coulomb/user-engine
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Record upstream tenant contract corrections
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
tegwick 2026-08-18 10:57:07 +02:00
parent 47a58d5cc2
commit ecc4ab5755
1 changed files with 24 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

24
workplans/USER-WP-0021-portal-product-expansion.md
View file

@ -162,6 +162,30 @@ focus; responsive viewport/mobile tables; provider handoff denial; and
desktop/browser positive flows. The full suite passes 115 tests with three
provider integration tests skipped when their external service is absent.
## Upstream corrections consumed (2026-08-18)
tenant-engine reported that production had been silently rolled back to the
pre-lifecycle TEN-WP-0004 image between 2026-08-13 and 2026-08-16, so PATCH,
retire, and reactivate returned 404 while flex-auth simultaneously ran a
four-action policy that would have denied them anyway. Both are resolved and
verified live. Our conformance suite passed throughout because it was right
about the contract and production was not serving it — which is precisely the
gap the handoff note flagged. The live cross-service check from a user-engine
pod is now owed as part of the next rollout; contract-level evidence cannot
see a pin rollback.
tenant-engine also corrected the contract: `grouping` is no longer immutable.
It changes only through the authority's own reclassification route under a
separate `tenant.grouping.set` action, because grouping resolves a tenant's
guardrail spend ceiling and must not ride on a rename. The identifier's
grouping segment is now historical — a tenant created as `tenant:small:acme`
can report grouping `large`. Verified that user-engine performs no identifier
parsing; every `split` in the portal is URL routing. `TenantRecord` had been
dropping the field, so the read now carries it, the operator screen shows it
with the identifier caveat, and OpenAPI documents where to read it. The
reclassification control itself is deliberately not built: the route is not
deployed and wants its own permission.
## T05 - Trigger enterprise federation planning only on demand
```task