approval-engine/workplans/APPROVAL-WP-0007-bounded-execution-carrier.md at e9e9f933174601931d0e0a8dd85df5388b86d174

tegwick e9e9f93317 APPROVAL-WP-0007-T01 done: required_assurance floor; executor ingress; alignment answer

- Optional required_assurance {"level": aal1|aal2|aal3} at issue, schema v7.
  Enforced at add_entry (403), claim (assurance_unsatisfied) and consume (409)
  from the verified token level only; inherited on supersession; legacy rows
  NULL. Served only when declared so undeclared claims keep exact bytes.
- deploy/networkpolicies.yaml: pod-scoped ingress for sso +
  app.kubernetes.io/name=bounded-executor on 8080 (hub 39a3bffa). Not applied.
- docs/decision-services-alignment-answer.md: owner answer to the NetKingdom
  decision services review (hub 81cafbf3): roles accepted, T02 split proposed,
  presentation_ref at create declined with an entry-level counter-proposal.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5502@bnt-lap001
Assistant-Session: 68b3b02f-5d0f-4e71-8421-796f62e50196

2026-10-31 23:07:05 +01:00

4.2 KiB

Raw Blame History

type

title

domain

repo

status

flavor

owner

topic_slug

created

updated

depends_on

state_hub_workstream_id

APPROVAL-WP-0007

workplan

Bounded-execution admission carrier: assurance floor, correspondence and revoker evidence

infotech

approval-engine

active

implementation

approval-engine

netkingdom

2026-10-31

af365506-f451-50b5-a0a2-f0ba9a0a4d9c

Demand: NetKingdom NK-WP-0056-T02 owner request (hub message 40344380-ea33-4670-9b27-dafca1699d36) to carry a Bounded Execution Admission v0.1 (proposed) as an approval. Owner answer: docs/bounded-execution-admission-carrier.md. The binding, consume and revoke already work. This plan closes the engine-side gaps the answer found. Every change is opt-in at issue, so existing approvals and consumers keep their behavior. Native digest, CAS consumption and no-unconsume are unchanged.

Declared minimum approver assurance

id: APPROVAL-WP-0007-T01
status: done
priority: high
state_hub_task_id: "9ce0aca8-7694-53c6-a76a-f78d395a9861"

Add an optional required_assurance (minimum level, ordered aal1 < aal2 < aal3) to POST /v1/approvals. Store it and serve it in the object and the claim, and inherit it on supersede. add_entry refuses an entry whose verified token assurance.level is weaker or missing. _evaluate and consume refuse when an existing entry does not meet it. Schema migration leaves old rows NULL, meaning no floor. Tests cover aal1 refused, aal2 accepted, missing level refused, supersede inheritance and the claim reason_code. Serves BEA-C4. Whether KeyCape emits aal2 is KeyCape's question, outside this plan.

Done 2026-10-31 in source (schema v7, tests/test_required_assurance.py, contract in docs/approval-claim.md). The member is present only when declared, so undeclared claims keep their exact bytes for strict readers. Not released or deployed: a v7 image and a founder-run rollout are still needed.

Opt-in approver and consumer correspondence

id: APPROVAL-WP-0007-T02
status: wait
priority: medium
state_hub_task_id: "9657820d-23f9-54d9-920c-8f2a72110ad0"

Proposal for owner and Gate House agreement before implementation, because it gives principal and actor an enforced meaning. Two optional issue flags:

principal_approves: every entry subject must equal binding.principal.
actor_consumes: the consuming subject must equal binding.actor.

Owner position 2026-10-31 (docs/decision-services-alignment-answer.md): split it. actor_consumes is ready to implement once agreed. principal_approves keeps waiting for the subject mapping and the S5 doctrine.

Today any human with approval:approve can approve, and any tenant service with approval:consume can spend the object (a denial-of-run risk). Wait reason: semantic decision. NetKingdom's actor and principal strings must also match KeyCape subjects exactly.

Revoker identity in revocation evidence

id: APPROVAL-WP-0007-T03
status: todo
priority: medium
state_hub_task_id: "7ceb5ffd-3ba8-5e9d-96a2-5e89c38a5c43"

Record the verified revoker's subject, principal_type and assurance, plus an optional bounded reason, in the approval.revocation outbox event. Persist them on the object (the revoked_by fields) without changing the CAS or terminal semantics. This is the evidence for the founder's pre-start kill switch (NK-WP-0056-T07). Do not require the revoker to equal the principal: revocation must stay possible without the holder.

Synthetic bounded-execution carrier proof

id: APPROVAL-WP-0007-T04
status: todo
priority: medium
state_hub_task_id: "673890fe-3d49-5fe3-8ad7-c8c73e4d9376"

Add an in-process test and an example request covering the full path: the executor (service) creates the request (action: bounded-execution, target: {admission_id, admission_digest}, human_control: true, pdp_path: false); a human aal2 entry approves it; GET binding comparison; consume with request_digest = admission digest; idempotent retry; a different digest returns 409; revoke before consume gives 409 on consume; consumption outside the window is refused. Synthetic fixtures only, with no live service.

Founder decision 2026-10-31

Approved by the founder (proposed -> ready) after the NK-WP-0056-T02 owner answers (hub decision 19afd15e).

4.2 KiB Raw Blame History