coulomb/flex-auth
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Apply gate-house's section 11 rulings: four-token validator, emission guarantee, resource.system.
All checks were successful
CI Smoke / host-smoke (push) Successful in 1s
Details
CI Smoke / container-smoke (push) Successful in 5s
Details
Build and Publish Container Image / build-and-push (push) Successful in 1m11s
Details

Browse source 
GH-DEC-2026-017: the validator admitted {Staff, Engine, Tooling}, built from
section 4's catalog rows, and rejected Taxonomy, which section 3.1 defines.
railiance-master was conforming; the validator was the divergent artifact.
Now four tokens, ASCII case folded, section 4's spelling canonical, INTENT.md
governing while form disagreements are still reported, and every run states
its scope (section 11 binds section 4; volunteers are not non-conformances).
Also fixes the survey silently dropping audit-core's layer.yaml by decoding
peers into flex-auth's own struct.

GH-DEC-2026-018: flex-auth is a section 4 source of evidence. G2 closes as a
question and reopens as a dated gap (review 2026-10-19). cadence.yaml
publishes the per-event-class inventory: deny, redact, not_applicable and
audit_only rare load-bearing (heartbeat and reconciliation, rate forbidden);
allow volume load-bearing (expected-rate and reconciliation). INTENT.md
declares source_of_evidence and names it; tests assert both. Delivery is
FLEX-WP-0031.

FLEX-DEC-2026-015: resource.system follows the runtime, not the repository,
answering ops-warden's WARDEN-IN-0003.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 63291@bnt-lap001
Assistant-Session: 8bd77868-ca68-4f49-bb1e-d539ecc0d703
This commit is contained in:
tegwick 2026-09-21 06:35:30 +02:00
parent d6c9e3bad4
commit 80ffe729d4
14 changed files with 1502 additions and 78 deletions
Download patch file Download diff file Expand all files Collapse all files

12
INTENT.md
View file

@ -19,6 +19,18 @@ declared_at: "2026-08-29"
conformance_record: docs/conformance/security-layer-conformance.md
pep_stance: null # not PEP-shaped: flex-auth renders decisions, it causes no protected side effect
tooling_contacts: [] # §5 binds Staff; flex-auth holds no Tooling client
#
# §11 emission guarantee. GH-DEC-2026-018 ruled that a custodian is never the
# source of what it holds, so flex-auth is the §4 source of evidence for the
# decision record and owes a guarantee PER EVENT CLASS. audit-core declined the
# role on its own authority (AUDIT-IN-0005). §4 gains an evidence-source
# marking under A10; this key is the repository's own side of that marking, so
# no run has to infer it. The class inventory and its classification are
# flex-auth's to publish — §11 forbids a run inferring class from event name,
# payload or observed rate, and GH-DEC-2026-018 §4 declined to classify on
# flex-auth's behalf for exactly that reason.
source_of_evidence: true
emission_guarantee: cadence.yaml
---
# Flex-Auth Intent