coulomb/emergent-security
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Record the offline access-engine admission branch

Browse source 
Compact-sitting v8 keeps pinned memos on the exact-record rules and admits
nobody while the submitter registry is empty. The deployed image pin is
unchanged, and EMERGENT-WP-0002 stays blocked.

Assistant: grok
Assistant-Session: 01a10286-9185-7bb2-b411-89cf6ab4c0c6
This commit is contained in:
tegwick 2026-10-03 22:06:14 +02:00
parent 4c11caa1aa
commit 51c7b69417
2 changed files with 6 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

2
docs/decision-runbook-integration.md
View file

@ -83,7 +83,7 @@ historical; it is not silently relabeled as evidence for 0.2.0.
| Dependency | Current evidence and next step | Live work record |
| --- | --- | --- |
| Automated memo submission | An offline intake service, schema-3 ledger, and durable outbox exist. Registries are empty and transports are injected. audit-core `70e4044` registers `informed-decision.memo.posed` locally and is not deployed. state-hub `49eeddb` adds a dev forwarding fixture and a deduplicated notification; no live submitter is registered and the write-back flag stays unset. Listener deployment, workload custody, admission activation, and live rollout remain blocked. A creating approval without a retained receipt is not retried. Keep the local draft ready and use the attended route when submission is authorized. Do not mint a submitter grant. | INFD-WP-0005 T05–T08 and T10; EMERGENT-WP-0002 T02/T09 |
| Automated memo submission | An offline intake service, schema-3 ledger, and durable outbox exist. Registries are empty and transports are injected. audit-core `70e4044` registers `informed-decision.memo.posed` locally and is not deployed. state-hub `49eeddb` adds a dev forwarding fixture and a deduplicated notification; no live submitter is registered and the write-back flag stays unset. access-engine `e85f511` adds an offline compact-sitting v8 branch with empty admit sets; the deployed image pin is unchanged. Listener deployment, workload custody, admission activation, and live rollout remain blocked. A creating approval without a retained receipt is not retried. Keep the local draft ready and use the attended route when submission is authorized. Do not mint a submitter grant. | INFD-WP-0005 T05–T08 and T10; EMERGENT-WP-0002 T02/T09 |
| Profile adoption | Owner review must decide accuracy/publication, class/group and the exact submission path. Drafting is already authorized; no human answer or owner assent has been fabricated. | Decision `d20a9750-2b29-534e-8227-fb866581a6ca`; EMERGENT-WP-0002 T02 |
| Engine execution/index | Automatic step execution, estate index and inter-pack dependencies remain deliberately deferred. Use explicit owner pack paths. No need to implement these to use the preparation pack. | RBT-WP-0006; existing decision `1e517449-2114-4a8f-9c6b-fcdbe977378e` |
| Runtime enforcement bridge | Pack actor/privilege/authorized_by fields and local waivers are not authenticated owner facts. No external approval/PDP gate plugin is claimed. Future execution requires an exact owner design, not a generic `approved: true` field. | EMERGENT-WP-0002 T06 mapping; RBT-WP-0006 T01/T06 |

7
workplans/EMERGENT-WP-0002-agent-security-knowledge-and-netkingdom-integration.md
View file

@ -725,8 +725,11 @@ state-hub `49eeddb` adds a dev-only forwarding fixture and a notification
limited to id, question, class, and submitter. No service account was admitted,
no live submitter was registered, and the write-back flag stays unset.
The access-engine attribute branch was still an uncommitted working tree when
this note was written. It is not admission and it is not deployed.
access-engine `e85f511` adds compact-sitting v8 beside the exact-record rules.
Requests for a pinned memo stay on those rules. The generated submitter and
class sets are empty, so an unpinned memo denies with `unknown_class`.
`attribute_eligible` checks id and digest shape and does not read an approval.
The deployed image pin is unchanged. This is not live admission.
T02, T05, T07, T08, T09, and T10 stay **wait**. The plan stays **blocked**.
No DoD-Ok is claimed.