Accept ActionAuthorization deferral; fix the state-hub authority constant
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
CI Smoke / container-smoke (push) Successful in 2s
Build and Publish Container Image / build-and-push (push) Successful in 40s

approval-engine filed APPROVAL-IN-0002: secrets-engine built its PEP
validator against our ActionAuthorization schema, pointed it at
GET /v1/approvals/{id}/claim, and it rejects every response. Both
envelopes declare schema_version 0.1, so it fails late and reads like an
approval-engine outage rather than a contract mismatch.

FLEX-DEC-2026-006 accepts the deferral and argues against flex-auth's own
proposal. The composed object had the PIP republish our decision, which
crosses the same layer boundary we invoked to decline authentication
evidence and to win section 17's schema. The claim-plus-DecisionEnvelope
split drops no check; each verification lands on the layer that owns it.

approval-engine asked, before the decision, whether the open G3 finding
argues for ratifying now. It does not: G3 is already closed the other
way. FLEX-WP-0019 added lifetime to the DecisionEnvelope itself, required
on every allow by schema conditional, published 2026-09-02. The trigger
resolved by adding a field rather than by composition, so the decision
stands alone and needs no bundle.

The provenance.authority == state-hub constant is our defect and is
fixed at source. It came from examples/caring/action_authorization.json,
which contradicted the same contract's ownership section. That fixture
now names approval-engine as the approval fact's authority and flex-auth
as the decision's, and its stale secrets-engine.lifecycle pin is
corrected to the reserved coordinate from FLEX-DEC-2026-005.

The contract doc and schema are marked deferred-not-withdrawn so no
other consumer builds a validator against them. The execute-time half is
untouched: /v1/check, binding, the canonical digest, and
flex-auth.decision-record.v1 stay published.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JTbVXpEiXA7mNJVpDnEPcB

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 412054@bnt-lap001
Assistant-Session: 3968fae1-8d59-4209-9bd6-c22594b8ab19
This commit is contained in:
tegwick 2026-09-06 01:30:04 +02:00
parent d144feb2e9
commit 74bfb3b664
5 changed files with 295 additions and 22 deletions

