tegwick
3cb1cfaedf
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a1046e-fcad-7ea3-bf36-361fc8d679e8
105 lines
6.6 KiB
Markdown
105 lines
6.6 KiB
Markdown
# Security Layer Model — flex-auth conformance record
|
|
|
|
> **Derived artifact** (§11). Derives from
|
|
> `net-kingdom/canon/standards/security-layer-model_v0.8.md`
|
|
> (`status: proposed`, `source_revision: gate-house@516ed4e`).
|
|
> Derived at: **2026-09-21**. Maintained by `flex-auth`.
|
|
|
|
This file exists because `INTENT.md` deliberately does not carry one. The layer
|
|
declaration states a **boundary** — flex-auth is Engine / PDP — and a boundary
|
|
does not change when the standard text is amended. Conformance state does change,
|
|
every revision, and belongs in an artifact that is expected to move and that
|
|
carries the version it was derived at.
|
|
|
|
The split is the standard's own. Its frontmatter: *"`assented_by` records assent
|
|
to a BOUNDARY, given at the version named. It is not assent to the current text."*
|
|
|
|
## Declaration
|
|
|
|
| Field | Value |
|
|
| --- | --- |
|
|
| Layer | `Engine` |
|
|
| Role | `PDP` — the estate's only policy decision point (§6) |
|
|
| Declared at | 2026-08-29 |
|
|
| Declared by | `FLEX-DEC-2026-001`, `FLEX-DEC-2026-002`, `FLEX-DEC-2026-003` |
|
|
| PEP stance | `null` — not PEP-shaped; flex-auth renders decisions and causes no protected side effect |
|
|
| Tooling contacts | none — §5 binds Staff; flex-auth holds no Tooling client |
|
|
|
|
## Assent history
|
|
|
|
Assent is to the boundary, recorded at the version where it was given.
|
|
|
|
| Version | Record | Outcome |
|
|
| --- | --- | --- |
|
|
| v0.4 | `FLEX-DEC-2026-002` | §9.3 contested and upheld |
|
|
| v0.6 | `FLEX-DEC-2026-003` | review; §6.4.2, §9.7.2, §17 adopted into v0.7 |
|
|
| v0.7 | — | four flex-auth findings adopted |
|
|
| v0.8 (`proposed`) | `FLEX-DEC-2026-011` | assent with four findings, all adopted |
|
|
|
|
## Conformance state at v0.8
|
|
|
|
**Scope of this record:** one repository, `flex-auth`, which is the §4 row
|
|
`access-engine`. §11 binds §4 and flex-auth is in it, so this is an in-scope
|
|
record. Stated because a run MUST state its scope (A11, `GH-DEC-2026-017` §4).
|
|
|
|
**Not conforming on §11, held as a declared gap.** `GH-DEC-2026-018` ruled that
|
|
flex-auth is a §4 source of evidence for the decision record and owes an
|
|
emission guarantee it did not declare. Recorded in those words, as gate-house
|
|
wrote them: flex-auth asked for the unflattering reading, and softening it here
|
|
would make the register useless for whoever is next.
|
|
|
|
§11's four states: conforming, blocked-clean, declared gap, undeclared
|
|
violation. flex-auth claims no blocked-clean capability and holds no undeclared
|
|
violation it is aware of. Everything below is a declared gap: owner, blocker,
|
|
review date.
