coulomb/tenant-engine
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Finish TEN-WP-0005-T05: ship lifecycle image and verify production

Browse source 
Pin tenant-engine to the CI-built digest from 7e68cc8, record rollback
digests, and close T05 after live create/update/retire/replay/reactivate
evidence against a disposable production tenant. Hands the 0.1.0 contract
to USER-WP-0021.
This commit is contained in:
tegwick 2026-08-14 01:42:41 +02:00
parent 7e68cc835e
commit 9ed391aec7
4 changed files with 30 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

23
workplans/TEN-WP-0005-tenant-update-and-retirement-api.md
View file

@ -4,7 +4,7 @@ type: workplan
title: "Tenant metadata update and reversible retirement API"
domain: infotech
repo: tenant-engine
status: active
status: finished
owner: codex
topic_slug: tenant-lifecycle
created: "2026-08-10"
@ -154,7 +154,7 @@ Not covered: no PostgreSQL tests exist, per the T02 note above.
```task
id: TEN-WP-0005-T05
status: progress
status: done
priority: high
state_hub_task_id: "9b21782a-1b26-4fac-81a1-06bd7e8cf70f"
```
@ -184,3 +184,22 @@ commit `e9911eb`). Production tenant-engine still runs the TEN-WP-0004 image
the live manifests into `deploy/` and added the fleet CI image workflow so the
lifecycle image is built from a forge revision rather than a workstation.
Done 2026-08-14. Consumer handoff:
| Fact | Value |
| --- | --- |
| Immutable image | `forgejo.coulomb.social/coulomb/tenant-engine@sha256:08be0b1dcdc65575592b7be665c28e09a82316ea3d4c9b551ccb753f25360612` (CI, `main-7e68cc8`) |
| API version | `0.1.0` |
| Authorization policy | `tenant-engine.write-api.mutate` v1, seven actions, flex-auth `@sha256:9320df394a642eff24da8af4a0ee8886a7bb78b0f14d8ee1deeb30ea8eeeaba7` (`e9911eb`) |
| Contract | `docs/tenant-lifecycle-api.md` |
Live against disposable `tenant:trial:ten-wp-0005-t05` (left `retired`):
create 201 → update 200 v2 → retire 200 v3 → update-while-retired 409
`invalid_lifecycle_transition` → grant-while-retired 409 `tenant_retired` →
retire replay `Idempotent-Replay: true` v3 unchanged → reactivate 200 v4 →
actor `ops` 403 `write_denied`. Existing `tenant:trial:portalcheck` survived
the forward-only SQLite migration (`active`, version 1). Rollback is
`kubectl -n tenant-engine rollout undo`; last-known-good is the TEN-WP-0004
digest `2249e8c6…85149207` (ReplicaSet still present). USER-WP-0021 is
unblocked for update/retirement UI; this workplan has no leftover residual.