coulomb/access-engine
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Admit p01 delivery-proof review in compact sitting v7 (INFD-WP-ADHOC-2026-10-03)
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details
Build and Publish Container Image / build-and-push (push) Successful in 53s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a1029c-c003-7283-acc9-930b434e6cae
This commit is contained in:
tegwick 2026-10-03 19:46:30 +02:00
parent 2372a6fe0d
commit f946c7b709
2 changed files with 27 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

11
examples/informed-decision-sitting/policy.md
View file

@ -2,7 +2,7 @@
id: informed-decision.compact-sitting id: informed-decision.compact-sitting
name: Compact sitting exact-record human review name: Compact sitting exact-record human review
namespace: informed-decision:decision-memo namespace: informed-decision:decision-memo
version: v6 version: v7
status: ready status: ready
package: flexauth.informed_decision.compact_sitting package: flexauth.informed_decision.compact_sitting
allow_ttl: 30s allow_ttl: 30s
@ -59,6 +59,11 @@ credential requests, apply/verify/exec per provider and worker lane. All acts
still require the authenticated human and fresh MFA. Ordinary worker approvals still require the authenticated human and fresh MFA. Ordinary worker approvals
retain their native control type and require exact-ID consumer configuration. retain their native control type and require exact-ID consumer configuration.
v7 (2026-10-03, INFD-WP-ADHOC-2026-10-03-T02) adds the exact
`memo:infd-20261003-p01` delivery-proof acceptance record. Native pins come
from informed-decision `docs/evidence/2026-10-03-provisioning-window-approval-create.json`.
Existing records and identity requirements are preserved.
The identity bar matches T03: authenticated informed-decision caller, The identity bar matches T03: authenticated informed-decision caller,
`net-kingdom-admins`, fresh KeyCape AAL2 MFA. No permission follows from `net-kingdom-admins`, fresh KeyCape AAL2 MFA. No permission follows from
memo content or presentation state. TokenReview must admit memo content or presentation state. TokenReview must admit
@ -72,6 +77,10 @@ approval. Native pins: `docs/evidence/2026-09-15-sitting-approval-creates.json`.
import rego.v1 import rego.v1
records := { records := {
"memo:infd-20261003-p01": {
"approval_id": "706f4205-aaa7-44f6-be30-d0f57664d69c",
"binding_digest": "sha256:c8a1a9c8fb22616e3aacfb877ba7974feb5eedaed491f856a6c90719c502ebe4"
},
"memo:infd-20260914-c02": { "memo:infd-20260914-c02": {
"approval_id": "ccfd8007-2061-48fd-9356-99b16279dac1", "approval_id": "ccfd8007-2061-48fd-9356-99b16279dac1",
"binding_digest": "sha256:942cf7d5e6805987df2077a0cc6cde75b148e1729a96dd0692153287820b6a0a" "binding_digest": "sha256:942cf7d5e6805987df2077a0cc6cde75b148e1729a96dd0692153287820b6a0a"

17
examples/informed-decision-sitting/records.json
View file

@ -338,5 +338,22 @@
} }
}, },
"memo_version": 1 "memo_version": 1
},
"memo:infd-20261003-p01": {
"approval_id": "706f4205-aaa7-44f6-be30-d0f57664d69c",
"binding_digest": "sha256:c8a1a9c8fb22616e3aacfb877ba7974feb5eedaed491f856a6c90719c502ebe4",
"label": "p01",
"binding": {
"action": "accept",
"actor": "informed-decision",
"principal": "railiance-platform",
"purpose": "Accept the 2026-09-13 scoped delivery proof for the CCR-2026-0019 secrets-engine approval-client reader",
"target": {
"id": "ccr:CCR-2026-0019-delivery-proof",
"type": "credential-lane",
"system": "railiance-platform"
}
},
"memo_version": 1
} }
} }