coulomb/flex-auth
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

chore(registrar): assign State Hub identifiers
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02e47-6aac-7ee1-914d-0584c75d3c81
This commit is contained in:
repo-manager 2026-08-23 13:21:43 +02:00
parent 46ba7a340c
commit 4c3c528644
3 changed files with 14 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

6
workplans/FLEX-WP-0017-action-bound-authorization-contract.md
View file

@ -11,6 +11,7 @@ planning_priority: P1
planning_order: 117
created: "2026-08-23"
updated: "2026-08-23"
state_hub_workstream_id: "d75b7256-8b3d-5797-911c-96c3199b8baa"
---
# FLEX-WP-0017 - Action-bound authorization and durable approval contract
@ -26,6 +27,7 @@ decision object each provide only part of that contract.
id: FLEX-WP-0017-T01
status: done
priority: high
state_hub_task_id: "e7b47e1d-58e8-503c-be89-e8f2050215b1"
```
Add a structured `binding` to standalone `DecisionEnvelope` responses with the
@ -38,6 +40,7 @@ Add schema and regression coverage. Prose remains diagnostic only.
id: FLEX-WP-0017-T02
status: done
priority: high
state_hub_task_id: "df7984fb-c31f-5b26-bf42-193e4c3cbb9f"
```
Publish `schemas/action_authorization.schema.json` and
@ -50,6 +53,7 @@ validity, distinct approvals, supersession, and fail-closed outage semantics.
id: FLEX-WP-0017-T03
status: wait
priority: high
state_hub_task_id: "82d39961-8140-5a7f-9bd8-5164dd1742e5"
```
State Hub must add a structured endpoint/object equivalent to the published
@ -64,6 +68,7 @@ organizational approval lifecycle.
id: FLEX-WP-0017-T04
status: done
priority: medium
state_hub_task_id: "d85089ee-ad8c-502b-ba1b-be4ad23aec46"
```
Populate the same binding in Topaz, relationship, rule, and Keycloak adapter
@ -75,6 +80,7 @@ success and fail-closed responses using the shared canonical constructor.
id: FLEX-WP-0017-T05
status: wait
priority: high
state_hub_task_id: "8c3fc0a2-0855-5ac9-afa5-d03b8b1f0bf9"
```
After T03, secrets-engine validates the canonical object before every

3
workplans/FLEX-WP-0018-inbound-auth-corrections.md
View file

@ -11,6 +11,7 @@ planning_priority: P2
planning_order: 118
created: "2026-08-23"
updated: "2026-08-23"
state_hub_workstream_id: "8f301c7c-e3e2-5bd0-a6f2-0cb92c1d782f"
---
## Classify rejected TokenReview credentials as unauthenticated
@ -19,6 +20,7 @@ updated: "2026-08-23"
id: FLEX-WP-0018-T01
status: done
priority: medium
state_hub_task_id: "4a85c91f-6f34-5224-99b0-23b8eaa3bf7b"
```
Treat a successful TokenReview response that rejects a bearer token as an
@ -32,6 +34,7 @@ and authenticator seam.
id: FLEX-WP-0018-T02
status: done
priority: low
state_hub_task_id: "5613aeb1-ad09-50e5-9933-ced39593dc54"
```
Document that caller-authenticated pins permit TCP 443 and 6443 without a