- Optional required_assurance {"level": aal1|aal2|aal3} at issue, schema v7.
Enforced at add_entry (403), claim (assurance_unsatisfied) and consume (409)
from the verified token level only; inherited on supersession; legacy rows
NULL. Served only when declared so undeclared claims keep exact bytes.
- deploy/networkpolicies.yaml: pod-scoped ingress for sso +
app.kubernetes.io/name=bounded-executor on 8080 (hub 39a3bffa). Not applied.
- docs/decision-services-alignment-answer.md: owner answer to the NetKingdom
decision services review (hub 81cafbf3): roles accepted, T02 split proposed,
presentation_ref at create declined with an entry-level counter-proposal.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5502@bnt-lap001
Assistant-Session: 68b3b02f-5d0f-4e71-8421-796f62e50196
Updated by fix-consistency on 2026-10-31:
- workplan status: ready → active
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 994874@bnt-lap001
Assistant-Session: 6017c416-d619-47eb-bd1a-f670a02d7d87
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 994874@bnt-lap001
Assistant-Session: 6017c416-d619-47eb-bd1a-f670a02d7d87
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 994874@bnt-lap001
Assistant-Session: 6017c416-d619-47eb-bd1a-f670a02d7d87
Owner answer in docs/bounded-execution-admission-carrier.md: binding, consume
and revoke are supported today; aal2 is recorded but not enforced. Workplan
APPROVAL-WP-0007 proposes an assurance floor, opt-in approver/consumer
correspondence, revoker evidence and a synthetic carrier proof.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 994874@bnt-lap001
Assistant-Session: 6017c416-d619-47eb-bd1a-f670a02d7d87
The claims name the workloads covered by RELREG-WP-0004. Each pin is a digest the live object already shows.
Assistant: grok
Assistant-Session: 01a16880-25e0-7031-b553-a1e0321ff397
Reconfirm that approval-engine-operator has no presenter and accept the amended CCR-2026-0018 removal. Name the separate create-only informed-decision requester. Keep the Access claim and fractional-time tasks waiting on consumer evidence, and refresh the repository-rename intake check.
Assistant: grok
Assistant-Session: 01a16889-9224-7ec0-bee0-2a46dd3819c4
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 8340@bnt-lap001
Assistant-Session: 2e192b3d-b3e8-4403-94d4-d55a2c8b476c
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 1370019@bnt-lap001
Assistant-Session: d462dd63-16de-4189-ae70-b9cd6566bf87
WP-0001 and WP-0003 are already finished with no open tasks. WP-0002's
remaining tasks (T01, T04, T05) are all gated on external owners
(KeyCape, audit-core, secrets-engine, platform credential custody);
nothing in this repo's own surface moves them forward.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: sonnet
Assistant-Process: 230497@bnt-lap001
Assistant-Session: 418cd0ab-dc61-43d8-8828-9ed571ac5c70
expired stays a terminal exit from valid (state machine unchanged),
but supersede() now also accepts it as a source status when the
caller supplies a validity window, linking a new successor approval
to the expired original instead of requiring a caller to mint an
unlinked replacement from scratch. Without a fresh window, an expired
source still conflicts exactly as before.
The original's status becomes superseded (not left as a bare dead-end
expired) and superseded_by points at the successor, so the link is
documented rather than hidden -- informed-decision's overview already
renders this automatically, no changes needed there.
Prompted by the operator missing infd-20260927-b01's approval window
during today's key-cape login outage (APPROVAL-WP-0003).
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: sonnet
Assistant-Process: 169987@bnt-lap001
Assistant-Session: 322ef1ef-9048-4021-8570-b6d6f6347999
A12 r2 reaches every key and value of the declaration, including the
companion's version. The standard: path in INTENT.md was already
unversioned and is unchanged. tests/test_layer_declaration.py fails if a
version key, a versioned standard path, or companion_version returns to
the INTENT.md frontmatter or layer.yaml; schema_version and comments are
not reached. One prose citation ("the v0.5 scope rule") in a rationale
value is allowlisted by exact text and reported to gate-house as open.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 63291@bnt-lap001
Assistant-Session: 8bd77868-ca68-4f49-bb1e-d539ecc0d703
Verified against gate-house's committed files before editing: GH-DEC-2026-017
in decisions/decisions.md and amendments A9-A13 in
docs/amendments/v0.8-section-11-declaration-amendments.md, then ops-warden's
reference change set (wiki/playbooks/netkingdom-layer-declaration.md and its
applied instance, ops-warden a70f559). Ruling and playbook agree.
layer.yaml: standard_version removed; marked derived: true / derived_from:
INTENT.md; header rewritten to say it does not govern and that a post-fold
disagreement between the forms is a finding. The Framework comment is
de-versioned for the same reason.
INTENT.md: the frontmatter layer: key is the declaration. It carried no
standard_version key, but its standard: path pinned _v0.7.md; de-versioned as
the reference instance did, since a pinned path reads as a validity condition.
Prose citing v0.7 as the accepted statute is left as is.
NO LAYER VALUE IS CHANGED. INTENT.md says Engine, layer.yaml says engine; the
section 3 vocabulary is closed and compared after an ASCII fold, so they agree.
No conformance checker exists in this repository, and no test reads
standard_version, so nothing else had to change with the field. Test suite:
156 passed. companion_version and schema_version are left untouched; the
ruling does not cover them.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 63291@bnt-lap001
Assistant-Session: 8bd77868-ca68-4f49-bb1e-d539ecc0d703
Set flavor on open workplans from origin/prose/status. Copy existing
depends_on aliases only. Do not promote residuals.
Assistant: grok
Assistant-Session: 01a09dc1-b21e-77e1-919e-fcad2f82b267
