coulomb/flex-auth
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(policy): add credential grant authorization package
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
Build and Publish Container Image / build-and-push (push) Successful in 37s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02e47-6aac-7ee1-914d-0584c75d3c81
This commit is contained in:
tegwick 2026-08-23 13:59:03 +02:00
parent df54c1b8f5
commit acbaa4a7c9
12 changed files with 476 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

23
workplans/FLEX-WP-0012-credential-grant-authorization-surface.md
View file

@ -135,7 +135,7 @@ place duration normalization explicitly.
```task
id: FLEX-WP-0012-T02
status: todo
status: done
priority: medium
state_hub_task_id: "7e9c4e59-e59c-4617-a87f-99142952fe78"
```
@ -168,11 +168,20 @@ id. Verify against the real binary: `test-policy`, `load-registry`, and
Done when all Rego tests and fixtures pass and default-deny is demonstrated
for an unregistered grant.
Completed 2026-08-23. `examples/railiance-platform/` registers all three
current catalog grants and representative requester subjects. The policy uses
numeric `requested_ttl_seconds`; duration parsing belongs to the selected wire
translator, and strings are explicitly denied. Three embedded Rego tests and
six external fixtures pass, covering allow, TTL, actor type, purpose, delivery
mode, and unknown-grant default deny. Real `load-registry` and `check` commands
returned `credential_grant_allowed` for the registered runtime grant and
`unknown_grant` for an unregistered id.
## T03 - Implement the decided integration and prove it end to end
```task
id: FLEX-WP-0012-T03
status: todo
status: wait
priority: medium
state_hub_task_id: "3335b2b7-cf1a-411d-95b3-03c4b4c35659"
```
@ -199,6 +208,10 @@ request metadata only. Nothing in this workplan should read, log, or persist a
credential value; if a task appears to require one, that is a signal the
design has drifted, not a reason to handle secrets here.
Waiting on T01's wire-translation decision. The policy-side normalized request
contract is implemented; either integration option must produce its numeric
TTL field without changing policy semantics.
Done when allow and all four denials are demonstrated against the real helper
over real HTTP, `go test ./...` is green, and `gofmt`/`go vet` are clean.
@ -206,7 +219,7 @@ over real HTTP, `go test ./...` is green, and `gofmt`/`go vet` are clean.
```task
id: FLEX-WP-0012-T04
status: todo
status: wait
priority: low
state_hub_task_id: "40015a87-040c-4d48-b360-fd5566dbc552"
```
@ -225,3 +238,7 @@ actually meant before promising an endpoint.
Update `docs/` with a credential-grant action vocabulary, matching the
existing per-consumer vocabulary docs.
The source-side action vocabulary is now present at
`docs/railiance-platform-action-vocabulary.md`; final consumer/deployment
handoff waits on T01 and T03.