coulomb/flex-auth
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Finish FLEX-WP-0019 layer-model v0.7 conformance
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details
Build and Publish Container Image / build-and-push (push) Successful in 57s
Details

Browse source 
Close the remaining PDP obligations: mechanical layer declaration check,
registry-snapshot digest in provenance, explicit allow TTL, per-input-class
freshness deadlines, and the published decision-record contract. Document
the canonical request digest as the §6.4.2 replay test.

Assistant: grok
Assistant-Session: 01a06256-fb71-7102-b3a9-27e6734257d0
This commit is contained in:
tegwick 2026-09-03 23:48:45 +02:00
parent 9689894c15
commit 56940727bf
32 changed files with 1194 additions and 111 deletions
Download patch file Download diff file Expand all files Collapse all files

9
examples/caring/action_authorization.json
View file

@ -47,6 +47,7 @@
},
"decision": {
"id": "decision:contract-example",
"contract_version": "flex-auth.decision-record.v1",
"request_id": "check:secrets-engine-destroy-example",
"effect": "allow",
"reason": "destruction_approved",
@ -87,7 +88,13 @@
"context": {
"purpose": "contract-test"
},
"request_digest": "sha256:73d5d7d5b3363f1a1db8f4c0e79c8f33dae5d77ffb97f21e449438bc0defa4c3"
"request_digest": "sha256:eb9d856a060813aebe039f19b82d4be1c4589fa6c0429cf20e15fb115db3ef9a"
},
"lifetime": {
"kind": "ttl",
"ttl": "15m",
"not_before": "2026-08-23T10:00:30Z",
"expires_at": "2026-08-23T10:15:30Z"
},
"provenance": {
"evaluator": "flex-auth/local",

14
examples/caring/decision_envelope.json
View file

@ -1,5 +1,6 @@
{
"id": "decision:tenant-alpha-internal-note",
"contract_version": "flex-auth.decision-record.v1",
"request_id": "check:tenant-alpha-internal-note",
"effect": "allow",
"reason": "reader_relation",
@ -33,7 +34,13 @@
"context": {
"purpose": "project-delivery"
},
"request_digest": "sha256:76ddf09170fc5ac49fb58aa9a6f5fb25bf1eb68b969254553979eb1ee0f15fab"
"request_digest": "sha256:99f772642c55b232a2d2fd3d5ff223cf1bf2c4f68942cd0def7c02cd3e5ae6ae"
},
"lifetime": {
"kind": "ttl",
"ttl": "15m",
"not_before": "2026-05-17T00:00:00Z",
"expires_at": "2026-05-17T00:15:00Z"
},
"obligations": [
{
@ -51,6 +58,11 @@
"mode": "standalone",
"policy_package": "markitect.documents",
"policy_version": "v1",
"policy_package_digest": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
"registry_snapshot_digest": "sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
"input_claim_digests": {
"context": "sha256:cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc"
},
"decision_time": "2026-05-17T00:00:00Z"
},
"caring": {