diff --git a/docs/platform-tenant-decision-receipts.json b/docs/platform-tenant-decision-receipts.json new file mode 100644 index 0000000..5540d4f --- /dev/null +++ b/docs/platform-tenant-decision-receipts.json @@ -0,0 +1,35 @@ +{ + "decision_id": "5ed3fb35-eca9-413a-82b9-95171ba85bf6", + "messages": [ + { + "id": "f487c63a-dd7e-4ad8-9188-eec9fbea59c6", + "to_agent": "key-cape", + "thread_id": "356f6977-d361-4e3b-83ab-b2c7f4759286", + "created_at": "2026-09-06T19:47:20.986481Z" + }, + { + "id": "feff15be-c916-411a-818e-ab7bf06507ab", + "to_agent": "railiance-platform", + "thread_id": "1b88b600-7b5d-4e3f-9999-8b8fec54b1ef", + "created_at": "2026-09-06T19:47:24.861958Z" + }, + { + "id": "aaa897fa-1ab3-4abc-9a18-4f0c6a121e25", + "to_agent": "approval-engine", + "thread_id": "1e45cc7f-f1f5-40a8-b3f9-f1f8d78ece5c", + "created_at": "2026-09-06T19:47:27.319877Z" + }, + { + "id": "9009e150-15f3-4d40-93af-2c8624566507", + "to_agent": "secrets-engine", + "thread_id": "7ab6d325-11a2-4f94-9736-b17335054e3c", + "created_at": "2026-09-06T19:47:34.413613Z" + }, + { + "id": "a24be254-e94e-4db6-93f4-20e232175f71", + "to_agent": "flex-auth", + "thread_id": "16172bc0-2935-40fe-8b5b-847132ecb689", + "created_at": "2026-09-06T19:47:40.852327Z" + } + ] +} diff --git a/docs/platform-tenant-decision.md b/docs/platform-tenant-decision.md new file mode 100644 index 0000000..c01b39a --- /dev/null +++ b/docs/platform-tenant-decision.md @@ -0,0 +1,26 @@ +# Platform management tenant decision + +Date: 2026-09-06 +Status: accepted by Bernd Worsch +Tracking: GLAS-WP-0015-T03 + +`tenant:platform` identifies the platform management, administration and services +tenant: the landlord zone supporting the other tenants. This describes its +operational role; access across tenant boundaries requires explicit policy grants. + +For the first Glas production dependency chain, use the exact string +`tenant:platform` in the approval store configuration, the JWT tenant claims for +`secrets-engine-approval` and `approval-engine-operator`, and the secrets-engine +lifecycle CheckRequest tenant. Retain exact tenant comparison and v2 wrong-tenant +denial. Neither bare `platform` nor `tenant:coulomb` is an alias. + +This decision authorizes alignment of those two proposed service registrations +and the undeployed approval service. It does not change unrelated clients, human +directory defaults, scopes or other tenant policies. Custody, runtime admission +and actual end-to-end verification remain separate outstanding gates. + +Owner implementation and evidence are requested on the existing KeyCape, +approval-engine, secrets-engine, flex-auth and railiance-platform handoff threads. +See platform-tenant-decision-receipts.json for the State Hub decision and delivery +receipts. The accepted choice resolves the decision blocker; implementation is +not yet verified. diff --git a/docs/production-dependency-handoffs.md b/docs/production-dependency-handoffs.md index 0e342da..9fcc31b 100644 --- a/docs/production-dependency-handoffs.md +++ b/docs/production-dependency-handoffs.md @@ -22,15 +22,14 @@ connectivity. Do not turn warn into enforce before caller adoption is proved. ## 1. Tenant alignment — key-cape, approval-engine, secrets-engine, flex-auth -Before materializing credentials, reconcile three existing values: -approval store `platform`, proposed client JWT `tenant:coulomb`, policy tenant -`tenant:platform`. JWT/store comparison is exact. These may identify distinct -layers, but an explicit owner-reviewed mapping is required; spelling similarity -is not a valid mapping. +Operator decision accepted 2026-09-06: use exact `tenant:platform` for the +approval store, both proposed approval-client JWT tenant claims, and lifecycle +CheckRequest tenant. This is the platform management and services tenant. +See [accepted