coulomb/flex-auth
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Finish FLEX-WP-0017
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a05e2e-805b-7042-a750-71f473bceea2
This commit is contained in:
tegwick 2026-09-01 20:21:58 +02:00
parent c9a4c98907
commit 58fbd46ff9
4 changed files with 46 additions and 30 deletions
Download patch file Download diff file Expand all files Collapse all files

35
docs/action-bound-authorization-contract.md
View file

@ -1,7 +1,7 @@
# Action-bound authorization contract
Status: implemented for execute-time request binding; durable approval storage
requires State Hub support.
and lifecycle require `approval-engine` support.
Date: 2026-08-23
@ -19,17 +19,11 @@ resource, context, and full SHA-256 request digest evaluated by the policy.
Consumers must compare structured fields; `reason`, `diagnostics`, titles, and
other prose are never an authorization contract.
State Hub owns durable organizational-decision identity, resolution,
supersession, and availability. Its current endpoint is:
```text
GET /decisions/{uuid}
```
That object is not yet sufficient for privileged action execution. As of
2026-08-23 it has lifecycle fields and `superseded_by`, but action details live
only in prose and it records only one free-form `decided_by` value. Production
consumers must not infer action binding or dual control from it.
`approval-engine` owns the durable approval object, authenticated approval
evidence, storage, supersession, consumption, and availability. State Hub
decision records are coordination and provenance evidence; they are not the
runtime approval authority. Production consumers must not infer action binding
or dual control from State Hub prose or a free-form `decided_by` value.
## Durable object
@ -67,8 +61,8 @@ policy inputs and should be denied for destructive production actions.
A production consumer may execute only when all of the following hold:
1. The durable object resolves from its canonical authority; an outage fails
the action closed.
1. The durable object resolves from `approval-engine`, its canonical authority;
an outage fails the action closed.
2. `status` is `approved`, `superseded_by` is absent, and the current time is
inside the validity window.
3. The caller's proposed action exactly matches `request`, including resource
@ -83,7 +77,7 @@ decision id are provenance only. They cannot unlock a production action.
## Outage and supersession semantics
- State Hub or future authorization-object store unreachable: privileged live
- `approval-engine` unreachable: privileged live
action denied; read-only inspection and dry-run may continue with a clear
non-authoritative status.
- flex-auth unavailable when a fresh decision is required: privileged live
@ -96,8 +90,9 @@ decision id are provenance only. They cannot unlock a production action.
## Remaining external work
State Hub needs a structured object/endpoint capable of storing this schema or
equivalent fields, authenticated approval entries, and atomic supersession.
Until that lands, secrets-engine is correct to keep live destructive actions
disabled. The standalone evaluator and the Topaz, relationship, rule, and
Keycloak delegated adapter boundaries now all populate the same binding.
`approval-engine` needs a structured object/endpoint capable of storing this
schema or equivalent fields, authenticated approval entries, atomic
supersession, and single-consumption semantics. Until that lands and the
consumer proof passes, secrets-engine is correct to keep live destructive
actions disabled. The standalone evaluator and the Topaz, relationship, rule,
and Keycloak delegated adapter boundaries now all populate the same binding.