2 KiB
| id | type | title | domain | repo | status | owner | topic_slug | created | updated | state_hub_workstream_id |
|---|---|---|---|---|---|---|---|---|---|---|
| USER-WP-0023 | workplan | Bind user-engine to flex-auth with rotating workload identity | communication | user-engine | active | codex | netkingdom | 2026-08-18 | 2026-08-18 | 014d0886-b690-4860-8337-c718e440f678 |
USER-WP-0023 — flex-auth caller identity
Close the caller side of FLEX-WP-0015 without changing user-facing identity or authorization semantics.
id: USER-WP-0023-T01
status: done
priority: high
state_hub_task_id: "8dae0fe1-f8a0-4276-8ae3-fe1f5b410669"
Read the audience-scoped caller token from a file per authorization decision, fail closed on rotation/read errors, and cover token rotation. Completed 2026-08-18; the full suite passes 143 tests with three provider-gated skips.
2026-08-18 fail-closed coverage: the contract promised denial on a missing, empty, or unreadable token file, but only rotation was proven. Conformance now covers all three unusable-token cases and asserts the adapter never reaches flex-auth without a usable credential, so an unauthenticated call cannot be mistaken for an authorized one. A further test proves the token value appears in neither the deny reason nor the decision repr. Suite: 148 tests, three provider-gated skips.
id: USER-WP-0023-T02
status: done
priority: high
state_hub_task_id: "4a6c85e8-1ada-4147-b6b7-d340b7e5192c"
Align tenant-authority reads with the protected tenant.read action and actor
user-engine, preserving opaque URL encoding. Completed 2026-08-18 with
adapter request coverage.
id: USER-WP-0023-T03
status: wait
priority: high
state_hub_task_id: "0499c65b-491d-4ed1-8549-f58dba48f612"
Promote together with the flex-auth A2 digest and the NetKingdom projected ServiceAccount token manifest. Prove a valid caller succeeds, no token returns 401, and user-engine cannot represent another protected system. This is a live operator rollout and was not performed by the source change.
Contract: docs/flex-auth-caller-identity.md.