coulomb/access-engine
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

FLEX-WP-0035: activate; draft application access readback contract and FLEX-DEC-2026-019
All checks were successful
CI Smoke / host-smoke (push) Successful in 1s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details

Browse source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 609675@bnt-lap001
Assistant-Session: 4987a36e-eb38-4b10-803c-15a29cd78212
This commit is contained in:
tegwick 2026-10-09 19:11:55 +02:00
parent 229a98c527
commit 9d9ca69b4c
4 changed files with 228 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

30
decisions/decisions.md
View file

@ -2080,3 +2080,33 @@ endpoint.
**Bound.** Unchanged from `cadence.yaml`: none of this detects a compromised
flex-auth suppressing a record together with its own count.
## FLEX-DEC-2026-019 — Application access readback is a per-package opt-in action, advisory by binding, served from a dedicated pin
**Date:** 2026-10-09
**Status:** proposed (pending user-engine review)
**Workplan:** `FLEX-WP-0035-T01`
**Contract:** `docs/application-access-readback.md`
**Question.** How does access-engine tell user-engine which applications a
signed-in person may use, without widening any pin's caller binding, and
without letting registry content decide an allow?
**Ruling (proposed).**
1. **The action is `application.access`, declared per package.** A system
takes part by giving the action rules in its own versioned package. If it
does not, the answer is `not_applicable`. No registry-level mapping, because
registry content is outside decision provenance until G1.
2. **The answer is advisory by construction.** The binding carries
`purpose: "readback"` inside the hashed request, so its digests never match
an enforcement request. The route evaluates only `application.access`.
3. **It runs on a dedicated readback pin** that loads participating packages
at the digests their own pins run, enforced by a digest-equality test. Its
caller binding admits the readback route only. Fan-out to consumer pins is
rejected, because it widens every pin's binding and ingress.
4. **Commitments do not grow.** Each result restates the §9.7 per-input-class
deadlines from `docs/decision-input-freshness.md` and carries
`lifetime.expires_at`. Readback decisions are recorded as their own
non-load-bearing `readback` event class under `FLEX-DEC-2026-018`.
5. **Grants stay inside access-engine.** No user-domain grant surface.