coulomb/access-engine
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Implement local decision delivery and reconcile blocked workplan requirements
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details
Build and Publish Container Image / build-and-push (push) Successful in 1m1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a1046e-fcad-7ea3-bf36-361fc8d679e8
This commit is contained in:
tegwick 2026-10-04 11:40:37 +02:00
parent 257a83e997
commit 3cb1cfaedf
25 changed files with 1258 additions and 50 deletions
Download patch file Download diff file Expand all files Collapse all files

9
docs/conformance/security-layer-conformance.md
View file

@ -56,7 +56,7 @@ review date.
| # | Gap | Owner | Blocked on | Review |
| --- | --- | --- | --- | --- |
| G1 | Registry-snapshot digest absent from decision provenance. §9.7.2 promotes it to a conformance prerequisite: a decision that turned on registry content must be replayable from its own record. | `flex-auth` | implementation | `FLEX-WP-0019` |
| G2 | **Emission guarantee declared, not delivered.** Ruled 2026-09-21 (`GH-DEC-2026-018`): flex-auth is the source; custody is never source; `audit-core` confirmed its half and declined the role (`AUDIT-IN-0005`). The per-event-class inventory and classification are **published** in [`cadence.yaml`](../../cadence.yaml) and named from `INTENT.md` (`source_of_evidence: true`, `emission_guarantee`). Five decision classes are load-bearing; `deny`, `redact`, `not_applicable`, `audit_only` are **rare** — heartbeat **and** reconciliation, rate monitoring forbidden; `allow` is **volume** — expected-rate **and** reconciliation. Nothing emits yet: no sender is registered with `audit-core`, no outbox, no heartbeat. | `flex-auth` | outbox + heartbeat implementation, and an `audit-core` sender registration (intake + token lane, per `AUDIT-IN-0002`/`0003`) — `FLEX-WP-0031` | **2026-10-19** |
| G2 | **Emission guarantee declared, not delivered.** Ruled 2026-09-21 (`GH-DEC-2026-018`): flex-auth is the source; custody is never source; `audit-core` confirmed its half and declined the role (`AUDIT-IN-0005`). The per-event-class inventory and classification are **published** in [`cadence.yaml`](../../cadence.yaml) and named from `INTENT.md` (`source_of_evidence: true`, `emission_guarantee`). Five decision classes are load-bearing; `deny`, `redact`, `not_applicable`, `audit_only` are **rare** — heartbeat **and** reconciliation, rate monitoring forbidden; `allow` is **volume** — expected-rate **and** reconciliation. No production pin emits yet. Durable outbox, per-class heartbeat/drain and optional PVC are implemented and locally tested; sender admission, compatible reconciliation windows and native observer evidence remain pending. | `flex-auth` | audit-core `AUDIT-IN-0006` admission/token delivery, gate-house `GH-WP-0004-T12` ruling, compatible count windows and approved native heartbeat/reconciliation/silence-finding evidence — `FLEX-WP-0031` | **2026-10-19** |
| G3 | Published stance-register review is stale: written at two register rows, §13.1 now carries five, and its Finding 1 was ruled by v0.8 §6.4 obligation 3. | `flex-auth` | second edition | `FLEX-WP-0029` |
**G2 fails closed.** A stream with no delivered cadence produces no silence
@ -96,3 +96,10 @@ heartbeat and reconciliation and forbidding rate monitoring. That is the same pr
praised in `ops-warden`'s stance map: the published artifact is asserted equal to
the shipped one by test, rather than merely written down. It does **not** assert
the contents below the declaration — a reviewer still has to read this file.
2026-10-04 implementation review: source-owned
`docs/contracts/decision-emission-cadence.json` passes the supplied InfoTechCanon
schema and NetKingdom security profile. This is declaration validity, not native
emission evidence. `FLEX-DEC-2026-018` supplies the local release rule;
`GH-WP-0004-T12` still owes the statutory disposition of its failure-path
exception. G2 remains open and no atomicity waiver is inferred.