diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index b38d604..d267bc2 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -35,6 +35,7 @@ | workplan | FLEX-WP-0025 | finished | — | workplans/FLEX-WP-0025-fact-versus-assertion.md | | workplan | FLEX-WP-0026 | finished | — | workplans/FLEX-WP-0026-openrouter-native-contract.md | | workplan | FLEX-WP-0027 | active | — | workplans/FLEX-WP-0027-t03-human-review.md | +| workplan | FLEX-WP-0028 | active | — | workplans/FLEX-WP-0028-compact-sitting-review.md | | task | FLEX-WP-0001-T001 | done | — | workplans/FLEX-WP-0001-repo-intent-and-architecture-baseline.md | | task | FLEX-WP-0001-T002 | done | — | workplans/FLEX-WP-0001-repo-intent-and-architecture-baseline.md | | task | FLEX-WP-0001-T003 | done | — | workplans/FLEX-WP-0001-repo-intent-and-architecture-baseline.md | @@ -158,6 +159,8 @@ | task | FLEX-WP-0027-T01 | done | — | workplans/FLEX-WP-0027-t03-human-review.md | | task | FLEX-WP-0027-T02 | done | — | workplans/FLEX-WP-0027-t03-human-review.md | | task | FLEX-WP-0027-T03 | wait | — | workplans/FLEX-WP-0027-t03-human-review.md | +| task | FLEX-WP-0028-T01 | done | — | workplans/FLEX-WP-0028-compact-sitting-review.md | +| task | FLEX-WP-0028-T02 | wait | — | workplans/FLEX-WP-0028-compact-sitting-review.md | | intake | FLEX-IN-0001 | closed | — | intakes/intakes.md | | intake | FLEX-IN-0002 | closed | — | intakes/intakes.md | | decision | FLEX-DEC-2026-001 | resolved | — | decisions/decisions.md | diff --git a/docs/evidence/2026-09-15-sitting-native-review-policy.json b/docs/evidence/2026-09-15-sitting-native-review-policy.json new file mode 100644 index 0000000..142da0c --- /dev/null +++ b/docs/evidence/2026-09-15-sitting-native-review-policy.json @@ -0,0 +1,62 @@ +{ + "scope": "native caller and policy with synthetic subject claims; not real human approval; T03 deployment unchanged", + "image": "forgejo.coulomb.social/coulomb/flex-auth@sha256:6da9543d02ff556d5d5e33624599eb26b73ef365ed0e1ee2fac2ad7703b7dcba", + "caller": "system:serviceaccount:informed-decision:review", + "service": "flex-auth-informed-decision-sitting.flex-auth.svc.cluster.local:8080", + "checks": [ + { + "case": "admitted-group-c02-accept", + "http": 200, + "effect": "allow", + "reason": "operator_admitted_compact_sitting", + "policy_package": "informed-decision.compact-sitting", + "policy_package_digest": "sha256:e0afd52e046616a93142f4064704b1cee6496801d94612fce29a958cf04eb41a", + "ok": true + }, + { + "case": "unrelated-group-c02-accept", + "http": 200, + "effect": "deny", + "reason": "compact_sitting_scope_or_identity_refused", + "policy_package": "informed-decision.compact-sitting", + "policy_package_digest": "sha256:e0afd52e046616a93142f4064704b1cee6496801d94612fce29a958cf04eb41a", + "ok": true + }, + { + "case": "omitted-c01-accept", + "http": 200, + "effect": "deny", + "reason": "compact_sitting_scope_or_identity_refused", + "policy_package": "informed-decision.compact-sitting", + "policy_package_digest": "sha256:e0afd52e046616a93142f4064704b1cee6496801d94612fce29a958cf04eb41a", + "ok": true + }, + { + "case": "t03-memo-accept", + "http": 200, + "effect": "deny", + "reason": "compact_sitting_scope_or_identity_refused", + "policy_package": "informed-decision.compact-sitting", + "policy_package_digest": "sha256:e0afd52e046616a93142f4064704b1cee6496801d94612fce29a958cf04eb41a", + "ok": true + }, + { + "case": "consume-c02", + "http": 200, + "effect": "deny", + "reason": "compact_sitting_scope_or_identity_refused", + "policy_package": "informed-decision.compact-sitting", + "policy_package_digest": "sha256:e0afd52e046616a93142f4064704b1cee6496801d94612fce29a958cf04eb41a", + "ok": true + }, + { + "case": "missing-token", + "http": 401, + "effect": null, + "reason": "unauthenticated\n", + "policy_package": null, + "policy_package_digest": null, + "ok": true + } + ] +} diff --git a/docs/request-enrichment.md b/docs/request-enrichment.md index 8c873df..46311fb 100644 --- a/docs/request-enrichment.md +++ b/docs/request-enrichment.md @@ -110,7 +110,7 @@ genuinely the request; **ambiguous** is the T01 input. | markitect (example) | subject.groups | membership | allowlist | yes (first-class `groups`) | | markitect (example) | subject.roles | membership | allowlist | yes (first-class `roles`) | | informed-decision-t03 (fixture) | subject.assurance, groups, principal_type_source, tenant_source | mixed | see T01 | fixture-only; not a published consumer package | -| informed-decision-sitting (fixture) | subject.assurance, groups, principal_type_source, tenant_source | mixed | see T03 | new package, not a T03 expansion; unpublished until FLEX-WP-0028-T02 | +| informed-decision-sitting | subject.assurance, groups, principal_type_source, tenant_source | mixed | see T03 | published pin, not a T03 expansion | No published-package ceiling or allowlist remains unbacked after the two declaration fixes above. `ttl_hours`, `purpose`, `requested_ttl_seconds`, and diff --git a/values/informed-decision-sitting.yaml b/values/informed-decision-sitting.yaml index 19ceccf..256cef9 100644 --- a/values/informed-decision-sitting.yaml +++ b/values/informed-decision-sitting.yaml @@ -1,12 +1,10 @@ # Compact sitting exact-record human review. Distinct from # values/informed-decision-t03.yaml / FLEX-WP-0027. -# image.digest is filled after CI builds the commit that added -# examples/informed-decision-sitting. Do not helm-upgrade until then: -# the live T03 digest does not contain this package. +# CI image of 8007ede (examples/informed-decision-sitting). name: flex-auth-informed-decision-sitting image: repository: forgejo.coulomb.social/coulomb/flex-auth - digest: sha256:0000000000000000000000000000000000000000000000000000000000000000 + digest: sha256:6da9543d02ff556d5d5e33624599eb26b73ef365ed0e1ee2fac2ad7703b7dcba args: - serve - --addr diff --git a/workplans/FLEX-WP-0028-compact-sitting-review.md b/workplans/FLEX-WP-0028-compact-sitting-review.md index 1b066c5..b6a74ec 100644 --- a/workplans/FLEX-WP-0028-compact-sitting-review.md +++ b/workplans/FLEX-WP-0028-compact-sitting-review.md @@ -4,7 +4,7 @@ type: workplan title: "Admit scoped human review for the seven compact sitting memos" domain: infotech repo: flex-auth -status: active +status: finished flavor: implementation owner: grok topic_slug: netkingdom @@ -13,6 +13,7 @@ updated: "2026-09-15" related_workplans: - FLEX-WP-0027 - INFD-WP-0002 +state_hub_workstream_id: "f7491b94-9f0e-5e5c-a03c-72e70d210807" --- Opened from informed-decision inbox `f266bf8c-072e-4a80-9a6b-ff89ee422d6b`. @@ -24,6 +25,7 @@ Do not widen `examples/informed-decision-t03` / FLEX-WP-0027. id: FLEX-WP-0028-T01 status: done priority: high +state_hub_task_id: "c9c28feb-d735-55a1-adc5-d229ab630f59" ``` Pins from `docs/evidence/2026-09-15-sitting-approval-creates.json`. @@ -38,13 +40,16 @@ Receipt: `docs/evidence/2026-09-15-sitting-review-policy.json`. ```task id: FLEX-WP-0028-T02 -status: wait +status: done priority: high +state_hub_task_id: "2d9be9d6-b8a0-5018-b5f5-524e72fc6239" ``` -Wait for CI to publish an image that contains `examples/informed-decision-sitting`, -then pin `values/informed-decision-sitting.yaml` by digest and helm-upgrade a -new release. Do not reuse the T03 image or change the T03 Deployment. +Dedicated release revision 1 uses CI image of `8007ede`, +`sha256:6da9543d02ff556d5d5e33624599eb26b73ef365ed0e1ee2fac2ad7703b7dcba`. +Service `flex-auth-informed-decision-sitting.flex-auth.svc.cluster.local:8080`. TokenReview admits only `system:serviceaccount:informed-decision:review`. -Native caller checks with synthetic identities are required before calling -this admitted. Human bind stays with INFD-WP-0002. +T03 Deployment image and generation unchanged. Six native caller checks pass +with synthetic identities (allow c02, deny wrong group / c01 / T03 memo / +consume, 401 without token). Human bind stays with INFD-WP-0002. +Receipt: `docs/evidence/2026-09-15-sitting-native-review-policy.json`.