schema_version = "railiance.app.v1"

[app]
id = "flex-auth"
name = "flex-auth"
repo = "flex-auth"
owner = "platform-security"
criticality = "high"
description = "Policy-as-code authorization PDP. Two independently pinned production Deployments (tenant-engine, user-engine). Outage fails closed: consumers receive deny/403 rather than an unauthorized allow, but write paths block."

[source]
revision = "git:main"
artifact = "image"
digest_policy = "required"

[rollback]
strategy = "helm-revision"
command = "helm rollback <release> <revision> --namespace flex-auth --wait"
verification = "Both Services' /healthz return 200 and the rolled-back Deployment image digest matches the recorded previous_stable pin."

[[platform.dependencies]]
name = "railiance01-k3s"
kind = "network"
required = true
stage = "stage2"
evidence = "kubectl -n flex-auth get ns reports Active on railiance01."

[[platform.dependencies]]
name = "forgejo-oci"
kind = "other"
required = true
stage = "stage2"
evidence = "Image forgejo.coulomb.social/coulomb/flex-auth is pullable by digest."

[secrets]
references = []

[[observability.health_endpoints]]
name = "local-health"
url = "http://127.0.0.1:8080/healthz"
stage = "stage1"
expected_status = 200

[[observability.health_endpoints]]
name = "tenant-engine-health"
url = "http://flex-auth-tenant-engine.flex-auth.svc.cluster.local:8080/healthz"
stage = "stage2"
expected_status = 200

[[observability.health_endpoints]]
name = "user-engine-health"
url = "http://flex-auth-user-engine.flex-auth.svc.cluster.local:8080/healthz"
stage = "stage2"
expected_status = 200

[[observability.health_endpoints]]
name = "canary-health"
url = "http://flex-auth-canary.flex-auth.svc.cluster.local:8080/healthz"
stage = "stage2"
expected_status = 200

[[observability.logs]]
name = "canary-pods"
reference = "kubectl -n flex-auth logs deploy/flex-auth-canary --tail=50"
stage = "stage2"

[stages.stage1]
enabled = true
namespace = "local"
release = "flex-auth-local"
commands = ["make test", "tests/stage1.sh"]
checks = ["unit-tests", "helm-template", "contract-schema"]
evidence = ["go test output", "helm template of tenant-engine, user-engine, and canary values", "app.toml schema validation"]
requires_approval = false

[stages.stage2]
enabled = true
namespace = "flex-auth"
release = "flex-auth-canary"
commands = ["bin/railiance deploy --stage 2 . --plan", "bin/railiance observe --stage 2 . --plan"]
checks = ["server-dry-run", "canary-ready", "canary-health", "operator-approval"]
evidence = ["isolated canary release name", "pod Available", "canary /healthz 200", "State Hub approval id"]
requires_approval = true
canary_mode = "isolated"
observation_minutes = 15

[stages.stage3]
enabled = true
namespace = "flex-auth"
release = "flex-auth-canary"
commands = ["bin/railiance promote . --plan", "bin/railiance rollback . --plan"]
checks = ["stage2-accepted", "rollback-target", "operator-approval"]
evidence = ["promotion command id", "recorded previous_stable digests", "post-promotion canary /healthz 200"]
requires_approval = true
promotion_mode = "release-replace"
previous_stable = "flex-auth-user-engine@sha256:1f5290376dc5fcf456dc7a785e394d8b90949dabecd1d3e856f38557149bb5f4;flex-auth-tenant-engine@sha256:9320df394a642eff24da8af4a0ee8886a7bb78b0f14d8ee1deeb30ea8eeeaba7"

[[checks]]
id = "unit-tests"
type = "command"
stage = "stage1"
description = "Run repository Go tests."
required = true
run = "make test"
timeout_seconds = 600

[[checks]]
id = "helm-template"
type = "helm"
stage = "stage1"
description = "Render the isolated canary chart locally."
required = true
chart = "charts/flex-auth"
values = "values/stage2-canary.yaml"
mode = "template"

[[checks]]
id = "contract-schema"
type = "command"
stage = "stage1"
description = "Validate railiance/app.toml against railiance.app.v1."
required = true
run = "python3 tests/validate_app_toml.py"
timeout_seconds = 60

[[checks]]
id = "local-health"
type = "http"
stage = "stage1"
description = "Confirm a locally served flex-auth /healthz when one is running."
required = false
url = "http://127.0.0.1:8080/healthz"
expected_status = 200
timeout_seconds = 10

[[checks]]
id = "server-dry-run"
type = "helm"
stage = "stage2"
description = "Server-side dry run of the isolated canary before apply."
required = true
chart = "charts/flex-auth"
values = "values/stage2-canary.yaml"
mode = "server-dry-run"

[[checks]]
id = "canary-ready"
type = "kubernetes"
stage = "stage2"
description = "Isolated canary Deployment reaches Available."
required = true
namespace = "flex-auth"
resource = "deploy/flex-auth-canary"
condition = "Available"

[[checks]]
id = "canary-health"
type = "http"
stage = "stage2"
description = "Isolated canary Service /healthz returns 200."
required = true
url = "http://flex-auth-canary.flex-auth.svc.cluster.local:8080/healthz"
expected_status = 200
timeout_seconds = 10

[[checks]]
id = "operator-approval"
type = "manual"
stage = "stage2"
description = "Human approval recorded before the isolated canary is applied and before any production pin is moved."
required = true
evidence_required = "State Hub approval note id, candidate digest, rollback target (both production pins)."

[[checks]]
id = "stage2-accepted"
type = "manual"
stage = "stage3"
description = "Stage 2 gates passed for the same candidate artifact."
required = true
evidence_required = "State Hub Stage 2 acceptance progress id."

[[checks]]
id = "rollback-target"
type = "manual"
stage = "stage3"
description = "Previous stable digest of each independently rollable Deployment is recorded before promotion."
required = true
evidence_required = "flex-auth-user-engine and flex-auth-tenant-engine image digests."