Pin deployed secrets-engine tenant policy v2

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a0726e-5232-73f2-aaca-2c05ceb62efb

railiance/README.md

@@ -121,3 +121,9 @@ by immutable digest, caller-auth warn, and ingress restricted to namespace
 secrets-engine/pod label app.kubernetes.io/name=secrets-engine. Do not promote
 to enforce until the consumer identity is adopted and verified. See
 FLEX-WP-0021 for positive/negative policy and network evidence.
+
+The secrets-engine pin is now revision 2, CI main-d98323b, policy v2, image
+sha256:db1c4f7e621c7ea119489a321d7db0e05da09afc17be5f69d873b2b3c7f60cfc.
+Live wrong_tenant denial and all six published requests pass. Revision 1 lacked
+tenant enforcement and is not a safe rollback target. Workstation caller
+access remains an adoption gate; warn is not authenticated production adoption.

values/secrets-engine.yaml

@@ -1,8 +1,8 @@
-# Dedicated secrets-engine policy service; CI build main-dd3ce4c.
+# Dedicated secrets-engine policy service; CI build main-d98323b.
 name: flex-auth-secrets-engine
 image:
   repository: forgejo.coulomb.social/coulomb/flex-auth
-  digest: sha256:89086c02c74a931068423e70937d03df7850fa0db9c63e70be56b3558f1756af
+  digest: sha256:db1c4f7e621c7ea119489a321d7db0e05da09afc17be5f69d873b2b3c7f60cfc
 args:
   - serve
   - --addr

workplans/FLEX-WP-0021-secrets-engine-consumer-policy-gate.md

@@ -299,3 +299,17 @@ waiting on consumer configuration/adoption and the owner handoff. Approval
 service, KeyCape clients and real credential-lane activation are not supplied
 by this deployment. First-install rollback is removal of this dedicated Helm
 release, leaving the three existing consumers untouched.
+
+## v2 production correction applied — 2026-09-06
+
+Glas applied the existing operator production authorization to correct the
+reported v1 tenant fail-open. Helm revision 2 uses CI main-d98323b digest
+sha256:db1c4f7e621c7ea119489a321d7db0e05da09afc17be5f69d873b2b3c7f60cfc.
+Lint/server dry-run/rollout passed. Six published Check requests on the live
+service returned expected two allows/four denies, including wrong_tenant;
+all matched_policy_version values are v2. Other consumer Deployment specs
+are unchanged. Values pin updated. Caller authentication remains warn;
+workstation consumer access/adoption remains outstanding despite T05 closure.
+Glas has sent a follow-up requesting an explicit live owner work record for
+that gate. Do not roll back to known over-permissive v1; stop this dedicated
+release if v2 cannot be served.