diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index 96f2b82..4405283 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -18,7 +18,7 @@ | workplan | FLEX-WP-0008 | finished | — | workplans/FLEX-WP-0008-tenant-engine-consumer-integration.md | | workplan | FLEX-WP-0009 | finished | — | workplans/FLEX-WP-0009-user-engine-production-policy-service.md | | workplan | FLEX-WP-0010 | finished | — | workplans/FLEX-WP-0010-tenant-lifecycle-policy-actions.md | -| workplan | FLEX-WP-0011 | active | — | workplans/FLEX-WP-0011-railiance-staged-promotion-overlay.md | +| workplan | FLEX-WP-0011 | proposed | — | workplans/FLEX-WP-0011-railiance-staged-promotion-overlay.md | | workplan | FLEX-WP-0012 | proposed | — | workplans/FLEX-WP-0012-credential-grant-authorization-surface.md | | task | FLEX-WP-0001-T001 | done | — | workplans/FLEX-WP-0001-repo-intent-and-architecture-baseline.md | | task | FLEX-WP-0001-T002 | done | — | workplans/FLEX-WP-0001-repo-intent-and-architecture-baseline.md | @@ -72,9 +72,9 @@ | task | FLEX-WP-0010-T02 | done | — | workplans/FLEX-WP-0010-tenant-lifecycle-policy-actions.md | | task | FLEX-WP-0010-T03 | done | — | workplans/FLEX-WP-0010-tenant-lifecycle-policy-actions.md | | task | FLEX-WP-0010-T04 | done | — | workplans/FLEX-WP-0010-tenant-lifecycle-policy-actions.md | -| task | FLEX-WP-0011-T01 | done | — | workplans/FLEX-WP-0011-railiance-staged-promotion-overlay.md | -| task | FLEX-WP-0011-T02 | done | — | workplans/FLEX-WP-0011-railiance-staged-promotion-overlay.md | -| task | FLEX-WP-0011-T03 | wait | — | workplans/FLEX-WP-0011-railiance-staged-promotion-overlay.md | +| task | FLEX-WP-0011-T01 | todo | — | workplans/FLEX-WP-0011-railiance-staged-promotion-overlay.md | +| task | FLEX-WP-0011-T02 | todo | — | workplans/FLEX-WP-0011-railiance-staged-promotion-overlay.md | +| task | FLEX-WP-0011-T03 | todo | — | workplans/FLEX-WP-0011-railiance-staged-promotion-overlay.md | | task | FLEX-WP-0012-T01 | todo | — | workplans/FLEX-WP-0012-credential-grant-authorization-surface.md | | task | FLEX-WP-0012-T02 | todo | — | workplans/FLEX-WP-0012-credential-grant-authorization-surface.md | | task | FLEX-WP-0012-T03 | todo | — | workplans/FLEX-WP-0012-credential-grant-authorization-surface.md | diff --git a/deploy/README.md b/deploy/README.md index 4b03bb3..d485509 100644 --- a/deploy/README.md +++ b/deploy/README.md @@ -86,8 +86,8 @@ last-known-good digest below. | Deployment | Last-known-good digest | Policy state | | --- | --- | --- | -| `flex-auth-tenant-engine` | `sha256:9320df394a642eff24da8af4a0ee8886a7bb78b0f14d8ee1deeb30ea8eeeaba7` | **live 2026-08-16** — seven-action policy restored (FLEX-WP-0013); CI-built from `e9911eb` | -| `flex-auth-tenant-engine` *(rollback)* | `sha256:c25fc34a6cd7e64d955f8723ec70e176a583d5ae71d76280c4e2d89fba0fe0aa` | four-action policy; lifecycle actions deny `unknown_action` | +| `flex-auth-tenant-engine` | `sha256:c25fc34a6cd7e64d955f8723ec70e176a583d5ae71d76280c4e2d89fba0fe0aa` | **live 2026-08-16** — four-action policy; `tenant.retire`/`update`/`reactivate` deny `unknown_action` | +| `flex-auth-tenant-engine` *(FLEX-WP-0010)* | `sha256:9320df394a642eff24da8af4a0ee8886a7bb78b0f14d8ee1deeb30ea8eeeaba7` | seven-action policy, CI-built from `e9911eb`; ReplicaSet present but scaled to 0 | | `flex-auth-user-engine` | `sha256:1f5290376dc5fcf456dc7a785e394d8b90949dabecd1d3e856f38557149bb5f4` | **current** — FLEX-WP-0009-T04, nine fixtures (incl. registration-applicant) verified live 2026-08-16 | | `flex-auth-user-engine` *(previous)* | `sha256:a31961c45215aa6baf3bc748c6741ab703c2c8325e61aa7983a355026195e51b` | FLEX-WP-0009-T03, six fixtures