APPROVAL-WP-0006 finished: immediate strict CAS on the current pins
Access keeps fractional NotBefore. The current approval, access, and secrets pins consume immediately, with the stored instant after the signed start and no sleep or backdating. Native gates stay on APPROVAL-WP-0002. Assistant: grok Assistant-Session: 01a1b5fd-0c33-7ba1-b383-53937d525595
This commit is contained in:
parent
d39da805fe
commit
93907f3b69
4 changed files with 54 additions and 12 deletions
|
|
@ -16,7 +16,7 @@
|
|||
| workplan | APPROVAL-WP-0003 | finished | — | workplans/APPROVAL-WP-0003-reissue-expired-approvals.md |
|
||||
| workplan | APPROVAL-WP-0004 | finished | — | workplans/APPROVAL-WP-0004-exact-consume-source-provenance.md |
|
||||
| workplan | APPROVAL-WP-0005 | blocked | — | workplans/APPROVAL-WP-0005-access-claim-fact-contract.md |
|
||||
| workplan | APPROVAL-WP-0006 | blocked | — | workplans/APPROVAL-WP-0006-fractional-consumption-time.md |
|
||||
| workplan | APPROVAL-WP-0006 | finished | — | workplans/APPROVAL-WP-0006-fractional-consumption-time.md |
|
||||
| workplan | APPROVAL-WP-0007 | blocked | — | workplans/APPROVAL-WP-0007-bounded-execution-carrier.md |
|
||||
| task | APPROVAL-WP-ADHOC-2026-10-10-T01 | done | — | workplans/ADHOC-2026-10-10.md |
|
||||
| task | APPROVAL-WP-ADHOC-2026-10-11-T01 | done | — | workplans/ADHOC-2026-10-11.md |
|
||||
|
|
@ -44,7 +44,7 @@
|
|||
| task | APPROVAL-WP-0005-T02 | wait | — | workplans/APPROVAL-WP-0005-access-claim-fact-contract.md |
|
||||
| task | APPROVAL-WP-0005-T03 | done | — | workplans/APPROVAL-WP-0005-access-claim-fact-contract.md |
|
||||
| task | APPROVAL-WP-0006-T01 | done | — | workplans/APPROVAL-WP-0006-fractional-consumption-time.md |
|
||||
| task | APPROVAL-WP-0006-T02 | progress | — | workplans/APPROVAL-WP-0006-fractional-consumption-time.md |
|
||||
| task | APPROVAL-WP-0006-T02 | done | — | workplans/APPROVAL-WP-0006-fractional-consumption-time.md |
|
||||
| task | APPROVAL-WP-0007-T01 | done | — | workplans/APPROVAL-WP-0007-bounded-execution-carrier.md |
|
||||
| task | APPROVAL-WP-0007-T02 | done | — | workplans/APPROVAL-WP-0007-bounded-execution-carrier.md |
|
||||
| task | APPROVAL-WP-0007-T03 | done | — | workplans/APPROVAL-WP-0007-bounded-execution-carrier.md |
|
||||
|
|
|
|||
13
docs/evidence/2026-11-07-fractional-cas/README.md
Normal file
13
docs/evidence/2026-11-07-fractional-cas/README.md
Normal file
|
|
@ -0,0 +1,13 @@
|
|||
# APPROVAL-WP-0006 immediate strict CAS
|
||||
|
||||
Measured 2026-11-07 on clean pins:
|
||||
|
||||
- approval-engine `d39da805fea1`
|
||||
- access-engine `535bab7ddcd2`
|
||||
- secrets-engine `5f85c784d966`
|
||||
|
||||
Access `go test -count=1 ./internal/decision -run TestTrustedTaskWholeOperationLifetime` passed. `NotBefore` and `ExpiresAt` are formatted with `RFC3339Nano` and are not rounded earlier. The Access receipt is `access-receipt.json`.
|
||||
|
||||
The whole path used the current approval-engine and secrets-engine checkouts and an access-engine binary built from that pin. Immediate consume stored `consumed_at` `2026-11-07T13:53:25.958649+00:00`, after signed `NotBefore` `2026-11-07T13:53:25.840482563Z`. `wait_for_decision_start` did not sleep. `NotBefore` was not backdated. The same digest retried idempotently. One microsecond before the signed start was refused by the strict handoff. The source freshness default stayed 30. The synthetic store used freshness 120 so the v2 operation deadline could fit. That check was not waived.
|
||||
|
||||
Secrets `tests/test_application_time.py` and `tests/test_decision_start_wait.py` passed in the repo virtualenv, 11 tests. This measurement does not admit a native trust anchor, deploy the service, or perform a live effect. Native issuer, audit, and served PEP gates stay on APPROVAL-WP-0002.
|
||||
21
docs/evidence/2026-11-07-fractional-cas/access-receipt.json
Normal file
21
docs/evidence/2026-11-07-fractional-cas/access-receipt.json
Normal file
|
|
@ -0,0 +1,21 @@
|
|||
{
|
||||
"commit": "535bab7ddcd25cf7c02814b9e800991ccdfa2842",
|
||||
"expected_commit_prefix": "535bab7ddcd2",
|
||||
"commit_matches_expected": true,
|
||||
"git_status_sb": "## main...origin/main",
|
||||
"tree": "clean",
|
||||
"test_command": "go test -count=1 ./internal/decision -run TestTrustedTaskWholeOperationLifetime",
|
||||
"test_result": "pass",
|
||||
"test_output": "ok \tgithub.com/netkingdom/access-engine/internal/decision\t0.024s\n",
|
||||
"test_exit_code": 0,
|
||||
"failure_output": null,
|
||||
"binary_path": "/tmp/approval-wp-0006/access-engine",
|
||||
"binary_sha256": "d8138e695d2d7cbb783c4648dfc1d38b5a7495737a08de4284475176d29decbe",
|
||||
"registry_path": "/home/worsch/access-engine/examples/secrets-engine/registry_snapshot.json",
|
||||
"registry_sha256": "37fba44ec0e0fd9b1e17a05ad1b7e4f9bb6ec9e0fc0bb3133e8af2ac6f832d7c",
|
||||
"policy_path": "/home/worsch/access-engine/examples/secrets-engine-service-task-execution-v2/policy_package.md",
|
||||
"policy_sha256": "95def8495596520a286a62dc48aca3f232668534ff687a2f4d47a46805eaac15",
|
||||
"registry_note": "Preferred paths exist. examples/secrets-engine-service-task-execution-v2 has policy_package.md (version v2) but no registry_snapshot.json; its resource_manifest.yaml is a synthetic fixture and was not substituted. The registry hashed is examples/secrets-engine/registry_snapshot.json.",
|
||||
"not_before_truncated": false,
|
||||
"not_before_conclusion": "trustedTaskLifetime formats NotBefore and ExpiresAt with time.RFC3339Nano from the exact instants, so a fractional ExpiresAt is kept and NotBefore is not rounded earlier or truncated to a whole second."
|
||||
}
|
||||
|
|
@ -4,7 +4,7 @@ type: workplan
|
|||
title: "Preserve fractional authoritative approval and consumption time"
|
||||
domain: infotech
|
||||
repo: approval-engine
|
||||
status: blocked
|
||||
status: finished
|
||||
flavor: implementation
|
||||
owner: codex
|
||||
topic_slug: netkingdom
|
||||
|
|
@ -20,10 +20,9 @@ the actual signed decision. INTENT basis: valid right now, exact-bound atomic
|
|||
consumption and faithful source evidence. Fix source time, not Access backdating
|
||||
or a consumer waiver. This does not promote native issuer/deployment authority.
|
||||
|
||||
2026-11-07: status is `blocked`. This plan is not current work. T01 stays
|
||||
`done`. T02 stays `progress`; the remaining receipt is the Access and
|
||||
secrets-engine immediate strict CAS remeasurement, and no task status was
|
||||
changed to park the plan.
|
||||
2026-11-07: status is `finished`. T01 and T02 are done. The immediate strict
|
||||
CAS remeasurement is `docs/evidence/2026-11-07-fractional-cas/`. Native
|
||||
issuer, audit receiver, and served PEP gates stay on APPROVAL-WP-0002.
|
||||
|
||||
## Preserve clock precision and one post-lock consumption instant
|
||||
|
||||
|
|
@ -50,8 +49,7 @@ schema migration and preserves old rows/idempotent timestamps exactly.
|
|||
|
||||
```task
|
||||
id: APPROVAL-WP-0006-T02
|
||||
status: progress
|
||||
blocked_on: message-from:access-engine
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "c689f2b3-461c-5bdb-b6bc-01d756715564"
|
||||
```
|
||||
|
|
@ -75,6 +73,16 @@ remain pending coordinator/consumer evidence, not a reason to backdate or waive.
|
|||
|
||||
2026-10-23 handoff: the source review stays
|
||||
`docs/reviews/2026-10-16-fractional-consumption-temporal-approval-owner-review.json`
|
||||
(decision approved for the bounded repair only). Access and secrets-engine still
|
||||
owe the immediate strict CAS remeasurement on the exact successor pin. T02 stays
|
||||
`progress` until that receipt exists.
|
||||
(decision approved for the bounded repair only).
|
||||
|
||||
Done 2026-11-07 on the current clean pins: approval-engine `d39da805fea1`,
|
||||
access-engine `535bab7ddcd2`, secrets-engine `5f85c784d966`. Access
|
||||
`TestTrustedTaskWholeOperationLifetime` passed; `NotBefore` and `ExpiresAt`
|
||||
use `RFC3339Nano` and are not rounded earlier. The whole-path consume stored
|
||||
`consumed_at` `2026-11-07T13:53:25.958649+00:00`, after signed `NotBefore`
|
||||
`2026-11-07T13:53:25.840482563Z`. No sleep was used to reach that instant, and
|
||||
`NotBefore` was not backdated. The same digest retried idempotently. One
|
||||
microsecond before the signed start was refused. Source freshness default
|
||||
stayed 30; the synthetic store used freshness 120 so the v2 deadline could
|
||||
fit. Receipt and measurement: `docs/evidence/2026-11-07-fractional-cas/`.
|
||||
Native admission, deployment, and a live effect are not claimed.
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue