coulomb/access-engine
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

FLEX-WP-0040-T07: compact-sitting v14 admits present-existing requester
All checks were successful
CI Smoke / host-smoke (push) Successful in 1s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
Build and Publish Container Image / build-and-push (push) Successful in 1m15s
Details

Browse source 
v14 (proposed, sha256:8911458f36f1a60598aa19592a2d752a74dffe2617fd86238407ac87bc300fde)
keeps every v13 decision and admits approval requester service:nk-bind-executor
only from submitter nk-bind-executor, memo class and approval action
bounded-execution, an aal2 human reviewer, and never the approval actor
itself (GH-DEC-2026-026 class C2). v13 stays unchanged as rollback reference.
The admission generator skips present_existing registry rows.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5502@bnt-lap001
Assistant-Session: 68b3b02f-5d0f-4e71-8421-796f62e50196
This commit is contained in:
tegwick 2026-11-01 00:40:35 +01:00
parent 18db517e00
commit 2de0f862f9
10 changed files with 1414 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

9
tools/gen_informed_decision_admission.py
View file

@ -4,7 +4,8 @@
The compact-sitting attribute branch does not author who may pose. It copies
submitter ids and the union of their memo classes from
``deploy/intake-submitters.json``. An empty registry generates empty sets, so
the branch admits nobody. A malformed registry refuses to write.
the branch admits nobody. Rows with a ``present_existing`` profile are skipped:
they are admitted only by the owner-authored ``present_existing_profiles``. A malformed registry refuses to write.
Usage:
python3 tools/gen_informed_decision_admission.py [--source PATH]
@ -48,7 +49,7 @@ def load_sets(path: Path) -> tuple[list[str], list[str]]:
for username, row in document.items():
if not isinstance(username, str) or not SA.fullmatch(username) or not isinstance(row, dict):
fail(f"refusing submitter row {username!r}")
if set(row) != ROW_KEYS:
if set(row) not in (ROW_KEYS, ROW_KEYS | {"present_existing"}):
fail(f"refusing submitter row {username!r}: keys must be {sorted(ROW_KEYS)}")
submitter_id = row["submitter_id"]
if not isinstance(submitter_id, str) or not SLUG.fullmatch(submitter_id):
@ -60,6 +61,10 @@ def load_sets(path: Path) -> tuple[list[str], list[str]]:
values = row[field]
if not isinstance(values, list) or any(not isinstance(item, str) or not SLUG.fullmatch(item) for item in values):
fail(f"refusing {field} for {username}")
if "present_existing" in row:
# Present-existing submitters are admitted only by the owner-authored
# present_existing_profiles (compact-sitting v14), never by these sets.
continue
submitters.append(submitter_id)
classes.update(row["memo_classes"])
if len(set(submitters)) != len(submitters):