Admit the compact sitting review package on a dedicated pin.
CI image 8007ede@sha256:6da9543d02ff556d5d5e33624599eb26b73ef365ed0e1ee2fac2ad7703b7dcba now serves examples/informed-decision-sitting. T03 deployment is unchanged. Native caller checks pass with synthetic identities; human bind stays with INFD-WP-0002. Assistant: grok Assistant-Session: 01a0a6cb-0334-72c0-83b0-2df57474a0f6
This commit is contained in:
parent
c353f8eadd
commit
11453682cf
5 changed files with 80 additions and 12 deletions
|
|
@ -35,6 +35,7 @@
|
|||
| workplan | FLEX-WP-0025 | finished | — | workplans/FLEX-WP-0025-fact-versus-assertion.md |
|
||||
| workplan | FLEX-WP-0026 | finished | — | workplans/FLEX-WP-0026-openrouter-native-contract.md |
|
||||
| workplan | FLEX-WP-0027 | active | — | workplans/FLEX-WP-0027-t03-human-review.md |
|
||||
| workplan | FLEX-WP-0028 | active | — | workplans/FLEX-WP-0028-compact-sitting-review.md |
|
||||
| task | FLEX-WP-0001-T001 | done | — | workplans/FLEX-WP-0001-repo-intent-and-architecture-baseline.md |
|
||||
| task | FLEX-WP-0001-T002 | done | — | workplans/FLEX-WP-0001-repo-intent-and-architecture-baseline.md |
|
||||
| task | FLEX-WP-0001-T003 | done | — | workplans/FLEX-WP-0001-repo-intent-and-architecture-baseline.md |
|
||||
|
|
@ -158,6 +159,8 @@
|
|||
| task | FLEX-WP-0027-T01 | done | — | workplans/FLEX-WP-0027-t03-human-review.md |
|
||||
| task | FLEX-WP-0027-T02 | done | — | workplans/FLEX-WP-0027-t03-human-review.md |
|
||||
| task | FLEX-WP-0027-T03 | wait | — | workplans/FLEX-WP-0027-t03-human-review.md |
|
||||
| task | FLEX-WP-0028-T01 | done | — | workplans/FLEX-WP-0028-compact-sitting-review.md |
|
||||
| task | FLEX-WP-0028-T02 | wait | — | workplans/FLEX-WP-0028-compact-sitting-review.md |
|
||||
| intake | FLEX-IN-0001 | closed | — | intakes/intakes.md |
|
||||
| intake | FLEX-IN-0002 | closed | — | intakes/intakes.md |
|
||||
| decision | FLEX-DEC-2026-001 | resolved | — | decisions/decisions.md |
|
||||
|
|
|
|||
62
docs/evidence/2026-09-15-sitting-native-review-policy.json
Normal file
62
docs/evidence/2026-09-15-sitting-native-review-policy.json
Normal file
|
|
@ -0,0 +1,62 @@
|
|||
{
|
||||
"scope": "native caller and policy with synthetic subject claims; not real human approval; T03 deployment unchanged",
|
||||
"image": "forgejo.coulomb.social/coulomb/flex-auth@sha256:6da9543d02ff556d5d5e33624599eb26b73ef365ed0e1ee2fac2ad7703b7dcba",
|
||||
"caller": "system:serviceaccount:informed-decision:review",
|
||||
"service": "flex-auth-informed-decision-sitting.flex-auth.svc.cluster.local:8080",
|
||||
"checks": [
|
||||
{
|
||||
"case": "admitted-group-c02-accept",
|
||||
"http": 200,
|
||||
"effect": "allow",
|
||||
"reason": "operator_admitted_compact_sitting",
|
||||
"policy_package": "informed-decision.compact-sitting",
|
||||
"policy_package_digest": "sha256:e0afd52e046616a93142f4064704b1cee6496801d94612fce29a958cf04eb41a",
|
||||
"ok": true
|
||||
},
|
||||
{
|
||||
"case": "unrelated-group-c02-accept",
|
||||
"http": 200,
|
||||
"effect": "deny",
|
||||
"reason": "compact_sitting_scope_or_identity_refused",
|
||||
"policy_package": "informed-decision.compact-sitting",
|
||||
"policy_package_digest": "sha256:e0afd52e046616a93142f4064704b1cee6496801d94612fce29a958cf04eb41a",
|
||||
"ok": true
|
||||
},
|
||||
{
|
||||
"case": "omitted-c01-accept",
|
||||
"http": 200,
|
||||
"effect": "deny",
|
||||
"reason": "compact_sitting_scope_or_identity_refused",
|
||||
"policy_package": "informed-decision.compact-sitting",
|
||||
"policy_package_digest": "sha256:e0afd52e046616a93142f4064704b1cee6496801d94612fce29a958cf04eb41a",
|
||||
"ok": true
|
||||
},
|
||||
{
|
||||
"case": "t03-memo-accept",
|
||||
"http": 200,
|
||||
"effect": "deny",
|
||||
"reason": "compact_sitting_scope_or_identity_refused",
|
||||
"policy_package": "informed-decision.compact-sitting",
|
||||
"policy_package_digest": "sha256:e0afd52e046616a93142f4064704b1cee6496801d94612fce29a958cf04eb41a",
|
||||
"ok": true
|
||||
},
|
||||
{
|
||||
"case": "consume-c02",
|
||||
"http": 200,
|
||||
"effect": "deny",
|
||||
"reason": "compact_sitting_scope_or_identity_refused",
|
||||
"policy_package": "informed-decision.compact-sitting",
|
||||
"policy_package_digest": "sha256:e0afd52e046616a93142f4064704b1cee6496801d94612fce29a958cf04eb41a",
|
||||
"ok": true
|
||||
},
|
||||
{
|
||||
"case": "missing-token",
|
||||
"http": 401,
|
||||
"effect": null,
|
||||
"reason": "unauthenticated\n",
|
||||
"policy_package": null,
|
||||
"policy_package_digest": null,
|
||||
"ok": true
|
||||
}
|
||||
]
|
||||
}
|
||||
|
|
@ -110,7 +110,7 @@ genuinely the request; **ambiguous** is the T01 input.