|
|
|
|
| # | Gap | Owner | Blocked on | Review |
|
|
| --- | --- | --- | --- | --- |
|
|
| G1 | Registry-snapshot digest absent from decision provenance. §9.7.2 promotes it to a conformance prerequisite: a decision that turned on registry content must be replayable from its own record. | `flex-auth` | implementation | `FLEX-WP-0019` |
|
|
| G2 | **Emission guarantee declared, not delivered.** Ruled 2026-09-21 (`GH-DEC-2026-018`): flex-auth is the source; custody is never source; `audit-core` confirmed its half and declined the role (`AUDIT-IN-0005`). The per-event-class inventory and classification are **published** in [`cadence.yaml`](../../cadence.yaml) and named from `INTENT.md` (`source_of_evidence: true`, `emission_guarantee`). Five decision classes are load-bearing; `deny`, `redact`, `not_applicable`, `audit_only` are **rare** — heartbeat **and** reconciliation, rate monitoring forbidden; `allow` is **volume** — expected-rate **and** reconciliation. No production pin emits yet. Durable outbox, per-class heartbeat/drain and optional PVC are implemented and locally tested; sender admission, compatible reconciliation windows and native observer evidence remain pending. | `flex-auth` | audit-core `AUDIT-IN-0006` admission/token delivery, gate-house `GH-WP-0004-T12` ruling, compatible count windows and approved native heartbeat/reconciliation/silence-finding evidence — `FLEX-WP-0031` | **2026-10-19** |
|
|
| G3 | Published stance-register review is stale: written at two register rows, §13.1 now carries five, and its Finding 1 was ruled by v0.8 §6.4 obligation 3. | `flex-auth` | second edition | `FLEX-WP-0029` |
|
|
|
|
**G2 fails closed.** A stream with no delivered cadence produces no silence
|
|
finding, so the failure on its distinguishing case is a **missed detection**,
|
|
never a manufactured permission (A-17, §9.6's §8-asymmetry). That is why it can
|
|
be held as a gap rather than being a permission. It is still non-conformance,
|
|
tracked, and it is not closed by the classification being published: a
|
|
declaration of a guarantee nobody delivers is the §9.1 defect this standard
|
|
keeps correcting.
|
|
|
|
**What the classification is.** flex-auth's, published as §11 requires the
|
|
source to publish it. `GH-DEC-2026-018` §4 declined to classify on flex-auth's
|
|
behalf because §11 forbids inferring class from event name, payload or observed
|
|
rate, and that binds a ruling as hard as a runner. A conformance run is supplied
|
|
this inventory and must not derive it.
|
|
|
|
**Atomicity is pending, not waived.** Whether decision-record emission must be
|
|
atomic with the decision (§9.4) was expressly left open by `GH-DEC-2026-018`
|
|
pending this inventory. It now exists; the question goes to `FLEX-WP-0031`.
|
|
|
|
## Not gaps
|
|
|
|
- **No standard version in `INTENT.md`.** Deliberate, enforced by test
|
|
(`internal/layer`), and raised to `gate-house` as `FLEX-WP-0030` B4 in case §11
|
|
should say so generally.
|
|
- **Canon says `access-engine`, the repository answers to `flex-auth`.** The
|
|
rename is ruled (`FLEX-DEC-2026-013`) and sequenced (`FLEX-WP-0020`); the
|
|
coordinate is pending, not broken. Raised as B5.
|
|
|
|
## How this file is kept true
|
|
|
|
`internal/layer` asserts that `INTENT.md` carries no `standard_version`, names
|
|
a `conformance_record` that exists on disk, states `source_of_evidence`, and —
|
|
because it is `true` — names an `emission_guarantee` that exists on disk and
|
|
classifies every event class, with every rare load-bearing class carrying
|
|
heartbeat and reconciliation and forbidding rate monitoring. That is the same property flex-auth
|
|
praised in `ops-warden`'s stance map: the published artifact is asserted equal to
|
|
the shipped one by test, rather than merely written down. It does **not** assert
|
|
the contents below the declaration — a reviewer still has to read this file.
|
|
|
|
2026-10-04 implementation review: source-owned
|
|
`docs/contracts/decision-emission-cadence.json` passes the supplied InfoTechCanon
|
|
schema and NetKingdom security profile. This is declaration validity, not native
|
|
emission evidence. `FLEX-DEC-2026-018` supplies the local release rule;
|
|
`GH-WP-0004-T12` still owes the statutory disposition of its failure-path
|
|
exception. G2 remains open and no atomicity waiver is inferred.
|