coulomb/flex-auth
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
A policy-as-code capable authorization registry/control-plane service.
104 commits 1 branch 0 tags 1.4 MiB
Find a file
tegwick 8e127e50f7 Authorize tenant-engine lifecycle actions (FLEX-WP-0010) 
Extend the tenant-engine write-API policy package with tenant.update,
tenant.retire, and tenant.reactivate, the three actions TEN-WP-0005
introduced. Until now every lifecycle mutation resolved to deny
unknown_action, blocking TEN-WP-0005-T05 production rollout.

- policy_package.md: three actions in valid_actions and frontmatter;
  CARING capabilities extended with EditAny/Archive/Restore
- protected_system_manifest.yaml, subject_manifest.yaml, and the rebuilt
  registry_snapshot.json carry all seven actions
- docs/tenant-engine-action-vocabulary.md documents the HTTP surfaces
- 8 new fixture pairs and 5 new Rego tests, including action-drift
  guards (tenant.retired, tenant_update -> unknown_action)

T02 decision, recorded in policy_package.md: tenant.retire does NOT get
stricter authorization yet. With one service subject and no assurance
claim in the CheckRequest there is nothing stricter to check, and a
condition the sole caller always satisfies would falsely read as
separate control. Retirement is reversible and non-destructive. Revisit
on KEY-WP-0005 assurance claims or a second operator subject.

Verified: 11/11 Rego tests, 16/16 fixtures, go test ./... green, gofmt
and go vet clean. End-to-end against a live serve with a real
tenant-engine through the unmodified FlexAuthWriteAuthorizer: update
6176c39c2f4d7b15, retire 8a801b8ee8455080, reactivate c64cf3713cecd970
all allow; unregistered actor denied unknown_subject
(59d3e99c6416be89, 403 write_denied).

Handoff revision for TEN-WP-0005-T05: package
tenant-engine.write-api.mutate v1 (ready, caring-0.4.0-rc2).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-10 20:52:10 +02:00
.claude/rules docs: workplan-first agent guidance prose (CUST-WP-0055 T04 batch 2) 2026-07-08 16:41:17 +02:00
.forgejo/workflows Add Forgejo CI smoke workflow (enablement template) 2026-07-08 12:32:37 +02:00
.github/workflows Land foundations: assessment, ADR-001/002/003, FLEX-WP-0005, Go skeleton 2026-05-16 01:54:44 +02:00
cmd/flex-auth FLEX-WP-0007: production registry fixture, tests, and sync runbook 2026-06-24 14:52:35 +02:00
docs Authorize tenant-engine lifecycle actions (FLEX-WP-0010) 2026-08-10 20:52:10 +02:00
examples Authorize tenant-engine lifecycle actions (FLEX-WP-0010) 2026-08-10 20:52:10 +02:00
internal FLEX-WP-0008 T03-T04: tenant-engine live-lookup context adapter, close 2026-07-23 23:33:34 +02:00
pkg/api FLEX-WP-0006: implement ops-warden signing gate policy 2026-06-23 21:17:42 +02:00
registry Add capability registry with seed entry from reuse-surface 2026-06-16 01:46:54 +02:00
schemas FLEX-WP-0006: implement ops-warden signing gate policy 2026-06-23 21:17:42 +02:00
workplans Authorize tenant-engine lifecycle actions (FLEX-WP-0010) 2026-08-10 20:52:10 +02:00
.custodian-brief.md chore(consistency): sync task status from DB [auto] 2026-08-10 20:11:54 +02:00
.gitignore Land foundations: assessment, ADR-001/002/003, FLEX-WP-0005, Go skeleton 2026-05-16 01:54:44 +02:00
.golangci.yml Land foundations: assessment, ADR-001/002/003, FLEX-WP-0005, Go skeleton 2026-05-16 01:54:44 +02:00
.repo-classification.yaml Human-review .repo-classification.yaml (CUST-WP-0050 follow-up) 2026-06-22 17:56:17 +02:00
AGENTS.md Regenerate agent instructions from state-hub templates (CUST-WP-0055 T01) 2026-07-08 14:50:24 +02:00
CLAUDE.md Add credential routing instructions for all agent runtimes 2026-06-18 22:48:37 +02:00
Containerfile Package flex-auth policy service 2026-08-09 01:35:30 +02:00
go.mod Implement policy package loader 2026-05-17 05:30:40 +02:00
go.sum Implement policy package loader 2026-05-17 05:30:40 +02:00
INTENT.md docs(intent/scope): align with ops-warden as first shipped consumer 2026-06-27 20:37:07 +02:00
LICENSE Adopt Target Revenue Source License V1C1 (org-wide preliminary rollout) 2026-07-30 00:16:31 +02:00
Makefile Pin FlexAuthResourceManifest schema (resource-registration-v0) 2026-05-16 02:04:00 +02:00
README.md Refine workplans for CARING profile 2026-05-17 04:15:38 +02:00
SCOPE.md docs(scope): reflect baseline complete — all FLEX-WP-0001..0007 done 2026-06-30 01:40:19 +02:00
WORK-RECORDS.md Authorize tenant-engine lifecycle actions (FLEX-WP-0010) 2026-08-10 20:52:10 +02:00

README.md

flex-auth

Policy-as-code authorization registry and control plane for NetKingdom-aligned systems.

Start with INTENT.md for the project boundary and direction. Research notes and ADRs live in docs/ and docs/adr/.

The product boundary is captured in SCOPE.md, and the current Product Requirements Document is docs/ProductRequirementsDocument.md.

The 2026-05-15 pre-implementation assessment that shapes the current sequencing is in docs/pre-implementation-assessment.md.

The CARING reference-implementation approach is captured in docs/caring-architecture-blueprint.md.

Workplans live in workplans/, with sequencing captured in docs/workplan-planning-map.md.