coulomb/approval-engine
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

APPROVAL-WP-0007: record the verified revoker and park the inactive plans

Browse source 
Schema v9 stores who revoked an approval and an optional bounded reason.
The bounded-execution carrier example is proven in process. APPROVAL-WP-0005,
0006, and 0007 are blocked because they are not current work. Task statuses
stay as they were, apart from T03 and T04, which are done in source.

Assistant: grok
Assistant-Session: 01a1b5fd-0c33-7ba1-b383-53937d525595
This commit is contained in:
tegwick 2026-11-07 14:10:01 +01:00
parent f41a9ca82c
commit 4aa0b75449
17 changed files with 599 additions and 36 deletions
Download patch file Download diff file Expand all files Collapse all files

10
workplans/APPROVAL-WP-0005-access-claim-fact-contract.md
View file

@ -4,12 +4,12 @@ type: workplan
title: "Approval fact contract and reusable Go data adapter"
domain: infotech
repo: approval-engine
status: active
status: blocked
flavor: implementation
owner: codex
topic_slug: netkingdom
created: "2026-10-16"
updated: "2026-10-23"
updated: "2026-11-07"
depends_on: []
state_hub_workstream_id: "777b17de-2c1e-5ce5-aa82-c99e5137e956"
---
@ -21,6 +21,12 @@ T03's pure reusable data adapter, agreed with Access before implementation.
No broad residual activation, credential transport runtime, trust admission,
policy eligibility or live action is included.
2026-11-07: status is `blocked`. T01 and T03 are done in this repo. T02 stays
`wait` on access-engine. The producer Go adapter bytes match the copy in
access-engine `third_party/approvalfact`. Closing T02 needs Access
conformance evidence under FLEX-WP-0024-T06, which is still `progress`. No
further change in this repo closes it.
## Review authoritative claim guarantees and publish thin consumer vectors
```task

9
workplans/APPROVAL-WP-0006-fractional-consumption-time.md
View file

@ -4,12 +4,12 @@ type: workplan
title: "Preserve fractional authoritative approval and consumption time"
domain: infotech
repo: approval-engine
status: active
status: blocked
flavor: implementation
owner: codex
topic_slug: netkingdom
created: "2026-10-16"
updated: "2026-10-23"
updated: "2026-11-07"
depends_on: []
state_hub_workstream_id: "9b859b2f-f98a-5104-b0d5-72bfdaf56da4"
---
@ -20,6 +20,11 @@ the actual signed decision. INTENT basis: valid right now, exact-bound atomic
consumption and faithful source evidence. Fix source time, not Access backdating
or a consumer waiver. This does not promote native issuer/deployment authority.
2026-11-07: status is `blocked`. This plan is not current work. T01 stays
`done`. T02 stays `progress`; the remaining receipt is the Access and
secrets-engine immediate strict CAS remeasurement, and no task status was
changed to park the plan.
## Preserve clock precision and one post-lock consumption instant
```task

28
workplans/APPROVAL-WP-0007-bounded-execution-carrier.md
View file

@ -4,12 +4,12 @@ type: workplan
title: "Bounded-execution admission carrier: assurance floor, correspondence and revoker evidence"
domain: infotech
repo: approval-engine
status: active
status: blocked
flavor: implementation
owner: approval-engine
topic_slug: netkingdom
created: "2026-10-31"
updated: "2026-11-01"
updated: "2026-11-07"
depends_on: []
state_hub_workstream_id: "af365506-f451-50b5-a0a2-f0ba9a0a4d9c"
---
@ -22,6 +22,10 @@ revoke already work. This plan closes the engine-side gaps the answer found.
Every change is opt-in at issue, so existing approvals and consumers keep
their behavior. Native digest, CAS consumption and no-unconsume are unchanged.
2026-11-07: status is `blocked`. This plan is not current work. T01 through
T04 stay as recorded. T05 stays `wait` on KeyCape subject equality. T06 stays
`todo` for the later self-acceptance exception.
## Declared minimum approver assurance
```task
@ -100,7 +104,7 @@ the entry subject itself (`docs/bounded-execution-admission-carrier.md` §3).
```task
id: APPROVAL-WP-0007-T03
status: todo
status: done
priority: medium
state_hub_task_id: "7ceb5ffd-3ba8-5e9d-96a2-5e89c38a5c43"
```
@ -112,11 +116,18 @@ terminal semantics. This is the evidence for the founder's pre-start kill
switch (NK-WP-0056-T07). Do not require the revoker to equal the principal:
revocation must stay possible without the holder.
Done 2026-11-07 in source (schema v9, `tests/test_revoker.py`, contract in
`docs/approval-claim.md`). `POST /revoke` accepts only an optional one-line
reason of at most 200 characters. The token supplies the revoker. GET and
`details.revoked_by` serve it. The claim omits it. An internal revoke with no
verified identity still revokes and omits the member, as do migrated rows.
Not released or deployed: a v9 image and a founder-run rollout are still needed.
## Synthetic bounded-execution carrier proof
```task
id: APPROVAL-WP-0007-T04
status: todo
status: done
priority: medium
state_hub_task_id: "673890fe-3d49-5fe3-8ad7-c8c73e4d9376"
```
@ -130,6 +141,14 @@ different digest returns 409; revoke before consume gives 409 on consume;
consumption outside the window is refused. Synthetic fixtures only, with no
live service.
Done 2026-11-07. Example `examples/bounded-execution-approval-request.json`.
Test `tests/test_bounded_execution_carrier.py` runs that request in process:
aal1 entry refused by the declared floor, human aal2 approves, GET matches
the binding, the actor consumes the admission digest, the same digest retries,
a different digest is 409, a founder who is not the principal revokes before
consume and consume is 409, and consume before the window and at expiry is
409. No live service.
## Founder decision 2026-10-31
Approved by the founder (`proposed` -> `ready`) after the NK-WP-0056-T02 owner answers (hub decision 19afd15e).
@ -140,6 +159,7 @@ Approved by the founder (`proposed` -> `ready`) after the NK-WP-0056-T02 owner a
id: APPROVAL-WP-0007-T06
status: todo
priority: low
state_hub_task_id: "db25c052-3c60-5328-9993-b51f87fc5ba6"
```
Founder direction, 2026-11-01 (gate-house GH-DEC-2026-026 addendum, relayed by the net-kingdom coordinator).