coulomb/access-engine
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add an offline attribute-admission branch beside exact-record review.
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
Build and Publish Container Image / build-and-push (push) Successful in 59s
Details

Browse source 
Compact-sitting v8 can admit a new memo from carried class, submitter, and approval attributes, but shipped sets are empty and exact-record decisions stay on their pins. The sitting image pin is unchanged.

Assistant: grok
Assistant-Session: 01a10329-31cb-78d3-b7a3-788c2f91d6d4
This commit is contained in:
tegwick 2026-10-03 22:03:46 +02:00
parent d014453a1a
commit e85f511c4f
8 changed files with 1237 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

20
tools/exercise_sitting_review_policy.py
View file

@ -92,8 +92,12 @@ with tempfile.TemporaryDirectory() as temp:
# every act stays scoped to the act records, with the 900 s window.
list_only = json.loads((r / 'list_only_records.json').read_text())
listable = {k: dict(v, memo_version=1) for k, v in records.items()} | list_only
now = int(time.time())
for memo, record in listable.items():
# Sample the clock per check. A single `now` goes stale while each
# check reloads the package, and the 12h case has only 60s of slack.
def stamp():
return int(time.time())
request = {
'id': 'local-regression',
'tenant': 'tenant:platform',
@ -104,7 +108,7 @@ with tempfile.TemporaryDirectory() as temp:
'tenant_source': 'registration-supplied',
'principal_type_source': 'authentication-derived',
'assurance': {'level': 'aal2', 'mfa': True, 'methods': ['pwd', 'otp'],
'source': 'key-cape', 'at': now},
'source': 'key-cape', 'at': stamp()},
},
},
'resource': {'id': memo, 'type': 'decision-memo',
@ -125,14 +129,14 @@ with tempfile.TemporaryDirectory() as temp:
return c
at = ['subject', 'attributes', 'assurance', 'at']
check(label + ':fresh', request, 'allow')
check(label + ':fresh', variant(at, stamp()), 'allow')
# The observed production refusal: 1744 s, allowed for list...
check(label + ':observed-1744s', variant(at, now - 1744), 'allow')
check(label + ':inside-12h', variant(at, now - 43200 + 60), 'allow')
check(label + ':observed-1744s', variant(at, stamp() - 1744), 'allow')
check(label + ':inside-12h', variant(at, stamp() - 43200 + 60), 'allow')
# ...but the 12 h bound is real, and read does not follow list.
check(label + ':past-12h', variant(at, now - 43200 - 60), 'deny')
check(label + ':past-12h', variant(at, stamp() - 43200 - 60), 'deny')
is_act_record = memo in records
read_stale = variant(at, now - 1744) | {'action': 'read'}
read_stale = variant(at, stamp() - 1744) | {'action': 'read'}
check(label + ':read-stale-refused', read_stale, 'deny')
if not is_act_record:
# T03 records are listable only; no act widens to them, even fresh.
@ -143,7 +147,7 @@ with tempfile.TemporaryDirectory() as temp:
('no-group', ['subject', 'attributes', 'groups'], []),
('service', ['subject', 'type'], 'service'),
('agent', ['subject', 'type'], 'agent'),
('future-mfa', at, now + 300),
('future-mfa', at, stamp() + 300),
('no-mfa', ['subject', 'attributes', 'assurance', 'mfa'], False),
('aal1', ['subject', 'attributes', 'assurance', 'level'], 'aal1'),
('forged-human-route', ['subject', 'attributes', 'principal_type_source'], 'registration-supplied'),