coulomb/flex-auth
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Close B2 and finish FLEX-WP-0030; record tenant-engine's and key-cape's answers.

Browse source 
B2: key-cape (Tooling), net-kingdom (Taxonomy) and ops-mason (Staff) now declare
in their own files. Verified by the survey rather than taken on report: 14 of 14
counterparts declared, 0 undeclared. ops-mason sent no reply and needed none —
under §11 the file is the declaration. Every T04 finding is answered, so
FLEX-WP-0030 is finished. B5's residual ping belongs to FLEX-WP-0020.

key-cape stated the identity boundary from its side for the first time and
cautioned that principal_type must not be read as authentication-derived until
GH-DEC-2026-013/-016 §5 is answered. Checked against every published package:
only the two informed-decision packages gate on a human subject, and both also
require principal_type_source == "authentication-derived", which informed-decision
derives from the verified code-flow MFA event rather than from key-cape's claim.
No change needed; the assessment and a warning about the legacy "otherwise ->
human" fallback are in docs/iam-profile-consumption.md.

tenant-engine confirmed FLEX-DEC-2026-016's reading of commitment (b): the
fixed-record exclusion is consistent with it. Recorded under point 3; v3 stands.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 28468@bnt-lap001
Assistant-Session: c76569b2-6056-4dad-aea4-49cd7a018f5d
This commit is contained in:
tegwick 2026-09-21 22:57:56 +02:00
parent 882b381af6
commit 39a0034fcc
5 changed files with 607 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

29
workplans/FLEX-WP-0030-boundary-declaration-cleanup.md
View file

@ -4,7 +4,7 @@ type: workplan
title: "The layer declaration pins a version it should not, and four security-relevant peers do not declare at all"
domain: infotech
repo: flex-auth
status: active
status: finished
flavor: review
owner: claude
topic_slug: netkingdom
@ -146,7 +146,7 @@ over (`ops-mason`).
```task
id: FLEX-WP-0030-T04
status: progress
status: done
priority: high
state_hub_task_id: "70786e6d-02f2-5a90-8640-247ba377d9a4"
```
@ -286,6 +286,31 @@ survey (`docs/evidence/2026-09-21-layer-declaration-survey-after-ghdec017.json`)
`maturity-engine`, `zone-engine`, `secrets-engine` and `railiance-master` also
confirmed the ruling applied. None of these bears on B2.
2026-09-21 (B2 closed): all three outstanding repositories now declare in their
own files, verified by the survey rather than taken on report — receipt
`docs/evidence/2026-09-21-layer-declaration-survey-b2-closed.json`, 14 of 14
declared, 0 undeclared.
| Repository | Declares | Commit | Reply |
| --- | --- | --- | --- |
| `key-cape` | `Tooling` | `key-cape@9cb9507` | `c9bd902b` — boundary read the same way from its side |
| `net-kingdom` | `Taxonomy` | `net-kingdom@0b10b4b` | `897ef3b6` |
| `ops-mason` | `Staff` | `ops-mason@0ff263a` | none — the file is the declaration (§11), a reply is not needed |
`key-cape` also stated the boundary from its side for the first time: it
expects nothing of flex-auth beyond standard token verification, and there is no
assurance property flex-auth should re-derive. Its caveat — do not read
`principal_type` as authentication-derived until `GH-DEC-2026-013`/`-016` §5 is
answered — was checked against every published package and needs no change; the
assessment is in `docs/iam-profile-consumption.md`.
B5: `net-kingdom` approved A13, the "pending, not broken" note. It lands with the
rest of gate-house's amendment set after the v0.8 hold closes, not before. The
remaining obligation — ping when `access-engine` resolves — is `FLEX-WP-0020`'s,
already owed to `reuse-surface` on the same trigger.
Every finding is answered. T04 is done.
## Out of scope
- Bumping flex-auth to declare v0.8. v0.8 is `status: proposed`; T01 removes the