flex-auth

Author	SHA1	Message	Date
tegwick	79582870c0	Pin flex-auth-tenant-engine to the nine-action policy image All checks were successful CI Smoke / host-smoke (push) Successful in 0s Details CI Smoke / container-smoke (push) Successful in 1s Details Build and Publish Container Image / build-and-push (push) Successful in 35s Details CI digest sha256:1bf060e6 (main-f304688) is live. Seven pre-existing actions still allow; guardrail.read/set match the FLEX-WP-0014 split. user-engine pin unchanged. Rollback target is sha256:9320df39.	2026-08-16 09:57:07 +02:00
tegwick	a98b5fc063	chore(consistency): record FLEX-WP-0014 hub IDs All checks were successful CI Smoke / host-smoke (push) Successful in 0s Details CI Smoke / container-smoke (push) Successful in 1s Details C-06 registered the guardrail workplan and wrote state_hub_workstream_id plus the four task ids back into the file.	2026-08-16 02:47:13 +02:00
tegwick	f304688d72	Authorize tenant-engine guardrail read and set actions All checks were successful CI Smoke / host-smoke (push) Successful in 1s Details CI Smoke / container-smoke (push) Successful in 2s Details Build and Publish Container Image / build-and-push (push) Successful in 39s Details FLEX-WP-0014. Package tenant-engine.write-api.mutate v1 now carries nine actions: tenant.guardrail.read and tenant.guardrail.set on resource type guardrail, verbatim from tenant-engine's mapping. The read/write split is used now: flex-auth may read ceilings and is denied action_not_granted on set; tenant-engine may do both. 17/17 Rego tests and 23/23 fixtures pass. Live e2e against a real tenant-engine FlexAuthWriteAuthorizer matches. In source only; production still serves the seven-action 9320df39 pin.	2026-08-16 02:46:25 +02:00

3 commits