tegwick
d5d1e41035
The example set satisfied §11's both-shapes clause only by accident. Both values of pdp_digest and pdp_path appeared, but they appeared in perfect correlation with validity: claim.valid carried a digest with pdp_path true, claim.revoked carried null with pdp_path false, and nothing else existed. Two independent dimensions presented as one. A reader could reasonably conclude that pdp_digest is null because the claim is revoked, or that pdp_path tracks validity. Both are false, and the example set is what would have taught them -- the failure the both-shapes clause exists to catch, which this repo proposed and then shipped a case of. The missing shape is the consequential one: a claim that is entirely valid -- valid_now true, reason_code ok, not consumed -- and carries no PDP binding. It is usable for a consumer comparing the native binding.digest and unusable on the GH-DEC-2026-003 path, where a PEP MUST refuse it. valid_now true is not permission to proceed on that lane. A consumer writing that refusal previously had no published shape to test against and would have had to invent a fixture, which is the drift §12 names. examples/claim.valid.no-pdp.json publishes it. The tests now assert the decorrelation rather than mere presence: one requires a valid claim with no PDP binding to exist, the other requires valid claims to cover both pdp_path declarations. Verified both fail when the new example is removed, so they hold the property rather than restating today's file list. 121 tests pass. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PM5HnEAhokxdfcPqBNpT7D Assistant: claude-code Assistant-Model: opus Assistant-Process: 715850@bnt-lap001 Assistant-Session: eb557e93-7cb1-45d0-9e57-7d15b3edc60e |
||
|---|---|---|
| approval_engine | ||
| deploy | ||
| docs | ||
| examples | ||
| history | ||
| intakes | ||
| schemas | ||
| tests | ||
| workplans | ||
| .custodian-brief.md | ||
| .gitignore | ||
| .repo-classification.yaml | ||
| AGENTS.md | ||
| cadence.yaml | ||
| Containerfile | ||
| INTENT.md | ||
| layer.yaml | ||
| Makefile | ||
| pyproject.toml | ||
| README.md | ||
| SCOPE.md | ||
| WORK-RECORDS.md | ||
approval-engine
The approval as a durable, authenticated, consumable object — issued before an action, verified at the moment of use, and provably not replayable.
An Engine, role PIP, in the NetKingdom security layer model (statute v0.7,
accepted; operative form net-kingdom/SECURITY-COMPANION.md). It answers one
question, totally and decidably:
Is this approval valid right now — for this exact action, target, actor, and purpose — and has it already been used?
It does not decide whether the action is permitted. That is access-engine,
which stays NetKingdom's only policy decision point. An approval is one input to
that decision.
Deliberately small, boring, and strict: atomic supersession and single
consumption are what make Canon test T-06 — Approval Replay passable.
Flexibility here would be a defect. Graded, evidence-based progression belongs to
maturity-engine; the two engines are deliberate opposites.
See INTENT.md and SCOPE.md. Declaration: layer.yaml.
Claim: docs/approval-claim.md.
Consume: docs/approval-consumption.md.
Caller auth: docs/caller-authentication.md.
PEP sequence: docs/pep-integration.md.
Origin: flex-auth FLEX-DEC-2026-001, raised while assenting to the security
layer model.
make test
approval-engine migrate --db approvals.sqlite
approval-engine verify --db approvals.sqlite
approval-engine serve --db approvals.sqlite \
--jwt-issuer https://auth.netkingdom.local \
--jwt-audience approval-engine \
--jwks-url http://key-cape.sso.svc.cluster.local:8080/jwks
POST /v1/approvals/{id}/consume implements GH-DEC-2026-003: the PEP
atomically spends the approval before the protected side effect. Same-digest
retries are idempotent; a different digest conflicts.
Production operations, caller scopes, audit delivery, and PEP sequencing are
documented in docs/storage-operations.md, docs/caller-authentication.md,
docs/outbox-contract.md, and docs/pep-integration.md. The checked-in
StatefulSet deliberately refuses production startup without a migrated
persistent store, KeyCape JWT verification, and authenticated audit delivery.