flex-auth

Author	SHA1	Message	Date
tegwick	0e020b2d8c	Cover wrong-tenant denials in ops-warden and railiance-platform fixtures. FLEX-WP-0022-T03: the rules already refused a foreign tenant; the fixture suites never varied the field. No policy or version change. Asked tenant-engine to name the CheckRequest tenant relation for T01/T02. Assistant: grok Assistant-Session: 01a0a6cb-0334-72c0-83b0-2df57474a0f6	2026-09-15 23:38:48 +02:00
tegwick	86716ff263	Audit package attribute reads and choose fact/assertion shape. All checks were successful CI Smoke / host-smoke (push) Successful in 0s Details CI Smoke / container-smoke (push) Successful in 2s Details Build and Publish Container Image / build-and-push (push) Successful in 56s Details FLEX-WP-0025-T01/T02: keep merged attributes, add registry/asserted namespaces later, and declare the remaining ceiling keys so no published allowlist is unbacked. T03 stays waiting on validate. Assistant: grok Assistant-Session: 01a09dc1-b21e-77e1-919e-fcad2f82b267	2026-09-14 04:47:52 +02:00
tegwick	e521e7b715	feat(policy): adopt security zone stances All checks were successful CI Smoke / host-smoke (push) Successful in 0s Details CI Smoke / container-smoke (push) Successful in 1s Details Build and Publish Container Image / build-and-push (push) Successful in 33s Details Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a0291a-1e87-7151-9934-fcbfe3f65eb1	2026-08-22 15:17:13 +02:00
tegwick	941501c590	FLEX-WP-0007: production registry fixture, tests, and sync runbook Add production_registry_snapshot.json from ops-warden inventory with CI coverage for real actors, IAM subject binding, ttl_out_of_bounds, and unknown_actor_resource. Extend serve contract tests with /healthz and publish the registry sync contract for operator deployment.	2026-06-24 14:52:35 +02:00
tegwick	0fde95a87c	FLEX-WP-0006: implement ops-warden signing gate policy	2026-06-23 21:17:42 +02:00

5 commits