From 93907f3b69f15676ce261376a7121723eafa46bc Mon Sep 17 00:00:00 2001 From: tegwick Date: Sat, 7 Nov 2026 14:57:15 +0100 Subject: [PATCH] APPROVAL-WP-0006 finished: immediate strict CAS on the current pins Access keeps fractional NotBefore. The current approval, access, and secrets pins consume immediately, with the stored instant after the signed start and no sleep or backdating. Native gates stay on APPROVAL-WP-0002. Assistant: grok Assistant-Session: 01a1b5fd-0c33-7ba1-b383-53937d525595 --- WORK-RECORDS.md | 4 +-- .../2026-11-07-fractional-cas/README.md | 13 +++++++++ .../access-receipt.json | 21 ++++++++++++++ ...VAL-WP-0006-fractional-consumption-time.md | 28 ++++++++++++------- 4 files changed, 54 insertions(+), 12 deletions(-) create mode 100644 docs/evidence/2026-11-07-fractional-cas/README.md create mode 100644 docs/evidence/2026-11-07-fractional-cas/access-receipt.json diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index 8fb8f01..afdecba 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -16,7 +16,7 @@ | workplan | APPROVAL-WP-0003 | finished | — | workplans/APPROVAL-WP-0003-reissue-expired-approvals.md | | workplan | APPROVAL-WP-0004 | finished | — | workplans/APPROVAL-WP-0004-exact-consume-source-provenance.md | | workplan | APPROVAL-WP-0005 | blocked | — | workplans/APPROVAL-WP-0005-access-claim-fact-contract.md | -| workplan | APPROVAL-WP-0006 | blocked | — | workplans/APPROVAL-WP-0006-fractional-consumption-time.md | +| workplan | APPROVAL-WP-0006 | finished | — | workplans/APPROVAL-WP-0006-fractional-consumption-time.md | | workplan | APPROVAL-WP-0007 | blocked | — | workplans/APPROVAL-WP-0007-bounded-execution-carrier.md | | task | APPROVAL-WP-ADHOC-2026-10-10-T01 | done | — | workplans/ADHOC-2026-10-10.md | | task | APPROVAL-WP-ADHOC-2026-10-11-T01 | done | — | workplans/ADHOC-2026-10-11.md | @@ -44,7 +44,7 @@ | task | APPROVAL-WP-0005-T02 | wait | — | workplans/APPROVAL-WP-0005-access-claim-fact-contract.md | | task | APPROVAL-WP-0005-T03 | done | — | workplans/APPROVAL-WP-0005-access-claim-fact-contract.md | | task | APPROVAL-WP-0006-T01 | done | — | workplans/APPROVAL-WP-0006-fractional-consumption-time.md | -| task | APPROVAL-WP-0006-T02 | progress | — | workplans/APPROVAL-WP-0006-fractional-consumption-time.md | +| task | APPROVAL-WP-0006-T02 | done | — | workplans/APPROVAL-WP-0006-fractional-consumption-time.md | | task | APPROVAL-WP-0007-T01 | done | — | workplans/APPROVAL-WP-0007-bounded-execution-carrier.md | | task | APPROVAL-WP-0007-T02 | done | — | workplans/APPROVAL-WP-0007-bounded-execution-carrier.md | | task | APPROVAL-WP-0007-T03 | done | — | workplans/APPROVAL-WP-0007-bounded-execution-carrier.md | diff --git a/docs/evidence/2026-11-07-fractional-cas/README.md b/docs/evidence/2026-11-07-fractional-cas/README.md new file mode 100644 index 0000000..a572674 --- /dev/null +++ b/docs/evidence/2026-11-07-fractional-cas/README.md @@ -0,0 +1,13 @@ +# APPROVAL-WP-0006 immediate strict CAS + +Measured 2026-11-07 on clean pins: + +- approval-engine `d39da805fea1` +- access-engine `535bab7ddcd2` +- secrets-engine `5f85c784d966` + +Access `go test -count=1 ./internal/decision -run TestTrustedTaskWholeOperationLifetime` passed. `NotBefore` and `ExpiresAt` are formatted with `RFC3339Nano` and are not rounded earlier. The Access receipt is `access-receipt.json`. + +The whole path used the current approval-engine and secrets-engine checkouts and an access-engine binary built from that pin. Immediate consume stored `consumed_at` `2026-11-07T13:53:25.958649+00:00`, after signed `NotBefore` `2026-11-07T13:53:25.840482563Z`. `wait_for_decision_start` did not sleep. `NotBefore` was not backdated. The same digest retried idempotently. One microsecond before the signed start was refused by the strict handoff. The source freshness default stayed 30. The synthetic store used freshness 120 so the v2 operation deadline could fit. That check was not waived. + +Secrets `tests/test_application_time.py` and `tests/test_decision_start_wait.py` passed in the repo virtualenv, 11 tests. This measurement does not admit a native trust anchor, deploy the service, or perform a live effect. Native issuer, audit, and served PEP gates stay on APPROVAL-WP-0002. diff --git a/docs/evidence/2026-11-07-fractional-cas/access-receipt.json b/docs/evidence/2026-11-07-fractional-cas/access-receipt.json new file mode 100644 index 0000000..ee9807c --- /dev/null +++ b/docs/evidence/2026-11-07-fractional-cas/access-receipt.json @@ -0,0 +1,21 @@ +{ + "commit": "535bab7ddcd25cf7c02814b9e800991ccdfa2842", + "expected_commit_prefix": "535bab7ddcd2", + "commit_matches_expected": true, + "git_status_sb": "## main...origin/main", + "tree": "clean", + "test_command": "go test -count=1 ./internal/decision -run TestTrustedTaskWholeOperationLifetime", + "test_result": "pass", + "test_output": "ok \tgithub.com/netkingdom/access-engine/internal/decision\t0.024s\n", + "test_exit_code": 0, + "failure_output": null, + "binary_path": "/tmp/approval-wp-0006/access-engine", + "binary_sha256": "d8138e695d2d7cbb783c4648dfc1d38b5a7495737a08de4284475176d29decbe", + "registry_path": "/home/worsch/access-engine/examples/secrets-engine/registry_snapshot.json", + "registry_sha256": "37fba44ec0e0fd9b1e17a05ad1b7e4f9bb6ec9e0fc0bb3133e8af2ac6f832d7c", + "policy_path": "/home/worsch/access-engine/examples/secrets-engine-service-task-execution-v2/policy_package.md", + "policy_sha256": "95def8495596520a286a62dc48aca3f232668534ff687a2f4d47a46805eaac15", + "registry_note": "Preferred paths exist. examples/secrets-engine-service-task-execution-v2 has policy_package.md (version v2) but no registry_snapshot.json; its resource_manifest.yaml is a synthetic fixture and was not substituted. The registry hashed is examples/secrets-engine/registry_snapshot.json.", + "not_before_truncated": false, + "not_before_conclusion": "trustedTaskLifetime formats NotBefore and ExpiresAt with time.RFC3339Nano from the exact instants, so a fractional ExpiresAt is kept and NotBefore is not rounded earlier or truncated to a whole second." +} diff --git a/workplans/APPROVAL-WP-0006-fractional-consumption-time.md b/workplans/APPROVAL-WP-0006-fractional-consumption-time.md index 05bada7..bcd74ac 100644 --- a/workplans/APPROVAL-WP-0006-fractional-consumption-time.md +++ b/workplans/APPROVAL-WP-0006-fractional-consumption-time.md @@ -4,7 +4,7 @@ type: workplan title: "Preserve fractional authoritative approval and consumption time" domain: infotech repo: approval-engine -status: blocked +status: finished flavor: implementation owner: codex topic_slug: netkingdom @@ -20,10 +20,9 @@ the actual signed decision. INTENT basis: valid right now, exact-bound atomic consumption and faithful source evidence. Fix source time, not Access backdating or a consumer waiver. This does not promote native issuer/deployment authority. -2026-11-07: status is `blocked`. This plan is not current work. T01 stays -`done`. T02 stays `progress`; the remaining receipt is the Access and -secrets-engine immediate strict CAS remeasurement, and no task status was -changed to park the plan. +2026-11-07: status is `finished`. T01 and T02 are done. The immediate strict +CAS remeasurement is `docs/evidence/2026-11-07-fractional-cas/`. Native +issuer, audit receiver, and served PEP gates stay on APPROVAL-WP-0002. ## Preserve clock precision and one post-lock consumption instant @@ -50,8 +49,7 @@ schema migration and preserves old rows/idempotent timestamps exactly. ```task id: APPROVAL-WP-0006-T02 -status: progress -blocked_on: message-from:access-engine +status: done priority: high state_hub_task_id: "c689f2b3-461c-5bdb-b6bc-01d756715564" ``` @@ -75,6 +73,16 @@ remain pending coordinator/consumer evidence, not a reason to backdate or waive. 2026-10-23 handoff: the source review stays `docs/reviews/2026-10-16-fractional-consumption-temporal-approval-owner-review.json` -(decision approved for the bounded repair only). Access and secrets-engine still -owe the immediate strict CAS remeasurement on the exact successor pin. T02 stays -`progress` until that receipt exists. +(decision approved for the bounded repair only). + +Done 2026-11-07 on the current clean pins: approval-engine `d39da805fea1`, +access-engine `535bab7ddcd2`, secrets-engine `5f85c784d966`. Access +`TestTrustedTaskWholeOperationLifetime` passed; `NotBefore` and `ExpiresAt` +use `RFC3339Nano` and are not rounded earlier. The whole-path consume stored +`consumed_at` `2026-11-07T13:53:25.958649+00:00`, after signed `NotBefore` +`2026-11-07T13:53:25.840482563Z`. No sleep was used to reach that instant, and +`NotBefore` was not backdated. The same digest retried idempotently. One +microsecond before the signed start was refused. Source freshness default +stayed 30; the synthetic store used freshness 120 so the v2 deadline could +fit. Receipt and measurement: `docs/evidence/2026-11-07-fractional-cas/`. +Native admission, deployment, and a live effect are not claimed.