From 0eb46d61b548ec553954dbcd33b8ced144a75721 Mon Sep 17 00:00:00 2001 From: tegwick Date: Sun, 23 Aug 2026 14:21:33 +0200 Subject: [PATCH] docs(workplan): clarify denial verification Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02e47-6aac-7ee1-914d-0584c75d3c81 --- .../FLEX-WP-0012-credential-grant-authorization-surface.md | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/workplans/FLEX-WP-0012-credential-grant-authorization-surface.md b/workplans/FLEX-WP-0012-credential-grant-authorization-surface.md index 3a8b899..afdc383 100644 --- a/workplans/FLEX-WP-0012-credential-grant-authorization-surface.md +++ b/workplans/FLEX-WP-0012-credential-grant-authorization-surface.md @@ -222,8 +222,11 @@ non-allow effect. The integration was exercised over real HTTP against `flex-auth serve` with this repository's railiance registry and policy. A bound request allowed; the same helper rejected `ttl_out_of_bounds`, `actor_type_not_allowed`, -`purpose_not_allowed`, and `delivery_mode_not_allowed`. With flex-auth -unreachable, strict mode blocked and optional mode deliberately continued as +`purpose_not_allowed`, and `delivery_mode_not_allowed`. For those deny probes, +the otherwise-valid helper request was mutated at the HTTP boundary after its +local validation, ensuring the independent flex-auth policy—not the helper's +duplicated local guard—produced each rejection. With flex-auth unreachable, +strict mode blocked and optional mode deliberately continued as `local-preauthorized`. No credential issuance function or secret material was used. The 70-test railiance credential suite, `go test ./...`, and `go vet ./...` all pass.