Rollback target is `sha256:c25fc34a…` (four-action). TEN-WP-0006 guardrail
+actions are **not** in this image.
 
 ## Related
 

railiance/README.md

@@ -76,7 +76,7 @@ or re-apply the last-known-good digest in `deploy/README.md`.
 
 | Deployment | Last-known-good digest | Policy state |
 | --- | --- | --- |
-| `flex-auth-tenant-engine` | `sha256:c25fc34a6cd7e64d955f8723ec70e176a583d5ae71d76280c4e2d89fba0fe0aa` | **live 2026-08-16** — four-action policy; lifecycle actions deny `unknown_action` |
+| `flex-auth-tenant-engine` | `sha256:9320df394a642eff24da8af4a0ee8886a7bb78b0f14d8ee1deeb30ea8eeeaba7` | **live 2026-08-16** — seven-action policy restored (FLEX-WP-0013) |
-| `flex-auth-tenant-engine` *(FLEX-WP-0010 image, scaled to 0)* | `sha256:9320df394a642eff24da8af4a0ee8886a7bb78b0f14d8ee1deeb30ea8eeeaba7` | seven-action policy, previously live 2026-08-11 |
+| `flex-auth-tenant-engine` *(rollback)* | `sha256:c25fc34a6cd7e64d955f8723ec70e176a583d5ae71d76280c4e2d89fba0fe0aa` | four-action policy; lifecycle actions deny `unknown_action` |
 | `flex-auth-user-engine` | `sha256:1f5290376dc5fcf456dc7a785e394d8b90949dabecd1d3e856f38557149bb5f4` | FLEX-WP-0009-T04, nine fixtures, live 2026-08-16 |
 | `flex-auth-user-engine` *(previous)* | `sha256:a31961c45215aa6baf3bc748c6741ab703c2c8325e61aa7983a355026195e51b` | FLEX-WP-0009-T03, six fixtures |

values/tenant-engine.yaml

@@ -2,7 +2,7 @@
 name: flex-auth-tenant-engine
 image:
   repository: forgejo.coulomb.social/coulomb/flex-auth
-  digest: sha256:c25fc34a6cd7e64d955f8723ec70e176a583d5ae71d76280c4e2d89fba0fe0aa
+  digest: sha256:9320df394a642eff24da8af4a0ee8886a7bb78b0f14d8ee1deeb30ea8eeeaba7
 args:
   - serve
   - --addr

