---
id: APPROVAL-WP-0001
type: workplan
title: "v0.7 alignment and the engine spine"
domain: infotech
repo: approval-engine
status: active
owner: grok
topic_slug: netkingdom
created: "2026-08-29"
updated: "2026-08-29"
---

# APPROVAL-WP-0001 — v0.7 alignment and the engine spine

Evolve this repository from a v0.5 seed INTENT into a v0.7-aligned PIP with
the contracts and first implementation that make Canon `T-06` passable and
unblock `FLEX-WP-0017` T03/T05.

Source:

- `net-kingdom/canon/standards/security-layer-model_v0.7.md` (accepted)
- `net-kingdom/SECURITY-COMPANION.md` v0.2
- `history/2026-08-29-security-layer-model-v0.7-scope-intent-review.md`
- `INTENT.md`, `SCOPE.md`, `layer.yaml`

**Rule of the workplan.** Contracts before code. Consumption is not
implemented until `GH-WP-0002-T06` settles it. A reachable mutation that
guesses the three races is a defect, not a prototype.

Peer work this does not own and must not duplicate: `GH-WP-0002` (T02 outbox
wire, T03 revocation failure mode, T04 detection surface, T06 consumption
ordering), `FLEX-WP-0017` T03/T05, `AUDIT-IN-0001`.

## T01 — Align declaration to the accepted statute

```task
id: APPROVAL-WP-0001-T01
status: done
priority: high
```

2026-08-29: INTENT frontmatter `layer: Engine` / `role: PIP`; aligned to
v0.7 (PIP typing, threat decomposition, load-bearing cadence, custody
closed, consumption as mutation, issuer/freshness, Railiance non-axis).
SCOPE.md written as first-cut boundary with standard sections. `layer.yaml`
declared in this repository's own voice. Review filed under `history/`.
Registered with State Hub (`infotech`, topic custodian). Register's
bootstrap workplan was discarded: it collided on `APPROVAL-WP-0001` and
its three tasks are already discharged by this file, `AGENTS.md`, and
`SCOPE.md`.

## T02 — Publish the approval claim contract

```task
id: APPROVAL-WP-0001-T02
status: todo
priority: high
```

Specify the input claim `access-engine` consumes: approval identifier,
canonical-binding digest over the same binding the PDP already computes,
issuer (this engine), and freshness. Schema and examples in-repo.

Until Taxonomy's request-claim schema exists (statute §17, ownership
proposed not assigned), this is the boundary contract. Mark it as yielding
to Taxonomy; do not treat a local shape as permanent.

Acceptance: a document `access-engine` can implement a consumer against
without reading this engine's source; wrong-action / wrong-target /
wrong-scope are distinguishable; a PDP can state a deadline for this input
class.

## T03 — Specify the local transactional-outbox contract

```task
id: APPROVAL-WP-0001-T03
status: todo
priority: high
```

Event classes (issuance, use, supersession, revocation, and the heartbeat
class T04 needs), same transaction as the object mutation, queue local to
this engine, at-least-once into the outbox (`audit-core` dedupes on event
id). No synchronous `audit-core` call inside the state-change transaction.

Coordinate with `GH-WP-0002-T02`; do not author doctrine this engine does
not own. INTENT already states the boundary and the locality.

Acceptance: a wire contract another repository can review; an implementer
cannot satisfy it by emitting synchronously to `audit-core`.

## T04 — Declare load-bearing cadence as heartbeat or reconciliation

```task
id: APPROVAL-WP-0001-T04
status: todo
priority: high
```

Approval evidence is load-bearing and low-volume. Rate monitoring is the
wrong form (statute §9.6). Publish the source-side declaration: expected
classes, the heartbeat (*nothing to report*, signed, itself able to go
missing) and/or reconciliation of this engine's transitions against
`audit-core` event counts per class.

Coordinate with `GH-WP-0002-T04`, which is the detection surface. This
task is the source that surface reads.

Acceptance: `layer.yaml` `evidence.cadence_status` is no longer
`undeclared`; a missing heartbeat or a count divergence is specified as a
finding, not as a log line.

## T05 — Wait on consumption ordering; do not implement it

```task
id: APPROVAL-WP-0001-T05
status: wait
priority: high
```

Blocked on `GH-WP-0002-T06` / `access-engine`. The three races (allow never
consumed; double consumption; consume after failed action) are named in
statute §9.7.4 and §16. This engine performs the mutation; it does not
choose the signal, the point relative to the decision, or the handling of
the three states.

Acceptance: a written contract both engines have assented to, recorded
here, *then* a consume path. Until then, no `consume` endpoint, no inferred
consumption from a decision record, no demo that "just consumes on allow".

## T06 — Durable object, closed state machine, authenticated entries

```task
id: APPROVAL-WP-0001-T06
status: todo
priority: high
```

Depends on T02 and T03. Implement the object and the machine in SCOPE:
identifiers; bindings (action, target, actor, principal, purpose, validity
window, approvers); authenticated entries; distinct-approver counting;
CAS supersession; validity/expiry; revocation without holder cooperation.

Do not ship a public `consume` until T05 is unblocked. Internal CAS
consumption may exist behind an unexported seam so T08 can be tested
without guessing the ordering contract.

Acceptance: state transitions are total and reconstructable; two concurrent
supersessions cannot both succeed; distinct-approver requirements fail
closed on duplicates; revocation is effective at the next introspection.

## T07 — Introspection API as input claims

```task
id: APPROVAL-WP-0001-T07
status: todo
priority: high
```

Depends on T02 and T06. An API that answers INTENT's question and returns
the T02 claim. No endpoint answers "may this actor do X". Fail-closed when
this engine's own store is unavailable.

Acceptance: `access-engine` can fetch a claim; a decision rendered against
approval A for request R cannot be replayed for R' on the digest; tests
forbid a decision-shaped response.

## T08 — Local outbox in the mutation transaction

```task
id: APPROVAL-WP-0001-T08
status: todo
priority: high
```

Depends on T03 and T06. Every issuance, use, supersession, and revocation
inserts the outbox row in the same transaction. Drain is asynchronous.
`audit-core` outage does not block a revocation.

Acceptance: a test that fails the transaction when emission fails, not an
inspection of the code; a test that revokes while the evidence engine is
unreachable; no path where the state change commits and the outbox row
does not.

## T09 — Canon T-06 and the FLEX-WP-0017 handoff

```task
id: APPROVAL-WP-0001-T09
status: todo
priority: medium
```

Depends on T07, T08, and T05 (the last only for the consume-side replay
cases). Point Canon `T-06 — Approval Replay` at a live implementation.
Hand `access-engine` / `secrets-engine` a claim they can validate before
privileged production actions (`FLEX-WP-0017` T03/T05).

Acceptance: `T-06` passes; T03 is unblocked on the object (not on a hub
substitute); T05 remains blocked only on consumption ordering if T05 of
this workplan is still `wait`, never on a missing object or a missing
digest.