coulomb/approval-engine
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
An engine for modelling and managing decisions.
15 commits 1 branch 0 tags 208 KiB
Find a file
tegwick c3f1dfbc07 Finish approval engine spine 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a05e2e-805b-7042-a750-71f473bceea2
2026-09-01 23:45:48 +02:00
approval_engine Finish approval engine spine 2026-09-01 23:45:48 +02:00
docs Finish approval engine spine 2026-09-01 23:45:48 +02:00
examples Implement the engine spine: claim, outbox, machine, API 2026-08-29 12:52:49 +02:00
history Align to security layer model v0.7 and open the engine spine 2026-08-29 11:58:28 +02:00
intakes Finish approval engine spine 2026-09-01 23:45:48 +02:00
schemas Implement the engine spine: claim, outbox, machine, API 2026-08-29 12:52:49 +02:00
tests Finish approval engine spine 2026-09-01 23:45:48 +02:00
workplans Finish approval engine spine 2026-09-01 23:45:48 +02:00
.custodian-brief.md chore(consistency): sync task status from DB [auto] 2026-09-01 20:45:52 +02:00
.gitignore Implement the engine spine: claim, outbox, machine, API 2026-08-29 12:52:49 +02:00
.repo-classification.yaml Add repo classification to close C-24/C-35 2026-08-29 14:43:52 +02:00
AGENTS.md Finish approval engine spine 2026-09-01 23:45:48 +02:00
cadence.yaml Finish approval engine spine 2026-09-01 23:45:48 +02:00
INTENT.md Finish approval engine spine 2026-09-01 23:45:48 +02:00
layer.yaml Implement the engine spine: claim, outbox, machine, API 2026-08-29 12:52:49 +02:00
Makefile Implement the engine spine: claim, outbox, machine, API 2026-08-29 12:52:49 +02:00
pyproject.toml Implement the engine spine: claim, outbox, machine, API 2026-08-29 12:52:49 +02:00
README.md Finish approval engine spine 2026-09-01 23:45:48 +02:00
SCOPE.md Finish approval engine spine 2026-09-01 23:45:48 +02:00
WORK-RECORDS.md Finish approval engine spine 2026-09-01 23:45:48 +02:00

README.md

approval-engine

The approval as a durable, authenticated, consumable object — issued before an action, verified at the moment of use, and provably not replayable.

An Engine, role PIP, in the NetKingdom security layer model (statute v0.7, accepted; operative form net-kingdom/SECURITY-COMPANION.md). It answers one question, totally and decidably:

Is this approval valid right now — for this exact action, target, actor, and purpose — and has it already been used?

It does not decide whether the action is permitted. That is access-engine, which stays NetKingdom's only policy decision point. An approval is one input to that decision.

Deliberately small, boring, and strict: atomic supersession and single consumption are what make Canon test T-06 — Approval Replay passable. Flexibility here would be a defect. Graded, evidence-based progression belongs to maturity-engine; the two engines are deliberate opposites.

See INTENT.md and SCOPE.md. Declaration: layer.yaml. Claim: docs/approval-claim.md. Consume: docs/approval-consumption.md. Origin: flex-auth FLEX-DEC-2026-001, raised while assenting to the security layer model.

make test
python3 -m approval_engine.cli serve --db approvals.sqlite

POST /v1/approvals/{id}/consume implements GH-DEC-2026-003: the PEP atomically spends the approval before the protected side effect. Same-digest retries are idempotent; a different digest conflicts.