View file

@ -2,9 +2,9 @@
"schema": "repo_manager.index.v1",
"slug": "flex-auth",
"repo_root": "/home/worsch/flex-auth",
"head_sha": "56940727bfb36aec705318b0128599f367256c23",
"observed_at": "2026-09-05T23:08:53.160637Z",
"source_fingerprint": "727c449ea8eb418a198b97d34244e377936060c84024b65b2af950ea71714259",
"head_sha": "d144feb2e9b74df39a085ce752335c1169ffac9a",
"observed_at": "2026-09-05T23:29:23.679186Z",
"source_fingerprint": "8708283bc20e40a97e9193fcf6de5b81cb3174f0cac5af6665ecc62d6c716c7e",
"source_files": [
".repo-classification.yaml",
"INTENT.md",
@ -29,7 +29,8 @@
"workplans/FLEX-WP-0017-action-bound-authorization-contract.md",
"workplans/FLEX-WP-0018-inbound-auth-corrections.md",
"workplans/FLEX-WP-0019-layer-model-conformance.md",
"workplans/FLEX-WP-0020-repository-identity-migration.md"
"workplans/FLEX-WP-0020-repository-identity-migration.md",
"workplans/FLEX-WP-0021-secrets-engine-consumer-policy-gate.md"
],
"work_records": [
{
@ -1216,6 +1217,66 @@
"parent_id": "FLEX-WP-0020",
"extra": {}
},
{
"kind": "workplan",
"id": "FLEX-WP-0021",
"status": "proposed",
"title": "secrets-engine consumer policy package and cluster-local pin",
"source_path": "workplans/FLEX-WP-0021-secrets-engine-consumer-policy-gate.md",
"uuid": "b01f655e-f71a-50ae-b110-178557f07c63",
"parent_id": null,
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0021-T01",
"status": "todo",
"title": "1. Obtain the real action vocabulary from secrets-engine",
"source_path": "workplans/FLEX-WP-0021-secrets-engine-consumer-policy-gate.md",
"uuid": "3c191808-6fe5-5a9b-9a68-a4ce4a672dbd",
"parent_id": "FLEX-WP-0021",
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0021-T02",
"status": "todo",
"title": "2. Publish `secrets-engine.catalog-lane.lifecycle` v1",
"source_path": "workplans/FLEX-WP-0021-secrets-engine-consumer-policy-gate.md",
"uuid": "38770813-dfcc-5711-bba3-0db50d3af135",
"parent_id": "FLEX-WP-0021",
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0021-T03",
"status": "todo",
"title": "3. Confirm the digest join against a real decision record",
"source_path": "workplans/FLEX-WP-0021-secrets-engine-consumer-policy-gate.md",
"uuid": "8f7e5cdd-777e-5f54-9b92-c72b79f65672",
"parent_id": "FLEX-WP-0021",
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0021-T04",
"status": "wait",
"title": "4. Stand up the `flex-auth-secrets-engine` pin",
"source_path": "workplans/FLEX-WP-0021-secrets-engine-consumer-policy-gate.md",
"uuid": "f4e8709a-65dd-5172-97ae-e7c3432afb22",
"parent_id": "FLEX-WP-0021",
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0021-T05",
"status": "wait",
"title": "5. Hand the pin coordinates back and close",
"source_path": "workplans/FLEX-WP-0021-secrets-engine-consumer-policy-gate.md",
"uuid": "f0828871-fd65-5d8c-adfd-28b13fedd2b0",
"parent_id": "FLEX-WP-0021",
"extra": {}
},
{
"kind": "decision",
"id": "FLEX-DEC-2026-001",
@ -1344,7 +1405,7 @@
"status": "resolved",
"title": "Decision lifetime does not reach past issuance: answer to ops-warden WARDEN-WP-0034-T05",
"source_path": "decisions/decisions.md",
"uuid": null,
"uuid": "f6bfb02a-bbf3-4488-acf9-0e1cb57ce19d",
"parent_id": null,
"extra": {
"record": {
@ -1366,7 +1427,9 @@
"decided_by": "flex-auth (access-engine / PDP)",
"rationale": "Answered, not declined. A decision lifetime shorter than the SSH certificate TTL is meaningful, but only as an authority-to-issue window, never as an authority-to-use window over an already-issued certificate. flex-auth lifetime.expires_at bounds how long that one allow may be relied on to authorise a sign; it cannot bound an artifact ops-warden issued under it, and flex-auth does not claim it does. The downstream contract that consumes the shorter lifetime is the pre-sign gate itself: no replay of an allow past expires_at, and a fresh Check per sign. The lever that actually shortens effective access is the requested TTL as a policy input, which is already deployed as the ttl_out_of_bounds deny; ops-warden section 9.7.2 window through cert TTL is correctly stated and correctly owned by the PEP.",
