FLEX-WP-0006: implement ops-warden signing gate policy

2026-06-23 21:17:42 +02:00
parent 53e0d055c9
commit 0fde95a87c
25 changed files with 1796 additions and 10 deletions
--- a/pkg/api/canonical.go
+++ b/pkg/api/canonical.go
@@ -148,6 +148,7 @@ type DecisionExpectation struct {
 // CheckRequest is the stable protected-system-facing decision request.
 type CheckRequest struct {
 	ID            string                  `json:"id,omitempty"             yaml:"id,omitempty"`
+	Tenant        string                  `json:"tenant,omitempty"         yaml:"tenant,omitempty"`
 	Subject       SubjectRef              `json:"subject"                  yaml:"subject"`
 	Action        string                  `json:"action"                   yaml:"action"`
 	Resource      ResourceRef             `json:"resource"                 yaml:"resource"`
@@ -159,6 +160,7 @@ type CheckRequest struct {
 // BatchCheckRequest evaluates one subject/action against multiple resources.
 type BatchCheckRequest struct {
 	ID            string         `json:"id,omitempty"             yaml:"id,omitempty"`
+	Tenant        string         `json:"tenant,omitempty"         yaml:"tenant,omitempty"`
 	Subject       SubjectRef     `json:"subject"                  yaml:"subject"`
 	Action        string         `json:"action"                   yaml:"action"`
 	Resources     []ResourceRef  `json:"resources"                yaml:"resources"`