coulomb/flex-auth
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Close B2 and finish FLEX-WP-0030; record tenant-engine's and key-cape's answers.

Browse source 
B2: key-cape (Tooling), net-kingdom (Taxonomy) and ops-mason (Staff) now declare
in their own files. Verified by the survey rather than taken on report: 14 of 14
counterparts declared, 0 undeclared. ops-mason sent no reply and needed none —
under §11 the file is the declaration. Every T04 finding is answered, so
FLEX-WP-0030 is finished. B5's residual ping belongs to FLEX-WP-0020.

key-cape stated the identity boundary from its side for the first time and
cautioned that principal_type must not be read as authentication-derived until
GH-DEC-2026-013/-016 §5 is answered. Checked against every published package:
only the two informed-decision packages gate on a human subject, and both also
require principal_type_source == "authentication-derived", which informed-decision
derives from the verified code-flow MFA event rather than from key-cape's claim.
No change needed; the assessment and a warning about the legacy "otherwise ->
human" fallback are in docs/iam-profile-consumption.md.

tenant-engine confirmed FLEX-DEC-2026-016's reading of commitment (b): the
fixed-record exclusion is consistent with it. Recorded under point 3; v3 stands.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 28468@bnt-lap001
Assistant-Session: c76569b2-6056-4dad-aea4-49cd7a018f5d
This commit is contained in:
tegwick 2026-09-21 22:57:56 +02:00
parent 882b381af6
commit 39a0034fcc
5 changed files with 607 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

20
docs/conformance/boundaries-review.md
View file

@ -156,3 +156,23 @@ with one of flex-auth's in a different shape (`audit-core`'s list-shaped
`emission_guarantee`) made that peer's `layer.yaml` silently disappear. Peers
are now read for `layer` and `role` only. A surveyor's schema is a house rule
too. Receipt: `docs/evidence/2026-09-21-layer-declaration-survey-after-ghdec017.json`.
## Addendum — B2 closed, 2026-09-21
The status table above is left as derived. Three rows have since moved, each
verified in the counterpart's own file (receipt
`docs/evidence/2026-09-21-layer-declaration-survey-b2-closed.json`):
| Counterpart | Was | Now |
| --- | --- | --- |
| `key-cape` | asserted from one side only | **agreed, stated from both sides** — declares `Tooling` (`key-cape@9cb9507`); expects nothing of flex-auth beyond standard token verification |
| `ops-mason` | undeclared twice over | declares `Staff` (`ops-mason@0ff263a`); the §13.1 stance-map mark is gate-house's and unchanged |
| `net-kingdom` | undeclared | declares `Taxonomy` (`net-kingdom@0b10b4b`) |
`gate-house` declared earlier the same day. Fourteen of fourteen counterparts now
declare. The `tenant-engine` row closed under `FLEX-WP-0022` (`TEN-DEC-2026-002`,
`FLEX-DEC-2026-016`); the `audit-core` row was ruled against flex-auth
(`GH-DEC-2026-018`), and delivery is `FLEX-WP-0031`.
One boundary remains held by flex-auth alone: `zone-engine` has confirmed the
casing ruling but not the membership/stance boundary it was asked about.