tegwick
2a5a47df89
The statute is accepted at v0.7; the operative form is net-kingdom/SECURITY-COMPANION.md v0.2. INTENT now declares Engine / PIP in its own voice, carries the §9.6 threat decomposition, the load-bearing heartbeat obligation, issuer and freshness on the claim, consumption as a mutation, and the custody question closed rather than held open. SCOPE.md is the first-cut boundary (nothing shipped). layer.yaml is the machine-readable declaration. The review under history/ scores intent vs scope vs the empty implementation. APPROVAL-WP-0001 sequences contracts before code and keeps consumption unimplemented until GH-WP-0002-T06. Registered with State Hub as infotech / approval-engine. Assistant: grok Assistant-Session: 01a04ceb-2057-7e20-b0f9-c282964d5dd9
202 lines
7 KiB
Markdown
202 lines
7 KiB
Markdown
---
|
|
id: APPROVAL-WP-0001
|
|
type: workplan
|
|
title: "v0.7 alignment and the engine spine"
|
|
domain: infotech
|
|
repo: approval-engine
|
|
status: active
|
|
owner: grok
|
|
topic_slug: netkingdom
|
|
created: "2026-08-29"
|
|
updated: "2026-08-29"
|
|
---
|
|
|
|
# APPROVAL-WP-0001 — v0.7 alignment and the engine spine
|
|
|
|
Evolve this repository from a v0.5 seed INTENT into a v0.7-aligned PIP with
|
|
the contracts and first implementation that make Canon `T-06` passable and
|
|
unblock `FLEX-WP-0017` T03/T05.
|
|
|
|
Source:
|
|
|
|
- `net-kingdom/canon/standards/security-layer-model_v0.7.md` (accepted)
|
|
- `net-kingdom/SECURITY-COMPANION.md` v0.2
|
|
- `history/2026-08-29-security-layer-model-v0.7-scope-intent-review.md`
|
|
- `INTENT.md`, `SCOPE.md`, `layer.yaml`
|
|
|
|
**Rule of the workplan.** Contracts before code. Consumption is not
|
|
implemented until `GH-WP-0002-T06` settles it. A reachable mutation that
|
|
guesses the three races is a defect, not a prototype.
|
|
|
|
Peer work this does not own and must not duplicate: `GH-WP-0002` (T02 outbox
|
|
wire, T03 revocation failure mode, T04 detection surface, T06 consumption
|
|
ordering), `FLEX-WP-0017` T03/T05, `AUDIT-IN-0001`.
|
|
|
|
## T01 — Align declaration to the accepted statute
|
|
|
|
```task
|
|
id: APPROVAL-WP-0001-T01
|
|
status: done
|
|
priority: high
|
|
```
|
|
|
|
2026-08-29: INTENT frontmatter `layer: Engine` / `role: PIP`; aligned to
|
|
v0.7 (PIP typing, threat decomposition, load-bearing cadence, custody
|
|
closed, consumption as mutation, issuer/freshness, Railiance non-axis).
|
|
SCOPE.md written as first-cut boundary with standard sections. `layer.yaml`
|
|
declared in this repository's own voice. Review filed under `history/`.
|
|
Registered with State Hub (`infotech`, topic custodian). Register's
|
|
bootstrap workplan was discarded: it collided on `APPROVAL-WP-0001` and
|
|
its three tasks are already discharged by this file, `AGENTS.md`, and
|
|
`SCOPE.md`.
|
|
|
|
## T02 — Publish the approval claim contract
|
|
|
|
```task
|
|
id: APPROVAL-WP-0001-T02
|
|
status: todo
|
|
priority: high
|
|
```
|
|
|
|
Specify the input claim `access-engine` consumes: approval identifier,
|
|
canonical-binding digest over the same binding the PDP already computes,
|
|
issuer (this engine), and freshness. Schema and examples in-repo.
|
|
|
|
Until Taxonomy's request-claim schema exists (statute §17, ownership
|
|
proposed not assigned), this is the boundary contract. Mark it as yielding
|
|
to Taxonomy; do not treat a local shape as permanent.
|
|
|
|
Acceptance: a document `access-engine` can implement a consumer against
|
|
without reading this engine's source; wrong-action / wrong-target /
|
|
wrong-scope are distinguishable; a PDP can state a deadline for this input
|
|
class.
|
|
|
|
## T03 — Specify the local transactional-outbox contract
|
|
|
|
```task
|
|
id: APPROVAL-WP-0001-T03
|
|
status: todo
|
|
priority: high
|
|
```
|
|
|
|
Event classes (issuance, use, supersession, revocation, and the heartbeat
|
|
class T04 needs), same transaction as the object mutation, queue local to
|
|
this engine, at-least-once into the outbox (`audit-core` dedupes on event
|
|
id). No synchronous `audit-core` call inside the state-change transaction.
|
|
|
|
Coordinate with `GH-WP-0002-T02`; do not author doctrine this engine does
|
|
not own. INTENT already states the boundary and the locality.
|
|
|
|
Acceptance: a wire contract another repository can review; an implementer
|
|
cannot satisfy it by emitting synchronously to `audit-core`.
|
|
|
|
## T04 — Declare load-bearing cadence as heartbeat or reconciliation
|
|
|
|
```task
|
|
id: APPROVAL-WP-0001-T04
|
|
status: todo
|
|
priority: high
|
|
```
|
|
|
|
Approval evidence is load-bearing and low-volume. Rate monitoring is the
|
|
wrong form (statute §9.6). Publish the source-side declaration: expected
|
|
classes, the heartbeat (*nothing to report*, signed, itself able to go
|
|
missing) and/or reconciliation of this engine's transitions against
|
|
`audit-core` event counts per class.
|
|
|
|
Coordinate with `GH-WP-0002-T04`, which is the detection surface. This
|
|
task is the source that surface reads.
|
|
|
|
Acceptance: `layer.yaml` `evidence.cadence_status` is no longer
|
|
`undeclared`; a missing heartbeat or a count divergence is specified as a
|
|
finding, not as a log line.
|
|
|
|
## T05 — Wait on consumption ordering; do not implement it
|
|
|
|
```task
|
|
id: APPROVAL-WP-0001-T05
|
|
status: wait
|
|
priority: high
|
|
```
|
|
|
|
Blocked on `GH-WP-0002-T06` / `access-engine`. The three races (allow never
|
|
consumed; double consumption; consume after failed action) are named in
|
|
statute §9.7.4 and §16. This engine performs the mutation; it does not
|
|
choose the signal, the point relative to the decision, or the handling of
|
|
the three states.
|
|
|
|
Acceptance: a written contract both engines have assented to, recorded
|
|
here, *then* a consume path. Until then, no `consume` endpoint, no inferred
|
|
consumption from a decision record, no demo that "just consumes on allow".
|
|
|
|
## T06 — Durable object, closed state machine, authenticated entries
|
|
|
|
```task
|
|
id: APPROVAL-WP-0001-T06
|
|
status: todo
|
|
priority: high
|
|
```
|
|
|
|
Depends on T02 and T03. Implement the object and the machine in SCOPE:
|
|
identifiers; bindings (action, target, actor, principal, purpose, validity
|
|
window, approvers); authenticated entries; distinct-approver counting;
|
|
CAS supersession; validity/expiry; revocation without holder cooperation.
|
|
|
|
Do not ship a public `consume` until T05 is unblocked. Internal CAS
|
|
consumption may exist behind an unexported seam so T08 can be tested
|
|
without guessing the ordering contract.
|
|
|
|
Acceptance: state transitions are total and reconstructable; two concurrent
|
|
supersessions cannot both succeed; distinct-approver requirements fail
|
|
closed on duplicates; revocation is effective at the next introspection.
|
|
|
|
## T07 — Introspection API as input claims
|
|
|
|
```task
|
|
id: APPROVAL-WP-0001-T07
|
|
status: todo
|
|
priority: high
|
|
```
|
|
|
|
Depends on T02 and T06. An API that answers INTENT's question and returns
|
|
the T02 claim. No endpoint answers "may this actor do X". Fail-closed when
|
|
this engine's own store is unavailable.
|
|
|
|
Acceptance: `access-engine` can fetch a claim; a decision rendered against
|
|
approval A for request R cannot be replayed for R' on the digest; tests
|
|
forbid a decision-shaped response.
|
|
|
|
## T08 — Local outbox in the mutation transaction
|
|
|
|
```task
|
|
id: APPROVAL-WP-0001-T08
|
|
status: todo
|
|
priority: high
|
|
```
|
|
|
|
Depends on T03 and T06. Every issuance, use, supersession, and revocation
|
|
inserts the outbox row in the same transaction. Drain is asynchronous.
|
|
`audit-core` outage does not block a revocation.
|
|
|
|
Acceptance: a test that fails the transaction when emission fails, not an
|
|
inspection of the code; a test that revokes while the evidence engine is
|
|
unreachable; no path where the state change commits and the outbox row
|
|
does not.
|
|
|
|
## T09 — Canon T-06 and the FLEX-WP-0017 handoff
|
|
|
|
```task
|
|
id: APPROVAL-WP-0001-T09
|
|
status: todo
|
|
priority: medium
|
|
```
|
|
|
|
Depends on T07, T08, and T05 (the last only for the consume-side replay
|
|
cases). Point Canon `T-06 — Approval Replay` at a live implementation.
|
|
Hand `access-engine` / `secrets-engine` a claim they can validate before
|
|
privileged production actions (`FLEX-WP-0017` T03/T05).
|
|
|
|
Acceptance: `T-06` passes; T03 is unblocked on the object (not on a hub
|
|
substitute); T05 remains blocked only on consumption ordering if T05 of
|
|
this workplan is still `wait`, never on a missing object or a missing
|
|
digest.
|