coulomb/flex-auth
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Admit the compact sitting review package on a dedicated pin.
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
CI image 8007ede@sha256:6da9543d02ff556d5d5e33624599eb26b73ef365ed0e1ee2fac2ad7703b7dcba
now serves examples/informed-decision-sitting. T03 deployment is unchanged.
Native caller checks pass with synthetic identities; human bind stays with
INFD-WP-0002.

Assistant: grok
Assistant-Session: 01a0a6cb-0334-72c0-83b0-2df57474a0f6
This commit is contained in:
tegwick 2026-09-15 22:50:24 +02:00
parent c353f8eadd
commit 11453682cf
5 changed files with 80 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

62
docs/evidence/2026-09-15-sitting-native-review-policy.json Normal file
View file

@ -0,0 +1,62 @@
{
"scope": "native caller and policy with synthetic subject claims; not real human approval; T03 deployment unchanged",
"image": "forgejo.coulomb.social/coulomb/flex-auth@sha256:6da9543d02ff556d5d5e33624599eb26b73ef365ed0e1ee2fac2ad7703b7dcba",
"caller": "system:serviceaccount:informed-decision:review",
"service": "flex-auth-informed-decision-sitting.flex-auth.svc.cluster.local:8080",
"checks": [
{
"case": "admitted-group-c02-accept",
"http": 200,
"effect": "allow",
"reason": "operator_admitted_compact_sitting",
"policy_package": "informed-decision.compact-sitting",
"policy_package_digest": "sha256:e0afd52e046616a93142f4064704b1cee6496801d94612fce29a958cf04eb41a",
"ok": true
},
{
"case": "unrelated-group-c02-accept",
"http": 200,
"effect": "deny",
"reason": "compact_sitting_scope_or_identity_refused",
"policy_package": "informed-decision.compact-sitting",
"policy_package_digest": "sha256:e0afd52e046616a93142f4064704b1cee6496801d94612fce29a958cf04eb41a",
"ok": true
},
{
"case": "omitted-c01-accept",
"http": 200,
"effect": "deny",
"reason": "compact_sitting_scope_or_identity_refused",
"policy_package": "informed-decision.compact-sitting",
"policy_package_digest": "sha256:e0afd52e046616a93142f4064704b1cee6496801d94612fce29a958cf04eb41a",
"ok": true
},
{
"case": "t03-memo-accept",
"http": 200,
"effect": "deny",
"reason": "compact_sitting_scope_or_identity_refused",
"policy_package": "informed-decision.compact-sitting",
"policy_package_digest": "sha256:e0afd52e046616a93142f4064704b1cee6496801d94612fce29a958cf04eb41a",
"ok": true
},
{
"case": "consume-c02",
"http": 200,
"effect": "deny",
"reason": "compact_sitting_scope_or_identity_refused",
"policy_package": "informed-decision.compact-sitting",
"policy_package_digest": "sha256:e0afd52e046616a93142f4064704b1cee6496801d94612fce29a958cf04eb41a",
"ok": true
},
{
"case": "missing-token",
"http": 401,
"effect": null,
"reason": "unauthenticated\n",
"policy_package": null,
"policy_package_digest": null,
"ok": true
}
]
}

2
docs/request-enrichment.md
View file

@ -110,7 +110,7 @@ genuinely the request; **ambiguous** is the T01 input.
| markitect (example) | subject.groups | membership | allowlist | yes (first-class `groups`) |
| markitect (example) | subject.roles | membership | allowlist | yes (first-class `roles`) |
| informed-decision-t03 (fixture) | subject.assurance, groups, principal_type_source, tenant_source | mixed | see T01 | fixture-only; not a published consumer package |
| informed-decision-sitting (fixture) | subject.assurance, groups, principal_type_source, tenant_source | mixed | see T03 | new package, not a T03 expansion; unpublished until FLEX-WP-0028-T02 |
| informed-decision-sitting | subject.assurance, groups, principal_type_source, tenant_source | mixed | see T03 | published pin, not a T03 expansion |
No published-package ceiling or allowlist remains unbacked after the two
declaration fixes above. `ttl_hours`, `purpose`, `requested_ttl_seconds`, and