tegwick
c3f1dfbc07
Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a05e2e-805b-7042-a750-71f473bceea2
31 lines
1.3 KiB
Markdown
31 lines
1.3 KiB
Markdown
# Handoff for `access-engine` / `FLEX-WP-0017`
|
|
|
|
`FLEX-WP-0017` T03 waited on a durable object that was not the State Hub
|
|
`/decisions/{uuid}` shape. That object is this engine.
|
|
|
|
## What exists
|
|
|
|
- Claim contract: [`approval-claim.md`](approval-claim.md)
|
|
- Introspection: `GET /v1/approvals/{id}/claim`
|
|
- Object: `POST /v1/approvals`, entries, revoke, supersede
|
|
- Consumption: `POST /v1/approvals/{id}/consume`, called by the PEP before the
|
|
protected side effect under `GH-DEC-2026-003`
|
|
- Native `binding.digest` plus optional `binding.pdp_digest` for
|
|
`NewDecisionBinding.request_digest`
|
|
|
|
T03 is unblocked on the **object**, not on a hub substitute. Validate the
|
|
claim before privileged production actions. Fail closed if this engine is
|
|
unreachable.
|
|
|
|
## Consumption contract
|
|
|
|
Gate House settled ordering in `GH-DEC-2026-003` and
|
|
`docs/contracts/approval-consumption.md`. The PEP presents the decision
|
|
binding's `request_digest` and consumes by CAS before the protected side
|
|
effect. A same-digest retry is idempotent success; a different digest conflicts;
|
|
there is no unconsume. `access-engine` remains read-only and never calls this
|
|
mutation.
|
|
|
|
Canon T-06 against this implementation: `tests/test_t06_replay.py` (wrong
|
|
target, wrong action, later time, revoked, superseded, same-digest retry, and
|
|
different-digest consume replay).
|