# tenant-engine Consumer Integration Fixtures

`FLEX-WP-0008-T01`/`T02`. Registers `tenant-engine` as a flex-auth
protected-system consumer, gating its own write API
(`TEN-WP-0003`'s `authz.FlexAuthWriteAuthorizer`).

## Files

| File | Purpose |
| --- | --- |
| `protected_system_manifest.yaml` | Resource types (`tenant`, `role-grant`, `plan-assignment`) and actions (`tenant.create`, `tenant.role.grant`, `tenant.role.revoke`, `tenant.plan.assign`) |
| `subject_manifest.yaml` | The one registered caller: `tenant-engine`'s own service identity |
| `policy_package.md` | Rego rules + embedded tests gating the write API |
| `policy_fixtures.yaml` | Allow/deny request/decision pairs, referenced by `policy_package.md`'s frontmatter |
| `registry_snapshot.json` | Merged `systems`/`subjects`/`groups` snapshot assembled from the two manifests above, loadable by `flex-auth serve`/`check`/`load-registry` |
| `check_request_allow_create.json`, `check_request_deny_unknown_subject.json` | Standalone example requests for `flex-auth check` |

**No `resource_manifest.yaml`** — unlike ops-warden's fixed SSH-certificate
inventory, `tenant-engine`'s resources (tenants) are created dynamically.
See `docs/tenant-engine-resource-namespace.md` for why that's a deliberate
omission, not an oversight.

## Verified

```bash
go build -o bin/flex-auth ./cmd/flex-auth

# Rego rules + embedded tests + fixtures, all pass:
bin/flex-auth test-policy -file examples/tenant-engine/policy_package.md

# Registry loads cleanly:
bin/flex-auth load-registry -file examples/tenant-engine/registry_snapshot.json

# Individual requests via the CLI:
bin/flex-auth check \
  -registry examples/tenant-engine/registry_snapshot.json \
  -policy examples/tenant-engine/policy_package.md \
  -request examples/tenant-engine/check_request_allow_create.json

# End-to-end over real HTTP: a live `flex-auth serve` loaded with this
# exact registry+policy, hit by tenant-engine's actual
# FlexAuthCheckClient/FlexAuthWriteAuthorizer (not a mock) --
# POST /tenants with actor="ops" -> 403 (unknown_subject);
# actor="tenant-engine" -> 201 (write_api_policy_matched).
bin/flex-auth serve -addr 127.0.0.1:9098 \
  -registry examples/tenant-engine/registry_snapshot.json \
  -policy examples/tenant-engine/policy_package.md
# (from tenant-engine's own checkout)
TENANT_ENGINE_FLEX_AUTH_URL=http://127.0.0.1:9098 make run
```

## Related

- `docs/tenant-engine-resource-namespace.md`
- `docs/tenant-engine-action-vocabulary.md`
- `tenant-engine/docs/flex-auth-integration.md` — the client side of this
  integration
- `net-kingdom/canon/standards/tenant-engine-boundary-contract_v0.1.md`