From ac024452069c1f866c78ff8cc9f9e95d859aae0a Mon Sep 17 00:00:00 2001 From: tegwick Date: Mon, 17 Aug 2026 22:04:04 +0200 Subject: [PATCH] Ask ops-warden how /v1/check should authenticate callers; T02 waits Co-Authored-By: Claude Opus 5 --- WORK-RECORDS.md | 6 ++++++ .../FLEX-WP-0015-tenancy-posture-conformance.md | 16 +++++++++++++++- 2 files changed, 21 insertions(+), 1 deletion(-) diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index 82dba34..a0ab7fc 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -22,6 +22,7 @@ | workplan | FLEX-WP-0012 | proposed | — | workplans/FLEX-WP-0012-credential-grant-authorization-surface.md | | workplan | FLEX-WP-0013 | finished | — | workplans/FLEX-WP-0013-restore-seven-action-tenant-engine-pin.md | | workplan | FLEX-WP-0014 | finished | — | workplans/FLEX-WP-0014-tenant-guardrail-policy-actions.md | +| workplan | FLEX-WP-0015 | active | — | workplans/FLEX-WP-0015-tenancy-posture-conformance.md | | task | FLEX-WP-0001-T001 | done | — | workplans/FLEX-WP-0001-repo-intent-and-architecture-baseline.md | | task | FLEX-WP-0001-T002 | done | — | workplans/FLEX-WP-0001-repo-intent-and-architecture-baseline.md | | task | FLEX-WP-0001-T003 | done | — | workplans/FLEX-WP-0001-repo-intent-and-architecture-baseline.md | @@ -88,3 +89,8 @@ | task | FLEX-WP-0014-T02 | done | — | workplans/FLEX-WP-0014-tenant-guardrail-policy-actions.md | | task | FLEX-WP-0014-T03 | done | — | workplans/FLEX-WP-0014-tenant-guardrail-policy-actions.md | | task | FLEX-WP-0014-T04 | done | — | workplans/FLEX-WP-0014-tenant-guardrail-policy-actions.md | +| task | FLEX-WP-0015-T01 | done | — | workplans/FLEX-WP-0015-tenancy-posture-conformance.md | +| task | FLEX-WP-0015-T02 | todo | — | workplans/FLEX-WP-0015-tenancy-posture-conformance.md | +| task | FLEX-WP-0015-T03 | todo | — | workplans/FLEX-WP-0015-tenancy-posture-conformance.md | +| task | FLEX-WP-0015-T04 | wait | — | workplans/FLEX-WP-0015-tenancy-posture-conformance.md | +| task | FLEX-WP-0015-T05 | todo | — | workplans/FLEX-WP-0015-tenancy-posture-conformance.md | diff --git a/workplans/FLEX-WP-0015-tenancy-posture-conformance.md b/workplans/FLEX-WP-0015-tenancy-posture-conformance.md index d02f710..45f330e 100644 --- a/workplans/FLEX-WP-0015-tenancy-posture-conformance.md +++ b/workplans/FLEX-WP-0015-tenancy-posture-conformance.md @@ -15,6 +15,7 @@ related_workplans: - FLEX-WP-0011 created: "2026-08-17" updated: "2026-08-17" +state_hub_workstream_id: "31846b19-c2a3-428e-950b-5985bc9146eb" --- # FLEX-WP-0015 - Tenancy posture declaration and inbound caller authentication @@ -54,6 +55,7 @@ per FLEX-WP-0007). id: FLEX-WP-0015-T01 status: done priority: high +state_hub_task_id: "0a32500d-511a-4bd7-972e-de4cd3e62dd9" ``` **Publish posture and answer the review.** Write `tenancy.yaml` and @@ -63,14 +65,23 @@ corrections. Done 2026-08-17. ```task id: FLEX-WP-0015-T02 -status: todo +status: wait priority: high +state_hub_task_id: "b2e87a81-b63d-4be4-ad44-01426b7e6f74" ``` **Close the A0 — authenticate callers of `/v1/check`.** Decide first, build second: this is a production-facing security boundary on a service two consumers already depend on, and the wrong instrument is worse than the delay. +**Waiting on `ops-warden`** (asked 2026-08-17): it owns how workloads prove +identity in this estate, and it is a flex-auth PEP, so it implements the +calling side of whatever we choose. `warden route find` was run first per the +credential-routing rules — the catalog holds credential lanes and has no entry +for service-to-service caller authentication as a pattern, which is part of +what was asked. Our stated instinct is ServiceAccount TokenReview; the +question is open pending their answer. Nothing is built until it lands. + Record an ADR covering at minimum: - What identifies a caller — Kubernetes ServiceAccount token review, mTLS via @@ -97,6 +108,7 @@ Ship through the FLEX-WP-0011 staged-promotion path, not by direct apply. id: FLEX-WP-0015-T03 status: todo priority: medium +state_hub_task_id: "64eb7652-3b67-4bfb-879b-8588deeec8b5" ``` **Wire or delete `internal/adapters/tenantengine`.** The adapter is complete @@ -117,6 +129,7 @@ Update `tenancy.yaml` `I` either way. id: FLEX-WP-0015-T04 status: wait priority: low +state_hub_task_id: "06432560-c28c-4de2-a672-87e74be54a6a" ``` **AuthZEN evaluation endpoint (framework `A4`).** Deliberately deferred, not @@ -136,6 +149,7 @@ this task and may be worth doing first. id: FLEX-WP-0015-T05 status: todo priority: medium +state_hub_task_id: "9195ba20-ab0f-4d75-b293-86978073beb1" ``` **Guard the declaration.** Framework §12 requires verifying the declared