Compile compact sitting review package without widening T03.
Seven exact-record pins from the 2026-09-15 sitting-create receipt. c01 is omitted. Identity bar matches T03. 147 local evaluator checks pass. Deploy waits on a CI image that contains the new package. Assistant: grok Assistant-Session: 01a0a6cb-0334-72c0-83b0-2df57474a0f6
This commit is contained in:
parent
a689bc2645
commit
8007edecc4
10 changed files with 1261 additions and 0 deletions
21
examples/informed-decision-sitting/fixtures.json
Normal file
21
examples/informed-decision-sitting/fixtures.json
Normal file
|
|
@ -0,0 +1,21 @@
|
|||
[
|
||||
{
|
||||
"id": "unknown-request-denied",
|
||||
"request": {
|
||||
"id": "unknown",
|
||||
"subject": {
|
||||
"id": "unknown",
|
||||
"type": "human"
|
||||
},
|
||||
"action": "accept",
|
||||
"resource": {
|
||||
"id": "memo:unrelated",
|
||||
"type": "decision-memo",
|
||||
"system": "informed-decision"
|
||||
}
|
||||
},
|
||||
"expect": {
|
||||
"effect": "deny"
|
||||
}
|
||||
}
|
||||
]
|
||||
108
examples/informed-decision-sitting/policy.md
Normal file
108
examples/informed-decision-sitting/policy.md
Normal file
|
|
@ -0,0 +1,108 @@
|
|||
---
|
||||
id: informed-decision.compact-sitting
|
||||
name: Compact sitting exact-record human review
|
||||
namespace: informed-decision:decision-memo
|
||||
version: v1
|
||||
status: ready
|
||||
package: flexauth.informed_decision.compact_sitting
|
||||
allow_ttl: 30s
|
||||
actions: [read, acknowledge, accept, return, discuss, decline]
|
||||
owner: flex-auth
|
||||
fixtures: [fixtures.json]
|
||||
caring:
|
||||
profile: caring-0.4.0-rc2
|
||||
enforce: false
|
||||
activation:
|
||||
mode: local
|
||||
---
|
||||
|
||||
# Compact sitting review mandate
|
||||
|
||||
This is a new exact-record package for seven 2026-09-14 sitting memos.
|
||||
It is not an expansion of `examples/informed-decision-t03` / FLEX-WP-0027.
|
||||
`memo:infd-20260914-c01` is omitted (create-client still undecided).
|
||||
|
||||
The identity bar matches T03: authenticated informed-decision caller,
|
||||
`net-kingdom-admins`, fresh KeyCape AAL2 MFA. No permission follows from
|
||||
memo content or presentation state. TokenReview must admit
|
||||
`system:serviceaccount:informed-decision:review` before this package is
|
||||
served. Membership tenant provenance may follow the accepted registration
|
||||
route; it does not assert directory membership in tenant:platform.
|
||||
Only a real human uses accept. This package neither issues nor consumes
|
||||
approval. Native pins: `docs/evidence/2026-09-15-sitting-approval-creates.json`.
|
||||
|
||||
```rego
|
||||
import rego.v1
|
||||
|
||||
records := {
|
||||
"memo:infd-20260914-c02": {
|
||||
"approval_id": "ccfd8007-2061-48fd-9356-99b16279dac1",
|
||||
"binding_digest": "sha256:942cf7d5e6805987df2077a0cc6cde75b148e1729a96dd0692153287820b6a0a"
|
||||
},
|
||||
"memo:infd-20260914-c03": {
|
||||
"approval_id": "a0611d0d-b9ef-4b9a-aa79-e94a9e3fcd5f",
|
||||
"binding_digest": "sha256:95cae135b994acea6dad9da978dd3df1aa3354de900a1f43c2e5a03a20e8e844"
|
||||
},
|
||||
"memo:infd-20260914-c04": {
|
||||
"approval_id": "22ac6df3-e6a9-472b-a68e-c8caca4289a7",
|
||||
"binding_digest": "sha256:dec960b30efaf654abbdcd8a2cdd20d4ff6bf52e170744f817dc55845d9cb192"
|
||||
},
|
||||
"memo:infd-20260914-d01": {
|
||||
"approval_id": "9f7c3506-68de-4826-86ff-e301f428408d",
|
||||
"binding_digest": "sha256:8cb7cc93f38db9d19b49e201e0554b50af1891fec853fef333a06ea078541d15"
|
||||
},
|
||||
"memo:infd-20260914-d02": {
|
||||
"approval_id": "b3ce2c01-0a3b-401e-b4ed-c1954af169c9",
|
||||
"binding_digest": "sha256:be0c7de123216740d2c2eeaed80384e03e6b6d1668104f94bb8f9cbae7dfe30f"
