Admit initial decision lifecycle audience and patch evaluator dependencies
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a10780-6d41-7952-9718-dfbc1f41236f
This commit is contained in:
parent
c0f3f25be2
commit
d2d0b6feeb
25 changed files with 2644 additions and 102 deletions
|
|
@ -0,0 +1,88 @@
|
|||
{
|
||||
"valid": true,
|
||||
"caring_findings": [
|
||||
{
|
||||
"code": "CARING-POLICY-MISSING-DIMENSION",
|
||||
"severity": "warning",
|
||||
"message": "policy package should declare governed canonical roles",
|
||||
"fields": [
|
||||
"caring.canonical_roles"
|
||||
]
|
||||
},
|
||||
{
|
||||
"code": "CARING-POLICY-MISSING-DIMENSION",
|
||||
"severity": "warning",
|
||||
"message": "policy package should declare governed organization relations",
|
||||
"fields": [
|
||||
"caring.organization_relations"
|
||||
]
|
||||
},
|
||||
{
|
||||
"code": "CARING-POLICY-MISSING-DIMENSION",
|
||||
"severity": "warning",
|
||||
"message": "policy package should declare governed scopes",
|
||||
"fields": [
|
||||
"caring.scopes"
|
||||
]
|
||||
},
|
||||
{
|
||||
"code": "CARING-POLICY-MISSING-DIMENSION",
|
||||
"severity": "warning",
|
||||
"message": "policy package should declare governed planes",
|
||||
"fields": [
|
||||
"caring.planes"
|
||||
]
|
||||
},
|
||||
{
|
||||
"code": "CARING-POLICY-MISSING-DIMENSION",
|
||||
"severity": "warning",
|
||||
"message": "policy package should declare governed capabilities",
|
||||
"fields": [
|
||||
"caring.capabilities"
|
||||
]
|
||||
},
|
||||
{
|
||||
"code": "CARING-POLICY-MISSING-DIMENSION",
|
||||
"severity": "warning",
|
||||
"message": "policy package should declare governed exposure modes",
|
||||
"fields": [
|
||||
"caring.exposure_modes"
|
||||
]
|
||||
},
|
||||
{
|
||||
"code": "CARING-POLICY-MISSING-DIMENSION",
|
||||
"severity": "warning",
|
||||
"message": "policy package should declare governed conditions",
|
||||
"fields": [
|
||||
"caring.conditions"
|
||||
]
|
||||
},
|
||||
{
|
||||
"code": "CARING-POLICY-MISSING-DIMENSION",
|
||||
"severity": "warning",
|
||||
"message": "policy package should declare governed restrictions",
|
||||
"fields": [
|
||||
"caring.restrictions"
|
||||
]
|
||||
}
|
||||
],
|
||||
"tests": [
|
||||
{
|
||||
"name": "test_empty_denied",
|
||||
"passed": true
|
||||
}
|
||||
],
|
||||
"fixtures": [
|
||||
{
|
||||
"id": "unknown-request-denied",
|
||||
"passed": true,
|
||||
"expected": {
|
||||
"effect": "deny"
|
||||
},
|
||||
"actual": {
|
||||
"effect": "deny",
|
||||
"reason": "lifecycle_scope_or_identity_refused"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
17
docs/evidence/2026-10-04-infd-lifecycle/policy-scan.json
Normal file
17
docs/evidence/2026-10-04-infd-lifecycle/policy-scan.json
Normal file
|
|
@ -0,0 +1,17 @@
|
|||
{
|
||||
"scanner": "aquasec/trivy@sha256:62b1e65e8869bc4b4c6aa4fa2b21595256c7c2f6018a9d9ad61caf87187c1969",
|
||||
"scanner_version": "0.74.0",
|
||||
"scanned_at": "2026-10-04T19:35:45.454792771Z",
|
||||
"artifact": "flex-auth:wp0007-candidate",
|
||||
