Finish approval engine spine
Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a05e2e-805b-7042-a750-71f473bceea2
This commit is contained in:
parent
e7c210bf56
commit
c3f1dfbc07
18 changed files with 526 additions and 75 deletions
|
|
@ -4,11 +4,11 @@ type: workplan
|
|||
title: "v0.7 alignment and the engine spine"
|
||||
domain: infotech
|
||||
repo: approval-engine
|
||||
status: active
|
||||
status: finished
|
||||
owner: grok
|
||||
topic_slug: netkingdom
|
||||
created: "2026-08-29"
|
||||
updated: "2026-08-29"
|
||||
updated: "2026-09-01"
|
||||
state_hub_workstream_id: "546f2fae-c53e-5ea5-8c63-320118d8ee1e"
|
||||
---
|
||||
|
||||
|
|
@ -133,11 +133,11 @@ Acceptance: `layer.yaml` `evidence.cadence_status` is no longer
|
|||
`undeclared`; a missing heartbeat or a count divergence is specified as a
|
||||
finding, not as a log line.
|
||||
|
||||
## T05 — Wait on consumption ordering; do not implement it
|
||||
## T05 — Implement the assented consumption ordering contract
|
||||
|
||||
```task
|
||||
id: APPROVAL-WP-0001-T05
|
||||
status: wait
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "204bdfeb-a669-569e-a654-10c1a9fcacbc"
|
||||
```
|
||||
|
|
@ -152,6 +152,17 @@ Acceptance: a written contract both engines have assented to, recorded
|
|||
here, *then* a consume path. Until then, no `consume` endpoint, no inferred
|
||||
consumption from a decision record, no demo that "just consumes on allow".
|
||||
|
||||
2026-09-01: Gate House resolved the blocker in `GH-DEC-2026-003` and
|
||||
`docs/contracts/approval-consumption.md`, with an explicit State Hub handoff
|
||||
from gate-house (`2ade6044`). Implemented
|
||||
`POST /v1/approvals/{id}/consume`: the PEP presents the PDP decision binding's
|
||||
`request_digest` after ALLOW and before the protected side effect. The SQLite
|
||||
CAS stores the digest and optional decision id; same-digest retries are
|
||||
idempotent success, different digests conflict, and there is no unconsume.
|
||||
The `approval.use` outbox row remains in the same transaction. Concurrency,
|
||||
rollback, API-shape, legacy-database migration, and consume-side T-06 tests are
|
||||
included.
|
||||
|
||||
## T06 — Durable object, closed state machine, authenticated entries
|
||||
|
||||
```task
|
||||
|
|
@ -165,6 +176,9 @@ state_hub_task_id: "44c4997b-6833-5540-a554-0e24210809f2"
|
|||
CAS supersession (concurrent test), distinct-approver fail-closed, revocation
|
||||
without holder cooperation. `_cas_consume` is unexported.
|
||||
|
||||
2026-09-01: the assented T05 contract replaced the private seam with the public
|
||||
digest-bound `consume` mutation and added an in-place SQLite column migration.
|
||||
|
||||
|
||||
|
||||
Depends on T02 and T03. Implement the object and the machine in SCOPE:
|
||||
|
|
@ -190,7 +204,7 @@ state_hub_task_id: "ea51499d-ced5-50fa-b852-396719a8c0f4"
|
|||
```
|
||||
|
||||
2026-08-29: `GET /v1/approvals/{id}/claim`. Tests forbid decision-shaped
|
||||
keys and `/v1/check` / `/authorize` / `/consume`. Store unavailable → 503.
|
||||
keys and `/v1/check` / `/authorize`. Store unavailable → 503.
|
||||
|
||||
|
||||
|
||||
|
|
@ -240,6 +254,10 @@ wrong action, later time, revoked, superseded. Consume-side replay stays out.
|
|||
Handoff: `docs/flex-auth-handoff.md`. `FLEX-WP-0017` T03 is unblocked on this
|
||||
object; T05 remains blocked only on consumption ordering.
|
||||
|
||||
2026-09-01: consume-side replay coverage added after `GH-DEC-2026-003`:
|
||||
same-digest retry is idempotent and different-digest replay conflicts. The
|
||||
handoff document now records the PEP-before-side-effect protocol.
|
||||
|
||||
|
||||
|
||||
Depends on T07, T08, and T05 (the last only for the consume-side replay
|
||||
|
|
@ -251,3 +269,15 @@ Acceptance: `T-06` passes; T03 is unblocked on the object (not on a hub
|
|||
substitute); T05 remains blocked only on consumption ordering if T05 of
|
||||
this workplan is still `wait`, never on a missing object or a missing
|
||||
digest.
|
||||
|
||||
## Closeout
|
||||
|
||||
Finished 2026-09-01. All nine tasks are complete and the full test suite passes.
|
||||
The first-cut engine now has a durable approval object, authenticated-entry
|
||||
shape, atomic supersession and consumption, claim introspection, transactional
|
||||
outbox, cadence declaration, and complete Canon T-06 replay coverage.
|
||||
|
||||
Residual production hardening and consumer adoption are carried by
|
||||
`APPROVAL-WP-0002`. The unassigned shared Taxonomy request-claim schema is
|
||||
carried by residual intake `APPROVAL-IN-0001`; the local claim continues to
|
||||
yield rather than claiming permanent vocabulary ownership.
|
||||
|
|
|
|||
|
|
@ -0,0 +1,85 @@
|
|||
---
|
||||
id: APPROVAL-WP-0002
|
||||
type: workplan
|
||||
title: "Production readiness and consumer adoption"
|
||||
domain: infotech
|
||||
repo: approval-engine
|
||||
status: proposed
|
||||
owner: codex
|
||||
topic_slug: netkingdom
|
||||
created: "2026-09-01"
|
||||
updated: "2026-09-01"
|
||||
origin: residual
|
||||
origin_ref: APPROVAL-WP-0001
|
||||
---
|
||||
|
||||
# APPROVAL-WP-0002 — Production readiness and consumer adoption
|
||||
|
||||
Move the completed first-cut engine spine into an authenticated, durable,
|
||||
observable production service and prove one PEP integration end to end. This is
|
||||
the residual production scope deliberately excluded from APPROVAL-WP-0001.
|
||||
|
||||
The workplan is proposed pending review against the deployment estate and the
|
||||
current key-cape, access-engine, audit-core, and secrets-engine contracts.
|
||||
|
||||
## Authenticate lifecycle mutations and approver evidence
|
||||
|
||||
```task
|
||||
id: APPROVAL-WP-0002-T01
|
||||
status: todo
|
||||
priority: high
|
||||
```
|
||||
|
||||
Bind create, approval-entry, revoke, supersede, and consume callers to
|
||||
authenticated identities. An API-supplied `subject_id`, `actor`, or
|
||||
`decision_id` is provenance only until independently authenticated. Keep
|
||||
authorization decisions in access-engine and approval doctrine in gate-house.
|
||||
|
||||
## Harden durable storage and migrations
|
||||
|
||||
```task
|
||||
id: APPROVAL-WP-0002-T02
|
||||
status: todo
|
||||
priority: high
|
||||
```
|
||||
|
||||
Define the production persistence, backup/restore, migration, concurrency, and
|
||||
recovery posture. Prove schema upgrades preserve existing approvals and that
|
||||
crash recovery cannot separate mutations from outbox evidence.
|
||||
|
||||
## Package and deploy the service
|
||||
|
||||
```task
|
||||
id: APPROVAL-WP-0002-T03
|
||||
status: todo
|
||||
priority: high
|
||||
```
|
||||
|
||||
Add the governed image/deployment surface, health and readiness behavior,
|
||||
resource bounds, and fail-closed caller configuration. A local WSGI development
|
||||
server is not production evidence.
|
||||
|
||||
## Wire outbox delivery and reconciliation
|
||||
|
||||
```task
|
||||
id: APPROVAL-WP-0002-T04
|
||||
status: todo
|
||||
priority: high
|
||||
```
|
||||
|
||||
Deliver the local outbox asynchronously to audit-core, preserve event-id
|
||||
deduplication, publish lag/depth signals, emit the declared heartbeat, and prove
|
||||
the Gate House reconciliation contract against accepted event counts.
|
||||
|
||||
## Prove one live PEP consumption path
|
||||
|
||||
```task
|
||||
id: APPROVAL-WP-0002-T05
|
||||
status: todo
|
||||
priority: high
|
||||
```
|
||||
|
||||
Integrate one protected-system consumer under `GH-DEC-2026-003`: claim before
|
||||
decision, CAS consume after ALLOW and before side effect, same-digest retry,
|
||||
different-digest conflict, spent-on-failure behavior, and no protected action
|
||||
when approval-engine is unavailable.
|
||||
Loading…
Add table
Add a link
Reference in a new issue