coulomb/flex-auth
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

docs(workplan): close credential grant integration
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02e47-6aac-7ee1-914d-0584c75d3c81
This commit is contained in:
tegwick 2026-08-23 14:19:53 +02:00
parent e59106e06e
commit 225fc5b73e
2 changed files with 36 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

8
WORK-RECORDS.md
View file

@ -19,7 +19,7 @@
| workplan | FLEX-WP-0009 | finished | — | workplans/FLEX-WP-0009-user-engine-production-policy-service.md |
| workplan | FLEX-WP-0010 | finished | — | workplans/FLEX-WP-0010-tenant-lifecycle-policy-actions.md |
| workplan | FLEX-WP-0011 | finished | — | workplans/FLEX-WP-0011-railiance-staged-promotion-overlay.md |
| workplan | FLEX-WP-0012 | active | — | workplans/FLEX-WP-0012-credential-grant-authorization-surface.md |
| workplan | FLEX-WP-0012 | finished | — | workplans/FLEX-WP-0012-credential-grant-authorization-surface.md |
| workplan | FLEX-WP-0013 | finished | — | workplans/FLEX-WP-0013-restore-seven-action-tenant-engine-pin.md |
| workplan | FLEX-WP-0014 | finished | — | workplans/FLEX-WP-0014-tenant-guardrail-policy-actions.md |
| workplan | FLEX-WP-0015 | finished | — | workplans/FLEX-WP-0015-tenancy-posture-conformance.md |
@ -81,10 +81,10 @@
| task | FLEX-WP-0011-T01 | done | — | workplans/FLEX-WP-0011-railiance-staged-promotion-overlay.md |
| task | FLEX-WP-0011-T02 | done | — | workplans/FLEX-WP-0011-railiance-staged-promotion-overlay.md |
| task | FLEX-WP-0011-T03 | done | — | workplans/FLEX-WP-0011-railiance-staged-promotion-overlay.md |
| task | FLEX-WP-0012-T01 | wait | — | workplans/FLEX-WP-0012-credential-grant-authorization-surface.md |
| task | FLEX-WP-0012-T01 | done | — | workplans/FLEX-WP-0012-credential-grant-authorization-surface.md |
| task | FLEX-WP-0012-T02 | done | — | workplans/FLEX-WP-0012-credential-grant-authorization-surface.md |
| task | FLEX-WP-0012-T03 | wait | — | workplans/FLEX-WP-0012-credential-grant-authorization-surface.md |
| task | FLEX-WP-0012-T04 | wait | — | workplans/FLEX-WP-0012-credential-grant-authorization-surface.md |
| task | FLEX-WP-0012-T03 | done | — | workplans/FLEX-WP-0012-credential-grant-authorization-surface.md |
| task | FLEX-WP-0012-T04 | done | — | workplans/FLEX-WP-0012-credential-grant-authorization-surface.md |
| task | FLEX-WP-0013-T01 | done | — | workplans/FLEX-WP-0013-restore-seven-action-tenant-engine-pin.md |
| task | FLEX-WP-0013-T02 | done | — | workplans/FLEX-WP-0013-restore-seven-action-tenant-engine-pin.md |
| task | FLEX-WP-0013-T03 | done | — | workplans/FLEX-WP-0013-restore-seven-action-tenant-engine-pin.md |

42
workplans/FLEX-WP-0012-credential-grant-authorization-surface.md
View file

@ -4,7 +4,7 @@ type: workplan
title: "Authorize railiance-platform credential-grant requests"
domain: infotech
repo: flex-auth
status: active
status: finished
owner: codex
topic_slug: netkingdom
planning_priority: P3
@ -84,7 +84,7 @@ What is *actually* missing is narrower and worth stating precisely:
```task
id: FLEX-WP-0012-T01
status: wait
status: done
priority: medium
state_hub_task_id: "a1c9ba0c-3413-4823-9f9e-ccee09cf5d74"
```
@ -131,6 +131,11 @@ options and was automatically escalated for human resolution; coordination
message `338e54d9-7313-433f-a8fe-8ad572d00365` asks the consumer to choose and
place duration normalization explicitly.
Resolved 2026-08-23: the operator approved Option A. railiance-platform owns
translation to canonical `POST /v1/check`, reads `DecisionEnvelope`, and parses
`requested_ttl` to integer seconds before the policy boundary. This preserves
one generic flex-auth decision surface.
## T02 - Credential-grant policy package and fixtures
```task
@ -181,7 +186,7 @@ returned `credential_grant_allowed` for the registered runtime grant and
```task
id: FLEX-WP-0012-T03
status: wait
status: done
priority: medium
state_hub_task_id: "3335b2b7-cf1a-411d-95b3-03c4b4c35659"
```
@ -208,9 +213,20 @@ request metadata only. Nothing in this workplan should read, log, or persist a
credential value; if a task appears to require one, that is a signal the
design has drifted, not a reason to handle secrets here.
Waiting on T01's wire-translation decision. The policy-side normalized request
contract is implemented; either integration option must produce its numeric
TTL field without changing policy semantics.
Completed 2026-08-23. railiance-platform implemented Option A in commit
`c9d0214`: its real credential helper now emits canonical `CheckRequest`,
normalizes TTLs to integer seconds, consumes `DecisionEnvelope`, validates the
returned subject/resource/provenance binding, and fails closed on every
non-allow effect.
The integration was exercised over real HTTP against `flex-auth serve` with
this repository's railiance registry and policy. A bound request allowed; the
same helper rejected `ttl_out_of_bounds`, `actor_type_not_allowed`,
`purpose_not_allowed`, and `delivery_mode_not_allowed`. With flex-auth
unreachable, strict mode blocked and optional mode deliberately continued as
`local-preauthorized`. No credential issuance function or secret material was
used. The 70-test railiance credential suite, `go test ./...`, and `go vet
./...` all pass.
Done when allow and all four denials are demonstrated against the real helper
over real HTTP, `go test ./...` is green, and `gofmt`/`go vet` are clean.
@ -219,7 +235,7 @@ over real HTTP, `go test ./...` is green, and `gofmt`/`go vet` are clean.
```task
id: FLEX-WP-0012-T04
status: wait
status: done
priority: low
state_hub_task_id: "40015a87-040c-4d48-b360-fd5566dbc552"
```
@ -239,6 +255,12 @@ actually meant before promising an endpoint.
Update `docs/` with a credential-grant action vocabulary, matching the
existing per-consumer vocabulary docs.
The source-side action vocabulary is now present at
`docs/railiance-platform-action-vocabulary.md`; final consumer/deployment
handoff waits on T01 and T03.
Completed 2026-08-23. The source-side action vocabulary is present at
`docs/railiance-platform-action-vocabulary.md`, and the consumer handoff is
implemented and verified in railiance-platform. The flex-auth changes are
pushed and covered by the repository image workflow, but no live
credential-grant endpoint was deployed or probed in this workplan: capability
status is explicitly **in source, not deployed**. The intended runtime remains
the helper-configured local endpoint (currently documented as
`127.0.0.1:18090`); selecting and operating that runtime is deployment work,
not part of this policy/interface closure.