diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index 839a4ea..d89c09e 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -19,7 +19,7 @@ | workplan | FLEX-WP-0009 | finished | — | workplans/FLEX-WP-0009-user-engine-production-policy-service.md | | workplan | FLEX-WP-0010 | finished | — | workplans/FLEX-WP-0010-tenant-lifecycle-policy-actions.md | | workplan | FLEX-WP-0011 | finished | — | workplans/FLEX-WP-0011-railiance-staged-promotion-overlay.md | -| workplan | FLEX-WP-0012 | active | — | workplans/FLEX-WP-0012-credential-grant-authorization-surface.md | +| workplan | FLEX-WP-0012 | finished | — | workplans/FLEX-WP-0012-credential-grant-authorization-surface.md | | workplan | FLEX-WP-0013 | finished | — | workplans/FLEX-WP-0013-restore-seven-action-tenant-engine-pin.md | | workplan | FLEX-WP-0014 | finished | — | workplans/FLEX-WP-0014-tenant-guardrail-policy-actions.md | | workplan | FLEX-WP-0015 | finished | — | workplans/FLEX-WP-0015-tenancy-posture-conformance.md | @@ -81,10 +81,10 @@ | task | FLEX-WP-0011-T01 | done | — | workplans/FLEX-WP-0011-railiance-staged-promotion-overlay.md | | task | FLEX-WP-0011-T02 | done | — | workplans/FLEX-WP-0011-railiance-staged-promotion-overlay.md | | task | FLEX-WP-0011-T03 | done | — | workplans/FLEX-WP-0011-railiance-staged-promotion-overlay.md | -| task | FLEX-WP-0012-T01 | wait | — | workplans/FLEX-WP-0012-credential-grant-authorization-surface.md | +| task | FLEX-WP-0012-T01 | done | — | workplans/FLEX-WP-0012-credential-grant-authorization-surface.md | | task | FLEX-WP-0012-T02 | done | — | workplans/FLEX-WP-0012-credential-grant-authorization-surface.md | -| task | FLEX-WP-0012-T03 | wait | — | workplans/FLEX-WP-0012-credential-grant-authorization-surface.md | -| task | FLEX-WP-0012-T04 | wait | — | workplans/FLEX-WP-0012-credential-grant-authorization-surface.md | +| task | FLEX-WP-0012-T03 | done | — | workplans/FLEX-WP-0012-credential-grant-authorization-surface.md | +| task | FLEX-WP-0012-T04 | done | — | workplans/FLEX-WP-0012-credential-grant-authorization-surface.md | | task | FLEX-WP-0013-T01 | done | — | workplans/FLEX-WP-0013-restore-seven-action-tenant-engine-pin.md | | task | FLEX-WP-0013-T02 | done | — | workplans/FLEX-WP-0013-restore-seven-action-tenant-engine-pin.md | | task | FLEX-WP-0013-T03 | done | — | workplans/FLEX-WP-0013-restore-seven-action-tenant-engine-pin.md | diff --git a/workplans/FLEX-WP-0012-credential-grant-authorization-surface.md b/workplans/FLEX-WP-0012-credential-grant-authorization-surface.md index df3ea2a..3a8b899 100644 --- a/workplans/FLEX-WP-0012-credential-grant-authorization-surface.md +++ b/workplans/FLEX-WP-0012-credential-grant-authorization-surface.md @@ -4,7 +4,7 @@ type: workplan title: "Authorize railiance-platform credential-grant requests" domain: infotech repo: flex-auth -status: active +status: finished owner: codex topic_slug: netkingdom planning_priority: P3 @@ -84,7 +84,7 @@ What is *actually* missing is narrower and worth stating precisely: ```task id: FLEX-WP-0012-T01 -status: wait +status: done priority: medium state_hub_task_id: "a1c9ba0c-3413-4823-9f9e-ccee09cf5d74" ``` @@ -131,6 +131,11 @@ options and was automatically escalated for human resolution; coordination message `338e54d9-7313-433f-a8fe-8ad572d00365` asks the consumer to choose and place duration normalization explicitly. +Resolved 2026-08-23: the operator approved Option A. railiance-platform owns +translation to canonical `POST /v1/check`, reads `DecisionEnvelope`, and parses +`requested_ttl` to integer seconds before the policy boundary. This preserves +one generic flex-auth decision surface. + ## T02 - Credential-grant policy package and fixtures ```task @@ -181,7 +186,7 @@ returned `credential_grant_allowed` for the registered runtime grant and ```task id: FLEX-WP-0012-T03 -status: wait +status: done priority: medium state_hub_task_id: "3335b2b7-cf1a-411d-95b3-03c4b4c35659" ``` @@ -208,9 +213,20 @@ request metadata only. Nothing in this workplan should read, log, or persist a credential value; if a task appears to require one, that is a signal the design has drifted, not a reason to handle secrets here. -Waiting on T01's wire-translation decision. The policy-side normalized request -contract is implemented; either integration option must produce its numeric -TTL field without changing policy semantics. +Completed 2026-08-23. railiance-platform implemented Option A in commit +`c9d0214`: its real credential helper now emits canonical `CheckRequest`, +normalizes TTLs to integer seconds, consumes `DecisionEnvelope`, validates the +returned subject/resource/provenance binding, and fails closed on every +non-allow effect. + +The integration was exercised over real HTTP against `flex-auth serve` with +this repository's railiance registry and policy. A bound request allowed; the +same helper rejected `ttl_out_of_bounds`, `actor_type_not_allowed`, +`purpose_not_allowed`, and `delivery_mode_not_allowed`. With flex-auth +unreachable, strict mode blocked and optional mode deliberately continued as +`local-preauthorized`. No credential issuance function or secret material was +used. The 70-test railiance credential suite, `go test ./...`, and `go vet +./...` all pass. Done when allow and all four denials are demonstrated against the real helper over real HTTP, `go test ./...` is green, and `gofmt`/`go vet` are clean. @@ -219,7 +235,7 @@ over real HTTP, `go test ./...` is green, and `gofmt`/`go vet` are clean. ```task id: FLEX-WP-0012-T04 -status: wait +status: done priority: low state_hub_task_id: "40015a87-040c-4d48-b360-fd5566dbc552" ``` @@ -239,6 +255,12 @@ actually meant before promising an endpoint. Update `docs/` with a credential-grant action vocabulary, matching the existing per-consumer vocabulary docs. -The source-side action vocabulary is now present at -`docs/railiance-platform-action-vocabulary.md`; final consumer/deployment -handoff waits on T01 and T03. +Completed 2026-08-23. The source-side action vocabulary is present at +`docs/railiance-platform-action-vocabulary.md`, and the consumer handoff is +implemented and verified in railiance-platform. The flex-auth changes are +pushed and covered by the repository image workflow, but no live +credential-grant endpoint was deployed or probed in this workplan: capability +status is explicitly **in source, not deployed**. The intended runtime remains +the helper-configured local endpoint (currently documented as +`127.0.0.1:18090`); selecting and operating that runtime is deployment work, +not part of this policy/interface closure.