coulomb/approval-engine
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add bounded source reconciliation counts and clarify receiver dependencies

Browse source 
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a1046e-fdbf-7b93-a267-5f72b9b24526
This commit is contained in:
tegwick 2026-10-04 11:34:42 +02:00
parent 1044a5f36d
commit 24a5ecd56b
8 changed files with 231 additions and 17 deletions
Download patch file Download diff file Expand all files Collapse all files

18
docs/production-dependencies.md
View file

@ -6,7 +6,7 @@ the workplan remains `blocked` after completing reachable source work.
| Task | Owner return required | Evidence that clears the wait |
| --- | --- | --- |
| T01 — authenticated approver evidence | key-cape and informed-decision; founder for release rollout | Exact deployed issuer revision and client/profile receipt for requester and human paths; human sub/type, tenant/source, resource audience, scopes and assurance captured as non-secret facts and correlated with a stored human-control entry. Promote scanned schema-v6 image under per-change approval, back up/migrate once, then verify native entry and issuance/use provenance. No tokens or secrets in receipts. |
| T04 — delivery and reconciliation | audit-core, with railiance-platform for deployed sender/custody acceptance | Accept current cadence.yaml inventory for source approval-engine and tenant tenant:platform, explicit redact policy and four transition heartbeat classes at the requested 172800s bound. Return actual lifecycle event ids/drain acknowledgment and independent accepted counts for the same bounded time window, with pending rows accounted separately. Prove startup beats, missing-class and lag findings (depth 100 / age 3600s), and scoped sender bearer revocation. |
| T04 — delivery and reconciliation | audit-core, with railiance-platform for deployed sender/custody acceptance | Accept current cadence.yaml inventory for source approval-engine and tenant tenant:platform, explicit redact policy and four transition heartbeat classes at the requested 172800s bound. Return actual lifecycle event ids/drain acknowledgment and independent accepted counts for an agreed bounded comparison, accounting for occurrence versus receiver acceptance time, delayed delivery, duplicate acknowledgments and boundary crossings; source pending rows remain lag. Prove startup beats, missing-class and lag findings (depth 100 / age 3600s), and scoped sender bearer revocation. |
| T05 — live PEP consumption | secrets-engine, with informed-decision for the act-specific human review and access-engine for decision binding | Name the served PEP route/workload, immutable component revision, engine image/endpoint, authenticated caller identities and exact binding. Prove claim-before-decision and CAS consume after ALLOW before protected side effect; same-digest retry, different-digest conflict, spent-on-failure, revoked/expired/superseded/wrong-binding/unavailable denial with no protected callback. Preserve the native approval and decision digests, declared human_control where required, and consumer-owned side-effect/refusal evidence. |
For live whitehat T-06 only, T05's named surface must additionally be covered by
@ -60,3 +60,19 @@ The [deployment runbook](../deploy/README.md) and
APPROVAL-IN-0001 also remains open for the unassigned shared Taxonomy schema
owner. It does not block this workplan's local claim contract and is not a
substitute for the three owner returns above.
## Reconciliation follow-up review — 2026-10-04
T04 source preparation now includes authenticated bounded cadence snapshots,
with committed/drained/pending occurrence counts and separate local
acknowledgment-window counts. The older lifetime-only surface did not satisfy
the source declaration's bounded-window requirement. The local implementation
is complete; source schema remains v6 and awaits the existing release gate.
Audit Core docs/stream-completeness.md explicitly defines receiver
acceptance-time windows. The required owner return must state the temporal
population and reconcile lag/duplicate/boundary cases; matching since/until
strings against occurrence counts is insufficient. Existing owner task bindings
remain key-cape (T01), audit-core (T04) and secrets-engine (T05). No new owner
receipt or named live T-06 surface arrived since the preceding review.