"created": "2026-09-05T23:08:38.877787Z",
"updated": "2026-09-05T23:08:38.877787Z"
"updated": "2026-09-06T00:00:00.000000Z",
"decided_at": "2026-09-06T00:00:00.000000Z",
"state_hub_decision_id": "f6bfb02a-bbf3-4488-acf9-0e1cb57ce19d"
}
}
},
@ -1376,7 +1439,7 @@
"status": "resolved",
"title": "secrets-engine policy package is expected but unpublished; /v1/check has no estate-wide endpoint by design",
"source_path": "decisions/decisions.md",
"uuid": null,
"uuid": "f318e4e2-6195-4db8-b8c0-c71eeecad766",
"parent_id": null,
"extra": {
"record": {
@ -1398,7 +1461,43 @@
"decided_by": "flex-auth (access-engine / PDP)",
"rationale": "Two answers. (1) Yes, a real package is expected, and flex-auth authors it in this repo as it did for every other consumer; the reserved coordinate is secrets-engine.catalog-lane.lifecycle at version v1, and it does not exist yet. Until it is published and pinned, secrets-engine keeping SECRETS_ENGINE_AUTHORIZATION_POLICY_PACKAGE and _VERSION as required configuration with no fallback is the correct shape and flex-auth endorses it. (2) POST /v1/check is deployed, but there is no estate-wide PDP address and there is not meant to be one: each consumer gets its own cluster-local pin whose NetworkPolicy default-denies ingress except from that one approved workload. The 2026-09-06 probe finding no reachable PDP is the design working, not an outage. A reachable endpoint for secrets-engine is a per-consumer pin that follows its policy package.",
"created": "2026-09-05T23:08:51.144287Z",
"updated": "2026-09-05T23:08:51.144287Z"
"updated": "2026-09-06T00:00:00.000000Z",
"decided_at": "2026-09-06T00:00:00.000000Z",
"state_hub_decision_id": "f318e4e2-6195-4db8-b8c0-c71eeecad766"
}
}
},
{
"kind": "decision",
"id": "FLEX-DEC-2026-006",
"status": "resolved",
"title": "ActionAuthorization deferral accepted; G3 is closed and does not argue for ratifying it",
"source_path": "decisions/decisions.md",
"uuid": null,
"parent_id": null,
"extra": {
"record": {
"id": "FLEX-DEC-2026-006",
"kind": "decision",
"title": "ActionAuthorization deferral accepted; G3 is closed and does not argue for ratifying it",
"status": "resolved",
"origin": "cross-repo",
"origin_ref": "APPROVAL-IN-0002 / GH-DEC-2026-003",
"owner": "flex-auth",
"affects": [
"flex-auth",
"approval-engine",
"gate-house",
"secrets-engine"
],
"requested_dispositions": [
"accept",
"contest"
],
"decided_by": "flex-auth (access-engine / PDP)",
"rationale": "Accepted, and flex-auth argues against its own proposal. The composed ActionAuthorization object was never ratified; the approval-claim plus DecisionEnvelope split lands each check on the layer that owns it and drops none. approval-engine asked whether the open G3 finding (DecisionEnvelope carries no lifetime) argues for ratifying the composed object now. It does not, because G3 is already closed the other way: FLEX-WP-0019 added lifetime to the DecisionEnvelope itself, required on every allow by schema conditional, published 2026-09-02. The revisit trigger is spent, and it resolved by adding a field rather than by composition, so the decision now stands alone and needs no bundle. Separately, the provenance.authority == state-hub constant is flex-auth defect: it came from examples/caring/action_authorization.json, which contradicted our own ownership section. Corrected at source, with the schema and contract doc marked deferred-not-withdrawn so no other consumer builds a validator against them.",
"created": "2026-09-05T23:29:20.156770Z",
"updated": "2026-09-05T23:29:20.156770Z"
}
}
},
@ -1479,15 +1578,15 @@
"type": "repo.command.applied",
"command": "repo.work.create_decision",
"operation": "create",
"correlation_id": "ff360be5-e7bf-4914-95c3-1ea6df9f6957",
"correlation_id": "ead04d14-441f-4ecd-8ee8-12ae0cd23362",
"kind": "decision",
"id": "FLEX-DEC-2026-005",
"id": "FLEX-DEC-2026-006",
"git_sha": null,
"files_touched": [
"decisions/decisions.md"
],
"source": "repo-manager",
"emitted_at": "2026-09-05T23:08:53.160770Z"
"emitted_at": "2026-09-05T23:29:23.679390Z"
}
]
}

