coulomb/flex-auth
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Sign decision envelopes and close FLEX-WP-0024.
All checks were successful
CI Smoke / host-smoke (push) Successful in 1s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details
Build and Publish Container Image / build-and-push (push) Successful in 53s
Details

Browse source 
Detached Ed25519 over the canonical envelope with signature omitted.
Unsigned is stated, not implied. Testdata fixtures prove verify and
tamper failure without minting a production key. FLEX-WP-0025 is
finished with the validate check from the previous commit.

Assistant: grok
Assistant-Session: 01a09dc1-b21e-77e1-919e-fcad2f82b267
This commit is contained in:
tegwick 2026-09-14 09:57:50 +02:00
parent c074237aac
commit 127f83da4d
15 changed files with 697 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

1
docs/decision-record-contract.md
View file

@ -40,6 +40,7 @@ same shape.
| `provenance.input_claim_digests` | SHA-256 per request-time claim class (`context`, `caring_context`) |
| `provenance.decision_time` | UTC timestamp used to compute `lifetime` |
| `provenance.caller` | How the request was authenticated to the PDP. Additive; **not** decision material. `mode` is required (`disabled` / `warn` / `enforce`). A `principal` recorded under `warn` was observed, not enforced. Under `disabled` the object is `{"mode":"disabled"}` with no principal. `not_after` is the reviewed token `exp`. **Does not affect `request_digest`.** See `FLEX-DEC-2026-009` |
| `signature` | Detached Ed25519 signature over the canonical envelope with this field omitted. `mode` is `signed` or `unsigned` (absence stated). Additive; **does not affect `request_digest`.** See [`decision-envelope-signature.md`](decision-envelope-signature.md) (`FLEX-WP-0024`) |
`reason`, `diagnostics`, and CARING prose are not an authorization contract.