coulomb/flex-auth
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Deploy user-engine authorization policy
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source
This commit is contained in:
tegwick 2026-08-09 02:21:29 +02:00
parent 5217109103
commit ccf4b509be
5 changed files with 141 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

26
workplans/FLEX-WP-0009-user-engine-production-policy-service.md
View file

@ -4,7 +4,7 @@ type: workplan
title: "Provide production authorization for user-engine"
domain: infotech
repo: flex-auth
status: ready
status: active
owner: codex
topic_slug: netkingdom
created: "2026-08-08"
@ -24,7 +24,7 @@ net-kingdom/docs/user-engine-platform-expansion-contract.md.
```task
id: FLEX-WP-0009-T01
status: todo
status: done
priority: high
state_hub_task_id: "e940c5a3-ecb4-43d3-9554-2bfb422ec56d"
```
@ -38,11 +38,15 @@ deny.
Done when all manifests validate and the vocabulary matches the action and
resource strings emitted by user-engine.
Done 2026-08-09: `examples/user-engine` defines the dynamic protected-system
registry and verified-claim request vocabulary for platform, tenant-admin,
self-service, cross-tenant, missing-role, and wrong-system cases.
## T02 - Implement and verify the policy package
```task
id: FLEX-WP-0009-T02
status: todo
status: done
priority: high
state_hub_task_id: "6e0fe708-d7ff-411f-a64d-84a1692a6e11"
```
@ -55,11 +59,14 @@ mismatch, cross-tenant, malformed-context, and stale-policy fixtures.
Done when fixture evaluation is deterministic, default deny is proven, and
decision envelopes contain stable decision IDs and policy provenance.
Done 2026-08-09: all six embedded Rego tests and all six request fixtures pass;
the package validates under CARING 0.4.0-rc2 and the registry loads cleanly.
## T03 - Deploy the cluster-local service
```task
id: FLEX-WP-0009-T03
status: todo
status: done
priority: high
state_hub_task_id: "f8293230-136d-4f2d-8d3f-bb9840ea7e63"
```
@ -72,11 +79,15 @@ NetworkPolicy, and ingress restricted to approved protected systems.
Done when user-engine can reach POST /v1/check, an unrelated namespace
cannot, and restart/rollback procedures are documented.
Done 2026-08-09: immutable digest `sha256:a31961c45215aa6baf3bc748c6741ab703c2c8325e61aa7983a355026195e51b`
is deployed as `flex-auth-user-engine.flex-auth.svc.cluster.local:8080`, Ready
behind ingress restricted to the user-engine workload and with no egress.
## T04 - Hand back production evidence
```task
id: FLEX-WP-0009-T04
status: todo
status: progress
priority: high
state_hub_task_id: "97b931e9-ac5b-46c7-a462-e23c0c18c4f4"
```
@ -87,3 +98,8 @@ policy version, and correlation IDs. Send completion evidence to NK-WP-0024.
Done when user-engine can replace its local authorization bridge without an
availability bypass and the deployed failure matrix remains fail closed.
2026-08-09 live evidence: from the user-engine pod, `live-self` returned allow
with decision `decision:4bf95ebb989ac628`; the cross-tenant variant returned
deny/cross_tenant with decision `decision:bab072ce3ee72d98`. Runtime activation
remains gated on the separately owned event and mail receivers.