History

tegwick 49de2f40ff All checks were successful CI Smoke / host-smoke (push) Successful in 0s Details CI Smoke / container-smoke (push) Successful in 3s Details FLEX-WP-0008 T01-T02: tenant-engine resource/action vocabulary + policy package docs/tenant-engine-{resource-namespace,action-vocabulary}.md: four actions (tenant.create, tenant.role.grant, tenant.role.revoke, tenant.plan.assign) matching tenant_engine/src/tenant_engine/authz.py's _RESOURCE_TYPES mapping exactly. No resource_manifest.yaml -- tenant-engine's resources are created dynamically, unlike ops-warden's fixed SSH-certificate inventory; documented as a deliberate deviation. examples/tenant-engine/: protected_system_manifest.yaml, subject_manifest.yaml (one registered caller: tenant-engine's own service identity), policy_package.md (Rego rules + embedded tests), policy_fixtures.yaml (8 allow/deny pairs), assembled registry_snapshot.json, two standalone check_request examples, README. Design decision made explicit in the workplan: operator/service-identity authorization (one known subject, four known actions), not aal2+assurance + tenant-capability-role checking -- CheckRequest carries no assurance claim yet (TEN-WP-0003 already flagged actor as a plain request-body field, not a real auth context), and a tenant's capability roles are the tenant's own state, not a property of who may call tenant-engine's admin API. Revisit once KEY-WP-0005 gives callers a real assurance-bearing identity. Verified for real: built ./cmd/flex-auth, ran test-policy (6 tests + 8 fixtures, all pass), load-registry, check against both example requests. Then ran a live flex-auth serve with this exact registry+policy and pointed tenant-engine's real, unmodified FlexAuthCheckClient/FlexAuthWriteAuthorizer at it over real HTTP: unknown subject -> 403, tenant-engine -> 201. go test ./... still green across the whole repo. T03 (live-lookup context adapter for other protected systems) stays open -- new Go adapter package, tracked separately. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>		2026-07-23 23:05:57 +02:00
..
caring	Add CARING examples and coverage	2026-05-17 06:05:18 +02:00
claims	Align IAM Profile consumption with v0.2	2026-05-22 14:35:30 +02:00
markitect	Add Markitect check fixtures	2026-05-17 06:32:05 +02:00
ops-warden	FLEX-WP-0007: production registry fixture, tests, and sync runbook	2026-06-24 14:52:35 +02:00
tenant-engine	FLEX-WP-0008 T01-T02: tenant-engine resource/action vocabulary + policy package	2026-07-23 23:05:57 +02:00
topaz	Implement Topaz adapter	2026-05-17 06:58:04 +02:00
README.md	FLEX-WP-0006: implement ops-warden signing gate policy	2026-06-23 21:17:42 +02:00

README.md

examples/

Runnable examples used both as documentation and as test fixtures.

Expected layout (filled in across FLEX-WP-0002 / FLEX-WP-0003 / FLEX-WP-0005):

examples/
  claims/                  # key-cape lightweight-mode and Keycloak heavy-mode
                           # claim envelopes (P5.5)
  caring/                  # executable CARING descriptor, request,
                           # decision, registry, and audit fixtures (P2.1)
  markitect/               # FlexAuthResourceManifest fixtures, decision
                           # fixtures, and Rego-in-Markdown policy packages
  ops-warden/              # SSH certificate signing policy-gate fixtures
                           # for ops-warden policy.enabled smoke checks
  topaz/                   # docker-compose + sample directory and policy
                           # for the Topaz alignment spike (P5.4)
  policies/                # generic Rego-in-Markdown packages used by
                           # the standalone core tests