diff --git a/docs/coordination/2026-10-11-user-catalogue-continuation.json b/docs/coordination/2026-10-11-user-catalogue-continuation.json new file mode 100644 index 0000000..e2900d5 --- /dev/null +++ b/docs/coordination/2026-10-11-user-catalogue-continuation.json @@ -0,0 +1,77 @@ +{ + "id": "case:cross-owner:user-engine:USER-WP-0026-T03:access-engine:FLEX-IN-0003", + "purpose": "Finish the existing signed-in one-app catalogue/readback acceptance and obtain supported ordinary catalogue-management authorization", + "scenario_type": "cross_owner_wait", + "goal": { + "result_type": "completion", + "target_population": "named_participants", + "required_outcome": "Access returns ordinary application.register contract/source proposal; User verifies actual signed-in projection and selects any separate T05 application-fact mutation scope", + "required_evidence_level": "high", + "partial_success_rules": [], + "failure_rules": [] + }, + "state": "active", + "created_at": "2026-10-11T00:00:00Z", + "deadlines": [], + "beneficiary_workplan_id": "USER-WP-0026", + "beneficiary_task_id": "USER-WP-0026-T03", + "driver_repo": null, + "driver_workplan_id": null, + "participants": [ + { + "id": "access-engine", + "roles": [ + "implementer" + ] + }, + { + "id": "user-engine", + "roles": [ + "implementer" + ] + }, + { + "id": "the-custodian", + "roles": [ + "observer" + ] + } + ], + "commitments": [ + { + "id": "case:cross-owner:user-engine:USER-WP-0026-T03:access-engine:FLEX-IN-0003:provider-response", + "case_id": "case:cross-owner:user-engine:USER-WP-0026-T03:access-engine:FLEX-IN-0003", + "kind": "response", + "obligor": "access-engine", + "beneficiary": "user-engine", + "subject_ref": "repo:access-engine/intakes/intakes.md#FLEX-IN-0003", + "required_evidence_level": "high", + "state": "proposed", + "satisfaction_predicate": "Provider contract/source response names supported exact User application.register actions, policy/verified-claim admission and promotion/rollback proposal; generic grant API is not implied." + } + ], + "observations": [ + { + "subject_ref": "FLEX-WP-0035", + "observed_state": "finished", + "meaning": "Producer readback complete, not new obligation" + }, + { + "subject_ref": "approval:b859698b-5d08-4da5-9599-4760c6a799f1", + "observed_state": "applied-and-independently-verified", + "meaning": "One-app catalogue facts delivered, ordinary PDP path still denies; no human projection proof" + } + ], + "receipt": { + "scenario_type": "cross_owner_wait", + "case_id": "case:cross-owner:user-engine:USER-WP-0026-T03:access-engine:FLEX-IN-0003", + "state": "waiting", + "reason": "Provider ordinary-management response proposed in FLEX-IN-0003; genuine human projection and any T05 scope choice remain separate", + "beneficiary_workplan_id": "USER-WP-0026", + "obligor_record_id": "FLEX-IN-0003", + "obligor_record_kind": "intake", + "central_publication": "not_submitted", + "worker_wake_enabled": false + }, + "projection_note": "Core v0.1 response commitment uses subject_ref to intake; no intake-as-obligor_workplan_id. Publish metadata via progress coordination_receipt, never a fake workplan dependency." +} diff --git a/docs/reviews/2026-10-11-user-catalogue-continuation.md b/docs/reviews/2026-10-11-user-catalogue-continuation.md new file mode 100644 index 0000000..96cc700 --- /dev/null +++ b/docs/reviews/2026-10-11-user-catalogue-continuation.md @@ -0,0 +1,87 @@ +# Access owner review: application catalogue continuation + +reviewer: access-engine-owner (agent access-engine, codex) +decision: changes_requested +work_item: FLEX-WP-ADHOC-2026-10-11-T01 +reviewed: 2026-10-11 + +The changes requested concern the ownership/dependency wording, not reversal +of the founder's exact R1 catalogue decision. This review authorizes no live +change, grants no permission and makes no human identity claim. + +## Exact evidence and boundary + +Native R1 approval b859698b-5d08-4da5-9599-4760c6a799f1 committed the +informed-decision Application and its client/protected-system binding. +Independent verification confirms two facts, exact consumed ledger, genuine +ordinary PDP denial, three maintenance-SERVICE audits and one undelivered +registered event. Actual signed-in human projection