coulomb/flex-auth
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Record production gap for FLEX-WP-0010 and re-probe FLEX-WP-0009
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
FLEX-WP-0010-T04: the deployed flex-auth-tenant-engine Deployment bakes
the policy package into its image, so production still serves the
four-action policy -- probed live, tenant.retire returns deny
unknown_action there while tenant.create allows. TEN-WP-0005-T05 is
unblocked in source but needs an image build from 8e127e5 and a rollout,
which this workplan does not scope. Stated in the workplan and in
examples/tenant-engine/README.md rather than left implied.

FLEX-WP-0009-T04: replayed all six user-engine fixtures against the
deployed flex-auth-user-engine service; all six matched expected effect
and reason, confirming the deployed failure matrix is still fail-closed.
T04 stays in progress -- the criterion also requires user-engine to
retire its local bridge, which is not flex-auth's to close.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
tegwick 2026-08-10 20:55:41 +02:00
parent 8e127e50f7
commit 9e6de5a50d
3 changed files with 45 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

21
workplans/FLEX-WP-0010-tenant-lifecycle-policy-actions.md
View file

@ -221,4 +221,23 @@ profile `caring-0.4.0-rc2`, now carrying all seven actions — the version
string is unchanged because the package is additive and `v1` remains the
activated revision; the identifying fact for TEN-WP-0005-T05 is that `v1` as
of this commit contains `tenant.update`, `tenant.retire`, and
`tenant.reactivate`. `TEN-WP-0005-T05` is unblocked.
`tenant.reactivate`.
**Production is not yet serving this policy — stated plainly because
TEN-WP-0005-T05 depends on it.** The policy package is baked into the
flex-auth container image, not mounted from a ConfigMap: the deployed
`flex-auth-tenant-engine` Deployment in namespace `flex-auth` runs image
`@sha256:c25fc34a6cd7e64d955f8723ec70e176a583d5ae71d76280c4e2d89fba0fe0aa`
with `--policy /opt/flex-auth/examples/tenant-engine/policy_package.md`
from that image. Probed live on 2026-08-10 via port-forward:
`tenant.retire` still returns **deny `unknown_action`**, while
`tenant.create` returns allow — i.e. the running instance is the
pre-FLEX-WP-0010 four-action policy.
So `TEN-WP-0005-T05` is unblocked **in source** but not **in the cluster**
until a new image is built from commit `8e127e5` and rolled out. That
rollout is a production deploy that this workplan does not scope (contrast
FLEX-WP-0007 and FLEX-WP-0009-T03, which carried explicit deployment
tasks) and it is deliberately left for an owner decision rather than done
implicitly under a policy-authoring workplan. It is the single remaining
step between this commit and a live lifecycle mutation.