History

tegwick 8e127e50f7 Authorize tenant-engine lifecycle actions (FLEX-WP-0010) Extend the tenant-engine write-API policy package with tenant.update, tenant.retire, and tenant.reactivate, the three actions TEN-WP-0005 introduced. Until now every lifecycle mutation resolved to deny unknown_action, blocking TEN-WP-0005-T05 production rollout. - policy_package.md: three actions in valid_actions and frontmatter; CARING capabilities extended with EditAny/Archive/Restore - protected_system_manifest.yaml, subject_manifest.yaml, and the rebuilt registry_snapshot.json carry all seven actions - docs/tenant-engine-action-vocabulary.md documents the HTTP surfaces - 8 new fixture pairs and 5 new Rego tests, including action-drift guards (tenant.retired, tenant_update -> unknown_action) T02 decision, recorded in policy_package.md: tenant.retire does NOT get stricter authorization yet. With one service subject and no assurance claim in the CheckRequest there is nothing stricter to check, and a condition the sole caller always satisfies would falsely read as separate control. Retirement is reversible and non-destructive. Revisit on KEY-WP-0005 assurance claims or a second operator subject. Verified: 11/11 Rego tests, 16/16 fixtures, go test ./... green, gofmt and go vet clean. End-to-end against a live serve with a real tenant-engine through the unmodified FlexAuthWriteAuthorizer: update 6176c39c2f4d7b15, retire 8a801b8ee8455080, reactivate c64cf3713cecd970 all allow; unregistered actor denied unknown_subject (59d3e99c6416be89, 403 write_denied). Handoff revision for TEN-WP-0005-T05: package tenant-engine.write-api.mutate v1 (ready, caring-0.4.0-rc2). Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>		2026-08-10 20:52:10 +02:00
..
caring	Add CARING examples and coverage	2026-05-17 06:05:18 +02:00
claims	Align IAM Profile consumption with v0.2	2026-05-22 14:35:30 +02:00
markitect	Add Markitect check fixtures	2026-05-17 06:32:05 +02:00
ops-warden	FLEX-WP-0007: production registry fixture, tests, and sync runbook	2026-06-24 14:52:35 +02:00
qonto-assistant	Register qonto-assistant as a protected system (finance.qonto.read)	2026-07-24 00:19:26 +02:00
tenant-engine	Authorize tenant-engine lifecycle actions (FLEX-WP-0010)	2026-08-10 20:52:10 +02:00
topaz	Implement Topaz adapter	2026-05-17 06:58:04 +02:00
user-engine	Deploy user-engine authorization policy	2026-08-09 02:21:29 +02:00
README.md	FLEX-WP-0006: implement ops-warden signing gate policy	2026-06-23 21:17:42 +02:00

README.md

examples/

Runnable examples used both as documentation and as test fixtures.

Expected layout (filled in across FLEX-WP-0002 / FLEX-WP-0003 / FLEX-WP-0005):

examples/
  claims/                  # key-cape lightweight-mode and Keycloak heavy-mode
                           # claim envelopes (P5.5)
  caring/                  # executable CARING descriptor, request,
                           # decision, registry, and audit fixtures (P2.1)
  markitect/               # FlexAuthResourceManifest fixtures, decision
                           # fixtures, and Rego-in-Markdown policy packages
  ops-warden/              # SSH certificate signing policy-gate fixtures
                           # for ops-warden policy.enabled smoke checks
  topaz/                   # docker-compose + sample directory and policy
                           # for the Topaz alignment spike (P5.4)
  policies/                # generic Rego-in-Markdown packages used by
                           # the standalone core tests