coulomb/approval-engine
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

APPROVAL-WP-0007-T01 done: required_assurance floor; executor ingress; alignment answer

Browse source 
- Optional required_assurance {"level": aal1|aal2|aal3} at issue, schema v7.
  Enforced at add_entry (403), claim (assurance_unsatisfied) and consume (409)
  from the verified token level only; inherited on supersession; legacy rows
  NULL. Served only when declared so undeclared claims keep exact bytes.
- deploy/networkpolicies.yaml: pod-scoped ingress for sso +
  app.kubernetes.io/name=bounded-executor on 8080 (hub 39a3bffa). Not applied.
- docs/decision-services-alignment-answer.md: owner answer to the NetKingdom
  decision services review (hub 81cafbf3): roles accepted, T02 split proposed,
  presentation_ref at create declined with an entry-level counter-proposal.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5502@bnt-lap001
Assistant-Session: 68b3b02f-5d0f-4e71-8421-796f62e50196
This commit is contained in:
tegwick 2026-10-31 23:07:05 +01:00
parent e5f31477d4
commit e9e9f93317
14 changed files with 540 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

11
workplans/APPROVAL-WP-0007-bounded-execution-carrier.md
View file

@ -26,7 +26,7 @@ their behavior. Native digest, CAS consumption and no-unconsume are unchanged.
```task
id: APPROVAL-WP-0007-T01
status: todo
status: done
priority: high
state_hub_task_id: "9ce0aca8-7694-53c6-a76a-f78d395a9861"
```
@ -41,6 +41,11 @@ accepted, missing level refused, supersede inheritance and the claim
reason_code. Serves BEA-C4. Whether KeyCape emits `aal2` is KeyCape's
question, outside this plan.
Done 2026-10-31 in source (schema v7, `tests/test_required_assurance.py`,
contract in `docs/approval-claim.md`). The member is present only when
declared, so undeclared claims keep their exact bytes for strict readers.
Not released or deployed: a v7 image and a founder-run rollout are still needed.
## Opt-in approver and consumer correspondence
```task
@ -57,6 +62,10 @@ flags:
- `principal_approves`: every entry subject must equal `binding.principal`.
- `actor_consumes`: the consuming subject must equal `binding.actor`.
Owner position 2026-10-31 (`docs/decision-services-alignment-answer.md`):
split it. `actor_consumes` is ready to implement once agreed. `principal_approves`
keeps waiting for the subject mapping and the S5 doctrine.
Today any human with `approval:approve` can approve, and any tenant service
with `approval:consume` can spend the object (a denial-of-run risk). Wait
reason: semantic decision. NetKingdom's actor and principal strings must also