"image_id": "sha256:f6ed8af69af766d7e9498465a23c292d91185b79352065736a2132216aac1d37",
|
||||
"severities": [
|
||||
"HIGH",
|
||||
"CRITICAL"
|
||||
],
|
||||
"vulnerabilities": 0,
|
||||
"full_report_sha256": "e41d19c961f0e0d3a4051362c6769edc3069b4286612239861818d403c16ee6a",
|
||||
"warnings": [
|
||||
"vendor severity selection"
|
||||
],
|
||||
"scope": "candidate artifact scan; not a general security attestation"
|
||||
}
|
||||
|
|
@ -0,0 +1,232 @@
|
|||
{
|
||||
"valid": true,
|
||||
"caring_findings": [
|
||||
{
|
||||
"code": "CARING-POLICY-MISSING-DIMENSION",
|
||||
"severity": "warning",
|
||||
"message": "policy package should declare governed canonical roles",
|
||||
"fields": [
|
||||
"caring.canonical_roles"
|
||||
]
|
||||
},
|
||||
{
|
||||
"code": "CARING-POLICY-MISSING-DIMENSION",
|
||||
"severity": "warning",
|
||||
"message": "policy package should declare governed organization relations",
|
||||
"fields": [
|
||||
"caring.organization_relations"
|
||||
]
|
||||
},
|
||||
{
|
||||
"code": "CARING-POLICY-MISSING-DIMENSION",
|
||||
"severity": "warning",
|
||||
"message": "policy package should declare governed scopes",
|
||||
"fields": [
|
||||
"caring.scopes"
|
||||
]
|
||||
},
|
||||
{
|
||||
"code": "CARING-POLICY-MISSING-DIMENSION",
|
||||
"severity": "warning",
|
||||
"message": "policy package should declare governed planes",
|
||||
"fields": [
|
||||
"caring.planes"
|
||||
]
|
||||
},
|
||||
{
|
||||
"code": "CARING-POLICY-MISSING-DIMENSION",
|
||||
"severity": "warning",
|
||||
"message": "policy package should declare governed capabilities",
|
||||
"fields": [
|
||||
"caring.capabilities"
|
||||
]
|
||||
},
|
||||
{
|
||||
"code": "CARING-POLICY-MISSING-DIMENSION",
|
||||
"severity": "warning",
|
||||
"message": "policy package should declare governed exposure modes",
|
||||
"fields": [
|
||||
"caring.exposure_modes"
|
||||
]
|
||||
},
|
||||
{
|
||||
"code": "CARING-POLICY-MISSING-DIMENSION",
|
||||
"severity": "warning",
|
||||
"message": "policy package should declare governed conditions",
|
||||
"fields": [
|
||||
"caring.conditions"
|
||||
]
|
||||
},
|
||||
{
|
||||
"code": "CARING-POLICY-MISSING-DIMENSION",
|
||||
"severity": "warning",
|
||||
"message": "policy package should declare governed restrictions",
|
||||
"fields": [
|
||||
"caring.restrictions"
|
||||
]
|
||||
}
|
||||
],
|
||||
"tests": [
|
||||
{
|
||||
"name": "test_allow_does_not_prove_the_pin",
|
||||
"passed": true
|
||||
},
|
||||
{
|
||||
"name": "test_approval_id_malformed",
|
||||
"passed": true
|
||||
},
|
||||
{
|
||||
"name": "test_attribute_acts_are_eligible_only_when_sets_admit",
|
||||
"passed": true
|
||||
},
|
||||
{
|
||||
"name": "test_bad_memo_id_refused",
|
||||
"passed": true
|
||||
},
|
||||
{
|
||||
"name": "test_digest_mismatch",
|
||||
"passed": true
|
||||
},
|
||||
{
|
||||
"name": "test_exact_pin_mismatch_is_not_rescued",
|
||||
"passed": true
|
||||
},
|
||||
{
|
||||
"name": "test_exact_record_ignores_attribute_context",
|
||||
"passed": true
|
||||
},
|
