Clarify catalogue owner obligations and retain ordinary admission response
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade
This commit is contained in:
parent
22185e94ec
commit
c829e53030
4 changed files with 234 additions and 0 deletions
|
|
@ -0,0 +1,77 @@
|
|||
{
|
||||
"id": "case:cross-owner:user-engine:USER-WP-0026-T03:access-engine:FLEX-IN-0003",
|
||||
"purpose": "Finish the existing signed-in one-app catalogue/readback acceptance and obtain supported ordinary catalogue-management authorization",
|
||||
"scenario_type": "cross_owner_wait",
|
||||
"goal": {
|
||||
"result_type": "completion",
|
||||
"target_population": "named_participants",
|
||||
"required_outcome": "Access returns ordinary application.register contract/source proposal; User verifies actual signed-in projection and selects any separate T05 application-fact mutation scope",
|
||||
"required_evidence_level": "high",
|
||||
"partial_success_rules": [],
|
||||
"failure_rules": []
|
||||
},
|
||||
"state": "active",
|
||||
"created_at": "2026-10-11T00:00:00Z",
|
||||
"deadlines": [],
|
||||
"beneficiary_workplan_id": "USER-WP-0026",
|
||||
"beneficiary_task_id": "USER-WP-0026-T03",
|
||||
"driver_repo": null,
|
||||
"driver_workplan_id": null,
|
||||
"participants": [
|
||||
{
|
||||
"id": "access-engine",
|
||||
"roles": [
|
||||
"implementer"
|
||||
]
|
||||
},
|
||||
{
|
||||
"id": "user-engine",
|
||||
"roles": [
|
||||
"implementer"
|
||||
]
|
||||
},
|
||||
{
|
||||
"id": "the-custodian",
|
||||
"roles": [
|
||||
"observer"
|
||||
]
|
||||
}
|
||||
],
|
||||
"commitments": [
|
||||
{
|
||||
"id": "case:cross-owner:user-engine:USER-WP-0026-T03:access-engine:FLEX-IN-0003:provider-response",
|
||||
"case_id": "case:cross-owner:user-engine:USER-WP-0026-T03:access-engine:FLEX-IN-0003",
|
||||
"kind": "response",
|
||||
"obligor": "access-engine",
|
||||
"beneficiary": "user-engine",
|
||||
"subject_ref": "repo:access-engine/intakes/intakes.md#FLEX-IN-0003",
|
||||
"required_evidence_level": "high",
|
||||
"state": "proposed",
|
||||
"satisfaction_predicate": "Provider contract/source response names supported exact User application.register actions, policy/verified-claim admission and promotion/rollback proposal; generic grant API is not implied."
|
||||
}
|
||||
],
|
||||
"observations": [
|
||||
{
|
||||
"subject_ref": "FLEX-WP-0035",
|
||||
"observed_state": "finished",
|
||||
"meaning": "Producer readback complete, not new obligation"
|
||||
},
|
||||
{
|
||||
"subject_ref": "approval:b859698b-5d08-4da5-9599-4760c6a799f1",
|
||||
"observed_state": "applied-and-independently-verified",
|
||||
"meaning": "One-app catalogue facts delivered, ordinary PDP path still denies; no human projection proof"
|
||||
}
|
||||
],
|
||||
"receipt": {
|
||||
"scenario_type": "cross_owner_wait",
|
||||
"case_id": "case:cross-owner:user-engine:USER-WP-0026-T03:access-engine:FLEX-IN-0003",
|
||||
"state": "waiting",
|
||||
"reason": "Provider ordinary-management response proposed in FLEX-IN-0003; genuine human projection and any T05 scope choice remain separate",
|
||||
"beneficiary_workplan_id": "USER-WP-0026",
|
||||
"obligor_record_id": "FLEX-IN-0003",
|
||||
"obligor_record_kind": "intake",
|
||||
"central_publication": "not_submitted",
|
||||
"worker_wake_enabled": false
|
||||
},
|
||||
"projection_note": "Core v0.1 response commitment uses subject_ref to intake; no intake-as-obligor_workplan_id. Publish metadata via progress coordination_receipt, never a fake workplan dependency."
|
||||
}
|
||||
87
docs/reviews/2026-10-11-user-catalogue-continuation.md
Normal file
87
docs/reviews/2026-10-11-user-catalogue-continuation.md
Normal file
|
|
@ -0,0 +1,87 @@
|
|||
# Access owner review: application catalogue continuation
|
||||
|
||||
reviewer: access-engine-owner (agent access-engine, codex)
|
||||
decision: changes_requested
|
||||
work_item: FLEX-WP-ADHOC-2026-10-11-T01
|
||||
reviewed: 2026-10-11
|
||||
|
||||
The changes requested concern the ownership/dependency wording, not reversal
|
||||
of the founder's exact R1 catalogue decision. This review authorizes no live
|
||||
change, grants no permission and makes no human identity claim.
|
||||
|
||||
## Exact evidence and boundary
|
||||
|
||||
Native R1 approval b859698b-5d08-4da5-9599-4760c6a799f1 committed the
|
||||
informed-decision Application and its client/protected-system binding.
|
||||
Independent verification confirms two facts, exact consumed ledger, genuine
|
||||
ordinary PDP denial, three maintenance-SERVICE audits and one undelivered
|
||||
registered event. Actual signed-in human projection and downstream delivery
|
||||
are explicitly not verified. SERVICE/synthetic checks are not human login.
|
||||
|
||||
Access INTENT Responsibility Boundary gives Access exclusive evaluation,
|
||||
protected-system/action registry and policy-package lifecycle. Policy content
|
||||
remains authored by the protected system owner under that mechanism and
|
||||
Gate House doctrine. It does not make Access the owner of every user/tenant
|
||||
membership or identity-provider grant fact.
