tegwick
9e6de5a50d
FLEX-WP-0010-T04: the deployed flex-auth-tenant-engine Deployment bakes
the policy package into its image, so production still serves the
four-action policy -- probed live, tenant.retire returns deny
unknown_action there while tenant.create allows. TEN-WP-0005-T05 is
unblocked in source but needs an image build from 8e127e5 and a rollout,
which this workplan does not scope. Stated in the workplan and in
examples/tenant-engine/README.md rather than left implied.
FLEX-WP-0009-T04: replayed all six user-engine fixtures against the
deployed flex-auth-user-engine service; all six matched expected effect
and reason, confirming the deployed failure matrix is still fail-closed.
T04 stays in progress -- the criterion also requires user-engine to
retire its local bridge, which is not flex-auth's to close.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
124 lines
4.9 KiB
Markdown
124 lines
4.9 KiB
Markdown
---
|
|
id: FLEX-WP-0009
|
|
type: workplan
|
|
title: "Provide production authorization for user-engine"
|
|
domain: infotech
|
|
repo: flex-auth
|
|
status: active
|
|
owner: codex
|
|
topic_slug: netkingdom
|
|
created: "2026-08-08"
|
|
updated: "2026-08-08"
|
|
depends_on:
|
|
- NK-WP-0024
|
|
state_hub_workstream_id: "45756b89-feba-45f5-a24a-63a1119254bf"
|
|
---
|
|
|
|
# FLEX-WP-0009 - user-engine production authorization
|
|
|
|
Provide the cluster-local flex-auth policy-decision service required by the
|
|
user-engine portal. The consumer contract is
|
|
net-kingdom/docs/user-engine-platform-expansion-contract.md.
|
|
|
|
## T01 - Pin the protected-system vocabulary
|
|
|
|
```task
|
|
id: FLEX-WP-0009-T01
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "e940c5a3-ecb4-43d3-9554-2bfb422ec56d"
|
|
```
|
|
|
|
Add a user-engine protected-system manifest, resource manifests, subject
|
|
fixtures, and check-request fixtures. Cover self, tenant-admin, and
|
|
platform-admin actions over user, membership, invitation, tenant, recovery,
|
|
and outbox resources. Unknown resources/actions and cross-tenant requests must
|
|
deny.
|
|
|
|
Done when all manifests validate and the vocabulary matches the action and
|
|
resource strings emitted by user-engine.
|
|
|
|
Done 2026-08-09: `examples/user-engine` defines the dynamic protected-system
|
|
registry and verified-claim request vocabulary for platform, tenant-admin,
|
|
self-service, cross-tenant, missing-role, and wrong-system cases.
|
|
|
|
## T02 - Implement and verify the policy package
|
|
|
|
```task
|
|
id: FLEX-WP-0009-T02
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "6e0fe708-d7ff-411f-a64d-84a1692a6e11"
|
|
```
|
|
|
|
Implement policy-as-code for self-only mutations, tenant-admin authority
|
|
within one tenant, and platform-admin authority for tenant creation, recovery,
|
|
outbox delivery, and replay. Include allow, deny, missing-role, target-user
|
|
mismatch, cross-tenant, malformed-context, and stale-policy fixtures.
|
|
|
|
Done when fixture evaluation is deterministic, default deny is proven, and
|
|
decision envelopes contain stable decision IDs and policy provenance.
|
|
|
|
Done 2026-08-09: all six embedded Rego tests and all six request fixtures pass;
|
|
the package validates under CARING 0.4.0-rc2 and the registry loads cleanly.
|
|
|
|
## T03 - Deploy the cluster-local service
|
|
|
|
```task
|
|
id: FLEX-WP-0009-T03
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "f8293230-136d-4f2d-8d3f-bb9840ea7e63"
|
|
```
|
|
|
|
Publish an immutable flex-auth image and deploy a namespaced Service at
|
|
http://flex-auth.flex-auth.svc.cluster.local:8080. Apply least-privilege
|
|
security context, readiness/liveness probes, resource limits, default-deny
|
|
NetworkPolicy, and ingress restricted to approved protected systems.
|
|
|
|
Done when user-engine can reach POST /v1/check, an unrelated namespace
|
|
cannot, and restart/rollback procedures are documented.
|
|
|
|
Done 2026-08-09: immutable digest `sha256:a31961c45215aa6baf3bc748c6741ab703c2c8325e61aa7983a355026195e51b`
|
|
is deployed as `flex-auth-user-engine.flex-auth.svc.cluster.local:8080`, Ready
|
|
behind ingress restricted to the user-engine workload and with no egress.
|
|
|
|
## T04 - Hand back production evidence
|
|
|
|
```task
|
|
id: FLEX-WP-0009-T04
|
|
status: progress
|
|
priority: high
|
|
state_hub_task_id: "97b931e9-ac5b-46c7-a462-e23c0c18c4f4"
|
|
```
|
|
|
|
Run live allow, deny, service-unavailable, and cross-tenant probes from the
|
|
user-engine namespace. Record only non-secret decision IDs, effects, reasons,
|
|
policy version, and correlation IDs. Send completion evidence to NK-WP-0024.
|
|
|
|
Done when user-engine can replace its local authorization bridge without an
|
|
availability bypass and the deployed failure matrix remains fail closed.
|
|
|
|
2026-08-09 live evidence: from the user-engine pod, `live-self` returned allow
|
|
with decision `decision:4bf95ebb989ac628`; the cross-tenant variant returned
|
|
deny/cross_tenant with decision `decision:bab072ce3ee72d98`. Runtime activation
|
|
remains gated on the separately owned event and mail receivers.
|
|
|
|
2026-08-10 re-probe: all six policy fixtures were replayed against the
|
|
**deployed** `flex-auth-user-engine.flex-auth.svc.cluster.local:8080` and
|
|
every one matched its expected effect and reason —
|
|
`self-allow` `decision:27cbab2e5533508a` allow/`self_service`;
|
|
`tenant-admin-allow` `decision:350b46fb42989606` allow/`tenant_admin`;
|
|
`platform-allow` `decision:79334537419466bd` allow/`platform_operator`;
|
|
`cross-tenant-deny` `decision:b3cc0b7e819aecde` deny/`cross_tenant`;
|
|
`missing-role-deny` `decision:818e2249491ef09f` deny/`no_matching_role_or_context`;
|
|
`wrong-system-deny` `decision:5e20697e202aa7c6` deny/`wrong_system`.
|
|
The deployed failure matrix is therefore confirmed still fail-closed 42h
|
|
into the current rollout.
|
|
|
|
**Still open, and not flex-auth's to close:** the done-criterion is that
|
|
*user-engine* replaces its local authorization bridge without an
|
|
availability bypass. That cutover is user-engine's decision and remains
|
|
gated on the separately owned event and mail receivers. flex-auth has
|
|
delivered and re-verified the service side; T04 stays `progress` rather
|
|
than being marked done on evidence that only covers half the criterion.
|