and downstream delivery +are explicitly not verified. SERVICE/synthetic checks are not human login. + +Access INTENT Responsibility Boundary gives Access exclusive evaluation, +protected-system/action registry and policy-package lifecycle. Policy content +remains authored by the protected system owner under that mechanism and +Gate House doctrine. It does not make Access the owner of every user/tenant +membership or identity-provider grant fact. + +Accepted User boundary contract v0.1 §§Ownership/Boundary and Membership +Synchronization: product memberships are User-owned unless an explicit import +contract says otherwise; fine-grained roles/scopes/policies are Access-owned; +IAM owns coarse roles/groups. A flex_auth_export remains a source fact, not a +transfer of membership custody. IAM claims are identity facts, not final +permission. Accepted security-layer model v0.8 §§6/9.7 keeps one PDP, exact +binding/lifetimes and input-class revocation visibility. + +FLEX-DEC-2026-019 and `docs/application-access-readback.md` §§2/8 are exact: +`application.access` only means begin using an application and gives no rights +inside it; grants/revocations remain package and registry changes under normal +review; no grant/revoke surface is delivered to user-domain admins. User Engine +accepted this on 2026-10-09. FLEX-WP-0035 remains finished. + +## Split the remaining obligations without cloning tasks + +1. USER-WP-0026-T03 initial application discovery: actual signed-in human + account projection over the now-bound catalogue/readback is User-owned + integration acceptance with KeyCape human authentication. Attach real + human evidence when it exists. Do not wait for a new general Access grant API. +2. Ordinary authenticated catalogue management: User owns `application.register` + mutation, binding validation, audit/event transaction and deployment. Access + owes the matching supported check vocabulary and explicit policy/claims + admission. R1's genuine denial shows normal path needs restoration; exact + scope proposal and provider source/live verification remain outstanding. + Track that ask in FLEX-IN-0003, not a reopened FLEX35 or cloned User task. +3. U09 readback and T05 management are different acceptance goals. For T05, + first name the authoritative fact being changed: User application membership, + IAM group/role, tenant-role grant, or Access package/registry policy. Each + stays with its existing owner and remains subject to Access evaluation. + A request for a generic grant/revoke HTTP surface is new product design, + not an implicit unmet requirement of the delivered advisory readback. + Until that exact authority/scope choice is reviewed, Access owes no invented + endpoint. No unsupported self-entitlement admin surface should be exposed. +4. Revocation evidence must name the actual changed input class. KeyCape + claims change, package/registry activation and allow expiry are distinct. + Reuse `docs/decision-input-freshness.md`; do not claim that a local membership + deletion or logout revokes already-issued JWTs globally. Real scoped + mutation acceptance stays open in USER-WP-0028-T02 until owners select it. + +No open Access workplan implements ordinary User catalogue-management +admission. FLEX-WP-0009 is finished historical policy deployment, FLEX35 is +finished readback, FLEX36 is runtime rename, and FLEX31 is audit emission. +The fresh live obligor response intake FLEX-IN-0003 is necessary. It is bounded +to provider contract/source proposal, not whole User journeys or new standing +grants. The waiting plan is beneficiary; a local-only response case connects +it to that intake. Human login gates remain separate decision commitments. + +Reviewed independent verification SHA-256: `22af2db044ed510863f883b0836f1bedc5f95a69fb0c8f99f4bf9ce3bfd52a64`. + +## Source revision digests reviewed + +- `/home/worsch/access-engine/INTENT.md`: SHA-256 `f6c14f5f824fb86ac06368fb9c52e60d627ee42810817a45723d34a6a9a178a5`. +- `/home/worsch/access-engine/docs/application-access-readback.md`: SHA-256 `197f017207879f25996f886d70a76931e2aa7d3e3685a1ee9f3ebbfc2192e1c8`. +- `/home/worsch/access-engine/docs/decision-input-freshness.md`: SHA-256 `28c5d0d95d3a5f29c190e018305eb9931ee1d75525651e0275298dc7a1e2497c`. +- `/home/worsch/access-engine/values/user-engine.yaml`: SHA-256 `eece796adf96ba50f1b210b58377d96ad88b3f1d287bb9e5c5d7c22a4037f460`. +- `/home/worsch/access-engine/examples/user-engine/policy_package.md`: SHA-256 `d74e780fc694f1e4fe353d9c48c0d3464097b0665c6fdfdf1c884bfd0720ee7d`. +- `/home/worsch/net-kingdom/canon/standards/security-layer-model_v0.8.md`: SHA-256 `3d8298560069ef471fba28d2b1245fb2309328f231dad1a667cdf0ce5a5a7c8b`. +- `/home/worsch/net-kingdom/canon/standards/user-engine-boundary-contract_v0.1.md`: SHA-256 `ea49fb9d9301e441a91bfe91d3ee9b13f660b081be87b4c28dee2fa8c36c6f1a`. +- `/home/worsch/net-kingdom/canon/standards/iam-profile_v0.4.md`: SHA-256 `f43bb2dcfab63fb79a936ed8e04f7b7c2fc354c755df39ba73e3a994fdd98088`. +- `/home/worsch/user-engine/INTENT.md`: SHA-256 `8aa0f276e0879d3545338727188a1fd5af973c43acbfa986a135b20979ec7ba4`. diff --git a/intakes/intakes.md b/intakes/intakes.md index c3558c3..bd929c7 100644 --- a/intakes/intakes.md +++ b/intakes/intakes.md @@ -81,3 +81,41 @@ closed_at: '2026-08-29T00:42:14.888434Z' outcome: assented with findings — see FLEX-DEC-2026-002 state_hub_intake_id: "01a04afa-307b-7e9e-b210-261badabcec7" ``` + +## FLEX-IN-0003 — Ordinary User Engine catalogue authorization contract + +```yaml +id: FLEX-IN-0003 +kind: intake +title: Ordinary User Engine catalogue authorization contract +status: open +origin: cross-repo +origin_ref: USER-WP-0026-T03 +priority: high +owner: access-engine +requested_by: user-engine +created: "2026-10-11" +updated: "2026-10-11" +description: >- + Native one-app catalogue/readback is delivered under exact R1 approval + b859698b-5d08-4da5-9599-4760c6a799f1. Genuine ordinary application.register + denial remains. Return the supported User Engine application-management + resource/action/verified-claim contract and narrowly scoped policy proposal, + with source fixtures and exact runtime promotion/rollback candidate. State + which application/tenant actions and principal classes are admitted; do not + broaden self-service, grant maintenance identity human claims, or use + catalogue membership as entitlement. Clarify that any T05 grant/revoke + mutation changes its explicitly named owner fact under normal review, + not a new generic mutation endpoint from the finished FLEX-WP-0035 readback. + User Engine owns the protected write and broader signed-in acceptance. + Source response can proceed autonomously; exact live policy rollout retains + separate founder approval and real native negative/positive verification. +notes: + - content: >- + Existing provider readback contract and native R1 verification reviewed + under FLEX-WP-ADHOC-2026-10-11-T01. No open Access workplan covers this + distinct ordinary-management admission ask; FLEX35 is not reopened. + Prepare response coordination case, not a foreign implementation clone. + author: codex + created: "2026-10-11" +``` diff --git a/workplans/ADHOC-2026-10-11.md b/workplans/ADHOC-2026-10-11.md new file mode 100644 index 0000000..430c0b6 --- /dev/null +++ b/workplans/ADHOC-2026-10-11.md @@ -0,0 +1,32 @@ +--- +id: FLEX-WP-ADHOC-2026-10-11 +type: workplan +title: "Review application catalogue continuation ownership" +domain: infotech +repo: access-engine +status: finished +owner: codex +topic_slug: netkingdom +created: "2026-10-11" +updated: "2026-10-11" +--- + +## Review exact provider obligations after native one-app registration + +```task +id: FLEX-WP-ADHOC-2026-10-11-T01 +status: done +priority: high +``` + +Read Access/User INTENT, accepted security-layer model v0.8, IAM profile, +User boundary contract, FLEX-DEC-2026-019/readback contract and current +native R1 verification. Recorded the Access owner review in +`docs/reviews/2026-10-11-user-catalogue-continuation.md`. +No source authorization rule, runtime, credential or foreign task changed. + +The provider-specific outstanding ask is live in `FLEX-IN-0003` before this +review closes; User Engine retains USER-WP-0026-T03/USER-WP-0028-T02, +including real human projection and broader journey acceptance. +`docs/coordination/2026-10-11-user-catalogue-continuation.json` prepares the +response case with explicit local-only custody; it enables no worker wake.