verified live 2026-08-10 | diff --git a/deploy/flex-auth-tenant-engine.yaml b/deploy/flex-auth-tenant-engine.yaml index de25e54..e0a71ad 100644 --- a/deploy/flex-auth-tenant-engine.yaml +++ b/deploy/flex-auth-tenant-engine.yaml @@ -23,7 +23,7 @@ spec: - /opt/flex-auth/examples/tenant-engine/registry_snapshot.json - --policy - /opt/flex-auth/examples/tenant-engine/policy_package.md - image: forgejo.coulomb.social/coulomb/flex-auth@sha256:9320df394a642eff24da8af4a0ee8886a7bb78b0f14d8ee1deeb30ea8eeeaba7 + image: forgejo.coulomb.social/coulomb/flex-auth@sha256:c25fc34a6cd7e64d955f8723ec70e176a583d5ae71d76280c4e2d89fba0fe0aa livenessProbe: httpGet: path: /healthz diff --git a/examples/tenant-engine/README.md b/examples/tenant-engine/README.md index 8528e1f..7a4b43c 100644 --- a/examples/tenant-engine/README.md +++ b/examples/tenant-engine/README.md @@ -74,22 +74,11 @@ covered by fixture and by driven through the client, which only ever emits the seven registered strings — which is the property the guard exists to protect. -**In production as of FLEX-WP-0013 (2026-08-16).** The live -`flex-auth-tenant-engine` Deployment on railiance01 runs -`sha256:9320df394a642eff24da8af4a0ee8886a7bb78b0f14d8ee1deeb30ea8eeeaba7` -(CI-built from `e9911eb`). Probed against the Service after restore: - -| Action | Effect | Decision | -| --- | --- | --- | -| `tenant.create` | allow `write_api_policy_matched` | `decision:2a94b9ee0dcb4050` | -| `tenant.update` | allow `write_api_policy_matched` | `decision:422fe875467610fb` | -| `tenant.retire` | allow `write_api_policy_matched` | `decision:799301d3443fd6a4` | -| `tenant.reactivate` | allow `write_api_policy_matched` | `decision:4160478ca5499457` | -| `tenant.retired` (typo) | deny `unknown_action` | `decision:30946c43cbe80bfc` | -| unregistered subject | deny `unknown_subject` | `decision:7b107e73cf16fab9` | - -Rollback target is `sha256:c25fc34a…` (four-action). TEN-WP-0006 guardrail -actions are **not** in this image. +**Not yet in production.** The policy package is baked into the container +image, so the deployed `flex-auth-tenant-engine` Deployment still serves the +pre-FLEX-WP-0010 four-action policy — probed 2026-08-10, `tenant.retire` +returns deny `unknown_action` there. A new image built from this commit and +rolled out is the remaining step before a live lifecycle mutation succeeds. ## Related diff --git a/railiance/README.md b/railiance/README.md index 66c075b..d3fda4d 100644 --- a/railiance/README.md +++ b/railiance/README.md @@ -76,7 +76,7 @@ or re-apply the last-known-good digest in `deploy/README.md`. | Deployment | Last-known-good digest | Policy state | | --- | --- | --- | -| `flex-auth-tenant-engine` | `sha256:9320df394a642eff24da8af4a0ee8886a7bb78b0f14d8ee1deeb30ea8eeeaba7` | **live 2026-08-16** — seven-action policy restored (FLEX-WP-0013) | -| `flex-auth-tenant-engine` *(rollback)* | `sha256:c25fc34a6cd7e64d955f8723ec70e176a583d5ae71d76280c4e2d89fba0fe0aa` | four-action policy; lifecycle actions deny `unknown_action` | +| `flex-auth-tenant-engine` | `sha256:c25fc34a6cd7e64d955f8723ec70e176a583d5ae71d76280c4e2d89fba0fe0aa` | **live 2026-08-16** — four-action policy; lifecycle actions deny `unknown_action` | +| `flex-auth-tenant-engine` *(FLEX-WP-0010 image, scaled to 0)* | `sha256:9320df394a642eff24da8af4a0ee8886a7bb78b0f14d8ee1deeb30ea8eeeaba7` | seven-action policy, previously live 2026-08-11 | | `flex-auth-user-engine` | `sha256:1f5290376dc5fcf456dc7a785e394d8b90949dabecd1d3e856f38557149bb5f4` | FLEX-WP-0009-T04, nine fixtures, live 2026-08-16 | | `flex-auth-user-engine` *(previous)* | `sha256:a31961c45215aa6baf3bc748c6741ab703c2c8325e61aa7983a355026195e51b` | FLEX-WP-0009-T03, six