tegwick
8f2ba75e4a
Contract accepted by user-engine; FLEX-DEC-2026-019 accepted. - serve-readback: dedicated pin, no enforcement routes, own caller binding - CheckRequest.purpose hashed into every digest when set; /v1/check refuses it - POST /v1/readback/application_access and GET /v1/readback/systems - optional client_binding on protected systems; readback schemas - schemaguard implements maxItems - T05 added: informed-decision needs an application.access rule over realm-level claims (its lifecycle rules read authentication_audience) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 609675@bnt-lap001 Assistant-Session: 4987a36e-eb38-4b10-803c-15a29cd78212
86 lines
1.9 KiB
JSON
86 lines
1.9 KiB
JSON
{
|
|
"$schema": "https://json-schema.org/draft/2020-12/schema",
|
|
"$id": "https://flex-auth.netkingdom/schemas/readback_response.schema.json",
|
|
"title": "ReadbackResponse",
|
|
"description": "Advisory: no row is an enforcement decision. One row per requested system, in request order; none omitted.",
|
|
"type": "object",
|
|
"additionalProperties": false,
|
|
"required": [
|
|
"registry_snapshot_digest",
|
|
"results"
|
|
],
|
|
"properties": {
|
|
"registry_snapshot_digest": {
|
|
"type": "string",
|
|
"pattern": "^sha256:[0-9a-f]{64}$"
|
|
},
|
|
"results": {
|
|
"type": "array",
|
|
"items": {
|
|
"$ref": "#/$defs/result"
|
|
}
|
|
}
|
|
},
|
|
"$defs": {
|
|
"result": {
|
|
"type": "object",
|
|
"additionalProperties": false,
|
|
"required": [
|
|
"system",
|
|
"effect"
|
|
],
|
|
"properties": {
|
|
"system": {
|
|
"type": "string",
|
|
"minLength": 1
|
|
},
|
|
"effect": {
|
|
"enum": [
|
|
"allow",
|
|
"deny",
|
|
"not_applicable"
|
|
]
|
|
},
|
|
"reason": {
|
|
"type": "string"
|
|
},
|
|
"decision_id": {
|
|
"type": "string"
|
|
},
|
|
"lifetime": {
|
|
"type": "object",
|
|
"required": [
|
|
"kind",
|
|
"expires_at"
|
|
],
|
|
"properties": {
|
|
"kind": {
|
|
"type": "string"
|
|
},
|
|
"ttl": {
|
|
"type": "string"
|
|
},
|
|
"not_before": {
|
|
"type": "string"
|
|
},
|
|
"expires_at": {
|
|
"type": "string"
|
|
}
|
|
}
|
|
},
|
|
"revocation_visibility": {
|
|
"type": "object",
|
|
"additionalProperties": {
|
|
"type": "string"
|
|
}
|
|
},
|
|
"policy_package": {
|
|
"type": "string"
|
|
},
|
|
"policy_package_digest": {
|
|
"type": "string"
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|