approval-engine/docs/evidence/2026-09-10-human-control.json

48 lines
1.8 KiB
JSON
Raw Normal View History

{
"status": "source-tests-passed",
"ruling": "GH-DEC-2026-016",
"schema_version": 5,
"new_cases_failed_before": 22,
"new_cases_passed_after": 22,
"full_suite_passed": 152,
"tests": "tests/test_human_control.py",
"semantics": {
"create": "Records declared intent on an unapproved request; service/agent requesters remain permitted under approval:create",
"bind": "Verified human required before insertion/issuance for declared human controls",
"legacy": "False, no inference from existing human entries",
"supersession": "Declaration inherited; mismatched existing successor conflicts atomically",
"identity": "RS256/JWKS verifies principal_type; entry body cannot spoof it",
"issuer_contract_source": "f9812ab3b2bfe8f0817185f44071e612264ec3ee:src/internal/server/oidc/token.go",
"persistence_proof": "Temporary on-disk v4 database migrated to v5; preserved records/digests",
"outbox": "Human bind and issuance roll back together",
"act_digest": "Unchanged five-field digest"
},
"consumer_compatibility": {
"status": "passed",
"cases": [
{
"human_control": false,
"existing_consumer_accepts_additive_field": true
},
{
"human_control": true,
"existing_consumer_accepts_additive_field": true
}
],
"native_calls": 0,
"human_control_required_by_existing_consumer": false,
"limit": "This proves wire compatibility only. The pilot requester/PEP must explicitly declare and require human_control; current consumer admission is not changed."
},
"native_issuer_proof": false,
"production_migration": false,
"factory_attempts": 0,
"residual_records": [
"APPROVAL-WP-0002-T01",
"APPROVAL-WP-0002-T03",
"APPROVAL-WP-0002-T05",
"SECRETS-WP-0009-T03",
"INFD-WP-0001-T08",
"HFACT-WP-0001-T01/T03/T04/T05"
]
}