63 lines
5.2 KiB
Markdown
63 lines
5.2 KiB
Markdown
|
# Production dependency requirements
|
||
|
|
|
||
|
|
Reviewed 2026-10-04 for APPROVAL-WP-0002. Task status `wait` means blocked;
|
||
|
|
the workplan remains `blocked` after completing reachable source work.
|
||
|
|
|
||
|
|
| Task | Owner return required | Evidence that clears the wait |
|
||
|
|
| --- | --- | --- |
|
||
|
|
| T01 — authenticated approver evidence | key-cape and informed-decision; founder for release rollout | Exact deployed issuer revision and client/profile receipt for requester and human paths; human sub/type, tenant/source, resource audience, scopes and assurance captured as non-secret facts and correlated with a stored human-control entry. Promote scanned schema-v6 image under per-change approval, back up/migrate once, then verify native entry and issuance/use provenance. No tokens or secrets in receipts. |
|
||
|
|
| T04 — delivery and reconciliation | audit-core, with railiance-platform for deployed sender/custody acceptance | Accept current cadence.yaml inventory for source approval-engine and tenant tenant:platform, explicit redact policy and four transition heartbeat classes at the requested 172800s bound. Return actual lifecycle event ids/drain acknowledgment and independent accepted counts for the same bounded time window, with pending rows accounted separately. Prove startup beats, missing-class and lag findings (depth 100 / age 3600s), and scoped sender bearer revocation. |
|
||
|
|
| T05 — live PEP consumption | secrets-engine, with informed-decision for the act-specific human review and access-engine for decision binding | Name the served PEP route/workload, immutable component revision, engine image/endpoint, authenticated caller identities and exact binding. Prove claim-before-decision and CAS consume after ALLOW before protected side effect; same-digest retry, different-digest conflict, spent-on-failure, revoked/expired/superseded/wrong-binding/unavailable denial with no protected callback. Preserve the native approval and decision digests, declared human_control where required, and consumer-owned side-effect/refusal evidence. |
|
||
|
|
|
||
|
|
For live whitehat T-06 only, T05's named surface must additionally be covered by
|
||
|
|
a complete engagement and plane admission naming identities, bounded window
|
||
|
|
and technique. Neither an in-process client nor this dependency document
|
||
|
|
admits a test or authorizes a packet. WHITEHAT-WP-0008 remains blocked.
|
||
|
|
|
||
|
|
## Delivered prerequisites
|
||
|
|
|
||
|
|
- Approval Engine deployment, schema-v5 persistence, restart and restore:
|
||
|
|
[deployment receipt](evidence/2026-09-14-approval-engine-deployment.json).
|
||
|
|
Image sha256:251941a5cb2724b57cc32cff6b693b1ab0be695bee4f56f02d51961189c0fa49.
|
||
|
|
- KeyCape: KEY-WP-0013 publishes `informed-decision-approver`, callback
|
||
|
|
https://decisions.coulomb.social/auth/callback, scopes openid/approval:read/
|
||
|
|
approval:approve, S256 PKCE, MFA and tenant:platform. KEY-WP-0031 is finished
|
||
|
|
and publishes directory/registration/default provenance. A source fragment
|
||
|
|
is insufficient to pin the exact deployed issuer/profile used by an entry.
|
||
|
|
- Informed Decision: archived INFD-WP-0001-T08 reports real human acceptance.
|
||
|
|
Its docs/evidence/2026-09-27-tool-budget-approval-create.json records requester
|
||
|
|
actor informed-decision and human_control=true; the corresponding
|
||
|
|
2026-09-27-tool-budget-acceptance.json confirms approval
|
||
|
|
e9521804-8fce-4fbc-bfdf-8a1aa959fd61, subject
|
||
|
|
uid=platform-root,ou=people,dc=netkingdom,dc=local at 18:05:35Z.
|
||
|
|
These discharge the historical absence of a requester/human flow. They do
|
||
|
|
not prove the new v6 field or admit a different protected action. Standing
|
||
|
|
requester runtime composition remains INFD-WP-0005-T05's platform dependency.
|
||
|
|
- Secrets Engine: SECRETS-WP-0010's native reader acceptance records existing
|
||
|
|
CCR-2026-0019 delivery and separate native read/consume scopes, an engine 404
|
||
|
|
for an unknown approval and 403 for consume-only read. Credential delivery is
|
||
|
|
complete; that test explicitly created, bound and consumed no approval.
|
||
|
|
- Audit Core: AUDIT-WP-0009 is finished. Native producer/readback receipts from
|
||
|
|
2026-09-11 and engine startup heartbeat drain are delivered. Current class
|
||
|
|
admission, actual lifecycle reconciliation and observed findings still need
|
||
|
|
their own receipt; implementation completion is insufficient evidence.
|
||
|
|
|
||
|
|
## Approval Engine source completion and release boundary
|
||
|
|
|
||
|
|
Schema v6 retains verified tenant provenance without treating registration or
|
||
|
|
default provenance as directory membership. Entries and issuance/use evidence
|
||
|
|
carry null for absent provenance; historic rows/events are preserved. Signed
|
||
|
|
HTTP tests cover all three sources, absent/malformed claims and body spoofing;
|
||
|
|
on-disk tests cover migration, restart, binding preservation and rollback.
|
||
|
|
|
||
|
|
The production pin remains schema v5. Release preparation uses the existing
|
||
|
|
image-build/image-scan targets and immutable matching migration/server pins.
|
||
|
|
Production migration/rollout requires founder approval per change, a verified
|
||
|
|
backup and native readback; this review performs none of those live operations.
|
||
|
|
The [deployment runbook](../deploy/README.md) and
|
||
|
|
[storage operations](storage-operations.md) specify that boundary and recovery.
|
||
|
|
|
||
|
|
APPROVAL-IN-0001 also remains open for the unassigned shared Taxonomy schema
|
||
|
|
owner. It does not block this workplan's local claim contract and is not a
|
||
|
|
substitute for the three owner returns above.
|