fixtures | diff --git a/values/tenant-engine.yaml b/values/tenant-engine.yaml index 2ec86e6..a438289 100644 --- a/values/tenant-engine.yaml +++ b/values/tenant-engine.yaml @@ -2,7 +2,7 @@ name: flex-auth-tenant-engine image: repository: forgejo.coulomb.social/coulomb/flex-auth - digest: sha256:9320df394a642eff24da8af4a0ee8886a7bb78b0f14d8ee1deeb30ea8eeeaba7 + digest: sha256:c25fc34a6cd7e64d955f8723ec70e176a583d5ae71d76280c4e2d89fba0fe0aa args: - serve - --addr diff --git a/workplans/FLEX-WP-0013-restore-seven-action-tenant-engine-pin.md b/workplans/FLEX-WP-0013-restore-seven-action-tenant-engine-pin.md deleted file mode 100644 index d90f248..0000000 --- a/workplans/FLEX-WP-0013-restore-seven-action-tenant-engine-pin.md +++ /dev/null @@ -1,159 +0,0 @@ ---- -id: FLEX-WP-0013 -type: workplan -title: "Restore the seven-action tenant-engine policy pin" -domain: infotech -repo: flex-auth -status: finished -owner: grok -topic_slug: netkingdom -planning_priority: P1 -planning_order: 130 -depends_on_workplans: - - FLEX-WP-0010 - - FLEX-WP-0011 -related_workplans: - - TEN-WP-0005 - - TEN-WP-0006 -created: "2026-08-16" -updated: "2026-08-16" ---- - -# FLEX-WP-0013 - Restore the seven-action tenant-engine policy pin - -`flex-auth-tenant-engine` on railiance01 is serving the pre-FLEX-WP-0010 -four-action image. `tenant.update` / `tenant.retire` / `tenant.reactivate` -deny `unknown_action`. That undoes the TEN-WP-0005-T05 production authority -tenant-engine confirmed on 2026-08-13. - -This is a pin restore, not a policy change. The seven-action package is -already in source (`FLEX-WP-0010`) and already exists as image -`sha256:9320df394a642eff24da8af4a0ee8886a7bb78b0f14d8ee1deeb30ea8eeeaba7` -(CI-built from `e9911eb`). That image was live 2026-08-11 through at least -2026-08-13; its ReplicaSet is still present at desired=0. - -Do **not** add the TEN-WP-0006 guardrail actions here. Those land on a -package that is behind; extending it first would compound the regression. - -## Why production is on four actions - -| Date | What happened | -|---|---| -| 2026-08-11 | `3dc6223` pinned and applied `9320df39` (seven actions). tenant-engine confirmed live lifecycle writes. | -| 2026-08-16 | Live probe during `FLEX-WP-0011` found the Deployment back on `c25fc34a`. Revision 4 reused the 2026-08-08 four-action ReplicaSet. | -| 2026-08-16 | Overlay commit `1d58f13` rewrote `deploy/flex-auth-tenant-engine.yaml` and `values/tenant-engine.yaml` to match the rolled-back live pin, so the files now *encode* the regression. | - -`FLEX-WP-0011` explicitly did not re-promote. tenant-engine left the restore -as the operator's call (`5572d198`). This workplan is that call. - -## Candidate and rollback - -| Role | Digest | Policy | -|---|---|---| -| Candidate | `sha256:9320df394a642eff24da8af4a0ee8886a7bb78b0f14d8ee1deeb30ea8eeeaba7` | seven-action, previously live | -| Rollback | `sha256:c25fc34a6cd7e64d955f8723ec70e176a583d5ae71d76280c4e2d89fba0fe0aa` | four-action, live at start of this workplan | - -Restore the known-good digest rather than building a new image. The -tenant-engine policy has not changed since `e9911eb`. A new image would -re-bake unrelated later packages and would not be the artifact tenant-engine -already verified. - -Apply via the emergency kubectl path. Production has no Helm release; -`helm upgrade --install` would adopt the live objects and is out of scope. - -Do not move `flex-auth-user-engine`. - -## T01 - Re-pin the overlay and emergency manifests - -```task -id: FLEX-WP-0013-T01 -status: done -priority: high -``` - -Set the tenant-engine digest to `9320df39` in: - -- `values/tenant-engine.yaml` (overlay pin; leaving this on `c25fc34a` would - re-encode the regression and invite the next overlay apply to undo T02) -- `deploy/flex-auth-tenant-engine.yaml` (emergency kubectl path, what - production actually applies) - -Update the last-known-good tables in `deploy/README.md` and -`railiance/README.md`. Leave `flex-auth-user-engine` untouched. - -Done when both pin files name the seven-action digest and the runbooks list -`c25fc34a` as the rollback target. - -Done 2026-08-16: `values/tenant-engine.yaml` and -`deploy/flex-auth-tenant-engine.yaml` pin `9320df39`. Runbook tables list -that digest as live and `c25fc34a` as rollback. - -## T02 - Apply and prove the seven actions live - -```task -id: FLEX-WP-0013-T02 -status: done -priority: high -``` - -`kubectl apply -f deploy/flex-auth-tenant-engine.yaml` against railiance01, -then `rollout status`. Prove the policy, not just that the pod started. - -Required live `/v1/check` outcomes against the Service: - -| Action | Expected | -|---|---| -| `tenant.create` | allow `write_api_policy_matched` | -| `tenant.update` | allow `write_api_policy_matched` | -| `tenant.retire` | allow `write_api_policy_matched` | -| `tenant.reactivate` | allow `write_api_policy_matched` | -| misspelled lifecycle action | deny `unknown_action` | -| unknown subject | deny `unknown_subject` | - -Confirm `flex-auth-user-engine` is still on -`sha256:1f5290376dc5fcf456dc7a785e394d8b90949dabecd1d3e856f38557149bb5f4`. - -Done when the three lifecycle actions allow from the live Service and the -user-engine pin is unchanged. - -Done 2026-08-16 on railiance01. `kubectl apply -f -deploy/flex-auth-tenant-engine.yaml` reused ReplicaSet -`flex-auth-tenant-engine-56d5bbd6bf` (desired 0 → 1). Approval -`f3fbe4cf-efb2-4e4a-99ca-a83050dac6ed`. Decision `c8e39a19`. - -| Action | Subject | Effect | Decision | -|---|---|---|---| -| `tenant.create` | tenant-engine | allow `write_api_policy_matched` | `decision:2a94b9ee0dcb4050` | -| `tenant.role.grant` | tenant-engine | allow `write_api_policy_matched` | `decision:845d6aa2d5cf6ae7` | -| `tenant.role.revoke` | tenant-engine | allow `write_api_policy_matched` | `decision:bd0e331d9443b0bf` | -| `tenant.plan.assign` | tenant-engine | allow `write_api_policy_matched` | `decision:b900c1e96b5534ad` | -| `tenant.update` | tenant-engine | allow `write_api_policy_matched` | `decision:422fe875467610fb` | -| `tenant.retire` | tenant-engine | allow `write_api_policy_matched` | `decision:799301d3443fd6a4` | -| `tenant.reactivate` | tenant-engine | allow `write_api_policy_matched` | `decision:4160478ca5499457` | -| `tenant.retired` | tenant-engine | deny `unknown_action` | `decision:30946c43cbe80bfc` | -| `tenant.retire` | ops | deny `unknown_subject` | `decision:7b107e73cf16fab9` | - -`flex-auth-user-engine` remained -`sha256:1f5290376dc5fcf456dc7a785e394d8b90949dabecd1d3e856f38557149bb5f4`. - -## T03 - Handoff and close - -```task -id: FLEX-WP-0013-T03 -status: done -priority: medium -``` - -Notify `tenant-engine` that TEN-WP-0005-T05 authority is restored, naming -digest `9320df39` and the live decision ids. State plainly that TEN-WP-0006 -guardrail actions (`tenant.guardrail.read` / `tenant.guardrail.set`) are -**not** in this image and still need a separate policy revision. - -Update `examples/tenant-engine/README.md` so it no longer says the lifecycle -actions are not in production. - -Done when the handoff is sent and this workplan is `finished`. - -Done 2026-08-16: handoff sent to `tenant-engine`. TEN-WP-0005-T05 authority -is restored on digest `9320df39`. TEN-WP-0006 guardrail actions are not in -this image.