coulomb/flex-auth
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Finish FLEX-WP-0019 layer-model v0.7 conformance
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details
Build and Publish Container Image / build-and-push (push) Successful in 57s
Details

Browse source 
Close the remaining PDP obligations: mechanical layer declaration check,
registry-snapshot digest in provenance, explicit allow TTL, per-input-class
freshness deadlines, and the published decision-record contract. Document
the canonical request digest as the §6.4.2 replay test.

Assistant: grok
Assistant-Session: 01a06256-fb71-7102-b3a9-27e6734257d0
This commit is contained in:
tegwick 2026-09-03 23:48:45 +02:00
parent 9689894c15
commit 56940727bf
32 changed files with 1194 additions and 111 deletions
Download patch file Download diff file Expand all files Collapse all files

36
INTENT.md
View file

@ -306,27 +306,27 @@ policy service consumer-specific.
## Layer Conformance
flex-auth's conformance state under §11 is **conforming with one declared gap**.
It holds no Tooling client, so the §5 shapes do not apply to it, and it is not
PEP-shaped, so it owes no stance map under §6.4.
flex-auth's conformance state under §11 is **conforming**. The mechanical
check is `go run ./tools/check_layer_conformance.go` (wired into `make test`):
the INTENT.md declaration parses, the layer is in the §3 vocabulary, the
Engine role is PDP, and no Tooling client exists in production Go sources.
It is not PEP-shaped, so it owes no stance map under §6.4.
**The declared gap — registry-snapshot digest in decision provenance (§13).**
`DecisionProvenance` carries the evaluator, mode, policy package, policy version,
directory ETag, and decision time, but no digest of the registry snapshot that
supplied resource, subject, and relationship facts. A decision that turned on
registry content cannot be replayed from its own provenance.
The former declared gap — registry-snapshot digest in decision provenance —
is closed. `DecisionProvenance` carries `registry_snapshot_digest` so a
decision that turned on registry content is replayable from its own record.
Revocation visibility deadlines per input class are stated in
[`docs/decision-input-freshness.md`](docs/decision-input-freshness.md).
The published decision-record contract is
[`docs/decision-record-contract.md`](docs/decision-record-contract.md)
(`flex-auth.decision-record.v1`). The §6.4.2 replay test is
[`docs/canonical-request-digest.md`](docs/canonical-request-digest.md).
v0.7 §9.7.2 promotes this from housekeeping to a **conformance prerequisite**,
on flex-auth's own argument: a stated visibility deadline for a fact carried by
a registry snapshot is unfalsifiable while provenance holds no snapshot digest,
because nobody can determine afterwards which snapshot a decision read. The
deadline and the digest are one gap seen from two sides.
Until it closes, one rule holds and flex-auth applies it to everyone equally,
including itself: **outcome-determining content belongs in the versioned policy
package, not in registry content** — for zone stance, for gate-house's authority
Outcome-determining content still belongs in the versioned policy package,
not in registry content — for zone stance, for gate-house's authority
ceilings, for maturity levels, and for flex-auth's own facts. Registry content
carries membership and identity; the policy package carries effect.
carries membership and identity; the policy package carries effect. The
snapshot digest makes that split checkable rather than aspirational.
## Non-Goals