coulomb/tenant-engine
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Finish TEN-WP-0005-T05: ship lifecycle image and verify production

Browse source 
Pin tenant-engine to the CI-built digest from 7e68cc8, record rollback
digests, and close T05 after live create/update/retire/replay/reactivate
evidence against a disposable production tenant. Hands the 0.1.0 contract
to USER-WP-0021.
This commit is contained in:
tegwick 2026-08-14 01:42:41 +02:00
parent 7e68cc835e
commit 9ed391aec7
4 changed files with 30 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

3
deploy/README.md
View file

@ -46,7 +46,8 @@ last-known-good digest below.
| Deployment | Digest | State |
| --- | --- | --- |
| `tenant-engine` | `sha256:2249e8c6ee44ae36081cddc52daf9c3f63acd18a95a5d620ab4fa7ac85149207` | **current** — TEN-WP-0004 create/role/plan API, live since 2026-08-09 |
| `tenant-engine` | `sha256:08be0b1dcdc65575592b7be665c28e09a82316ea3d4c9b551ccb753f25360612` | **current** — TEN-WP-0005 lifecycle API, CI-built from `7e68cc8`, live 2026-08-14 |
| `tenant-engine` *(previous)* | `sha256:2249e8c6ee44ae36081cddc52daf9c3f63acd18a95a5d620ab4fa7ac85149207` | TEN-WP-0004 create/role/plan API, live 2026-08-09 to 2026-08-14 |
| `tenant-engine` *(earlier)* | `sha256:33c5dd84eaf1c2f5e067c04931219e13f9348a764a153d641035a6d019095d4f` | first TEN-WP-0004 revision |
Rolling back to `2249e8c6…` removes the lifecycle routes (`GET /tenants/{id}`,

2
deploy/tenant-engine.yaml
View file

@ -42,7 +42,7 @@ spec:
value: /data/tenant-engine.db
- name: TENANT_ENGINE_FLEX_AUTH_URL
value: http://flex-auth-tenant-engine.flex-auth.svc.cluster.local:8080
image: forgejo.coulomb.social/coulomb/tenant-engine@sha256:2249e8c6ee44ae36081cddc52daf9c3f63acd18a95a5d620ab4fa7ac85149207
image: forgejo.coulomb.social/coulomb/tenant-engine@sha256:08be0b1dcdc65575592b7be665c28e09a82316ea3d4c9b551ccb753f25360612
livenessProbe:
httpGet:
path: /health

10
docs/tenant-lifecycle-api.md
View file

@ -164,10 +164,12 @@ thereby granting a retirement:
| `tenant.retire` | `tenant` |
| `tenant.reactivate` | `tenant` |
These must be added to the flex-auth policy package alongside the existing
`tenant.create`, `tenant.role.grant`, `tenant.role.revoke`, and
`tenant.plan.assign` actions. Until they exist, checks resolve to deny —
correct fail-closed behaviour, not a defect.
These sit alongside the existing `tenant.create`, `tenant.role.grant`,
`tenant.role.revoke`, and `tenant.plan.assign` actions in package
`tenant-engine.write-api.mutate` v1. Production flex-auth serves the
seven-action revision from image
`forgejo.coulomb.social/coulomb/flex-auth@sha256:9320df394a642eff24da8af4a0ee8886a7bb78b0f14d8ee1deeb30ea8eeeaba7`
(commit `e9911eb`). Unknown action strings still deny.
---

23
workplans/TEN-WP-0005-tenant-update-and-retirement-api.md
View file

@ -4,7 +4,7 @@ type: workplan
title: "Tenant metadata update and reversible retirement API"
domain: infotech
repo: tenant-engine
status: active
status: finished
owner: codex
topic_slug: tenant-lifecycle
created: "2026-08-10"
@ -154,7 +154,7 @@ Not covered: no PostgreSQL tests exist, per the T02 note above.
```task
id: TEN-WP-0005-T05
status: progress
status: done
priority: high
state_hub_task_id: "9b21782a-1b26-4fac-81a1-06bd7e8cf70f"
```
@ -184,3 +184,22 @@ commit `e9911eb`). Production tenant-engine still runs the TEN-WP-0004 image
the live manifests into `deploy/` and added the fleet CI image workflow so the
lifecycle image is built from a forge revision rather than a workstation.
Done 2026-08-14. Consumer handoff:
| Fact | Value |
| --- | --- |
| Immutable image | `forgejo.coulomb.social/coulomb/tenant-engine@sha256:08be0b1dcdc65575592b7be665c28e09a82316ea3d4c9b551ccb753f25360612` (CI, `main-7e68cc8`) |
| API version | `0.1.0` |
| Authorization policy | `tenant-engine.write-api.mutate` v1, seven actions, flex-auth `@sha256:9320df394a642eff24da8af4a0ee8886a7bb78b0f14d8ee1deeb30ea8eeeaba7` (`e9911eb`) |
| Contract | `docs/tenant-lifecycle-api.md` |
Live against disposable `tenant:trial:ten-wp-0005-t05` (left `retired`):
create 201 → update 200 v2 → retire 200 v3 → update-while-retired 409
`invalid_lifecycle_transition` → grant-while-retired 409 `tenant_retired` →
retire replay `Idempotent-Replay: true` v3 unchanged → reactivate 200 v4 →
actor `ops` 403 `write_denied`. Existing `tenant:trial:portalcheck` survived
the forward-only SQLite migration (`active`, version 1). Rollback is
`kubectl -n tenant-engine rollout undo`; last-known-good is the TEN-WP-0004
digest `2249e8c6…85149207` (ReplicaSet still present). USER-WP-0021 is
unblocked for update/retirement UI; this workplan has no leftover residual.