coulomb/flex-auth
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Finish FLEX-WP-0019 layer-model v0.7 conformance
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details
Build and Publish Container Image / build-and-push (push) Successful in 57s
Details

Browse source 
Close the remaining PDP obligations: mechanical layer declaration check,
registry-snapshot digest in provenance, explicit allow TTL, per-input-class
freshness deadlines, and the published decision-record contract. Document
the canonical request digest as the §6.4.2 replay test.

Assistant: grok
Assistant-Session: 01a06256-fb71-7102-b3a9-27e6734257d0
This commit is contained in:
tegwick 2026-09-03 23:48:45 +02:00
parent 9689894c15
commit 56940727bf
32 changed files with 1194 additions and 111 deletions
Download patch file Download diff file Expand all files Collapse all files

31
workplans/FLEX-WP-0019-layer-model-conformance.md
View file

@ -4,13 +4,13 @@ type: workplan
title: "Layer model v0.7 conformance: provenance, lifetimes, deadlines, and the decision contract"
domain: infotech
repo: flex-auth
status: ready
owner: codex
status: finished
owner: grok
topic_slug: netkingdom
planning_priority: P1
planning_order: 119
created: "2026-08-29"
updated: "2026-08-29"
updated: "2026-09-03"
reviewed_at: "2026-08-29"
reviewed_against_commit: "d402408"
reviewed_note: >-
@ -54,7 +54,7 @@ would publish a number nobody can check.
```task
id: FLEX-WP-0019-T01
status: todo
status: done
priority: medium
state_hub_task_id: "f72b1305-114e-5ba2-b84c-f6cc0b524178"
```
@ -72,7 +72,7 @@ Closes G1's remaining half. Wire it into `make test`.
```task
id: FLEX-WP-0019-T02
status: todo
status: done
priority: high
state_hub_task_id: "7a980074-8488-5ab1-9202-60878adb261d"
```
@ -94,7 +94,7 @@ snapshot changes the digest and that two decisions over the same snapshot agree.
```task
id: FLEX-WP-0019-T03
status: todo
status: done
priority: high
state_hub_task_id: "9d9c0e7a-56e2-5c71-9110-cea973243c22"
```
@ -115,7 +115,7 @@ appear in the decision record and the published schema.
```task
id: FLEX-WP-0019-T04
status: todo
status: done
priority: high
state_hub_task_id: "d5917b24-2efb-503e-9a9d-837702cafc1c"
```
@ -134,7 +134,7 @@ identify the snapshot a decision read. Publish as
```task
id: FLEX-WP-0019-T05
status: todo
status: done
priority: medium
state_hub_task_id: "f7f501d7-6862-5542-88f7-78b704524706"
```
@ -154,7 +154,7 @@ flex-auth's.
```task
id: FLEX-WP-0019-T06
status: todo
status: done
priority: medium
state_hub_task_id: "bc109ee3-14b0-5603-a655-0d7376c2a41c"
```
@ -168,3 +168,16 @@ Publish what it is computed over, what normalization applies, its stability
guarantees across versions, and worked examples of a permitted retry and a
refused replay. Consumers cannot honour §6.4.2 against an undocumented digest,
and negative caching under §6.4.2 needs the same guidance.
## Closeout
Finished 2026-09-03. `go test -race ./...` and `go run ./tools/check_layer_conformance.go` pass.
| Task | Landed as |
| --- | --- |
| T01 | `internal/layer`, `tools/check_layer_conformance.go`, wired into `make test` |
| T02 | `registry.Store.Digest` in `DecisionProvenance.registry_snapshot_digest` on standalone and delegated envelopes |
| T03 | Policy `allow_ttl`, engine default `15m`, deny `allow_lifetime_unstated` |
| T04 | `docs/decision-input-freshness.md`, referenced from `INTENT.md` |
| T05 | `flex-auth.decision-record.v1` in schema + `docs/decision-record-contract.md` |
| T06 | `docs/canonical-request-digest.md`; digest is tenant/subject/action/resource/context |