coulomb/access-engine
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

FLEX-WP-0035-T05: informed-decision lifecycle v2 declares application.access
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details
Build and Publish Container Image / build-and-push (push) Successful in 1m5s
Details

Browse source 
- application.access allows only with purpose=readback and the authoring
  human bar; no workload path, no audience or client-scoped claims
- v1 operations unchanged; pin.json moves to v2; live pin stays v1 until T04
- examples/application-readback: readback catalogue with informed-decision's
  key-cape client binding; integration test over the shipped files

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 609675@bnt-lap001
Assistant-Session: 4987a36e-eb38-4b10-803c-15a29cd78212
This commit is contained in:
tegwick 2026-10-09 20:10:50 +02:00
parent a4103272e1
commit b5da745063
10 changed files with 207 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

17
workplans/FLEX-WP-0035-per-identity-application-readback.md
View file

@ -124,8 +124,11 @@ and `readback_systems` are checked against live service output
```task
id: FLEX-WP-0035-T05
status: todo
status: wait
priority: high
blocked_on: message-from:informed-decision
blocking_reason: "Source side done; informed-decision must agree to lifecycle v2 (its own lifecycle pin will run the same digest at the next rollout)."
state_hub_task_id: "701cbd99-1a84-5290-8f66-15fa7f407d3b"
```
informed-decision is the first participant. Its `informed-decision.lifecycle`
@ -138,6 +141,18 @@ informed-decision, because its own pin must run the same digest. Add
Gate: package valid with allow/deny fixtures, informed-decision agrees, and
the rule reads no audience, authorized-party or client-scoped claim.
2026-10-09 source done. `informed-decision.lifecycle` is now v2
(`sha256:da01e045…`, `pin.json` updated). It adds `application.access`, which
requires `purpose == "readback"` and the existing `human` bar: net-kingdom-admins,
KeyCape AAL2 `pwd`+`otp` within 12h, platform tenant. It has no workload path
and reads no audience or client-scoped claim. v1's twelve operations are
unchanged. Eight Go cases cover it, plus a fixture showing that it denies
without the readback purpose. The catalogue `examples/application-readback/`
binds informed-decision to `https://kc.coulomb.social` /
`informed-decision-approver`. `TestReadbackInformedDecisionCatalogue` proves the
readback over the shipped files. The live lifecycle pin still runs v1 (image
`bdac62bc`) until the T04 rollout. Waiting on informed-decision's agreement.
## Deploy the readback pin
```task