zeekayandHanzo Dev 3b44aea20f The warehouse maps the platform's real IAM clients, and the host owns the hanzo database ...

The rules named hanzo-cloud as the sink, but IAM provisions the event app
as hanzo-event and the o11y app as hanzo-o11y, and the cloud host is
hanzo-cloud. hanzo-event is now the sink, hanzo-cloud holds a new
`platform` role for the hanzo database it creates and owns, and the three
processes hold `observer`, the event plane's cross-org read, for the
reads no caller's token speaks for (an API key, a background job, a
fleet view). Without these the host was refused everything and the
sink's own reads failed.

`schema` may also keep the migration runner's ledger and lock
(hanzo.migration, hanzo.migration_lock_*), without which the o11y app
could not record that 0005 ran, and may create `observer`. `platform`
may grant SELECT on its own tables and write their row policies, so the
host confines the tables it reads as a person's org the same way.

The gtests and the integration test load the image's own directory
section instead of a copy, so the deployment's rules are what they test.
The integration test adds the host, the ledger, query cache isolation
and SET ROLE. contrib/authz is pinned to the v1.10.41 tag.


Co-authored-by: Hanzo Dev <[email protected]>

2026-09-24 21:18:12 -07:00

..

test-issuer.xml

The warehouse maps the platform's real IAM clients, and the host owns the hanzo database

2026-09-24 21:18:12 -07:00