coulomb/flex-auth
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

docs(workplan): clarify denial verification
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02e47-6aac-7ee1-914d-0584c75d3c81
This commit is contained in:
tegwick 2026-08-23 14:21:33 +02:00
parent 225fc5b73e
commit 0eb46d61b5
1 changed files with 5 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

7
workplans/FLEX-WP-0012-credential-grant-authorization-surface.md
View file

@ -222,8 +222,11 @@ non-allow effect.
The integration was exercised over real HTTP against `flex-auth serve` with
this repository's railiance registry and policy. A bound request allowed; the
same helper rejected `ttl_out_of_bounds`, `actor_type_not_allowed`,
`purpose_not_allowed`, and `delivery_mode_not_allowed`. With flex-auth
unreachable, strict mode blocked and optional mode deliberately continued as
`purpose_not_allowed`, and `delivery_mode_not_allowed`. For those deny probes,
the otherwise-valid helper request was mutated at the HTTP boundary after its
local validation, ensuring the independent flex-auth policy—not the helper's
duplicated local guard—produced each rejection. With flex-auth unreachable,
strict mode blocked and optional mode deliberately continued as
`local-preauthorized`. No credential issuance function or secret material was
used. The 70-test railiance credential suite, `go test ./...`, and `go vet
./...` all pass.