decision](platform-tenant-decision.md). No alias or implicit +cross-tenant privilege follows from the landlord role. -Return: the exact store tenant, JWT tenant, CheckRequest tenant and any permitted -mapping, with a decision/contract reference and wrong-tenant denial evidence. -No unilateral change to live clients or policy subjects is requested. +Return: aligned source/deployment coordinates and wrong-tenant denial evidence. +The decision is resolved; owner implementation and verification remain open. Related: KEY-WP-0013-T02, APPROVAL-WP-0002-T01, SECRETS-WP-0009-T03. ## 2. Admit service-client custody — railiance-platform with key-cape @@ -142,8 +141,8 @@ secrets-engine, flex-auth and sand-boxer. railiance-platform has not returned a reply in this review. See GLAS-WP-0015 for the receipt summary. - v1 lacked tenant enforcement; v2 is now live with wrong_tenant denial. -- Tenant values remain incompatible, with no authorized mapping. Operator - choice requested before changing registration/store semantics. +- Tenant choice is now accepted as exact tenant:platform; owner alignment + and verification remain outstanding (see platform-tenant-decision.md). - Workstation caller access remains open even though FLEX-WP-0021-T05 was marked done; service coordinates are insufficient for the actual consumer. - AUDIT-WP-0009-T03 must precede T09 so load-bearing evidence is represented. diff --git a/workplans/GLAS-WP-0012-first-local-profile-production-proof.md b/workplans/GLAS-WP-0012-first-local-profile-production-proof.md index e03c679..083f456 100644 --- a/workplans/GLAS-WP-0012-first-local-profile-production-proof.md +++ b/workplans/GLAS-WP-0012-first-local-profile-production-proof.md @@ -313,3 +313,9 @@ to lack tenant denial at v1; the owner correction v2 is now deployed at Helm revision 2 and six live Check fixtures pass, including wrong_tenant denial. Tenant choice, workstation caller access, audit load-bearing schema/admission, identity/custody and native activation remain gates. T02 remains wait. + + +Tenant decision update (2026-09-06): operator approved `tenant:platform` for the +approval dependency chain as the platform management/services tenant. See +`docs/platform-tenant-decision.md`. The choice blocker is resolved; exact owner +configuration alignment and verification remain part of T02 before readiness. diff --git a/workplans/GLAS-WP-0015-production-dependency-coordination.md b/workplans/GLAS-WP-0015-production-dependency-coordination.md index 4eff738..245e20d 100644 --- a/workplans/GLAS-WP-0015-production-dependency-coordination.md +++ b/workplans/GLAS-WP-0015-production-dependency-coordination.md @@ -98,7 +98,17 @@ consumer Deployment specs unchanged. Receipt file: docs/evidence/GLAS-WP-0015-policy-v2-2026-09-06.json. Do not roll back to the known over-permissive v1; if v2 cannot operate, stop this consumer release. -Operator tenant choice is pending. Follow-ups request live tracking of the +Operator tenant choice was pending at rollout and is resolved below. Follow-ups request live tracking of the workstation caller path, independent Claude packaging, audit T03 then T09, and correct v2 adoption. T03 remains progress until owner prerequisites are verified; no real credential or model run has occurred. + +## Accepted tenant choice — 2026-09-06 + +Operator approved exact `tenant:platform`, the platform management, +administration and services tenant (landlord zone). Recorded in +`docs/platform-tenant-decision.md` and State Hub; delivery receipts in +`docs/platform-tenant-decision-receipts.json`. The two proposed service clients, +approval store and lifecycle request must agree exactly. No alias or implicit +cross-tenant authorization. Existing owner threads receive the approved change; +T03 remains progress pending implementation evidence and other dependencies.