coulomb/access-engine
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Bind trusted task approval to exact producer facts and lifetime
Some checks failed
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details
Build and Publish Container Image / build-and-push (push) Failing after 1m10s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a140c4-354a-7823-8f0d-8f717397f786
This commit is contained in:
tegwick 2026-10-16 17:27:30 +02:00
parent 4f6946bbb3
commit 2b064eee51
31 changed files with 2170 additions and 30 deletions
Download patch file Download diff file Expand all files Collapse all files

33
workplans/FLEX-WP-0024-decision-envelope-authenticity.md
View file

@ -239,3 +239,36 @@ source evidence only. B2 depends on independently reviewed Approval fact contrac
and canonical vectors; B3 additionally needs exact source/normalization numeric
representation and full trusted provider joins. No current policy false gate,
production trust, native deployment or protected effect is enabled by B1.
2026-10-16 B2/B3 source successor preparation (separate from frozen B1): the
isolated v2 source path now joins the fixed authenticated Approval reader,
unchanged Approval-owner canonical/fact helper, original/fresh correspondence,
raw numeric request/registry source retention, same policy evaluator and signed
source provenance. Disposable actual HTTP and production serve subprocess prove
synthetic signed ALLOW and fail-closed negative joins with exact response/record
parity. See `docs/trusted-service-task-source.md`. T06 remains `progress`: this
source proposal requires independent cross-owner review and full consumer/Platform
successor integration, then separately admitted runtime custody, source trust,
image provenance and rollout. No source-only proof establishes those runtime gates.
2026-10-16 B2/B3 R2 temporal correction (R1 retained): whole-stack review exposed
that R1's 15s ALLOW and default Approval freshness30 cannot fit the declared
minimum backendTTL30 plus existing cleanupreserve5. The v2 successor now derives
exact ALLOW expiry from the immutable operationdeadline, requiring all original/
fresh approval/freshness/caller bounds, a conservative source maximum120 and
remaining declaredTTL+5 after source I/O/evaluation. No consumer/native deadline
or cleanup guard is relaxed. Max structural budgets that cannot fit refuse.
The fixture declares backendTTL30/deadline60 and explicit source freshness120;
owner runtime source freshness configuration and full native integration remain
separate reviewed gates. See docs/trusted-service-task-source.md.
2026-10-16 B2/B3 R3 follows actual retained-registry integration failure: subject
enrichment changed evaluated approval-free digest from the original proposal.
The existing signed claim-free DENY now explicitly carries v2 approvalfree digest
(equal evaluated requestdigest), enabling producer-owned preapproval facts under
the already published enrichment contract. The final original proposal adds only
the issued claim; registry drift/refreshed facts cannot silently rebind it.
Retained-registry HTTP and production serve proofs and negative joins pass.
R3 preserves precise notbefore pending separate Approval-owner timestamp fidelity
repair; no rounding waiver, copied registry algorithm or empty-registry workaround.