diff --git a/decisions/decisions.md b/decisions/decisions.md index f4cccd7..8bc1a09 100644 --- a/decisions/decisions.md +++ b/decisions/decisions.md @@ -192,3 +192,48 @@ tenant-engine's own words. revisited — but it would be a *new* field, not a change of meaning for this one. - Unblocks `FLEX-WP-0022-T02`. + +--- + +## TEN-DEC-2026-003 — net-kingdom's combined runtime.yaml reference copy of tenant-engine is retired in favour of pointers + +```yaml +id: TEN-DEC-2026-003 +kind: decision +title: "net-kingdom's combined runtime.yaml reference copy of tenant-engine is retired in favour of pointers" +status: resolved +disposition: approved +origin: cross-repo +origin_ref: NK-WP-0039-T04 +owner: tenant-engine +affects: + - tenant-engine + - net-kingdom +requested_by: net-kingdom +created: "2026-09-30" +updated: "2026-09-30" +decided_by: tenant-engine (the owner of its own deployment declaration) +decided_at: "2026-09-30" +``` + +**Question (net-kingdom message 2c637dc9 / 9fc740da):** does net-kingdom keep a +reference copy of tenant-engine's objects in `sso-mfa/k8s/tenant-engine/runtime.yaml`, +or retire it? + +**Decision: retire it.** The authoritative declaration is this repository: +`deploy/base/tenant-engine.yaml` (applied by `kubectl apply -k deploy/`, TEN-WP-0008), +with the staged-promotion contract in `railiance/app.toml`. net-kingdom's copy +already differs from live in image digest, storage, strategy, environment and egress +(its own 2026-09-23 `kubectl diff`), and no script or workflow consumes it (net-kingdom +searched; the file carries a DO-NOT-APPLY header). A second hand-kept copy can only +drift further. ADR-0015 of net-kingdom already prefers pointers to owner declarations, +and net-kingdom applied that to the flex-auth objects on 2026-09-28. + +**What tenant-engine asks of net-kingdom:** replace the five remaining tenant-engine +objects (Namespace, PVC, Deployment, Service, NetworkPolicy) with links to +`tenant-engine/deploy/base/tenant-engine.yaml` and `tenant-engine/railiance/app.toml`, +keeping the DO-NOT-APPLY guard until the file holds no objects. Nothing in this repo +depends on the copy; no cluster change follows from the retirement. + +**Not changed:** `deploy/`, `railiance/`, and all runtime names. + diff --git a/docs/flex-auth-integration.md b/docs/flex-auth-integration.md index c60fd39..ffe9ee0 100644 --- a/docs/flex-auth-integration.md +++ b/docs/flex-auth-integration.md @@ -8,7 +8,7 @@ without a decision record or a recorded fail-closed stance ## What tenant-engine sends -A `CheckRequest` per `flex-auth/schemas/check_request.schema.json`: +A `CheckRequest` per `access-engine/schemas/check_request.schema.json`: ```json { @@ -82,7 +82,7 @@ Action → resource-type mapping (must match `flex-auth`'s ## What tenant-engine expects back -A `DecisionEnvelope` per `flex-auth/schemas/decision_envelope.schema.json`. +A `DecisionEnvelope` per `access-engine/schemas/decision_envelope.schema.json`. Only `effect: "allow"` authorizes the action. Every other `effect`, a non-200 response, a malformed body, or a transport failure/timeout all resolve to **deny**. `FlexAuthCheckClient.check()` never raises past its @@ -104,13 +104,13 @@ reads the store. That check does **not** re-enter tenant-engine: 2. `FlexAuthCheckClient` POSTs only `/v1/check`. Proven by `tests/test_pip_claims.py::test_live_lookup_check_does_not_reenter_tenant_engine`. 3. flex-auth's tenant-engine policy package - (`flex-auth/examples/tenant-engine/policy_package.md`) matches + (`access-engine/examples/tenant-engine/policy_package.md`) matches `subject.id` and `action` only. It does not consult tenant capability roles. The package's own scope note says those roles are tenant state a *different* protected system might consult via live-lookup; conflating the two would authorize the wrong thing. 4. flex-auth's live-roles adapter is built and unwired - (`FLEX-WP-0015`, `flex-auth/docs/tenancy-posture-review.md`): no + (`FLEX-WP-0015`, `access-engine/docs/tenancy-posture-review.md`): no non-test caller, no current policy consumes `tenant_roles` for a privileged path. @@ -141,17 +141,17 @@ Tests assert the file equals shipped behaviour. ## Repository coordinate vs runtime name (TEN-IN-0004) -The `flex-auth` repository is renaming to `access-engine` (`FLEX-WP-0020`). +The `flex-auth` repository was renamed to `access-engine` (`FLEX-WP-0020`). **Runtime names stay `flex-auth`** per `FLEX-DEC-2026-013`: the cluster namespace, the `flex-auth-tenant-engine` Service, the token audience, and this engine's `TENANT_ENGINE_FLEX_AUTH_*` settings are all unchanged by the rename. -Only the `flex-auth/...` repository paths cited below and above change, and -only once the rename lands. +Only the `flex-auth/...` repository paths cited below and above changed to +`access-engine/...` when the rename landed (2026-09-30, FLEX-WP-0020). ## Related - `pep-stance.yaml` — published fail-closed map - `pip-claims.yaml` — input-class freshness -- `flex-auth/workplans/FLEX-WP-0008-tenant-engine-consumer-integration.md` +- `access-engine/workplans/FLEX-WP-0008-tenant-engine-consumer-integration.md` - `key-cape/workplans/KEY-WP-0005-iam-profile-core-claims.md` - `net-kingdom/canon/standards/tenant-engine-boundary-contract_v0.1.md` diff --git a/intakes/intakes.md b/intakes/intakes.md index 66b727f..b932803 100644 --- a/intakes/intakes.md +++ b/intakes/intakes.md @@ -67,14 +67,14 @@ state_hub_intake_id: "01a04cf8-c135-70cb-a24c-33219a9f2985" id: TEN-IN-0004 kind: intake title: "flex-auth → access-engine repository rename: verify the retained runtime contract" -status: open +status: closed origin: cross-repo origin_ref: FLEX-WP-0020 priority: low owner: tenant-engine requested_by: flex-auth created: "2026-09-21" -updated: "2026-09-21" +updated: "2026-09-30" state_hub_intake_id: "01a0c14b-b2f7-78f1-8f6c-e36c952fe004" description: >- flex-auth is preparing a repository-coordinate rename to access-engine. @@ -114,6 +114,13 @@ notes: the five documentation coordinates are repointed. author: tenant-engine created: "2026-09-21" +- content: >- + 2026-09-30: rename landed. The five documentation coordinates in + docs/flex-auth-integration.md now read access-engine/ and every target + resolves in ~/access-engine. Runtime and client config unchanged. Closed. + Separately answered net-kingdom NK-WP-0039-T04 in TEN-DEC-2026-003. + author: tenant-engine + created: "2026-09-30" ``` ---