user-engine/workplans/USER-WP-0023-flex-auth-caller-identity.md

id	type	title	domain	repo	status	owner	topic_slug	created	updated	state_hub_workstream_id
USER-WP-0023	workplan	Bind user-engine to flex-auth with rotating workload identity	communication	user-engine	finished	codex	netkingdom	2026-08-18	2026-08-19	4255c44c-70f3-5aa9-a301-4a0c0e1a9a47

USER-WP-0023 — flex-auth caller identity

Close the caller side of FLEX-WP-0015 without changing user-facing identity or authorization semantics.

id: USER-WP-0023-T01
status: done
priority: high
state_hub_task_id: "f513c592-35df-5950-91ae-f4d5297b67d0"

Read the audience-scoped caller token from a file per authorization decision, fail closed on rotation/read errors, and cover token rotation. Completed 2026-08-18; the full suite passes 143 tests with three provider-gated skips.

2026-08-18 fail-closed coverage: the contract promised denial on a missing, empty, or unreadable token file, but only rotation was proven. Conformance now covers all three unusable-token cases and asserts the adapter never reaches flex-auth without a usable credential, so an unauthenticated call cannot be mistaken for an authorized one. A further test proves the token value appears in neither the deny reason nor the decision repr. Suite: 148 tests, three provider-gated skips.

id: USER-WP-0023-T02
status: done
priority: high
state_hub_task_id: "eb4ec2b0-36b3-5cc8-b912-d0bdf3d51cf0"

Align tenant-authority reads with the protected tenant.read action and actor user-engine, preserving opaque URL encoding. Completed 2026-08-18 with adapter request coverage.

id: USER-WP-0023-T03
status: done
priority: high
state_hub_task_id: "dc4c771e-c16f-5609-bd09-20f051a6aae9"

Promote together with the flex-auth A2 digest and the NetKingdom projected ServiceAccount token manifest. Prove a valid caller succeeds, no token returns 401, and user-engine cannot represent another protected system. This is a live operator rollout and was not performed by the source change.

2026-08-18 readiness review: our half is done. The rapp-user-engine managed package is now the apply home, and image sha256:c501aeb2… from 7604d31 — which contains the caller-token change — is live and passed make verify-live. The projected ServiceAccount token manifest is in place: audience flex-auth, mounted at /var/run/secrets/flex-auth-caller/token, with USER_ENGINE_FLEX_AUTH_TOKEN_FILE pointing at it. flex-auth's deploy carries the binding user-engine=system:serviceaccount:user-engine:user-engine.

The blocker is now precisely one upstream item. FLEX-WP-0015-T02 is wait: ADR 0004's TokenReview choke point exists in flex-auth source, but the running digest is unchanged, so production still accepts unauthenticated callers and our Authorization header is sent and ignored. Running the probe today would pass steps 1 and 3 and silently fail step 2 — a false pass on the only assertion that proves enforcement. The probe is therefore written down rather than run: see docs/flex-auth-caller-identity.md, which carries all three checks as commands plus the digests to record.

This task stays wait on FLEX-WP-0015-T02 promotion through FLEX-WP-0011, and on an operator shell with cluster credentials, which agent sessions in this repo do not hold.

2026-08-19 policy-nexus adaptation: the published contracts now name the same split this workplan already implemented.

• IAM Profile v0.3 Service Account Flow (https://policy.coulomb.social/standards/iam-profile/v0.3/) requires audience-scoped, rotating workload credentials delivered through the credential-management standard — that is the projected ServiceAccount token we already send. The optional tenant_roles claim is forwarded to flex-auth as a subject attribute and is never used as a local authorization decision.
• Tenancy Posture v0.1 (https://policy.coulomb.social/standards/tenancy-posture/v0.1/) is the public A2 target T03 is waiting to prove: a single inbound choke point that refuses an unbound caller. Our half of that vector is deployed; flex-auth's running digest is still A0.
• NetKingdom architecture draft-2 (https://policy.coulomb.social/architecture/net-kingdom/v0.1/) lists both documents in chapter 9.

2026-08-19 close: flex-auth-user-engine is live enforce (Helm release rev 4, digest sha256:138aa347…). Probe from pod user-engine-8569d7cb87-fp7px (message 45852487, FLEX-WP-0015-T02):

1. Bearer projected token → 200 decision:350b46fb42989606 allow tenant_admin
2. No Authorization → 401 unauthenticated (not a decision)
3. resource.system=tenant-engine → 403 forbidden (binding, not allow)

user-engine digest sha256:c501aeb2…. tenant-engine and policy.enabled were not moved. Live user-engine needed fsGroup: 10001 so uid 10001 can read the 0440 root:root projected token; that is persisted in rapp-user-engine manifests/runtime.yaml e599b4f. This workplan is finished.

Contract: docs/flex-auth-caller-identity.md.