coulomb/flex-auth
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Compile compact sitting review package without widening T03.
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
Build and Publish Container Image / build-and-push (push) Successful in 1m8s
Details

Browse source 
Seven exact-record pins from the 2026-09-15 sitting-create receipt.
c01 is omitted. Identity bar matches T03. 147 local evaluator checks
pass. Deploy waits on a CI image that contains the new package.

Assistant: grok
Assistant-Session: 01a0a6cb-0334-72c0-83b0-2df57474a0f6
This commit is contained in:
tegwick 2026-09-15 22:45:46 +02:00
parent a689bc2645
commit 8007edecc4
10 changed files with 1261 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

229
docs/evidence/2026-09-15-sitting-approval-creates.json Normal file
View file

@ -0,0 +1,229 @@
{
"observed_at": "2026-09-15T20:35:14.412859+00:00",
"status": "created",
"phase": "seven_unapproved_requests_created",
"requests": [
{
"memo_id": "infd-20260914-c02",
"approval": {
"binding": {
"action": "accept",
"actor": "informed-decision",
"digest": "sha256:942cf7d5e6805987df2077a0cc6cde75b148e1729a96dd0692153287820b6a0a",
"human_control": true,
"pdp_digest": null,
"pdp_path": false,
"principal": "railiance-platform",
"purpose": "Accept provisioning of the secrets-engine service JWT login on the reviewed credential lane",
"target": {
"id": "rpf-wp-0035-t02",
"system": "railiance-platform",
"type": "credential-lane"
}
},
"created_at": "2026-09-15T20:35:16+00:00",
"entries": [],
"id": "ccfd8007-2061-48fd-9356-99b16279dac1",
"required_count": 1,
"status": "requested",
"superseded_by": null,
"updated_at": "2026-09-15T20:35:16+00:00",
"validity": {
"expires_at": "2026-09-16T20:35:16.122938+00:00",
"not_before": "2026-09-15T20:35:16.122938+00:00"
}
}
},
{
"memo_id": "infd-20260914-c03",
"approval": {
"binding": {
"action": "apply",
"actor": "informed-decision",
"digest": "sha256:95cae135b994acea6dad9da978dd3df1aa3354de900a1f43c2e5a03a20e8e844",
"human_control": true,
"pdp_digest": null,
"pdp_path": false,
"principal": "netkingdom",
"purpose": "Apply the live OpenBao role addition already specified for the operator-tunneled browser callback",
"target": {
"id": "nk-wp-0032-t03",
"system": "netkingdom",
"type": "openbao-role"
}
},
"created_at": "2026-09-15T20:35:16+00:00",
"entries": [],
"id": "a0611d0d-b9ef-4b9a-aa79-e94a9e3fcd5f",
"required_count": 1,
"status": "requested",
"superseded_by": null,
"updated_at": "2026-09-15T20:35:16+00:00",
"validity": {
"expires_at": "2026-09-16T20:35:16.122938+00:00",
"not_before": "2026-09-15T20:35:16.122938+00:00"
}
}
},
{
"memo_id": "infd-20260914-c04",
"approval": {
"binding": {
"action": "attend",
"actor": "informed-decision",
"digest": "sha256:dec960b30efaf654abbdcd8a2cdd20d4ff6bf52e170744f817dc55845d9cb192",
"human_control": true,
"pdp_digest": null,
"pdp_path": false,
"principal": "ops-warden",
"purpose": "Attend the graded lockdown / break-glass seal for ops-warden trust-root work",
"target": {
"id": "warden-wp-0027-t02",
"system": "ops-warden",
"type": "trust-root"
}
},
"created_at": "2026-09-15T20:35:17+00:00",
"entries": [],
"id": "22ac6df3-e6a9-472b-a68e-c8caca4289a7",
"required_count": 1,
"status": "requested",
"superseded_by": null,
"updated_at": "2026-09-15T20:35:17+00:00",
"validity": {
"expires_at": "2026-09-16T20:35:16.122938+00:00",
"not_before": "2026-09-15T20:35:16.122938+00:00"
}
}
},
{
"memo_id": "infd-20260914-d01",
"approval": {
"binding": {
"action": "retire",
"actor": "informed-decision",
