tegwick
35fee0ea84
Condition of audit-core's assent to the approval evidence half (AUDIT-IN-0001), now in the standard at §9.4. Every issuance, use, supersession, and revocation is emitted in the same transaction as the state change. Emit-after-commit is a defect, not an optimization. The reasoning is carried here rather than by reference because it constrains implementation from the first commit: an append-only archive proves records were not altered or truncated after arrival, but cannot prove one was never sent (§9.6). A suppressed event leaves the chain intact and verification reports intact. For approvals the most valuable event to suppress is a revocation, so completeness is this engine's obligation and nothing downstream can retrofit it. Also records that audit-core's guarantee is bounded — not WORM, not object lock, tamper evidence conditional on live preconditions — and that whether approvals warrant stronger custody is an open gap this engine must not assume closed. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 2564823@bnt-lap001 Assistant-Session: 2a7ed827-4928-4b9f-8613-9135c9cadfe9 |
||
|---|---|---|
| INTENT.md | ||
| README.md | ||
approval-engine
The approval as a durable, authenticated, consumable object — issued before an action, verified at the moment of use, and provably not replayable.
An Engine in the NetKingdom security layer model. It answers one question, totally and decidably:
Is this approval valid right now — for this exact action, target, actor, and purpose — and has it already been used?
It does not decide whether the action is permitted. That is access-engine,
which stays NetKingdom's only policy decision point. An approval is one input to
that decision.
Deliberately small, boring, and strict: atomic supersession and single
consumption are what make Canon test T-06 — Approval Replay passable.
Flexibility here would be a defect. Graded, evidence-based progression belongs to
maturity-engine; the two engines are deliberate opposites.
See INTENT.md. Origin: flex-auth FLEX-DEC-2026-001, raised while
assenting to the security layer model.