View file

@ -744,3 +744,137 @@ that order: publish the package, then pin it.
published. Nothing in this record authorises a fallback value.
- No change to `flex-auth.decision-record.v1`. The digest join secrets-engine
built against it is correct as described.
## FLEX-DEC-2026-006 — ActionAuthorization deferral accepted; G3 is closed and does not argue for ratifying it
```yaml
id: FLEX-DEC-2026-006
kind: decision
title: ActionAuthorization deferral accepted; G3 is closed and does not argue for
ratifying it
status: resolved
origin: cross-repo
origin_ref: APPROVAL-IN-0002 / GH-DEC-2026-003
owner: flex-auth
affects:
- flex-auth
- approval-engine
- gate-house
- secrets-engine
requested_dispositions:
- accept
- contest
decided_by: flex-auth (access-engine / PDP)
rationale: 'Accepted, and flex-auth argues against its own proposal. The composed
ActionAuthorization object was never ratified; the approval-claim plus DecisionEnvelope
split lands each check on the layer that owns it and drops none. approval-engine
asked whether the open G3 finding (DecisionEnvelope carries no lifetime) argues
for ratifying the composed object now. It does not, because G3 is already closed
the other way: FLEX-WP-0019 added lifetime to the DecisionEnvelope itself, required
on every allow by schema conditional, published 2026-09-02. The revisit trigger
is spent, and it resolved by adding a field rather than by composition, so the decision
now stands alone and needs no bundle. Separately, the provenance.authority == state-hub
constant is flex-auth defect: it came from examples/caring/action_authorization.json,
which contradicted our own ownership section. Corrected at source, with the schema
and contract doc marked deferred-not-withdrawn so no other consumer builds a validator
against them.'
created: '2026-09-05T23:29:20.156770Z'
updated: '2026-09-05T23:29:20.156770Z'
```
## Context
`approval-engine` filed `APPROVAL-IN-0002` with gate-house and raised it here
directly, because the request touches flex-auth's artifact and accepting the
shelving is flex-auth's call.
The trigger was concrete damage: secrets-engine built its PEP validator against
the `ActionAuthorization` schema in
`docs/action-bound-authorization-contract.md`, then pointed it at
`GET /v1/approvals/{id}/claim`. It rejects every response. Both envelopes
declare `schema_version: 0.1`, so the mismatch surfaces late as a field or
authority error that reads like an `approval-engine` outage rather than a
contract mismatch.
## Disposition
**Accepted.** The approval-claim is the step-1 artifact; `ActionAuthorization`
is not required on that path; a PEP validates across the claim (approval fact)
and flex-auth's step-2 `DecisionEnvelope` (exact `CheckRequest` match and policy
pin).
flex-auth argues **against its own proposal** here. The composed object had the
PIP republish flex-auth's decision, which is the part that was wrong: it moves an
artifact across a layer boundary that the estate's own §2 rule says it should not
cross. flex-auth used that rule to decline authentication evidence in
`FLEX-DEC-2026-002` and to win §17's decision-record schema in
`FLEX-DEC-2026-003`. It applies the same way when it costs us the object.
The split drops no check. Each of the five verifications in the contract's
"Required verification" section lands on the layer that owns it — status,
validity window, supersession, and distinct authenticated approvers on the
approval-claim; effect, binding match, digest, and policy pin on the
`DecisionEnvelope`.
### Answer to the question asked before the decision: G3 does not argue for it
`approval-engine` named the open G3 finding — `DecisionEnvelope` carries no
lifetime — as a revisit trigger, *if* it is settled by composition rather than
by adding a lifetime field, and asked flex-auth to say so **before** the
decision if G3 is the strongest case for ratifying now.
It is not, and the reason is that **G3 is already closed, the other way.**
`FLEX-WP-0019` closed it by adding the field. `schemas/decision_envelope.schema.json`
now carries a conditional requiring `lifetime` whenever `effect` is `allow`; the
duration comes from the policy package's `allow_ttl` with a `15m` engine default,
and a package declaring `allow_ttl: none` produces a deny with reason
`allow_lifetime_unstated` rather than a standing grant. This was published in
`docs/decision-record-contract.md` on 2026-09-02.
So the trigger is spent, and it resolved on the branch that removes the argument
rather than the one that supports it. A `DecisionEnvelope` now states its own
end without borrowing `ActionAuthorizationValidity`. The bundle is not needed to
give an allow a lifetime, which was the only structural thing it did that the
split does not.
The 2026-08-29 alignment review's table still shows G3 `open`. That file is a
dated review record and is not rewritten; this record supersedes its status.
### The `provenance.authority == "state-hub"` constant is flex-auth's defect
Correct on the merits, and correctable regardless of how the deferral landed.
`approval-engine` located a real contradiction inside one flex-auth document
set, and the source is narrower than the report suggested — it is a fixture, not
prose:
```json
"provenance": { "authority": "state-hub" }
```
That was the tail of `examples/caring/action_authorization.json`, directly
contradicting the same contract's ownership section: *"State Hub decision
records are coordination and provenance evidence; they are not the runtime
approval authority."* A consumer reading the example rather than the paragraph
gets the wrong constant, which is what happened.
Corrected at source. The example now names `approval-engine` as the approval
fact's authority and flex-auth as the decision's, and says State Hub is neither.
Its stale `secrets-engine.lifecycle` policy pin is also corrected to the
reserved-but-unpublished coordinate from `FLEX-DEC-2026-005`.
## Consequences
- `docs/action-bound-authorization-contract.md` status is now **deferred, not
withdrawn**, with the two-step split stated up front and an explicit "do not
build a validator against it" warning. The `PROPOSED` material is retained as
the record of what was proposed.
- `schemas/action_authorization.schema.json` carries the same deferral in its
`description`, so a machine reader sees it too. `schema_version` stays `0.1`;
bumping it would imply a ratified successor that does not exist.
- The execute-time half is untouched and stays published: `POST /v1/check`,
`binding`, the canonical request digest, and `flex-auth.decision-record.v1`.
Nothing secrets-engine built against the digest join is invalidated.
- No revisit trigger remains open on flex-auth's side. If the composed object is
ever revisited, it needs a fresh argument, not G3.

