tegwick
8f2ba75e4a
Contract accepted by user-engine; FLEX-DEC-2026-019 accepted. - serve-readback: dedicated pin, no enforcement routes, own caller binding - CheckRequest.purpose hashed into every digest when set; /v1/check refuses it - POST /v1/readback/application_access and GET /v1/readback/systems - optional client_binding on protected systems; readback schemas - schemaguard implements maxItems - T05 added: informed-decision needs an application.access rule over realm-level claims (its lifecycle rules read authentication_audience) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 609675@bnt-lap001 Assistant-Session: 4987a36e-eb38-4b10-803c-15a29cd78212
79 lines
2.8 KiB
JSON
79 lines
2.8 KiB
JSON
{
|
|
"$schema": "https://json-schema.org/draft/2020-12/schema",
|
|
"$id": "https://flex-auth.netkingdom/schemas/protected_system_manifest.schema.json",
|
|
"title": "ProtectedSystemManifest",
|
|
"type": "object",
|
|
"additionalProperties": false,
|
|
"required": ["id"],
|
|
"properties": {
|
|
"id": {"type": "string", "minLength": 1},
|
|
"name": {"type": "string", "minLength": 1},
|
|
"description": {"type": "string"},
|
|
"client_binding": {
|
|
"type": "object",
|
|
"additionalProperties": false,
|
|
"required": ["issuer", "client_id"],
|
|
"description": "key-cape client this system's users sign in through; descriptive only, never decides an allow (FLEX-DEC-2026-019).",
|
|
"properties": {
|
|
"issuer": {"type": "string", "minLength": 1},
|
|
"client_id": {"type": "string", "minLength": 1}
|
|
}
|
|
},
|
|
"resource_types": {
|
|
"type": "array",
|
|
"items": {"$ref": "#/$defs/resource_type"}
|
|
},
|
|
"actions": {
|
|
"type": "array",
|
|
"items": {"$ref": "#/$defs/action"}
|
|
},
|
|
"caring_profiles": {
|
|
"type": "array",
|
|
"items": {"const": "caring-0.4.0-rc2"},
|
|
"uniqueItems": true
|
|
},
|
|
"metadata": {"type": "object", "additionalProperties": true}
|
|
},
|
|
"$defs": {
|
|
"resource_type": {
|
|
"type": "object",
|
|
"additionalProperties": false,
|
|
"required": ["name"],
|
|
"properties": {
|
|
"name": {"type": "string", "minLength": 1},
|
|
"parent_types": {"type": "array", "items": {"type": "string", "minLength": 1}},
|
|
"scope_level": {"$ref": "https://flex-auth.netkingdom/schemas/caring_access_descriptor.schema.json#/$defs/scope_level"},
|
|
"planes": {
|
|
"type": "array",
|
|
"items": {"$ref": "https://flex-auth.netkingdom/schemas/caring_access_descriptor.schema.json#/$defs/plane"},
|
|
"uniqueItems": true
|
|
},
|
|
"metadata": {"type": "object", "additionalProperties": true}
|
|
}
|
|
},
|
|
"action": {
|
|
"type": "object",
|
|
"additionalProperties": false,
|
|
"required": ["name"],
|
|
"properties": {
|
|
"name": {"type": "string", "minLength": 1},
|
|
"capabilities": {
|
|
"type": "array",
|
|
"items": {"$ref": "https://flex-auth.netkingdom/schemas/caring_access_descriptor.schema.json#/$defs/capability"},
|
|
"uniqueItems": true
|
|
},
|
|
"planes": {
|
|
"type": "array",
|
|
"items": {"$ref": "https://flex-auth.netkingdom/schemas/caring_access_descriptor.schema.json#/$defs/plane"},
|
|
"uniqueItems": true
|
|
},
|
|
"exposure_modes": {
|
|
"type": "array",
|
|
"items": {"$ref": "https://flex-auth.netkingdom/schemas/caring_access_descriptor.schema.json#/$defs/exposure_mode"},
|
|
"uniqueItems": true
|
|
},
|
|
"metadata": {"type": "object", "additionalProperties": true}
|
|
}
|
|
}
|
|
}
|
|
}
|