coulomb/flex-auth
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Make undeclared policy attribute reads a validate error.

Browse source 
FLEX-WP-0025-T03: flex-auth validate flags input.*.attributes keys that
no sibling registry or manifest supplies. A broken testdata package
proves tests can pass while the ceiling remains caller-only.

Assistant: grok
Assistant-Session: 01a09dc1-b21e-77e1-919e-fcad2f82b267
This commit is contained in:
tegwick 2026-09-14 09:54:09 +02:00
parent 80cae28a74
commit c074237aac
10 changed files with 401 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

11
workplans/FLEX-WP-0025-fact-versus-assertion.md
View file

@ -4,7 +4,7 @@ type: workplan
title: "A policy cannot tell a registry fact from a caller assertion"
domain: infotech
repo: flex-auth
status: active
status: finished
owner: claude
topic_slug: netkingdom
planning_priority: P1
@ -116,7 +116,7 @@ subject. Secrets-engine, tenant-engine and qonto-assistant read no attributes.
```task
id: FLEX-WP-0025-T03
status: wait
status: done
priority: medium
state_hub_task_id: "8ee5baf9-b364-5d3e-9c49-d0c9eb014c10"
```
@ -134,3 +134,10 @@ caller input, which is the set a reviewer must look at.
Gate: the check runs in `validate` and flags a package whose ceiling key is
undeclared, demonstrated against a deliberately broken fixture package.
**Done 2026-09-14.** `flex-auth validate --kind policy` emits
`POLICY-ATTRIBUTE-UNDECLARED` when a sibling registry/manifest does not supply
the key. Testdata package `internal/policy/testdata/undeclared-ceiling` has
passing tests and fixtures and still fails validate. Published packages remain
valid. `examples/informed-decision-t03/registry.json` now declares the subject
claims that policy reads.