coulomb/emergent-security
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Record the offline access-engine admission branch

Browse source 
Compact-sitting v8 keeps pinned memos on the exact-record rules and admits
nobody while the submitter registry is empty. The deployed image pin is
unchanged, and EMERGENT-WP-0002 stays blocked.

Assistant: grok
Assistant-Session: 01a10286-9185-7bb2-b411-89cf6ab4c0c6
This commit is contained in:
tegwick 2026-10-03 22:06:14 +02:00
parent 4c11caa1aa
commit 51c7b69417
2 changed files with 6 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

2
docs/decision-runbook-integration.md
View file

@ -83,7 +83,7 @@ historical; it is not silently relabeled as evidence for 0.2.0.
| Dependency | Current evidence and next step | Live work record | | Dependency | Current evidence and next step | Live work record |
| --- | --- | --- | | --- | --- | --- |
| Automated memo submission | An offline intake service, schema-3 ledger, and durable outbox exist. Registries are empty and transports are injected. audit-core `70e4044` registers `informed-decision.memo.posed` locally and is not deployed. state-hub `49eeddb` adds a dev forwarding fixture and a deduplicated notification; no live submitter is registered and the write-back flag stays unset. Listener deployment, workload custody, admission activation, and live rollout remain blocked. A creating approval without a retained receipt is not retried. Keep the local draft ready and use the attended route when submission is authorized. Do not mint a submitter grant. | INFD-WP-0005 T05–T08 and T10; EMERGENT-WP-0002 T02/T09 | | Automated memo submission | An offline intake service, schema-3 ledger, and durable outbox exist. Registries are empty and transports are injected. audit-core `70e4044` registers `informed-decision.memo.posed` locally and is not deployed. state-hub `49eeddb` adds a dev forwarding fixture and a deduplicated notification; no live submitter is registered and the write-back flag stays unset. access-engine `e85f511` adds an offline compact-sitting v8 branch with empty admit sets; the deployed image pin is unchanged. Listener deployment, workload custody, admission activation, and live rollout remain blocked. A creating approval without a retained receipt is not retried. Keep the local draft ready and use the attended route when submission is authorized. Do not mint a submitter grant. | INFD-WP-0005 T05–T08 and T10; EMERGENT-WP-0002 T02/T09 |
| Profile adoption | Owner review must decide accuracy/publication, class/group and the exact submission path. Drafting is already authorized; no human answer or owner assent has been fabricated. | Decision `d20a9750-2b29-534e-8227-fb866581a6ca`; EMERGENT-WP-0002 T02 | | Profile adoption | Owner review must decide accuracy/publication, class/group and the exact submission path. Drafting is already authorized; no human answer or owner assent has been fabricated. | Decision `d20a9750-2b29-534e-8227-fb866581a6ca`; EMERGENT-WP-0002 T02 |
| Engine execution/index | Automatic step execution, estate index and inter-pack dependencies remain deliberately deferred. Use explicit owner pack paths. No need to implement these to use the preparation pack. | RBT-WP-0006; existing decision `1e517449-2114-4a8f-9c6b-fcdbe977378e` | | Engine execution/index | Automatic step execution, estate index and inter-pack dependencies remain deliberately deferred. Use explicit owner pack paths. No need to implement these to use the preparation pack. | RBT-WP-0006; existing decision `1e517449-2114-4a8f-9c6b-fcdbe977378e` |
| Runtime enforcement bridge | Pack actor/privilege/authorized_by fields and local waivers are not authenticated owner facts. No external approval/PDP gate plugin is claimed. Future execution requires an exact owner design, not a generic `approved: true` field. | EMERGENT-WP-0002 T06 mapping; RBT-WP-0006 T01/T06 | | Runtime enforcement bridge | Pack actor/privilege/authorized_by fields and local waivers are not authenticated owner facts. No external approval/PDP gate plugin is claimed. Future execution requires an exact owner design, not a generic `approved: true` field. | EMERGENT-WP-0002 T06 mapping; RBT-WP-0006 T01/T06 |

7
workplans/EMERGENT-WP-0002-agent-security-knowledge-and-netkingdom-integration.md
View file

@ -725,8 +725,11 @@ state-hub `49eeddb` adds a dev-only forwarding fixture and a notification
limited to id, question, class, and submitter. No service account was admitted, limited to id, question, class, and submitter. No service account was admitted,
no live submitter was registered, and the write-back flag stays unset. no live submitter was registered, and the write-back flag stays unset.
The access-engine attribute branch was still an uncommitted working tree when access-engine `e85f511` adds compact-sitting v8 beside the exact-record rules.
this note was written. It is not admission and it is not deployed. Requests for a pinned memo stay on those rules. The generated submitter and
class sets are empty, so an unpinned memo denies with `unknown_class`.
`attribute_eligible` checks id and digest shape and does not read an approval.
The deployed image pin is unchanged. This is not live admission.
T02, T05, T07, T08, T09, and T10 stay **wait**. The plan stays **blocked**. T02, T05, T07, T08, T09, and T10 stay **wait**. The plan stays **blocked**.
No DoD-Ok is claimed. No DoD-Ok is claimed.