|
||||
},
|
||||
"memo:infd-20260914-d03": {
|
||||
"approval_id": "3b483e6b-0b92-45ff-83b6-bc5057c0a496",
|
||||
"binding_digest": "sha256:3c562278e86bb5e7f747452cf2e99d3a136853ab748676e8359262b835cd1425"
|
||||
},
|
||||
"memo:infd-20260914-d04": {
|
||||
"approval_id": "356e67a3-5539-46a1-922a-f5591fd38ee5",
|
||||
"binding_digest": "sha256:3c2d7759679d871cb7c5cac8999542a365e64c918d59d0c4ce864ffb837453e4"
|
||||
}
|
||||
}
|
||||
|
||||
decision := {"effect": "allow", "reason": "operator_admitted_compact_sitting"} if {
|
||||
input.tenant == "tenant:platform"
|
||||
input.subject.tenant == "tenant:platform"
|
||||
input.subject.type == "human"
|
||||
is_string(input.subject.id)
|
||||
input.subject.id != ""
|
||||
input.subject.attributes.principal_type_source == "authentication-derived"
|
||||
input.subject.attributes.tenant_source in {"registration-supplied", "directory-asserted"}
|
||||
"net-kingdom-admins" in input.subject.attributes.groups
|
||||
assurance := input.subject.attributes.assurance
|
||||
assurance.level == "aal2"
|
||||
assurance.mfa == true
|
||||
assurance.source == "key-cape"
|
||||
assurance.methods == ["pwd", "otp"]
|
||||
is_number(assurance.at)
|
||||
assurance.at > 0
|
||||
age := time.now_ns() / 1000000000 - assurance.at
|
||||
age >= -30
|
||||
age <= 900
|
||||
input.resource.tenant == "tenant:platform"
|
||||
input.resource.system == "informed-decision"
|
||||
input.resource.type == "decision-memo"
|
||||
record := records[input.resource.id]
|
||||
input.context.memo_version == 1
|
||||
input.context.approval_id == record.approval_id
|
||||
input.context.approval_binding_digest == record.binding_digest
|
||||
input.action in {"read", "acknowledge", "accept", "return", "discuss", "decline"}
|
||||
} else := {"effect": "deny", "reason": "compact_sitting_scope_or_identity_refused"} if {
|
||||
true
|
||||
}
|
||||
```
|
||||
|
||||
```rego test
|
||||
package flexauth.informed_decision.compact_sitting_test
|
||||
import rego.v1
|
||||
import data.flexauth.informed_decision.compact_sitting
|
||||
|
||||
test_unknown_request_denied if {
|
||||
compact_sitting.decision.effect == "deny" with input as {}
|
||||
}
|
||||
```
|
||||
121
examples/informed-decision-sitting/records.json
Normal file
121
examples/informed-decision-sitting/records.json
Normal file
|
|
@ -0,0 +1,121 @@
|
|||
{
|
||||
"memo:infd-20260914-c02": {
|
||||
"approval_id": "ccfd8007-2061-48fd-9356-99b16279dac1",
|
||||
"binding_digest": "sha256:942cf7d5e6805987df2077a0cc6cde75b148e1729a96dd0692153287820b6a0a",
|
||||
"label": "c02",
|
||||
"binding": {
|
||||
"action": "accept",
|
||||
"actor": "informed-decision",
|
||||
"principal": "railiance-platform",
|
||||
"purpose": "Accept provisioning of the secrets-engine service JWT login on the reviewed credential lane",
|
||||
"target": {
|
||||
"id": "rpf-wp-0035-t02",
|
||||
"type": "credential-lane",
|
||||
"system": "railiance-platform"
|
||||
}
|
||||
},
|
||||
"memo_version": 1
|
||||
},
|
||||
"memo:infd-20260914-c03": {
|
||||
"approval_id": "a0611d0d-b9ef-4b9a-aa79-e94a9e3fcd5f",
|
||||
"binding_digest": "sha256:95cae135b994acea6dad9da978dd3df1aa3354de900a1f43c2e5a03a20e8e844",
|
||||
"label": "c03",
|
||||
"binding": {
|
||||
"action": "apply",
|
||||
"actor": "informed-decision",
|
||||
"principal": "netkingdom",
|
||||
"purpose": "Apply the live OpenBao role addition already specified for the operator-tunneled browser callback",
|
||||
"target": {
|
||||
"id": "nk-wp-0032-t03",
|
||||
"type": "openbao-role",
|
||||
"system": "netkingdom"
|
||||
}
|
||||
},
|
||||
"memo_version": 1
|
||||
},
|
||||
"memo:infd-20260914-c04": {
|
||||