"digest": "sha256:8cb7cc93f38db9d19b49e201e0554b50af1891fec853fef333a06ea078541d15",
"human_control": true,
"pdp_digest": null,
"pdp_path": false,
"principal": "the-custodian",
"purpose": "After HA failover and restore drills pass, retire WSL2 as a State Hub fallback",
"target": {
"id": "cust-wp-0038-t08",
"system": "the-custodian",
"type": "operating-model"
}
},
"created_at": "2026-09-15T20:35:17+00:00",
"entries": [],
"id": "9f7c3506-68de-4826-86ff-e301f428408d",
"required_count": 1,
"status": "requested",
"superseded_by": null,
"updated_at": "2026-09-15T20:35:17+00:00",
"validity": {
"expires_at": "2026-09-16T20:35:16.122938+00:00",
"not_before": "2026-09-15T20:35:16.122938+00:00"
}
}
},
{
"memo_id": "infd-20260914-d02",
"approval": {
"binding": {
"action": "confirm",
"actor": "informed-decision",
"digest": "sha256:be0c7de123216740d2c2eeaed80384e03e6b6d1668104f94bb8f9cbae7dfe30f",
"human_control": true,
"pdp_digest": null,
"pdp_path": false,
"principal": "helixforge-factory",
"purpose": "Confirm the existing operator-group claim for CCR-2026-0019 as required by the factory identity/audit/approval path",
"target": {
"id": "ccr-2026-0019",
"system": "helixforge-factory",
"type": "ccr"
}
},
"created_at": "2026-09-15T20:35:17+00:00",
"entries": [],
"id": "b3ce2c01-0a3b-401e-b4ed-c1954af169c9",
"required_count": 1,
"status": "requested",
"superseded_by": null,
"updated_at": "2026-09-15T20:35:17+00:00",
"validity": {
"expires_at": "2026-09-16T20:35:16.122938+00:00",
"not_before": "2026-09-15T20:35:16.122938+00:00"
}
}
},
{
"memo_id": "infd-20260914-d03",
"approval": {
"binding": {
"action": "accept",
"actor": "informed-decision",
"digest": "sha256:3c562278e86bb5e7f747452cf2e99d3a136853ab748676e8359262b835cd1425",
"human_control": true,
"pdp_digest": null,
"pdp_path": false,
"principal": "mason",
"purpose": "Accept the fluid-telegram operator credential lane plan so construction may proceed",
"target": {
"id": "mason-wp-0005",
"system": "mason",
"type": "workplan"
}
},
"created_at": "2026-09-15T20:35:17+00:00",
"entries": [],
"id": "3b483e6b-0b92-45ff-83b6-bc5057c0a496",
"required_count": 1,
"status": "requested",
"superseded_by": null,
"updated_at": "2026-09-15T20:35:17+00:00",
"validity": {
"expires_at": "2026-09-16T20:35:16.122938+00:00",
"not_before": "2026-09-15T20:35:16.122938+00:00"
}
}
},
{
"memo_id": "infd-20260914-d04",
"approval": {
"binding": {
"action": "confirm",
"actor": "informed-decision",
"digest": "sha256:3c2d7759679d871cb7c5cac8999542a365e64c918d59d0c4ce864ffb837453e4",
"human_control": true,
"pdp_digest": null,
"pdp_path": false,
"principal": "railiance-clock",
"purpose": "Confirm ecosystem ownership and the security role for Railiance Clock as specified",
"target": {
"id": "rclk-wp-0002-t01",
"system": "railiance-clock",
"type": "workplan"
}
},
"created_at": "2026-09-15T20:35:17+00:00",
"entries": [],
"id": "356e67a3-5539-46a1-922a-f5591fd38ee5",
"required_count": 1,
"status": "requested",
"superseded_by": null,
"updated_at": "2026-09-15T20:35:17+00:00",
"validity": {
"expires_at": "2026-09-16T20:35:16.122938+00:00",
"not_before": "2026-09-15T20:35:16.122938+00:00"
}
}
}
],
"credential_values_emitted": false,
"human_entries_created": false,
"skipped": [
"infd-20260914-c01"
]
}

593
docs/evidence/2026-09-15-sitting-review-policy.json Normal file
View file

@ -0,0 +1,593 @@
{
"scope": "local actual evaluator with synthetic identity; no live human approvals; T03 package untouched",
"checks": [
{
"check": "c02:read",
"effect": "allow"
},
{
"check": "c02:acknowledge",
"effect": "allow"
},
