coulomb/flex-auth
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Admit list for the informed-decision overview as compact-sitting v3 (FLEX-DEC-2026-017).
All checks were successful
CI Smoke / host-smoke (push) Successful in 1s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details
Build and Publish Container Image / build-and-push (push) Successful in 1m14s
Details

Browse source 
list is a separate rule with exact-record scope over the union of the eight
sitting records and the three T03 records, each pinned by approval id, digest and
its own memo version, with a 12-hour MFA window. read and the five acts keep the
v2 rule unchanged — same eight records, same 900-second window — so a list allow
satisfies nothing else.

The operator chose exact-record scope over the consumer's preferred type-wide
scope: the PDP checks no recipient, so type-wide scope with a relaxed window would
have left the consumer's structural match — which the consumer itself says is
not an entitlement — as the only scope. The 12-hour bound replaces the requested
"no bound" so the PDP still states one. The KeyCape stale-timestamp defect is not
worked around; read stays strict.

417 evaluator checks: 168 v2 unchanged, 231 list, 18 proving no act widens to the
T03 records. Also fixes tools/exercise_t03_review_policy.py, which had been
failing since f85479c moved the T03 records to memo version 2 and it still sent
version 1. Test-only.

Not deployed: the pin serving the live review surface changes only with operator
confirmation.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 28468@bnt-lap001
Assistant-Session: c76569b2-6056-4dad-aea4-49cd7a018f5d
This commit is contained in:
tegwick 2026-09-21 23:06:40 +02:00
parent 1a3f2f7d78
commit ad7b7f536a
7 changed files with 1928 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

57
decisions/decisions.md
View file

@ -1953,3 +1953,60 @@ denies (mismatch, absent) were added. 42 fixtures, 33 embedded tests, all pass.
of behaviour for any caller that is not tenant-engine; per
`FLEX-DEC-2026-008` it is a version change, not a silent edit. tenant-engine
asked for no notice period.
## FLEX-DEC-2026-017 — `informed-decision.compact-sitting` v3 admits `list`: exact-record scope, 12-hour MFA window, acts unchanged
**Status:** accepted — operator decision, 2026-09-21
**Requested by:** `informed-decision` (`INFD-IN-0008`, `INFD-WP-0004-T02`),
hub message `a7b9ef3b-f95c-4c50-bfc5-7628d16881f6`
**Workplan:** `FLEX-WP-0032`
**Package:** `informed-decision.compact-sitting` v3,
`sha256:dd40c80c5719851737178097cdee65afac108b54e19c07370e549b860f1a9655`
**Decision.** v3 adds one action, `list`, as a rule of its own. It is not a
seventh member of the act set, and it changes nothing that v2 decided.
1. **Acts unchanged.** `read`, `acknowledge`, `accept`, `return`, `discuss` and
`decline` keep the v2 rule unchanged: the same eight records, the same
900-second MFA window. A `list` allow satisfies no other action.
2. **Exact-record scope.** `list` ranges over the union of this package's eight
records and the three `SECRETS-WP-0010-T03-*` records from
`informed-decision.t03-review`, each pinned by approval id, binding digest
and its own memo version (T03 at 2, sitting at 1).
3. **A lighter bar, not an absent one.** `list` requires the same identity as
the acts with a **12-hour** MFA window instead of 900 seconds.
**Why exact-record over resource-type-wide.** The consumer preferred
resource-type-wide scope (option A). The v2 rule scopes a decision three ways —
exact-record pinning, group, fresh MFA — and checks no recipient. Option A,
together with a relaxed window, would have removed both PDP-side scopes for
`list` at once, leaving the consumer's structural recipient match as the only
thing between a group member and every memo's question and status. The
consumer's own request says that match "is not an entitlement." A PDP cannot
rest an allow on a check its consumer disclaims. Under exact-record scope a memo
becomes listable when someone admits it, and a package version per sitting is
the cost of that property.
**Why a bound at all.** The request asked for no freshness bound. Unbounded
would have let an MFA of any age satisfy `list` for as long as the consumer
presented a key-cape session, and the PDP would have stated nothing. Twelve
hours covers the observed production refusals (1744 s) with ample margin and
keeps the bound in the policy, where a reviewer can read it.
**What this does not do.** It does not work around the KeyCape stale-timestamp
defect (`INFD-IN-0005`), which made the overview fail in the first place. The
case for `list` stands on its own — looking back at your own outcomes is not
binding a new one — and `read` stays strict. Loosening a binding bar to absorb
an identity-layer fault would move key-cape's defect into flex-auth's policy.
**Evidence.** 417 evaluator checks
(`docs/evidence/2026-09-21-sitting-review-policy-v3.json`): the 168 v2 checks
unchanged; 231 `list` checks over the 11-record union, including the observed
1744 s case allowed, the 12-hour bound refused past it, and stale MFA still
refused for `read`; and 18 proving no act widens to the T03 records even with
fresh MFA. Rego tests assert the union is exact and that T03 records are outside
the act scope. T03's own 57 checks pass.
**Rollout.** Deploying v3 changes the pin serving a live human-review surface,
and is confirmed with the operator before it runs. informed-decision updates its
admission input to the version and digest above once the pin serves v3.