|
|||
| markitect (example) | subject.groups | membership | allowlist | yes (first-class `groups`) |
|
||||
| markitect (example) | subject.roles | membership | allowlist | yes (first-class `roles`) |
|
||||
| informed-decision-t03 (fixture) | subject.assurance, groups, principal_type_source, tenant_source | mixed | see T01 | fixture-only; not a published consumer package |
|
||||
| informed-decision-sitting (fixture) | subject.assurance, groups, principal_type_source, tenant_source | mixed | see T03 | new package, not a T03 expansion; unpublished until FLEX-WP-0028-T02 |
|
||||
| informed-decision-sitting | subject.assurance, groups, principal_type_source, tenant_source | mixed | see T03 | published pin, not a T03 expansion |
|
||||
|
||||
No published-package ceiling or allowlist remains unbacked after the two
|
||||
declaration fixes above. `ttl_hours`, `purpose`, `requested_ttl_seconds`, and
|
||||
|
|
|
|||
|
|
@ -1,12 +1,10 @@
|
|||
# Compact sitting exact-record human review. Distinct from
|
||||
# values/informed-decision-t03.yaml / FLEX-WP-0027.
|
||||
# image.digest is filled after CI builds the commit that added
|
||||
# examples/informed-decision-sitting. Do not helm-upgrade until then:
|
||||
# the live T03 digest does not contain this package.
|
||||
# CI image of 8007ede (examples/informed-decision-sitting).
|
||||
name: flex-auth-informed-decision-sitting
|
||||
image:
|
||||
repository: forgejo.coulomb.social/coulomb/flex-auth
|
||||
digest: sha256:0000000000000000000000000000000000000000000000000000000000000000
|
||||
digest: sha256:6da9543d02ff556d5d5e33624599eb26b73ef365ed0e1ee2fac2ad7703b7dcba
|
||||
args:
|
||||
- serve
|
||||
- --addr
|
||||
|
|
|
|||
|
|
@ -4,7 +4,7 @@ type: workplan
|
|||
title: "Admit scoped human review for the seven compact sitting memos"
|
||||
domain: infotech
|
||||
repo: flex-auth
|
||||
status: active
|
||||
status: finished
|
||||
flavor: implementation
|
||||
owner: grok
|
||||
topic_slug: netkingdom
|
||||
|
|
@ -13,6 +13,7 @@ updated: "2026-09-15"
|
|||
related_workplans:
|
||||
- FLEX-WP-0027
|
||||
- INFD-WP-0002
|
||||
state_hub_workstream_id: "f7491b94-9f0e-5e5c-a03c-72e70d210807"
|
||||
---
|
||||
|
||||
Opened from informed-decision inbox `f266bf8c-072e-4a80-9a6b-ff89ee422d6b`.
|
||||
|
|
@ -24,6 +25,7 @@ Do not widen `examples/informed-decision-t03` / FLEX-WP-0027.
|
|||
id: FLEX-WP-0028-T01
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "c9c28feb-d735-55a1-adc5-d229ab630f59"
|
||||
```
|
||||
|
||||
Pins from `docs/evidence/2026-09-15-sitting-approval-creates.json`.
|
||||
|
|
@ -38,13 +40,16 @@ Receipt: `docs/evidence/2026-09-15-sitting-review-policy.json`.
|
|||
|
||||
```task
|
||||
id: FLEX-WP-0028-T02
|
||||
status: wait
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "2d9be9d6-b8a0-5018-b5f5-524e72fc6239"
|
||||
```
|
||||
|
||||
Wait for CI to publish an image that contains `examples/informed-decision-sitting`,
|
||||
then pin `values/informed-decision-sitting.yaml` by digest and helm-upgrade a
|
||||
new release. Do not reuse the T03 image or change the T03 Deployment.
|
||||
Dedicated release revision 1 uses CI image of `8007ede`,
|
||||
`sha256:6da9543d02ff556d5d5e33624599eb26b73ef365ed0e1ee2fac2ad7703b7dcba`.
|
||||
Service `flex-auth-informed-decision-sitting.flex-auth.svc.cluster.local:8080`.
|
||||
TokenReview admits only `system:serviceaccount:informed-decision:review`.
|
||||
Native caller checks with synthetic identities are required before calling
|
||||
this admitted. Human bind stays with INFD-WP-0002.
|
||||
T03 Deployment image and generation unchanged. Six native caller checks pass
|
||||
with synthetic identities (allow c02, deny wrong group / c01 / T03 memo /
|
||||
consume, 401 without token). Human bind stays with INFD-WP-0002.
|
||||
Receipt: `docs/evidence/2026-09-15-sitting-native-review-policy.json`.
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue