# tenant-engine Consumer Integration Fixtures

`FLEX-WP-0008-T01`/`T02`. Registers `tenant-engine` as a flex-auth
protected-system consumer, gating its own write API
(`TEN-WP-0003`'s `authz.FlexAuthWriteAuthorizer`).

## Files

| File | Purpose |
| --- | --- |
| `protected_system_manifest.yaml` | Resource types (`tenant`, `role-grant`, `plan-assignment`, `guardrail`) and the nine actions: the original four, the `FLEX-WP-0010` lifecycle trio, and the `FLEX-WP-0014` guardrail pair `tenant.guardrail.read` / `tenant.guardrail.set` |
| `subject_manifest.yaml` | Two registered callers: `tenant-engine` (all nine actions) and `flex-auth` (read-only on `tenant.guardrail.read`) |
| `policy_package.md` | Rego rules + embedded tests gating the write API |
| `policy_fixtures.yaml` | Allow/deny request/decision pairs, referenced by `policy_package.md`'s frontmatter |
| `registry_snapshot.json` | Merged `systems`/`subjects`/`groups` snapshot assembled from the two manifests above, loadable by `flex-auth serve`/`check`/`load-registry` |
| `check_request_allow_create.json`, `check_request_deny_unknown_subject.json`, `check_request_allow_retire.json`, `check_request_deny_misspelled_lifecycle.json`, `check_request_allow_guardrail_read.json`, `check_request_allow_guardrail_set.json`, `check_request_deny_guardrail_set_as_reader.json`, `check_request_deny_misspelled_guardrail.json` | Standalone example requests for `flex-auth check` |

**No `resource_manifest.yaml`** — unlike ops-warden's fixed SSH-certificate
inventory, `tenant-engine`'s resources (tenants) are created dynamically.
See `docs/tenant-engine-resource-namespace.md` for why that's a deliberate
omission, not an oversight.

## Verified

```bash
go build -o bin/flex-auth ./cmd/flex-auth

# Rego rules + embedded tests + fixtures, all pass:
bin/flex-auth test-policy -file examples/tenant-engine/policy_package.md

# Registry loads cleanly:
bin/flex-auth load-registry -file examples/tenant-engine/registry_snapshot.json

# Individual requests via the CLI:
bin/flex-auth check \
  -registry examples/tenant-engine/registry_snapshot.json \
  -policy examples/tenant-engine/policy_package.md \
  -request examples/tenant-engine/check_request_allow_create.json

# End-to-end over real HTTP: a live `flex-auth serve` loaded with this
# exact registry+policy, hit by tenant-engine's actual
# FlexAuthCheckClient/FlexAuthWriteAuthorizer (not a mock) --
# POST /tenants with actor="ops" -> 403 (unknown_subject);
# actor="tenant-engine" -> 201 (write_api_policy_matched).
bin/flex-auth serve -addr 127.0.0.1:9098 \
  -registry examples/tenant-engine/registry_snapshot.json \
  -policy examples/tenant-engine/policy_package.md
# (from tenant-engine's own checkout)
TENANT_ENGINE_FLEX_AUTH_URL=http://127.0.0.1:9098 make run
```

## Verified — lifecycle actions (FLEX-WP-0010-T03, 2026-08-10)

`test-policy` reports **11/11 Rego tests and 16/16 fixtures passing**, the
registry loads, and `go test ./...` / `gofmt` / `go vet` are clean.

End-to-end over real HTTP: a live `flex-auth serve` on `127.0.0.1:9098`
loaded with this registry and policy, and a real `tenant-engine`
(`TENANT_ENGINE_FLEX_AUTH_URL=http://127.0.0.1:9098`) driven through its
unmodified `FlexAuthWriteAuthorizer` with `Idempotency-Key` and an `If-Match`
echoed from a prior `GET`:

| Call | tenant-engine | flex-auth decision |
| --- | --- | --- |
| `POST /tenants` | 201 | `decision:174dc9ecb03ed9e5` allow `write_api_policy_matched` |
| `PATCH /tenants/t-e2e-1` | 200 `active` | `decision:6176c39c2f4d7b15` allow `write_api_policy_matched` |
| `POST /tenants/t-e2e-1/retire` | 200 `retired` | `decision:8a801b8ee8455080` allow `write_api_policy_matched` |
| `POST /tenants/t-e2e-1/reactivate` | 200 `active` | `decision:c64cf3713cecd970` allow `write_api_policy_matched` |
| `POST .../retire` as `actor: ops` | 403 `write_denied` | `decision:59d3e99c6416be89` deny `unknown_subject` |

The misspelled-action guard (`tenant.retired` → deny `unknown_action`) is
covered by fixture and by
`check -request check_request_deny_misspelled_lifecycle.json`; it cannot be
driven through the client, which only ever emits the seven registered strings
— which is the property the guard exists to protect.

