From 1c2d0c2cf67713996a985b4b32f79e71fd710c2f Mon Sep 17 00:00:00 2001 From: tegwick Date: Sat, 10 Oct 2026 15:28:05 +0200 Subject: [PATCH] Follow the access-engine CLI rename: ./cmd/flex-auth -> ./cmd/access-engine FLEX-DEC-2026-020; the old path is a stub that exits 2. Runtime names unchanged. Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 736651@bnt-lap001 Assistant-Session: f6189624-fd64-4109-b53e-f8a59ca8a2d8 --- docs/tutorials/protected-system-flex-auth.md | 8 +++--- runbooks/protected-system-flex-auth/pack.yaml | 28 +++++++++---------- sso-mfa/k8s/tenant-engine/README.md | 5 ++-- workplans/ADHOC-2026-10-10.md | 28 +++++++++++++++++++ 4 files changed, 49 insertions(+), 20 deletions(-) create mode 100644 workplans/ADHOC-2026-10-10.md diff --git a/docs/tutorials/protected-system-flex-auth.md b/docs/tutorials/protected-system-flex-auth.md index f958321..b42d715 100644 --- a/docs/tutorials/protected-system-flex-auth.md +++ b/docs/tutorials/protected-system-flex-auth.md @@ -19,7 +19,7 @@ back, and is refused when the caller is wrong. ## Prerequisites - **[owner: flex-auth]** A local checkout of `flex-auth` with Go, to run - `go run ./cmd/flex-auth`. Read `access-engine/docs/decision-record-contract.md`. + `go run ./cmd/access-engine`. Read `access-engine/docs/decision-record-contract.md`. - **[owner: your system's repo]** A system id and a list of the things it protects and the actions it performs on them. - **[owner: railiance-platform / package owner, ADR-0015]** A Kubernetes @@ -53,10 +53,10 @@ consumer running with caller auth in `warn` mode is not protected. fixtures covering every allow and every denial branch, including wrong tenant, unknown subject and unknown action. 4. **[owner: flex-auth]** Validate and load offline: - `go run ./cmd/flex-auth validate -kind policy -file ` - then `go run ./cmd/flex-auth load-registry -file `. + `go run ./cmd/access-engine validate -kind policy -file ` + then `go run ./cmd/access-engine load-registry -file `. 5. **[owner: flex-auth]** Evaluate a check request locally: - `go run ./cmd/flex-auth check -registry -policy -request `. + `go run ./cmd/access-engine check -registry -policy -request `. A request is `tenant`, `subject`, `action`, `resource` and `context`. The result is a decision envelope (`flex-auth.decision-record.v1`) with `effect`, `reason`, and a deterministic decision `id`. diff --git a/runbooks/protected-system-flex-auth/pack.yaml b/runbooks/protected-system-flex-auth/pack.yaml index 2dd8d6c..c82aee6 100644 --- a/runbooks/protected-system-flex-auth/pack.yaml +++ b/runbooks/protected-system-flex-auth/pack.yaml @@ -82,7 +82,7 @@ stages: title: Confirm the prerequisites actor: operator owner: workstation - description: "A flex-auth checkout with Go, to run go run ./cmd/flex-auth (flex-auth); kubectl access to the cluster through the k3s-api tunnel (ops-bridge); the live pin runs with --caller-auth-mode enforce and its bound ServiceAccount exists (package owner, ADR-0015)." + description: "A flex-auth checkout with Go, to run go run ./cmd/access-engine (flex-auth); kubectl access to the cluster through the k3s-api tunnel (ops-bridge); the live pin runs with --caller-auth-mode enforce and its bound ServiceAccount exists (package owner, ADR-0015)." idempotent: idempotent verify: done_when: All three prerequisites hold @@ -105,11 +105,11 @@ stages: owner: flex-auth requires: [read-manifest] uses: [flexauth_home, example] - command: cd {{flexauth_home}} && go run ./cmd/flex-auth validate -kind policy -file {{example}}/policy_package.md + command: cd {{flexauth_home}} && go run ./cmd/access-engine validate -kind policy -file {{example}}/policy_package.md idempotent: idempotent verify: done_when: validate exits 0 - command: cd {{flexauth_home}} && go run ./cmd/flex-auth validate -kind policy -file {{example}}/policy_package.md + command: cd {{flexauth_home}} && go run ./cmd/access-engine validate -kind policy -file {{example}}/policy_package.md expect: exit-0 - id: load-registry title: Load the registry snapshot offline @@ -117,11 +117,11 @@ stages: owner: flex-auth requires: [validate-policy] uses: [flexauth_home, example] - command: cd {{flexauth_home}} && go run ./cmd/flex-auth load-registry -file {{example}}/registry_snapshot.json + command: cd {{flexauth_home}} && go run ./cmd/access-engine load-registry -file {{example}}/registry_snapshot.json idempotent: idempotent verify: done_when: load-registry exits 0 - command: cd {{flexauth_home}} && go run ./cmd/flex-auth load-registry -file {{example}}/registry_snapshot.json + command: cd {{flexauth_home}} && go run ./cmd/access-engine load-registry -file {{example}}/registry_snapshot.json expect: exit-0 - id: check-allow title: A permitted request is allowed @@ -130,12 +130,12 @@ stages: requires: [load-registry] uses: [flexauth_home, example] command: | - cd {{flexauth_home}} && go run ./cmd/flex-auth check -registry {{example}}/registry_snapshot.json -policy {{example}}/policy_package.md -request {{example}}/check_request_allow_rotate.json | python3 -c "import sys,json;d=json.load(sys.stdin);print(d['effect'],d.get('reason'))" + cd {{flexauth_home}} && go run ./cmd/access-engine check -registry {{example}}/registry_snapshot.json -policy {{example}}/policy_package.md -request {{example}}/check_request_allow_rotate.json | python3 -c "import sys,json;d=json.load(sys.stdin);print(d['effect'],d.get('reason'))" idempotent: idempotent verify: done_when: The decision is allow with reason catalog_lane_policy_matched command: | - cd {{flexauth_home}} && go run ./cmd/flex-auth check -registry {{example}}/registry_snapshot.json -policy {{example}}/policy_package.md -request {{example}}/check_request_allow_rotate.json | python3 -c "import sys,json;d=json.load(sys.stdin);print(d['effect'],d.get('reason'))" + cd {{flexauth_home}} && go run ./cmd/access-engine check -registry {{example}}/registry_snapshot.json -policy {{example}}/policy_package.md -request {{example}}/check_request_allow_rotate.json | python3 -c "import sys,json;d=json.load(sys.stdin);print(d['effect'],d.get('reason'))" expect: output-contains contains: allow catalog_lane_policy_matched - id: check-wrong-tenant @@ -145,12 +145,12 @@ stages: requires: [load-registry] uses: [flexauth_home, example] command: | - cd {{flexauth_home}} && go run ./cmd/flex-auth check -registry {{example}}/registry_snapshot.json -policy {{example}}/policy_package.md -request {{example}}/check_request_deny_wrong_tenant.json | python3 -c "import sys,json;d=json.load(sys.stdin);print(d['effect'],d.get('reason'))" + cd {{flexauth_home}} && go run ./cmd/access-engine check -registry {{example}}/registry_snapshot.json -policy {{example}}/policy_package.md -request {{example}}/check_request_deny_wrong_tenant.json | python3 -c "import sys,json;d=json.load(sys.stdin);print(d['effect'],d.get('reason'))" idempotent: idempotent verify: done_when: The decision is deny with reason wrong_tenant command: | - cd {{flexauth_home}} && go run ./cmd/flex-auth check -registry {{example}}/registry_snapshot.json -policy {{example}}/policy_package.md -request {{example}}/check_request_deny_wrong_tenant.json | python3 -c "import sys,json;d=json.load(sys.stdin);print(d['effect'],d.get('reason'))" + cd {{flexauth_home}} && go run ./cmd/access-engine check -registry {{example}}/registry_snapshot.json -policy {{example}}/policy_package.md -request {{example}}/check_request_deny_wrong_tenant.json | python3 -c "import sys,json;d=json.load(sys.stdin);print(d['effect'],d.get('reason'))" expect: output-contains contains: deny wrong_tenant - id: check-unknown-action @@ -160,12 +160,12 @@ stages: requires: [load-registry] uses: [flexauth_home, example] command: | - cd {{flexauth_home}} && go run ./cmd/flex-auth check -registry {{example}}/registry_snapshot.json -policy {{example}}/policy_package.md -request {{example}}/check_request_deny_revoke_not_an_action.json | python3 -c "import sys,json;d=json.load(sys.stdin);print(d['effect'],d.get('reason'))" + cd {{flexauth_home}} && go run ./cmd/access-engine check -registry {{example}}/registry_snapshot.json -policy {{example}}/policy_package.md -request {{example}}/check_request_deny_revoke_not_an_action.json | python3 -c "import sys,json;d=json.load(sys.stdin);print(d['effect'],d.get('reason'))" idempotent: idempotent verify: done_when: The decision is deny with reason unknown_action command: | - cd {{flexauth_home}} && go run ./cmd/flex-auth check -registry {{example}}/registry_snapshot.json -policy {{example}}/policy_package.md -request {{example}}/check_request_deny_revoke_not_an_action.json | python3 -c "import sys,json;d=json.load(sys.stdin);print(d['effect'],d.get('reason'))" + cd {{flexauth_home}} && go run ./cmd/access-engine check -registry {{example}}/registry_snapshot.json -policy {{example}}/policy_package.md -request {{example}}/check_request_deny_revoke_not_an_action.json | python3 -c "import sys,json;d=json.load(sys.stdin);print(d['effect'],d.get('reason'))" expect: output-contains contains: deny unknown_action - id: check-unknown-subject @@ -175,12 +175,12 @@ stages: requires: [load-registry] uses: [flexauth_home, example] command: | - cd {{flexauth_home}} && go run ./cmd/flex-auth check -registry {{example}}/registry_snapshot.json -policy {{example}}/policy_package.md -request {{example}}/check_request_deny_unknown_subject.json | python3 -c "import sys,json;d=json.load(sys.stdin);print(d['effect'],d.get('reason'))" + cd {{flexauth_home}} && go run ./cmd/access-engine check -registry {{example}}/registry_snapshot.json -policy {{example}}/policy_package.md -request {{example}}/check_request_deny_unknown_subject.json | python3 -c "import sys,json;d=json.load(sys.stdin);print(d['effect'],d.get('reason'))" idempotent: idempotent verify: done_when: The decision is deny with reason unknown_subject command: | - cd {{flexauth_home}} && go run ./cmd/flex-auth check -registry {{example}}/registry_snapshot.json -policy {{example}}/policy_package.md -request {{example}}/check_request_deny_unknown_subject.json | python3 -c "import sys,json;d=json.load(sys.stdin);print(d['effect'],d.get('reason'))" + cd {{flexauth_home}} && go run ./cmd/access-engine check -registry {{example}}/registry_snapshot.json -policy {{example}}/policy_package.md -request {{example}}/check_request_deny_unknown_subject.json | python3 -c "import sys,json;d=json.load(sys.stdin);print(d['effect'],d.get('reason'))" expect: output-contains contains: deny unknown_subject gates: @@ -191,7 +191,7 @@ stages: downstream_risk: A policy that allows what it should deny, or denies for the wrong reason, makes the live caller tests meaningless. checks: - done_when: The policy package validates and the registry loads - command: cd {{flexauth_home}} && go run ./cmd/flex-auth validate -kind policy -file {{example}}/policy_package.md && go run ./cmd/flex-auth load-registry -file {{example}}/registry_snapshot.json + command: cd {{flexauth_home}} && go run ./cmd/access-engine validate -kind policy -file {{example}}/policy_package.md && go run ./cmd/access-engine load-registry -file {{example}}/registry_snapshot.json expect: exit-0 - done_when: One allow and three denials (wrong tenant, unknown action, unknown subject) each gave the expected decision and reason expect: manual diff --git a/sso-mfa/k8s/tenant-engine/README.md b/sso-mfa/k8s/tenant-engine/README.md index 361cb9d..1679693 100644 --- a/sso-mfa/k8s/tenant-engine/README.md +++ b/sso-mfa/k8s/tenant-engine/README.md @@ -26,8 +26,9 @@ owner; do not recreate a frozen deployment copy here. These links assume sibling checkouts. The repository is `coulomb/access-engine` (formerly `coulomb/flex-auth`; same Forge ID, renamed under FLEX-WP-0020). The product and runtime names stay `flex-auth`: the `flex-auth` namespace, Service -DNS, caller-token audience, `cmd/flex-auth`, the chart name and the OCI package -coordinate `coulomb/flex-auth` are unchanged (FLEX-DEC-2026-013). +DNS, caller-token audience, the chart name and the OCI package coordinate +`coulomb/flex-auth` are unchanged (FLEX-DEC-2026-013). The CLI is now +`cmd/access-engine`; `cmd/flex-auth` is a stub that exits 2 (FLEX-DEC-2026-020). Ownership follows [ADR-0015](../../../docs/adr/ADR-0015-netkingdom-railiance-workload-packaging-and-relational-platform.md). Removing references requires no cluster apply or rollout. Do not use the diff --git a/workplans/ADHOC-2026-10-10.md b/workplans/ADHOC-2026-10-10.md new file mode 100644 index 0000000..1ececcf --- /dev/null +++ b/workplans/ADHOC-2026-10-10.md @@ -0,0 +1,28 @@ +--- +id: NK-WP-ADHOC-2026-10-10 +type: workplan +title: "Follow the access-engine CLI rename" +domain: infotech +repo: net-kingdom +status: finished +owner: claude-code +topic_slug: net-kingdom +created: "2026-10-10" +updated: "2026-10-10" +--- + +## Replace `./cmd/flex-auth` with `./cmd/access-engine` + +```task +id: NK-WP-ADHOC-2026-10-10-T01 +status: done +priority: medium +``` + +access-engine renamed its CLI (FLEX-DEC-2026-020, access-engine 0ced299, +message `e2f1aac9`): `./cmd/flex-auth` is now a stub that exits 2. The +protected-system runbook pack and tutorial now call `go run ./cmd/access-engine` +(subcommands and flags unchanged), and the tenant-engine README no longer lists +`cmd/flex-auth` among the unchanged runtime names. Runtime names (namespace, +Service DNS, audience, chart, OCI package) stay `flex-auth` until FLEX-WP-0036. +`make runbooks-validate` passes; historical records are left as they were.