From ff87f32ef4306d861ebb49e514531a3b85b0869a Mon Sep 17 00:00:00 2001 From: custodian-sync Date: Tue, 18 Aug 2026 07:28:38 +0200 Subject: [PATCH] chore(consistency): sync task status from DB [auto] MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Updated by fix-consistency on 2026-08-18: - FLEX-WP-0015-T02: progress → wait --- ...LEX-WP-0015-tenancy-posture-conformance.md | 31 ++++++++++++++++--- 1 file changed, 27 insertions(+), 4 deletions(-) diff --git a/workplans/FLEX-WP-0015-tenancy-posture-conformance.md b/workplans/FLEX-WP-0015-tenancy-posture-conformance.md index 45f330e..ece25d2 100644 --- a/workplans/FLEX-WP-0015-tenancy-posture-conformance.md +++ b/workplans/FLEX-WP-0015-tenancy-posture-conformance.md @@ -14,7 +14,7 @@ related_workplans: - FLEX-WP-0004 - FLEX-WP-0011 created: "2026-08-17" -updated: "2026-08-17" +updated: "2026-08-18" state_hub_workstream_id: "31846b19-c2a3-428e-950b-5985bc9146eb" --- @@ -29,7 +29,9 @@ real defect the review surfaced. ## Why this workplan exists -Three of the framework's five axes describe flex-auth cleanly. Assessing +The original five axes described flex-auth unevenly; draft-8's sixth +availability axis and canonical provider declaration now cover the remaining +shape. Assessing against them turned up two things we did not know we were carrying: 1. **`/v1/check` authenticates no caller.** Any workload with network reach to @@ -104,9 +106,19 @@ with the §13 evidence artifact: a test that an unbound request is refused. Ship through the FLEX-WP-0011 staged-promotion path, not by direct apply. +2026-08-18 source outcome: ADR 0004 selects audience-scoped Kubernetes +ServiceAccount TokenReview with a separately projected reviewer identity and +exact `resource.system` → ServiceAccount bindings. Both check endpoints share +the choke point; missing/mismatched identity fails 401/403 and reviewer outage +fails 503. Unit and handler tests include the required unbound request. Desired +manifests select enforce mode and carry narrow TokenReview RBAC. The running +digest is unchanged, so `tenancy.current.A` honestly remains 0 while +`tenancy.implemented.A` is 2. Remaining: build/pin/promote through +FLEX-WP-0011, migrate both callers and capture the live negative probe. + ```task id: FLEX-WP-0015-T03 -status: todo +status: done priority: medium state_hub_task_id: "64eb7652-3b67-4bfb-879b-8588deeec8b5" ``` @@ -125,6 +137,12 @@ say so in the review record rather than leaving it as latent capability. Update `tenancy.yaml` `I` either way. +Completed 2026-08-18 by deletion. Repository-wide search found no non-test +caller and no policy consuming `tenant_roles`; wiring it would add a +synchronous dependency without a decision that uses the result. The adapter +and its isolated tests were removed, and the review records that any future +live-role policy must introduce the dependency explicitly. + ```task id: FLEX-WP-0015-T04 status: wait @@ -147,7 +165,7 @@ this task and may be worth doing first. ```task id: FLEX-WP-0015-T05 -status: todo +status: done priority: medium state_hub_task_id: "9195ba20-ab0f-4d75-b293-86978073beb1" ``` @@ -165,3 +183,8 @@ prove: that the `/v1/check` handler has caller authentication iff Designed for invisible failure per §12: posture regression returns correct-looking responses, exactly like the two silent pin rollbacks the estate has already been bitten by. + +Completed 2026-08-18. `make verify-posture` checks the current/implemented +distinction, both authenticated handlers, enforce-mode desired manifests, +TokenReview RBAC, absence of a latent tenant-engine caller, and the stateless +deployment assumptions behind `R: n/a`.