|
||||
|
||||
Accepted User boundary contract v0.1 §§Ownership/Boundary and Membership
|
||||
Synchronization: product memberships are User-owned unless an explicit import
|
||||
contract says otherwise; fine-grained roles/scopes/policies are Access-owned;
|
||||
IAM owns coarse roles/groups. A flex_auth_export remains a source fact, not a
|
||||
transfer of membership custody. IAM claims are identity facts, not final
|
||||
permission. Accepted security-layer model v0.8 §§6/9.7 keeps one PDP, exact
|
||||
binding/lifetimes and input-class revocation visibility.
|
||||
|
||||
FLEX-DEC-2026-019 and `docs/application-access-readback.md` §§2/8 are exact:
|
||||
`application.access` only means begin using an application and gives no rights
|
||||
inside it; grants/revocations remain package and registry changes under normal
|
||||
review; no grant/revoke surface is delivered to user-domain admins. User Engine
|
||||
accepted this on 2026-10-09. FLEX-WP-0035 remains finished.
|
||||
|
||||
## Split the remaining obligations without cloning tasks
|
||||
|
||||
1. USER-WP-0026-T03 initial application discovery: actual signed-in human
|
||||
account projection over the now-bound catalogue/readback is User-owned
|
||||
integration acceptance with KeyCape human authentication. Attach real
|
||||
human evidence when it exists. Do not wait for a new general Access grant API.
|
||||
2. Ordinary authenticated catalogue management: User owns `application.register`
|
||||
mutation, binding validation, audit/event transaction and deployment. Access
|
||||
owes the matching supported check vocabulary and explicit policy/claims
|
||||
admission. R1's genuine denial shows normal path needs restoration; exact
|
||||
scope proposal and provider source/live verification remain outstanding.
|
||||
Track that ask in FLEX-IN-0003, not a reopened FLEX35 or cloned User task.
|
||||
3. U09 readback and T05 management are different acceptance goals. For T05,
|
||||
first name the authoritative fact being changed: User application membership,
|
||||
IAM group/role, tenant-role grant, or Access package/registry policy. Each
|
||||
stays with its existing owner and remains subject to Access evaluation.
|
||||
A request for a generic grant/revoke HTTP surface is new product design,
|
||||
not an implicit unmet requirement of the delivered advisory readback.
|
||||
Until that exact authority/scope choice is reviewed, Access owes no invented
|
||||
endpoint. No unsupported self-entitlement admin surface should be exposed.
|
||||
4. Revocation evidence must name the actual changed input class. KeyCape
|
||||
claims change, package/registry activation and allow expiry are distinct.
|
||||
Reuse `docs/decision-input-freshness.md`; do not claim that a local membership
|
||||
deletion or logout revokes already-issued JWTs globally. Real scoped
|
||||
mutation acceptance stays open in USER-WP-0028-T02 until owners select it.
|
||||
|
||||
No open Access workplan implements ordinary User catalogue-management
|
||||
admission. FLEX-WP-0009 is finished historical policy deployment, FLEX35 is
|
||||
finished readback, FLEX36 is runtime rename, and FLEX31 is audit emission.
|
||||
The fresh live obligor response intake FLEX-IN-0003 is necessary. It is bounded
|
||||
to provider contract/source proposal, not whole User journeys or new standing
|
||||
grants. The waiting plan is beneficiary; a local-only response case connects
|
||||
it to that intake. Human login gates remain separate decision commitments.
|
||||
|
||||
Reviewed independent verification SHA-256: `22af2db044ed510863f883b0836f1bedc5f95a69fb0c8f99f4bf9ce3bfd52a64`.
|
||||
|
||||
## Source revision digests reviewed
|
||||
|
||||
- `/home/worsch/access-engine/INTENT.md`: SHA-256 `f6c14f5f824fb86ac06368fb9c52e60d627ee42810817a45723d34a6a9a178a5`.
|
||||
- `/home/worsch/access-engine/docs/application-access-readback.md`: SHA-256 `197f017207879f25996f886d70a76931e2aa7d3e3685a1ee9f3ebbfc2192e1c8`.
|
||||
- `/home/worsch/access-engine/docs/decision-input-freshness.md`: SHA-256 `28c5d0d95d3a5f29c190e018305eb9931ee1d75525651e0275298dc7a1e2497c`.
|
||||
- `/home/worsch/access-engine/values/user-engine.yaml`: SHA-256 `eece796adf96ba50f1b210b58377d96ad88b3f1d287bb9e5c5d7c22a4037f460`.
|
||||
- `/home/worsch/access-engine/examples/user-engine/policy_package.md`: SHA-256 `d74e780fc694f1e4fe353d9c48c0d3464097b0665c6fdfdf1c884bfd0720ee7d`.
|
||||
- `/home/worsch/net-kingdom/canon/standards/security-layer-model_v0.8.md`: SHA-256 `3d8298560069ef471fba28d2b1245fb2309328f231dad1a667cdf0ce5a5a7c8b`.
|
||||
- `/home/worsch/net-kingdom/canon/standards/user-engine-boundary-contract_v0.1.md`: SHA-256 `ea49fb9d9301e441a91bfe91d3ee9b13f660b081be87b4c28dee2fa8c36c6f1a`.
|
||||
- `/home/worsch/net-kingdom/canon/standards/iam-profile_v0.4.md`: SHA-256 `f43bb2dcfab63fb79a936ed8e04f7b7c2fc354c755df39ba73e3a994fdd98088`.
|
||||
- `/home/worsch/user-engine/INTENT.md`: SHA-256 `8aa0f276e0879d3545338727188a1fd5af973c43acbfa986a135b20979ec7ba4`.
|
||||
Loading…
Add table
Add a link
Reference in a new issue