coulomb/net-kingdom
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

NK-WP-0026 finished: user-engine caller identity verified live against railiance01

Browse source 
T02 done. Deployed user-engine digest c501aeb2 reads the projected flex-auth
token per decision (verified in the running container); flex-auth-user-engine
138aa347 serves with caller-auth enforce. Probes: valid 200
decision:d9aef25f08e17b84, missing token 401, wrong-system 403.

Closes manifest drift: runtime.yaml pinned e3b5f65b, the digest T01 warned
against, while the cluster ran c501aeb2. Re-applying it would have rolled the
portal back to an image that cannot authenticate to a PDP now in enforce.
kubectl diff is now empty.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
tegwick 2026-08-19 22:01:12 +02:00
parent dae0dc681a
commit 4a915ce6c7
5 changed files with 133 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

8
canon/standards/tenant-engine-boundary-contract_v0.1.md
View file

@ -114,9 +114,11 @@ Rules:
Performance model:
- the live-lookup API must be fast and highly available, since `flex-auth`
calls it synchronously on the request path for privileged actions; slow
or unavailable `tenant-engine` lookups fail closed (deny), never fail open;
- the live-lookup API must be fast and highly available, since `flex-auth` is
required to call it synchronously on the request path for privileged actions;
slow or unavailable `tenant-engine` lookups fail closed (deny), never fail
open. The adapter existing without a production caller does not satisfy this
contract and does not permit either service to claim I3;
- the cached-claim read API used by `key-cape` may be slower, since it only
runs at token issuance, not per-request;
- request-scoped memoization within a single `flex-auth` decision is