"approval_id": "22ac6df3-e6a9-472b-a68e-c8caca4289a7",
|
||||
"binding_digest": "sha256:dec960b30efaf654abbdcd8a2cdd20d4ff6bf52e170744f817dc55845d9cb192",
|
||||
"label": "c04",
|
||||
"binding": {
|
||||
"action": "attend",
|
||||
"actor": "informed-decision",
|
||||
"principal": "ops-warden",
|
||||
"purpose": "Attend the graded lockdown / break-glass seal for ops-warden trust-root work",
|
||||
"target": {
|
||||
"id": "warden-wp-0027-t02",
|
||||
"type": "trust-root",
|
||||
"system": "ops-warden"
|
||||
}
|
||||
},
|
||||
"memo_version": 1
|
||||
},
|
||||
"memo:infd-20260914-d01": {
|
||||
"approval_id": "9f7c3506-68de-4826-86ff-e301f428408d",
|
||||
"binding_digest": "sha256:8cb7cc93f38db9d19b49e201e0554b50af1891fec853fef333a06ea078541d15",
|
||||
"label": "d01",
|
||||
"binding": {
|
||||
"action": "retire",
|
||||
"actor": "informed-decision",
|
||||
"principal": "the-custodian",
|
||||
"purpose": "After HA failover and restore drills pass, retire WSL2 as a State Hub fallback",
|
||||
"target": {
|
||||
"id": "cust-wp-0038-t08",
|
||||
"type": "operating-model",
|
||||
"system": "the-custodian"
|
||||
}
|
||||
},
|
||||
"memo_version": 1
|
||||
},
|
||||
"memo:infd-20260914-d02": {
|
||||
"approval_id": "b3ce2c01-0a3b-401e-b4ed-c1954af169c9",
|
||||
"binding_digest": "sha256:be0c7de123216740d2c2eeaed80384e03e6b6d1668104f94bb8f9cbae7dfe30f",
|
||||
"label": "d02",
|
||||
"binding": {
|
||||
"action": "confirm",
|
||||
"actor": "informed-decision",
|
||||
"principal": "helixforge-factory",
|
||||
"purpose": "Confirm the existing operator-group claim for CCR-2026-0019 as required by the factory identity/audit/approval path",
|
||||
"target": {
|
||||
"id": "ccr-2026-0019",
|
||||
"type": "ccr",
|
||||
"system": "helixforge-factory"
|
||||
}
|
||||
},
|
||||
"memo_version": 1
|
||||
},
|
||||
"memo:infd-20260914-d03": {
|
||||
"approval_id": "3b483e6b-0b92-45ff-83b6-bc5057c0a496",
|
||||
"binding_digest": "sha256:3c562278e86bb5e7f747452cf2e99d3a136853ab748676e8359262b835cd1425",
|
||||
"label": "d03",
|
||||
"binding": {
|
||||
"action": "accept",
|
||||
"actor": "informed-decision",
|
||||
"principal": "mason",
|
||||
"purpose": "Accept the fluid-telegram operator credential lane plan so construction may proceed",
|
||||
"target": {
|
||||
"id": "mason-wp-0005",
|
||||
"type": "workplan",
|
||||
"system": "mason"
|
||||
}
|
||||
},
|
||||
"memo_version": 1
|
||||
},
|
||||
"memo:infd-20260914-d04": {
|
||||
"approval_id": "356e67a3-5539-46a1-922a-f5591fd38ee5",
|
||||
"binding_digest": "sha256:3c2d7759679d871cb7c5cac8999542a365e64c918d59d0c4ce864ffb837453e4",
|
||||
"label": "d04",
|
||||
"binding": {
|
||||
"action": "confirm",
|
||||
"actor": "informed-decision",
|
||||
"principal": "railiance-clock",
|
||||
"purpose": "Confirm ecosystem ownership and the security role for Railiance Clock as specified",
|
||||
"target": {
|
||||
"id": "rclk-wp-0002-t01",
|
||||
"type": "workplan",
|
||||
"system": "railiance-clock"
|
||||
}
|
||||
},
|
||||
"memo_version": 1
|
||||
}
|
||||
}
|
||||
17
examples/informed-decision-sitting/registry.json
Normal file
17
examples/informed-decision-sitting/registry.json
Normal file
|
|
@ -0,0 +1,17 @@
|
|||
{
|
||||
"subjects": [
|
||||
{
|
||||
"id": "sitting-reviewer",
|
||||
"type": "Human",
|
||||
"display_name": "Compact sitting reviewer",
|
||||
"organization_relation": "ServiceProvider",
|
||||
"groups": ["net-kingdom-admins"],
|
||||
"claims": {
|
||||
"assurance": "aal2",
|
||||
"principal_type_source": "authentication-derived",
|
||||
"tenant_source": "registration-supplied"
|
||||
}
|
||||
}
|
||||
],
|
||||
"resources": []
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue