coulomb/approval-engine
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Preserve fractional approval expiry through atomic consumption

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a140c4-354a-7823-8f0d-8f717397f786
This commit is contained in:
tegwick 2026-10-16 17:35:53 +02:00
parent 3485415b82
commit d40e842052
6 changed files with 271 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

18
docs/approval-consumption.md
View file

@ -42,6 +42,24 @@ after consumption, the approval remains spent and a retry needs a new approval.
The response is mutation evidence, not a permission decision. It contains no
`effect`, `allow`, `deny`, or decision result.
## Authoritative time and fractional precision
New source preserves the actual aware UTC clock's microseconds rather than
rounding down to whole seconds. The first consume samples one instant after
`BEGIN IMMEDIATE` acquires its write lock, then uses that instant for the
not-before/inclusive and expiry/exclusive check, persisted `consumed_at` and
`updated_at`, and use-event occurrence/creation time. Lock wait cannot borrow
an earlier validity instant or stamp evidence before actual admission.
Existing whole-second ISO strings remain valid and are never backfilled with
invented fractions. Idempotent responses and object readback retain the original
recorded timestamp/decision exactly, even after expiry; they do not renew
execution authority. The store schema, API keys, CAS/digest correspondence and
no-unconsume rule are unchanged. Claim observation/freshness and other new
source timestamps also retain actual clock precision. Consumers must parse
aware ISO/RFC3339 timestamps including fractional seconds instead of assuming
a fixed-width whole-second string. No clock skew or early-use tolerance is added.
## The claim response is not an `ActionAuthorization`
`GET /v1/approvals/{id}/claim` serves the **approval-claim** envelope defined in

46
docs/reviews/2026-10-16-fractional-consumption-temporal-approval-owner-review.json Normal file
View file

@ -0,0 +1,46 @@
{
"reviewer": "approval-engine-owner (agent approval-engine, codex)",
"decision": "approved",
"comment": "INTENT Purpose (valid right now), The Claim Shape and Consumption Ordering: approved for bounded Approval source time precision repair and Approval-owned fact/temporal correspondence in exact Access R3 source. Work APPROVAL-WP-0006-T01/T02. Repair patch SHA256 sha256:74eb0ff67d14508c2a2cee14d055790321ee171a96d5290ad6d037ce8f61dbcd against 3485415b823faf4f3b682079195e186666b0ed2b; store.py SHA256 sha256:866b275ed2d844d0aa9090ce9899ce955c6bfe32a493c2645c86e72efa343e86. Access R3 full patch SHA256 sha256:46bfeb706d3a88bf6054309cc9303eb360a91e57dda3b0fcbb7b80d551a75db6, delta sha256:17ecf399c50c07845c545b31cad4022200eb20dfb760595aa76a271e9cee7521; all 31 frozen source hashes matched. This review does not assent to Access policy/other-owner behavior, native credentials/trust, deployment or effects.",
"reviewed_repair_patch_sha256": "sha256:74eb0ff67d14508c2a2cee14d055790321ee171a96d5290ad6d037ce8f61dbcd",
"reviewed_access_full_r3_sha256": "sha256:46bfeb706d3a88bf6054309cc9303eb360a91e57dda3b0fcbb7b80d551a75db6",
"reviewed_access_r2_to_r3_sha256": "sha256:17ecf399c50c07845c545b31cad4022200eb20dfb760595aa76a271e9cee7521",
"approval_time_findings": [
"utc_now and iso preserve actual aware microseconds; no schema or binding algorithm change",
"First consume samples one authoritative time only after BEGINIMMEDIATE obtains the lock; identical instant checks validity, persists receipt/update and creates use outbox timestamp",
"Expiry remains exclusive; actual clock .750 refuses expiry .500; post-lock expiry cannot borrow pre-lock admission",
"Whole-second old rows, readback and idempotent original decision/timestamp are preserved without fabricated precision; no unconsume, retry authority or tolerance",
"No Access NotBefore backdating, caller wait/sleep acceptance or consumer timing waiver is needed"
],
"access_fact_temporal_findings": [
"Signed claim-free DENY normalization receipt supplies existing producer-evaluated native act and approval-free digest before issue, never permission; requester consumer independently authenticates it",
"Actual retained registry normalization is source-owned and number-preserving; final join compares the approved act/PDP digest and refuses drift instead of refreshing old context",
"Original and newly fetched facts are validated separately; no mutation of original claim/context or either request digest",
"Exact immutable operation deadline must fit caller, original/fetched freshness and approval validity; decision is precise post-evaluation NotBefore to exact operation deadline",
"Entire remaining interval must cover declared backendTTL plus 5-second cleanup reserve and source maximum 120; this review does not approve that policy or native budget",
"Default Approval freshness 30 cannot satisfy minimum 30+5; fixture freshness 120 is explicit synthetic configuration, not a producer default flip or native grant"
],
"validation": {
"repair_focused_passed": 89,
"repair_full_passed": 298,
"repair_full_failed_preexisting": 1,
"baseline_counterexamples_failed": 5,
"access_independent_command": "go test -race -count=1 ./internal/decision ./cmd/access-engine -run TestTrusted",
"access_independent_result": "passed"
},
"retained_failures": [
"coordinator-counterexample.json documents canonical expired fractional approval consumed",
"Initial repair expiry test attempted already-expired issuance; repaired engine correctly refused; fixture corrected to issue before expiry then advance",
"Existing deployment pin/historical release evidence mismatch remains unchanged"
],
"prior_evidence": "WP0005 closure and6079edR1review remain exact historical evidence; this is a new precision task and new exactR3 review",
"remaining_gates": [
"Coordinator independent source integration/publication/synchronization at exact repair and Access/Secrets successor source pins",
"Actual immediate strict CAS/whole-path remeasurement must use unchanged precise signed NotBefore and no sleep/waiver",
"Native issuer/profile, CA/source/read credential/store tenant admission and schema/image/config rollout remain existing WP0002T01",
"Actual use event/audit receiver reconciliation remains WP0002T04",
"Served PEP original decision/request CAS before effect, live one-shot journal, deadlines and confirmed cleanup remain WP0002T05 and existing Secrets/Platform work"
],
"native_accepted": false,
"authority_promotion": false
}