Record GH-DEC-2026-005 in the claim contract itself

The ruling names docs/approval-claim.md as the step-1 artifact on the
GH-DEC-2026-003 path, but the contract did not say so. It listed only
access-engine as consumer, so an implementer reading the governed
artifact alone would not learn that PEP-shaped consumers read it as step
1, that no other envelope may be served from that endpoint, or that a PEP
validates across this claim and the step-2 DecisionEnvelope.

State the two-artifact split and the layer rule at the top, and state
that the approval fact's authority is this engine -- a consumer requiring
a state-hub authority fails closed against every correctly issued
response, which is the defect GH-DEC-2026-005 struck. Point both
consumers at the existing Required verification section.

Also update the request doc's trailing record block from proposed to
resolved with its decision id, so a reader copying it does not
reintroduce a pending record for a settled question.

Docs only; 84 tests pass.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TvyJPAaVCGsVheVhcCwNND

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 411227@bnt-lap001
Assistant-Session: d566f6d3-bcaf-43c3-bc5e-3ddd0f64b535
This commit is contained in:
tegwick 2026-09-06 08:02:48 +02:00
parent 60c3cebbfa
commit 2db663fbf5
2 changed files with 24 additions and 3 deletions

View file

@ -135,12 +135,16 @@ This does not gate `APPROVAL-WP-0002-T03`. secrets-engine is fail-closed until
T03 and its own T04 both land; deploying publishes a URL and commits no one to
an envelope. The question gates the first live consume, not the deployment.
## Proposed record
## Record as resolved
Adopted by gate-house as `GH-DEC-2026-005`; this block reflects the outcome,
not the original request.
```yaml
id: GH-DEC-2026-005
kind: decision
title: The approval-claim is the step-1 artifact on the PEP consumption path
status: proposed
status: resolved
owner: Bernd Worsch
repo: gate-house
standard: net-kingdom/canon/standards/security-layer-model_v0.7.md
@ -149,6 +153,7 @@ requested_dispositions:
- approved
- revised
- rejected
disposition: approved
affects:
- gate-house
- approval-engine