coulomb/user-engine
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
user-engine/docs/operability.md
tegwick 4349758608
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
Build and Publish Container Image / build-and-push (push) Successful in 36s
Details
Implement USER-WP-0024 security layer conformance 
Declare Engine/PIP machine-readably, publish a total fail-closed PEP
stance map, stop minting local decision ids on engine-unavailable DENY,
bind allows to a 30s request lifetime, confine the local authorization
double, classify evidence and emit a denial/revocation heartbeat, and
prove access-control facts remain claims.

Assistant: grok
Assistant-Session: 01a04cea-f0d6-7ab3-9ffd-881eb6bea6cb
2026-08-29 12:53:16 +02:00

2 KiB
Raw Blame History

Operability

Diagnostics

Use readiness() for dependency checks and operability_snapshot() for runtime counters and invariant checks. The snapshot currently reports store readiness, whether written audit records carry a correlation id, outbox diagnostic availability, and counts for users, accounts, tenant accounts, memberships, applications, catalogs, profile values, audit records, and pending outbox events. Those checks describe the records in hand. They do not prove that every event that should have been emitted was emitted. See docs/evidence-classification.md.

Structured Logs

Use structured_log_context(correlation_id=..., tenant=..., actor=...) as the base log envelope. Adapters should add transport details around that envelope without dropping correlation id or tenant.

Metrics

GET /metrics exposes Prometheus text containing the binary user_engine_ready dependency gauge and bounded aggregate user_engine_records{kind=...} counters. It does not expose identity values, emails, tenant names, correlation identifiers, credential material, or raw outbox payloads. Keep this route cluster-internal and authorize ingress only from the selected monitoring workload.

Outbox Drain

outbox_diagnostics() reports pending event count, event type counts, and the oldest pending correlation id. A real outbox drain adapter should publish events idempotently by event_id, retain correlation_id, and only mark delivery after the sink acknowledges receipt.

Cache Status

ClaimsEnrichmentProjectionCache.status() reports entry count and cached tenant, application, and user keys. Token issuers must invalidate affected users after profile, membership, or catalog changes before minting enriched claims.

Runbook Checks

  1. Run make test-conformance.
  2. Confirm readiness().ready is true.
  3. Confirm operability_snapshot().issues is empty.
  4. Confirm pending outbox events are either drained or expected for the local environment.
  5. Confirm production identity adapters reject local, expired, and missing-tenant claims.