||||
{
|
||||
"name": "test_future_mfa_is_identity_refused",
|
||||
"passed": true
|
||||
},
|
||||
{
|
||||
"name": "test_human_control_false",
|
||||
"passed": true
|
||||
},
|
||||
{
|
||||
"name": "test_initial_release_allows_only_decision_record_class",
|
||||
"passed": true
|
||||
},
|
||||
{
|
||||
"name": "test_initial_release_sets",
|
||||
"passed": true
|
||||
},
|
||||
{
|
||||
"name": "test_list_does_not_use_attribute_admission",
|
||||
"passed": true
|
||||
},
|
||||
{
|
||||
"name": "test_listable_is_exact_union",
|
||||
"passed": true
|
||||
},
|
||||
{
|
||||
"name": "test_memo_review_group_is_not_hardcoded",
|
||||
"passed": true
|
||||
},
|
||||
{
|
||||
"name": "test_memo_version_refused",
|
||||
"passed": true
|
||||
},
|
||||
{
|
||||
"name": "test_requester_mismatch",
|
||||
"passed": true
|
||||
},
|
||||
{
|
||||
"name": "test_review_group_must_be_verified",
|
||||
"passed": true
|
||||
},
|
||||
{
|
||||
"name": "test_service_subject_is_identity_refused",
|
||||
"passed": true
|
||||
},
|
||||
{
|
||||
"name": "test_six_exact_metered_memos_allow_human_review",
|
||||
"passed": true
|
||||
},
|
||||
{
|
||||
"name": "test_stale_mfa_on_attribute_branch",
|
||||
"passed": true
|
||||
},
|
||||
{
|
||||
"name": "test_t03_records_not_in_act_scope",
|
||||
"passed": true
|
||||
},
|
||||
{
|
||||
"name": "test_tool_proof_exact_record_allowed",
|
||||
"passed": true
|
||||
},
|
||||
{
|
||||
"name": "test_tool_proof_without_mfa_denied",
|
||||
"passed": true
|
||||
},
|
||||
{
|
||||
"name": "test_tool_proof_wrong_digest_denied",
|
||||
"passed": true
|
||||
},
|
||||
{
|
||||
"name": "test_tool_proof_wrong_native_id_denied",
|
||||
"passed": true
|
||||
},
|
||||
{
|
||||
"name": "test_unknown_class",
|
||||
"passed": true
|
||||
},
|
||||
{
|
||||
"name": "test_unknown_request_denied",
|
||||
"passed": true
|
||||
},
|
||||
{
|
||||
"name": "test_unknown_submitter",
|
||||
"passed": true
|
||||
}
|
||||
],
|
||||
"fixtures": [
|
||||
{
|
||||
"id": "unknown-request-denied",
|
||||
"passed": true,
|
||||
"expected": {
|
||||
"effect": "deny"
|
||||
},
|
||||
"actual": {
|
||||
"effect": "deny",
|
||||
"reason": "compact_sitting_scope_or_identity_refused"
|
||||
}
|
||||
},
|
||||
{
|
||||
"id": "attribute-non-human-refused",
|
||||
"passed": true,
|
||||
"expected": {
|
||||
"effect": "deny",
|
||||
"reason": "identity_refused"
|
||||
},
|
||||
"actual": {
|
||||
"effect": "deny",
|
||||
"reason": "identity_refused"
|
||||
}
|
||||
},
|
||||
{
|
||||
"id": "attribute-stale-mfa",
|
||||
"passed": true,
|
||||
"expected": {
|
||||
"effect": "deny",
|
||||
"reason": "stale_mfa"
|
||||
},
|
||||
"actual": {
|
||||
"effect": "deny",
|
||||
"reason": "stale_mfa"
|
||||
}
|
||||
},
|
||||
{
|
||||
"id": "attribute-future-mfa",
|
||||
"passed": true,
|
||||
"expected": {
|
||||
"effect": "deny",
|
||||
"reason": "identity_refused"
|
||||
},
|
||||
"actual": {
|
||||
"effect": "deny",
|
||||
"reason": "identity_refused"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue