coulomb/approval-engine
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
An engine for modelling and managing decisions.
4 commits 1 branch 0 tags 208 KiB
Find a file
tegwick ab5d69e8f1 Local outbox, claim shape, and the unresolved consumption ordering 
From the v0.5 review round.

- The outbox is local, in this engine's own transactional store, with no
  synchronous audit-core dependency inside the state-change transaction. Raised
  by audit-core: "or equivalent" would otherwise let an implementer satisfy
  atomicity by emitting synchronously, turning an audit outage into an
  inability to revoke.
- The claim must carry the approval identifier and a digest over the same
  canonical binding access-engine already computes, so "approved" and "approved
  for this exact request" are distinguishable at decision time. Raised by
  flex-auth, needed for FLEX-WP-0017 T05.
- Consumption ordering is recorded as UNRESOLVED rather than guessed. The
  decision precedes the action and the action precedes consumption, so an
  allow never consumed, a double consumption by racing callers, and consumption
  after a failed action are gaps neither engine closes alone. Nothing may be
  implemented by assuming that contract.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 2564823@bnt-lap001
Assistant-Session: 2a7ed827-4928-4b9f-8613-9135c9cadfe9
2026-08-29 02:54:49 +02:00
INTENT.md Local outbox, claim shape, and the unresolved consumption ordering 2026-08-29 02:54:49 +02:00
README.md Seed INTENT and correct the README's concept 2026-08-28 22:33:50 +02:00

README.md

approval-engine

The approval as a durable, authenticated, consumable object — issued before an action, verified at the moment of use, and provably not replayable.

An Engine in the NetKingdom security layer model. It answers one question, totally and decidably:

Is this approval valid right now — for this exact action, target, actor, and purpose — and has it already been used?

It does not decide whether the action is permitted. That is access-engine, which stays NetKingdom's only policy decision point. An approval is one input to that decision.

Deliberately small, boring, and strict: atomic supersession and single consumption are what make Canon test T-06 — Approval Replay passable. Flexibility here would be a defect. Graded, evidence-based progression belongs to maturity-engine; the two engines are deliberate opposites.

See INTENT.md. Origin: flex-auth FLEX-DEC-2026-001, raised while assenting to the security layer model.