coulomb/approval-engine
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
approval-engine/docs/flex-auth-handoff.md
tegwick c3f1dfbc07 Finish approval engine spine 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a05e2e-805b-7042-a750-71f473bceea2
2026-09-01 23:45:48 +02:00

1.3 KiB
Raw Permalink Blame History

Handoff for access-engine / FLEX-WP-0017

FLEX-WP-0017 T03 waited on a durable object that was not the State Hub /decisions/{uuid} shape. That object is this engine.

What exists

  • Claim contract: approval-claim.md
  • Introspection: GET /v1/approvals/{id}/claim
  • Object: POST /v1/approvals, entries, revoke, supersede
  • Consumption: POST /v1/approvals/{id}/consume, called by the PEP before the protected side effect under GH-DEC-2026-003
  • Native binding.digest plus optional binding.pdp_digest for NewDecisionBinding.request_digest

T03 is unblocked on the object, not on a hub substitute. Validate the claim before privileged production actions. Fail closed if this engine is unreachable.

Consumption contract

Gate House settled ordering in GH-DEC-2026-003 and docs/contracts/approval-consumption.md. The PEP presents the decision binding's request_digest and consumes by CAS before the protected side effect. A same-digest retry is idempotent success; a different digest conflicts; there is no unconsume. access-engine remains read-only and never calls this mutation.

Canon T-06 against this implementation: tests/test_t06_replay.py (wrong target, wrong action, later time, revoked, superseded, same-digest retry, and different-digest consume replay).