**In production as of FLEX-WP-0013 (2026-08-16).** The live
`flex-auth-tenant-engine` Deployment on railiance01 runs
`sha256:9320df394a642eff24da8af4a0ee8886a7bb78b0f14d8ee1deeb30ea8eeeaba7`
(CI-built from `e9911eb`). Probed against the Service after restore:

| Action | Effect | Decision |
| --- | --- | --- |
| `tenant.create` | allow `write_api_policy_matched` | `decision:2a94b9ee0dcb4050` |
| `tenant.update` | allow `write_api_policy_matched` | `decision:422fe875467610fb` |
| `tenant.retire` | allow `write_api_policy_matched` | `decision:799301d3443fd6a4` |
| `tenant.reactivate` | allow `write_api_policy_matched` | `decision:4160478ca5499457` |
| `tenant.retired` (typo) | deny `unknown_action` | `decision:30946c43cbe80bfc` |
| unregistered subject | deny `unknown_subject` | `decision:7b107e73cf16fab9` |

Rollback target is `sha256:c25fc34a…` (four-action).

## Verified — guardrail actions (FLEX-WP-0014-T03, 2026-08-16)

`test-policy` reports **17/17 Rego tests and 23/23 fixtures passing**, the
registry loads (2 subjects, 2 groups), and `go test ./...` / `gofmt` /
`go vet` are clean.

End-to-end over real HTTP: a live `flex-auth serve` on `127.0.0.1:9098`
loaded with this registry and policy, and a real `tenant-engine`
(`TENANT_ENGINE_FLEX_AUTH_URL=http://127.0.0.1:9098`) driven through its
unmodified `FlexAuthWriteAuthorizer`:

| Call | tenant-engine | flex-auth decision |
| --- | --- | --- |
| `POST /tenants` actor=`tenant-engine` | 201 | allow `write_api_policy_matched` |
| `GET .../guardrails?actor=flex-auth` | 200 grouping `spend.monthly=25000` | allow |
| `GET .../guardrails?actor=ops` | 403 `write_denied` | deny `unknown_subject` |
| `PUT .../guardrails/spend.monthly` actor=`tenant-engine` | 200 override `9000` v2 | allow |
| `PUT ...` actor=`flex-auth` | 403 `write_denied` | deny `action_not_granted` |
| `PUT ...` actor=`ops` | 403 `write_denied` | deny `unknown_subject` |

**In production as of 2026-08-16.** The live `flex-auth-tenant-engine`
Deployment on railiance01 runs
`sha256:1bf060e61122693ce98359c167cc5fe8bdafc84e097e090eaa71af94d0f27cbc`
(CI-built from `f304688`, tag `main-f304688`). Probed against the Service
after pin:

| Request | Effect | Decision |
| --- | --- | --- |
| `tenant.create` | allow `write_api_policy_matched` | `decision:ef18e8bbd2dead6a` |
| `tenant.retire` | allow `write_api_policy_matched` | `decision:996663f6902d0762` |
| `tenant.guardrail.read` as flex-auth | allow `write_api_policy_matched` | `decision:9b9e540de13cf7cf` |
| `tenant.guardrail.set` as tenant-engine | allow `write_api_policy_matched` | `decision:20c82bc38501a343` |
| `tenant.guardrail.set` as flex-auth | deny `action_not_granted` | `decision:a057a7030df65208` |
| misspelled guardrail | deny `unknown_action` | `decision:18ae70a79c6d47c6` |

Rollback target is `sha256:9320df39` (seven-action). `flex-auth-user-engine`
was not moved.

Consumer pin (operator apply 2026-08-16, TEN-WP-0007 step 2): live
`tenant-engine` is
`sha256:44ca65f3cdd5967b0124e16b6aba10bf1ac2747e1dde96cbef3dd11ae7cc9574`
(`main-955fe33`). Previous live digest was
`sha256:2249e8c6ee44ae36081cddc52daf9c3f63acd18a95a5d620ab4fa7ac85149207`.
Their documented rollback image is
`sha256:08be0b1dcdc65575592b7be665c28e09a82316ea3d4c9b551ccb753f25360612`
(TEN-WP-0005 lifecycle). `/health` is `0.1.0`; OpenAPI lists 12 paths
including `/tenants/{tenant_id}/guardrails`.

Recorded from their handoff, so a later result does not surprise us:

- Newest commit is not always the newest image. After `955fe33` three
  non-trigger commits landed and no build fired; they pinned the verified
  digest, not `HEAD`.
- A guardrail read is sourced from an override or a grouping default.
  The plan-derived precedence layer has no feed (adaptive-pricing exposes
  no plan-derived ceilings). A missing plan layer is not a flex-auth
  policy gap.
- Rolling their image back is safe one way only: the old image ignores
  the new tables, but an override written on the new image stops being
  enforced after rollback. Inert until something consults guardrails.

## Related

- `docs/tenant-engine-resource-namespace.md`
- `docs/tenant-engine-action-vocabulary.md`
- `tenant-engine/docs/flex-auth-integration.md` — the client side of this
  integration
- `net-kingdom/canon/standards/tenant-engine-boundary-contract_v0.1.md`