From ebde4ecba69423aacc83468d0e81e6299c39df67 Mon Sep 17 00:00:00 2001 From: tegwick Date: Wed, 19 Aug 2026 13:31:08 +0200 Subject: [PATCH] Record user-engine ack that USER-WP-0023-T03 will not probe warn --- ...LEX-WP-0015-tenancy-posture-conformance.md | 19 +++++++++++-------- 1 file changed, 11 insertions(+), 8 deletions(-) diff --git a/workplans/FLEX-WP-0015-tenancy-posture-conformance.md b/workplans/FLEX-WP-0015-tenancy-posture-conformance.md index 967eef0..2bb40eb 100644 --- a/workplans/FLEX-WP-0015-tenancy-posture-conformance.md +++ b/workplans/FLEX-WP-0015-tenancy-posture-conformance.md @@ -136,15 +136,18 @@ would delay user-engine A2 evidence for no safety gain. Sequence: caller-auth disabled. Do not `kubectl apply` an enforce manifest. 3. Confirm warn logs per consumer. `user-engine` is migrated and deployed as of 2026-08-18 (image `sha256:c501aeb2…`, token at - `/var/run/secrets/flex-auth-caller/token`). `tenant-engine` source and - desired manifests already project that token and send it; live digest - is still unconfirmed. Warn is safe either way. `ops-warden` adopts the - calling side on its own schedule. + `/var/run/secrets/flex-auth-caller/token`). On 2026-08-19 they confirmed + USER-WP-0023-T03 stays wait and they will not run the three assertions + against warn (message `f963906d`). `tenant-engine` source and desired + manifests already project that token and send it; live digest is still + unconfirmed. Warn is safe either way. `ops-warden` adopts the calling + side on its own schedule. 4. Flip **user-engine only** to `enforce` (`callerAuth.mode: enforce` in - `values/user-engine.yaml`, same digest). Then capture the live negative - probe from a user-engine pod. The three assertions are already written - in user-engine `docs/flex-auth-caller-identity.md`; they must not run - against warn, because "no token returns 401" would still be a decision. + `values/user-engine.yaml`, same digest). Then they capture the live + negative probe from a user-engine pod. The three assertions are already + written in user-engine `docs/flex-auth-caller-identity.md`; they must + not run against warn, because "no token returns 401" would still be a + decision. 5. Flip tenant-engine to enforce only after its warn logs are clean. 6. Only then may `policy.enabled` flip anywhere — `ops-warden` names that the real deadline, and it is the same gate as FLEX-WP-0007.