coulomb/approval-engine
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Derive heartbeat cadence from the shared coordination frame

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a13eab-1e6a-7b33-9c37-372e90ada3a2
This commit is contained in:
tegwick 2026-10-15 20:41:49 +02:00
parent db850aded5
commit a786b061da
9 changed files with 98 additions and 27 deletions
Download patch file Download diff file Expand all files Collapse all files

10
docs/production-dependencies.md
View file

@ -6,7 +6,7 @@ the workplan remains `blocked` after completing reachable source work.
| Task | Owner return required | Evidence that clears the wait |
| --- | --- | --- |
| T01 — authenticated approver evidence | key-cape and informed-decision; founder for release rollout | Exact deployed issuer revision and client/profile receipt for requester and human paths; human sub/type, tenant/source, resource audience, scopes and assurance captured as non-secret facts and correlated with a stored human-control entry. Promote scanned schema-v6 image under per-change approval, back up/migrate once, then verify native entry and issuance/use provenance. No tokens or secrets in receipts. |
| T04 — delivery and reconciliation | audit-core, with railiance-platform for deployed sender/custody acceptance | Accept current cadence.yaml inventory for source approval-engine and tenant tenant:platform, explicit redact policy and four transition heartbeat classes at the requested 172800s bound. Return actual lifecycle event ids/drain acknowledgment and independent accepted counts for an agreed bounded comparison, accounting for occurrence versus receiver acceptance time, delayed delivery, duplicate acknowledgments and boundary crossings; source pending rows remain lag. Prove startup beats, missing-class and lag findings (depth 100 / age 3600s), and scoped sender bearer revocation. |
| T04 — delivery and reconciliation | audit-core, with railiance-platform for deployed sender/custody acceptance | Accept current cadence.yaml inventory for source approval-engine and tenant tenant:platform, explicit redact policy and four transition heartbeat classes at the frame-derived 2f=7200s registered wait (effective 3f=10800s after receiver grace). Return actual lifecycle event ids/drain acknowledgment and independent accepted counts for an agreed bounded comparison, accounting for occurrence versus receiver acceptance time, delayed delivery, duplicate acknowledgments and boundary crossings; source pending rows remain lag. Prove startup beats, missing-class and lag findings (depth 100 / age 3600s), and retain the delivered September 15 scoped sender bearer-revocation receipt. |
| T05 — live PEP consumption | secrets-engine, with informed-decision for the act-specific human review and access-engine for decision binding | Name the served PEP route/workload, immutable component revision, engine image/endpoint, authenticated caller identities and exact binding. Prove claim-before-decision and CAS consume after ALLOW before protected side effect; same-digest retry, different-digest conflict, spent-on-failure, revoked/expired/superseded/wrong-binding/unavailable denial with no protected callback. Preserve the native approval and decision digests, declared human_control where required, and consumer-owned side-effect/refusal evidence. |
For live whitehat T-06 only, T05's named surface must additionally be covered by
@ -76,3 +76,11 @@ population and reconcile lag/duplicate/boundary cases; matching since/until
strings against occurrence counts is insufficient. Existing owner task bindings
remain key-cape (T01), audit-core (T04) and secrets-engine (T05). No new owner
receipt or named live T-06 surface arrived since the preceding review.
2026-10-15 timing follow-up: founder selected shared coordination f=1h,
replacing a fixed day for this adoption. Generated source/config bindings are
prepared, not deployed. Canonical base is coordination-engine/config/coordination-frame.json;
NetKingdom retains regeneration and drift checks. Lifecycle drain/count-window,
registry admission and independent observation remain open. No credential,
JWT/approval validity, issuer scope or production image pin is changed.