# Reaching the access-engine pin

The supported way for this engine to reach `flex-auth-secrets-engine`, and the
reason the address is enforced in code rather than left to configuration.

## Never the Service DNS name

```
SECRETS_ENGINE_PDP_URL=http://flex-auth-secrets-engine.flex-auth.svc.cluster.local:8080
```

is refused by `decision_check.require_supported_pdp_address`. From a workstation
that name does not fail — it **resolves, to the wrong host**:

```text
$ getent hosts flex-auth-secrets-engine.flex-auth.svc.cluster.local
80.158.43.29   ...svc.cluster.local.ad.binect.de
$ getent hosts this-service-does-not-exist.flex-auth.svc.cluster.local
80.158.43.29   (identical — proves suffix expansion, not a record)
```

`resolv.conf` carries `search ad.binect.de`, a wildcard zone, so every
`*.svc.cluster.local` name answers with one unrelated public address. Sending
there ships the CheckRequest body and our bearer token to a third party.

`flex-auth.decision-record.v1` carries **no signature**, and every digest in it
is either sent by us or published in flex-auth's repo, so a forger reproduces
all three exactly. Digests establish integrity of the binding, never
authenticity of the source. As flex-auth put it in `FLEX-DEC-2026-010`:

> Fail-closed protects against a PDP that is ABSENT, not against one that LIES.

Until detached signatures ship (`FLEX-WP-0024`), the address shape is the only
thing standing in for responder authenticity. That is why it is enforced.

## The supported path

Loopback `kubectl port-forward` to the named pod. It resolves no DNS name,
targets one pod explicitly, and rides the Kubernetes API server's TLS with our
cluster credentials — so it authenticates the responder transitively. Note this
is the exact reverse of the caller direction, where port-forward bypasses the
NetworkPolicy (`FLEX-WP-0023`); the two properties point opposite ways and
summarising either as "the network protects it" gets one backwards.

```bash
# 1. Target the pod by name, not the Service.
POD=$(kubectl -n flex-auth get pods \
        -l app.kubernetes.io/name=flex-auth-secrets-engine \
        -o jsonpath='{.items[0].metadata.name}')
kubectl -n flex-auth port-forward "pod/$POD" 18080:8080 --address 127.0.0.1 &

# 2. Fresh bounded caller token per session. Audience MUST be flex-auth;
#    caller auth is `enforce` as of Helm revision 3.
umask 077
kubectl -n secrets-engine create token secrets-engine \
        --audience flex-auth --duration 10m > "$PDP_TOKEN"
chmod 600 "$PDP_TOKEN"          # outside any Git worktree

# 3. Point the engine at the forward.
export SECRETS_ENGINE_PDP_URL=http://127.0.0.1:18080
export SECRETS_ENGINE_PDP_TOKEN_FILE="$PDP_TOKEN"
export SECRETS_ENGINE_AUTHORIZATION_POLICY_PACKAGE=secrets-engine.catalog-lane.lifecycle
export SECRETS_ENGINE_AUTHORIZATION_POLICY_VERSION=v2
```

Shred the token file and stop the forward when the session ends. The token is
ten minutes; it is a caller credential, not an authorization.

`ServiceAccount secrets-engine/secrets-engine` has `automountServiceAccountToken:
false` and no role bindings — it exists to be a caller identity and nothing else.

## Pin v2, never v1

v1 shipped and was deployed with no `input.tenant` rule at all; a `rotate` under
`tenant:coulomb` returned **allow**. v2 supersedes rather than amends it so the
change is visible in the version string, and this engine refuses a v1 decision
outright. See `docs/tenant-alignment.md`.

## Known gap: the digest join does not hold against a real request

Proved live on 2026-09-07 and **not yet fixed**; the engine currently rejects
every real allow, which is fail-closed and therefore safe to leave standing
while the rule is published.

The evaluator enriches the request from its registry before hashing — `subject`
gains `attributes` and `tenant`, `resource` gains `tenant` — so
`binding.request_digest` is a digest of material we did not send and cannot
reproduce. `validate_decision_envelope` compares the binding against our
unenriched request and fails with *"decision binding does not match request"*.

Which fields the evaluator may enrich is flex-auth's contract to publish, not
ours to infer. Guessing it would mean accepting a binding that differs from what
we proposed in some way we decided was benign — the same fail-open shape as a
guessed digest exclusion or a guessed vocabulary mapping. Raised with flex-auth;
staying fail-closed and naming the missing rule is the correct posture until
they answer.