workplans/FLEX-WP-0013-restore-seven-action-tenant-engine-pin.md

@@ -0,0 +1,159 @@
+---
+id: FLEX-WP-0013
+type: workplan
+title: "Restore the seven-action tenant-engine policy pin"
+domain: infotech
+repo: flex-auth
+status: finished
+owner: grok
+topic_slug: netkingdom
+planning_priority: P1
+planning_order: 130
+depends_on_workplans:
+  - FLEX-WP-0010
+  - FLEX-WP-0011
+related_workplans:
+  - TEN-WP-0005
+  - TEN-WP-0006
+created: "2026-08-16"
+updated: "2026-08-16"
+---
+
+# FLEX-WP-0013 - Restore the seven-action tenant-engine policy pin
+
+`flex-auth-tenant-engine` on railiance01 is serving the pre-FLEX-WP-0010
+four-action image. `tenant.update` / `tenant.retire` / `tenant.reactivate`
+deny `unknown_action`. That undoes the TEN-WP-0005-T05 production authority
+tenant-engine confirmed on 2026-08-13.
+
+This is a pin restore, not a policy change. The seven-action package is
+already in source (`FLEX-WP-0010`) and already exists as image
+`sha256:9320df394a642eff24da8af4a0ee8886a7bb78b0f14d8ee1deeb30ea8eeeaba7`
+(CI-built from `e9911eb`). That image was live 2026-08-11 through at least
+2026-08-13; its ReplicaSet is still present at desired=0.
+
+Do **not** add the TEN-WP-0006 guardrail actions here. Those land on a
+package that is behind; extending it first would compound the regression.
+
+## Why production is on four actions
+
+| Date | What happened |
+|---|---|
+| 2026-08-11 | `3dc6223` pinned and applied `9320df39` (seven actions). tenant-engine confirmed live lifecycle writes. |
+| 2026-08-16 | Live probe during `FLEX-WP-0011` found the Deployment back on `c25fc34a`. Revision 4 reused the 2026-08-08 four-action ReplicaSet. |
+| 2026-08-16 | Overlay commit `1d58f13` rewrote `deploy/flex-auth-tenant-engine.yaml` and `values/tenant-engine.yaml` to match the rolled-back live pin, so the files now *encode* the regression. |
+
+`FLEX-WP-0011` explicitly did not re-promote. tenant-engine left the restore
+as the operator's call (`5572d198`). This workplan is that call.
+
+## Candidate and rollback
+
+| Role | Digest | Policy |
+|---|---|---|
+| Candidate | `sha256:9320df394a642eff24da8af4a0ee8886a7bb78b0f14d8ee1deeb30ea8eeeaba7` | seven-action, previously live |
+| Rollback | `sha256:c25fc34a6cd7e64d955f8723ec70e176a583d5ae71d76280c4e2d89fba0fe0aa` | four-action, live at start of this workplan |
+
+Restore the known-good digest rather than building a new image. The
+tenant-engine policy has not changed since `e9911eb`. A new image would
+re-bake unrelated later packages and would not be the artifact tenant-engine
+already verified.
+
+Apply via the emergency kubectl path. Production has no Helm release;
+`helm upgrade --install` would adopt the live objects and is out of scope.
+
+Do not move `flex-auth-user-engine`.
+
+## T01 - Re-pin the overlay and emergency manifests
+
+```task
+id: FLEX-WP-0013-T01
+status: done
+priority: high
+```
+
+Set the tenant-engine digest to `9320df39` in:
+
+- `values/tenant-engine.yaml` (overlay pin; leaving this on `c25fc34a` would
+  re-encode the regression and invite the next overlay apply to undo T02)
+- `deploy/flex-auth-tenant-engine.yaml` (emergency kubectl path, what
+  production actually applies)
+
+Update the last-known-good tables in `deploy/README.md` and
+`railiance/README.md`. Leave `flex-auth-user-engine` untouched.
+
+Done when both pin files name the seven-action digest and the runbooks list
+`c25fc34a` as the rollback target.
+
+Done 2026-08-16: `values/tenant-engine.yaml` and
+`deploy/flex-auth-tenant-engine.yaml` pin `9320df39`. Runbook tables list
+that digest as live and `c25fc34a` as rollback.
+
+## T02 - Apply and prove the seven actions live
+
+```task
+id: FLEX-WP-0013-T02
+status: done
+priority: high
+```
+
+`kubectl apply -f deploy/flex-auth-tenant-engine.yaml` against railiance01,
+then `rollout status`. Prove the policy, not just that the pod started.
+
+Required live `/v1/check` outcomes against the Service:
+
+| Action | Expected |
+|---|---|
+| `tenant.create` | allow `write_api_policy_matched` |
+| `tenant.update` | allow `write_api_policy_matched` |
+| `tenant.retire` | allow `write_api_policy_matched` |
+| `tenant.reactivate` | allow `write_api_policy_matched` |
+| misspelled lifecycle action | deny `unknown_action` |
+| unknown subject | deny `unknown_subject` |
+
+Confirm `flex-auth-user-engine` is still on
+`sha256:1f5290376dc5fcf456dc7a785e394d8b90949dabecd1d3e856f38557149bb5f4`.
+
+Done when the three lifecycle actions allow from the live Service and the
+user-engine pin is unchanged.
+
+Done 2026-08-16 on railiance01. `kubectl apply -f
+deploy/flex-auth-tenant-engine.yaml` reused ReplicaSet
+`flex-auth-tenant-engine-56d5bbd6bf` (desired 0 → 1). Approval
+`f3fbe4cf-efb2-4e4a-99ca-a83050dac6ed`. Decision `c8e39a19`.
+
+| Action | Subject | Effect | Decision |
+|---|---|---|---|
+| `tenant.create` | tenant-engine | allow `write_api_policy_matched` | `decision:2a94b9ee0dcb4050` |
+| `tenant.role.grant` | tenant-engine | allow `write_api_policy_matched` | `decision:845d6aa2d5cf6ae7` |
+| `tenant.role.revoke` | tenant-engine | allow `write_api_policy_matched` | `decision:bd0e331d9443b0bf` |
+| `tenant.plan.assign` | tenant-engine | allow `write_api_policy_matched` | `decision:b900c1e96b5534ad` |
+| `tenant.update` | tenant-engine | allow `write_api_policy_matched` | `decision:422fe875467610fb` |
+| `tenant.retire` | tenant-engine | allow `write_api_policy_matched` | `decision:799301d3443fd6a4` |
+| `tenant.reactivate` | tenant-engine | allow `write_api_policy_matched` | `decision:4160478ca5499457` |
+| `tenant.retired` | tenant-engine | deny `unknown_action` | `decision:30946c43cbe80bfc` |
+| `tenant.retire` | ops | deny `unknown_subject` | `decision:7b107e73cf16fab9` |
+
+`flex-auth-user-engine` remained
+`sha256:1f5290376dc5fcf456dc7a785e394d8b90949dabecd1d3e856f38557149bb5f4`.
+
+## T03 - Handoff and close
+
+```task
+id: FLEX-WP-0013-T03
+status: done
+priority: medium
+```
+
+Notify `tenant-engine` that TEN-WP-0005-T05 authority is restored, naming
+digest `9320df39` and the live decision ids. State plainly that TEN-WP-0006
+guardrail actions (`tenant.guardrail.read` / `tenant.guardrail.set`) are
+**not** in this image and still need a separate policy revision.
+
+Update `examples/tenant-engine/README.md` so it no longer says the lifecycle
+actions are not in production.
+
+Done when the handoff is sent and this workplan is `finished`.
+
+Done 2026-08-16: handoff sent to `tenant-engine`. TEN-WP-0005-T05 authority
+is restored on digest `9320df39`. TEN-WP-0006 guardrail actions are not in
+this image.