{
"check": "c02:accept",
"effect": "allow"
},
{
"check": "c02:return",
"effect": "allow"
},
{
"check": "c02:discuss",
"effect": "allow"
},
{
"check": "c02:decline",
"effect": "allow"
},
{
"check": "c02:wrong-group",
"effect": "deny"
},
{
"check": "c02:no-group",
"effect": "deny"
},
{
"check": "c02:service",
"effect": "deny"
},
{
"check": "c02:stale-mfa",
"effect": "deny"
},
{
"check": "c02:future-mfa",
"effect": "deny"
},
{
"check": "c02:no-mfa",
"effect": "deny"
},
{
"check": "c02:forged-human-route",
"effect": "deny"
},
{
"check": "c02:wrong-tenant",
"effect": "deny"
},
{
"check": "c02:other-memo",
"effect": "deny"
},
{
"check": "c02:omitted-c01",
"effect": "deny"
},
{
"check": "c02:t03-memo",
"effect": "deny"
},
{
"check": "c02:changed-version",
"effect": "deny"
},
{
"check": "c02:changed-approval",
"effect": "deny"
},
{
"check": "c02:changed-digest",
"effect": "deny"
},
{
"check": "c02:consume",
"effect": "deny"
},
{
"check": "c03:read",
"effect": "allow"
},
{
"check": "c03:acknowledge",
"effect": "allow"
},
{
"check": "c03:accept",
"effect": "allow"
},
{
"check": "c03:return",
"effect": "allow"
},
{
"check": "c03:discuss",
"effect": "allow"
},
{
"check": "c03:decline",
"effect": "allow"
},
{
"check": "c03:wrong-group",
"effect": "deny"
},
{
"check": "c03:no-group",
"effect": "deny"
},
{
"check": "c03:service",
"effect": "deny"
},
{
"check": "c03:stale-mfa",
"effect": "deny"
},
{
"check": "c03:future-mfa",
"effect": "deny"
},
{
"check": "c03:no-mfa",
"effect": "deny"
},
{
"check": "c03:forged-human-route",
"effect": "deny"
},
{
"check": "c03:wrong-tenant",
"effect": "deny"
},
{
"check": "c03:other-memo",
"effect": "deny"
},
{
"check": "c03:omitted-c01",
"effect": "deny"
},
{
"check": "c03:t03-memo",
"effect": "deny"
},
{
"check": "c03:changed-version",
"effect": "deny"
},
{
"check": "c03:changed-approval",
"effect": "deny"
},
{
"check": "c03:changed-digest",
"effect": "deny"
},
{
"check": "c03:consume",
"effect": "deny"
},
{
"check": "c04:read",
"effect": "allow"
},
{
"check": "c04:acknowledge",
"effect": "allow"
},
{
"check": "c04:accept",
"effect": "allow"
},
{
"check": "c04:return",
"effect": "allow"
},
{
"check": "c04:discuss",
"effect": "allow"
},
{
"check": "c04:decline",
"effect": "allow"
},
{
"check": "c04:wrong-group",
"effect": "deny"
},
{
"check": "c04:no-group",
"effect": "deny"
},
{
"check": "c04:service",
"effect": "deny"
},
{
"check": "c04:stale-mfa",
"effect": "deny"
},
{
"check": "c04:future-mfa",
"effect": "deny"
},
{
"check": "c04:no-mfa",
"effect": "deny"
},
{
"check": "c04:forged-human-route",
"effect": "deny"
},
{
"check": "c04:wrong-tenant",
"effect": "deny"
},
{
"check": "c04:other-memo",
"effect": "deny"
},
{
"check": "c04:omitted-c01",
"effect": "deny"
},
{
"check": "c04:t03-memo",
"effect": "deny"
},
{
"check": "c04:changed-version",
"effect": "deny"
},
{
"check": "c04:changed-approval",
"effect": "deny"
},
{
"check": "c04:changed-digest",
"effect": "deny"
},
{
"check": "c04:consume",
"effect": "deny"
},
{
"check": "d01:read",
"effect": "allow"
},
{
"check": "d01:acknowledge",
"effect": "allow"
},
{
"check": "d01:accept",
"effect": "allow"
},
{
"check": "d01:return",
"effect": "allow"
},
{
"check": "d01:discuss",
"effect": "allow"
},
{
"check": "d01:decline",
"effect": "allow"
},
{
"check": "d01:wrong-group",
"effect": "deny"
},
{
"check": "d01:no-group",
"effect": "deny"
},
{
"check": "d01:service",
"effect": "deny"
},
{
"check": "d01:stale-mfa",
"effect": "deny"
},
{
"check": "d01:future-mfa",
"effect": "deny"
},
{
"check": "d01:no-mfa",
"effect": "deny"