View file

@ -1,9 +1,11 @@
# Action-bound authorization contract
Status: implemented for execute-time request binding; durable approval storage
and lifecycle require `approval-engine` support.
Status: **execute-time request binding is implemented and published.** The
composed `ActionAuthorization` object in this document is **deferred, not
withdrawn** — see "Deferral of the composed object" below. Do not build a
validator against it.
Date: 2026-08-23
Date: 2026-08-23 (deferral recorded 2026-09-06, `FLEX-DEC-2026-006`)
## Ownership and endpoints
@ -30,7 +32,28 @@ decision records are coordination and provenance evidence; they are not the
runtime approval authority. Production consumers must not infer action binding
or dual control from State Hub prose or a free-form `decided_by` value.
## Durable object
## Deferral of the composed object
`ActionAuthorization` was never ratified. `GH-DEC-2026-003` (2026-08-29) named
`approval-engine`'s **approval-claim** as the step-1 artifact, and flex-auth
accepts that split (`FLEX-DEC-2026-006`):
- **Step 1 — approval fact:** `approval-engine`'s approval-claim, served from
`GET /v1/approvals/{id}/claim`. `approval-engine` is its authority.
- **Step 2 — decision:** flex-auth's `DecisionEnvelope`, with exact
`CheckRequest` match via `binding.request_digest` and the policy pin.
A PEP validates **across both**. No check from the composed object is dropped;
each one lands on the layer that owns it. The composed object would have had
the PIP republish flex-auth's decision, which is the part that was wrong.
The `PROPOSED` framing below is retained as the record of what was proposed.
It is not a contract, and a consumer that validates a `GET /v1/approvals/{id}/claim`
response against it will reject every response — both envelopes declare
`schema_version: 0.1`, so the mismatch surfaces late and reads like an
`approval-engine` outage. That is exactly what happened to secrets-engine.
## Durable object (deferred — proposed, never ratified)
[`../schemas/action_authorization.schema.json`](../schemas/action_authorization.schema.json)
defines the proposed `ActionAuthorization` storage and transport object. It
@ -80,6 +103,14 @@ A production consumer may execute only when all of the following hold:
Local fixtures, CCR labels, workplan ids, prose, and a caller-supplied flex-auth
decision id are provenance only. They cannot unlock a production action.
**State Hub is never the authority here.** A validator must not require
`provenance.authority == "state-hub"`, or accept it as evidence. State Hub
decision records are coordination and provenance evidence, as the Ownership
section above states. The authority of the approval fact is `approval-engine`;
the authority of the decision is flex-auth. The stale `"authority": "state-hub"`
value in `examples/caring/action_authorization.json` was the source of that
constant and is corrected.
## Outage and supersession semantics
- `approval-engine` unreachable: privileged live

View file

@ -15,7 +15,9 @@
"system": "secrets-engine",
"attributes": {
"stage": "build",
"fields": ["token"],
"fields": [
"token"
],
"policy_targets": [],
"auth_targets": []
}
@ -59,7 +61,9 @@
"system": "secrets-engine",
"attributes": {
"stage": "build",
"fields": ["token"],
"fields": [
"token"
],
"policy_targets": [],
"auth_targets": []
}
@ -80,7 +84,9 @@
"system": "secrets-engine",
"attributes": {
"stage": "build",
"fields": ["token"],
"fields": [
"token"
],
"policy_targets": [],
"auth_targets": []
}
@ -99,12 +105,15 @@
"provenance": {
"evaluator": "flex-auth/local",
"mode": "standalone",
"policy_package": "secrets-engine.lifecycle",
"policy_package": "secrets-engine.catalog-lane.lifecycle",
"policy_version": "v1",
"decision_time": "2026-08-23T10:00:30Z"
"decision_time": "2026-08-23T10:00:30Z",
"policy_package_note": "Reserved coordinate, not yet published (FLEX-DEC-2026-005). Illustrative only."
}
},
"provenance": {
"authority": "state-hub"
"note": "DEFERRED EXAMPLE (FLEX-DEC-2026-006). Not a contract. The approval fact's authority is approval-engine; the decision's authority is flex-auth. State Hub is never the authority for either -- do not derive a provenance.authority constant from this file.",
"approval_authority": "approval-engine",
"decision_authority": "flex-auth"
}
}

View file

@ -2,7 +2,7 @@
"$schema": "https://json-schema.org/draft/2020-12/schema",
"$id": "https://flex-auth.netkingdom/schemas/action_authorization.schema.json",
"title": "ActionAuthorization",
"description": "Durable approval envelope for one exact authorization request. This is a storage/transport contract; live evaluation remains POST /v1/check.",
"description": "DEFERRED, NOT WITHDRAWN (FLEX-DEC-2026-006, 2026-09-06). Proposed durable approval envelope for one exact authorization request; never ratified. GH-DEC-2026-003 named approval-engine's approval-claim as the step-1 artifact instead, and a PEP validates across that claim and flex-auth's DecisionEnvelope. Do not validate an approval-claim response against this schema. Live evaluation remains POST /v1/check.",
"type": "object",
"additionalProperties": false,
"required": ["schema_version", "id", "status", "request", "validity", "approvals", "decision"],