coulomb/approval-engine
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

APPROVAL-WP-0006 finished: immediate strict CAS on the current pins

Browse source 
Access keeps fractional NotBefore. The current approval, access, and
secrets pins consume immediately, with the stored instant after the signed
start and no sleep or backdating. Native gates stay on APPROVAL-WP-0002.

Assistant: grok
Assistant-Session: 01a1b5fd-0c33-7ba1-b383-53937d525595
This commit is contained in:
tegwick 2026-11-07 14:57:15 +01:00
parent d39da805fe
commit 93907f3b69
4 changed files with 54 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

13
docs/evidence/2026-11-07-fractional-cas/README.md Normal file
View file

@ -0,0 +1,13 @@
# APPROVAL-WP-0006 immediate strict CAS
Measured 2026-11-07 on clean pins:
- approval-engine `d39da805fea1`
- access-engine `535bab7ddcd2`
- secrets-engine `5f85c784d966`
Access `go test -count=1 ./internal/decision -run TestTrustedTaskWholeOperationLifetime` passed. `NotBefore` and `ExpiresAt` are formatted with `RFC3339Nano` and are not rounded earlier. The Access receipt is `access-receipt.json`.
The whole path used the current approval-engine and secrets-engine checkouts and an access-engine binary built from that pin. Immediate consume stored `consumed_at` `2026-11-07T13:53:25.958649+00:00`, after signed `NotBefore` `2026-11-07T13:53:25.840482563Z`. `wait_for_decision_start` did not sleep. `NotBefore` was not backdated. The same digest retried idempotently. One microsecond before the signed start was refused by the strict handoff. The source freshness default stayed 30. The synthetic store used freshness 120 so the v2 operation deadline could fit. That check was not waived.
Secrets `tests/test_application_time.py` and `tests/test_decision_start_wait.py` passed in the repo virtualenv, 11 tests. This measurement does not admit a native trust anchor, deploy the service, or perform a live effect. Native issuer, audit, and served PEP gates stay on APPROVAL-WP-0002.

21
docs/evidence/2026-11-07-fractional-cas/access-receipt.json Normal file
View file

@ -0,0 +1,21 @@
{
"commit": "535bab7ddcd25cf7c02814b9e800991ccdfa2842",
"expected_commit_prefix": "535bab7ddcd2",
"commit_matches_expected": true,
"git_status_sb": "## main...origin/main",
"tree": "clean",
"test_command": "go test -count=1 ./internal/decision -run TestTrustedTaskWholeOperationLifetime",
"test_result": "pass",
"test_output": "ok \tgithub.com/netkingdom/access-engine/internal/decision\t0.024s\n",
"test_exit_code": 0,
"failure_output": null,
"binary_path": "/tmp/approval-wp-0006/access-engine",
"binary_sha256": "d8138e695d2d7cbb783c4648dfc1d38b5a7495737a08de4284475176d29decbe",
"registry_path": "/home/worsch/access-engine/examples/secrets-engine/registry_snapshot.json",
"registry_sha256": "37fba44ec0e0fd9b1e17a05ad1b7e4f9bb6ec9e0fc0bb3133e8af2ac6f832d7c",
"policy_path": "/home/worsch/access-engine/examples/secrets-engine-service-task-execution-v2/policy_package.md",
"policy_sha256": "95def8495596520a286a62dc48aca3f232668534ff687a2f4d47a46805eaac15",
"registry_note": "Preferred paths exist. examples/secrets-engine-service-task-execution-v2 has policy_package.md (version v2) but no registry_snapshot.json; its resource_manifest.yaml is a synthetic fixture and was not substituted. The registry hashed is examples/secrets-engine/registry_snapshot.json.",
"not_before_truncated": false,
"not_before_conclusion": "trustedTaskLifetime formats NotBefore and ExpiresAt with time.RFC3339Nano from the exact instants, so a fractional ExpiresAt is kept and NotBefore is not rounded earlier or truncated to a whole second."
}