},
{
"check": "d01:forged-human-route",
"effect": "deny"
},
{
"check": "d01:wrong-tenant",
"effect": "deny"
},
{
"check": "d01:other-memo",
"effect": "deny"
},
{
"check": "d01:omitted-c01",
"effect": "deny"
},
{
"check": "d01:t03-memo",
"effect": "deny"
},
{
"check": "d01:changed-version",
"effect": "deny"
},
{
"check": "d01:changed-approval",
"effect": "deny"
},
{
"check": "d01:changed-digest",
"effect": "deny"
},
{
"check": "d01:consume",
"effect": "deny"
},
{
"check": "d02:read",
"effect": "allow"
},
{
"check": "d02:acknowledge",
"effect": "allow"
},
{
"check": "d02:accept",
"effect": "allow"
},
{
"check": "d02:return",
"effect": "allow"
},
{
"check": "d02:discuss",
"effect": "allow"
},
{
"check": "d02:decline",
"effect": "allow"
},
{
"check": "d02:wrong-group",
"effect": "deny"
},
{
"check": "d02:no-group",
"effect": "deny"
},
{
"check": "d02:service",
"effect": "deny"
},
{
"check": "d02:stale-mfa",
"effect": "deny"
},
{
"check": "d02:future-mfa",
"effect": "deny"
},
{
"check": "d02:no-mfa",
"effect": "deny"
},
{
"check": "d02:forged-human-route",
"effect": "deny"
},
{
"check": "d02:wrong-tenant",
"effect": "deny"
},
{
"check": "d02:other-memo",
"effect": "deny"
},
{
"check": "d02:omitted-c01",
"effect": "deny"
},
{
"check": "d02:t03-memo",
"effect": "deny"
},
{
"check": "d02:changed-version",
"effect": "deny"
},
{
"check": "d02:changed-approval",
"effect": "deny"
},
{
"check": "d02:changed-digest",
"effect": "deny"
},
{
"check": "d02:consume",
"effect": "deny"
},
{
"check": "d03:read",
"effect": "allow"
},
{
"check": "d03:acknowledge",
"effect": "allow"
},
{
"check": "d03:accept",
"effect": "allow"
},
{
"check": "d03:return",
"effect": "allow"
},
{
"check": "d03:discuss",
"effect": "allow"
},
{
"check": "d03:decline",
"effect": "allow"
},
{
"check": "d03:wrong-group",
"effect": "deny"
},
{
"check": "d03:no-group",
"effect": "deny"
},
{
"check": "d03:service",
"effect": "deny"
},
{
"check": "d03:stale-mfa",
"effect": "deny"
},
{
"check": "d03:future-mfa",
"effect": "deny"
},
{
"check": "d03:no-mfa",
"effect": "deny"
},
{
"check": "d03:forged-human-route",
"effect": "deny"
},
{
"check": "d03:wrong-tenant",
"effect": "deny"
},
{
"check": "d03:other-memo",
"effect": "deny"
},
{
"check": "d03:omitted-c01",
"effect": "deny"
},
{
"check": "d03:t03-memo",
"effect": "deny"
},
{
"check": "d03:changed-version",
"effect": "deny"
},
{
"check": "d03:changed-approval",
"effect": "deny"
},
{
"check": "d03:changed-digest",
"effect": "deny"
},
{
"check": "d03:consume",
"effect": "deny"
},
{
"check": "d04:read",
"effect": "allow"
},
{
"check": "d04:acknowledge",
"effect": "allow"
},
{
"check": "d04:accept",
"effect": "allow"
},
{
"check": "d04:return",
"effect": "allow"
},
{
"check": "d04:discuss",
"effect": "allow"
},
{
"check": "d04:decline",
"effect": "allow"
},
{
"check": "d04:wrong-group",
"effect": "deny"
},
{
"check": "d04:no-group",
"effect": "deny"
},
{
"check": "d04:service",
"effect": "deny"
},
{
"check": "d04:stale-mfa",
"effect": "deny"
},
{
"check": "d04:future-mfa",
"effect": "deny"
},
{
"check": "d04:no-mfa",
"effect": "deny"
},
{
"check": "d04:forged-human-route",
"effect": "deny"
},
{
"check": "d04:wrong-tenant",
"effect": "deny"
},
{
"check": "d04:other-memo",
"effect": "deny"
},
{
"check": "d04:omitted-c01",
"effect": "deny"
},
{
"check": "d04:t03-memo",
"effect": "deny"
},
{
"check": "d04:changed-version",
"effect": "deny"
},
{
"check": "d04:changed-approval",
"effect": "deny"
},
{
"check": "d04:changed-digest",
"effect": "deny"
},
{
"check": "d04:consume",
"effect": "deny"
}
]
}