coulomb/flex-auth
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Admit replacement window memo for the single tool proof
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 5s
Details
Build and Publish Container Image / build-and-push (push) Successful in 1m3s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a0e387-534d-70e3-ad53-4ea05676db8c
This commit is contained in:
tegwick 2026-09-27 20:19:54 +02:00
parent 9993a7cf24
commit 4817b151b8
2 changed files with 29 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

16
examples/informed-decision-sitting/policy.md
View file

@ -2,7 +2,7 @@
id: informed-decision.compact-sitting id: informed-decision.compact-sitting
name: Compact sitting exact-record human review name: Compact sitting exact-record human review
namespace: informed-decision:decision-memo namespace: informed-decision:decision-memo
version: v4 version: v5
status: ready status: ready
package: flexauth.informed_decision.compact_sitting package: flexauth.informed_decision.compact_sitting
allow_ttl: 30s allow_ttl: 30s
@ -50,6 +50,10 @@ EUR 10 single-attempt tool proof. Native pins come from informed-decision
`docs/evidence/2026-09-27-tool-budget-approval-create.json`. Existing records, `docs/evidence/2026-09-27-tool-budget-approval-create.json`. Existing records,
actions and identity requirements remain unchanged. actions and identity requirements remain unchanged.
v5 (2026-09-27, REINAH-WP-0003-T06) admits the replacement-window memo
`memo:infd-20260927-b02` with fresh native pins. The accepted b01 record is
preserved; this change does not extend its signed execution window.
The identity bar matches T03: authenticated informed-decision caller, The identity bar matches T03: authenticated informed-decision caller,
`net-kingdom-admins`, fresh KeyCape AAL2 MFA. No permission follows from `net-kingdom-admins`, fresh KeyCape AAL2 MFA. No permission follows from
memo content or presentation state. TokenReview must admit memo content or presentation state. TokenReview must admit
@ -98,6 +102,10 @@ records := {
"memo:infd-20260927-b01": { "memo:infd-20260927-b01": {
"approval_id": "e9521804-8fce-4fbc-bfdf-8a1aa959fd61", "approval_id": "e9521804-8fce-4fbc-bfdf-8a1aa959fd61",
"binding_digest": "sha256:7aefcee9b79eb3285997066b323ae1772e13d58f875aacc6eb5e9407bd1c1185" "binding_digest": "sha256:7aefcee9b79eb3285997066b323ae1772e13d58f875aacc6eb5e9407bd1c1185"
},
"memo:infd-20260927-b02": {
"approval_id": "1e73e514-ef74-4bff-83e7-fa88a3eaba0c",
"binding_digest": "sha256:3e5951847e1909abe1561f561b4591228848a2e1a939b9bf5acab61e2db42773"
} }
} }
@ -212,11 +220,11 @@ tool_proof_input := {
"assurance": {"level": "aal2", "mfa": true, "source": "key-cape", "assurance": {"level": "aal2", "mfa": true, "source": "key-cape",
"methods": ["pwd", "otp"], "at": time.now_ns() / 1000000000}}}, "methods": ["pwd", "otp"], "at": time.now_ns() / 1000000000}}},
"resource": {"tenant": "tenant:platform", "system": "informed-decision", "resource": {"tenant": "tenant:platform", "system": "informed-decision",
"type": "decision-memo", "id": "memo:infd-20260927-b01"}, "type": "decision-memo", "id": "memo:infd-20260927-b02"},
"action": "accept", "action": "accept",
"context": {"memo_version": 1, "context": {"memo_version": 1,
"approval_id": "e9521804-8fce-4fbc-bfdf-8a1aa959fd61", "approval_id": "1e73e514-ef74-4bff-83e7-fa88a3eaba0c",
"approval_binding_digest": "sha256:7aefcee9b79eb3285997066b323ae1772e13d58f875aacc6eb5e9407bd1c1185"}, "approval_binding_digest": "sha256:3e5951847e1909abe1561f561b4591228848a2e1a939b9bf5acab61e2db42773"},
} }
test_tool_proof_exact_record_allowed if { test_tool_proof_exact_record_allowed if {

17
examples/informed-decision-sitting/records.json
View file

@ -151,5 +151,22 @@
} }
}, },
"memo_version": 1 "memo_version": 1
},
"memo:infd-20260927-b02": {
"approval_id": "1e73e514-ef74-4bff-83e7-fa88a3eaba0c",
"binding_digest": "sha256:3e5951847e1909abe1561f561b4591228848a2e1a939b9bf5acab61e2db42773",
"label": "20260927-b02",
"binding": {
"action": "accept",
"actor": "informed-decision",
"principal": "helixforge-factory",
"purpose": "Accept one EUR 10 metered tool proof; no retry or publication; 2026-09-27T18:20:00Z through 2026-09-28T18:20:00Z",
"target": {
"id": "spend-envelope:hfact-glas-tool-proof-20260927-renewed-one-attempt",
"system": "rein-aharness",
"type": "spend-envelope"
}
},
"memo_version": 1
} }
} }