coulomb/flex-auth
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Make the layer declaration a boundary, and review the boundaries it implies.

Browse source 
INTENT.md pinned standard_version: "0.7" in the frontmatter §11 requires. That
conflated two things the standard separates itself: assent "records assent to a
BOUNDARY, given at the version named. It is not assent to the current text."
flex-auth is Engine/PDP at v0.6, v0.7, v0.8 and after; the role does not change
when the text is amended. The field was also decorative — parsed into
Declaration.StandardVersion and never validated — so the version was load-bearing
only via a test asserting it equalled 0.7.

That test is inverted rather than deleted: internal/layer now rejects a version
pin in the declaration and requires conformance_record to name a file that
exists. Version-scoped state moves to docs/conformance/security-layer-conformance.md,
a derived artifact carrying what it derives from and the version derived at, as
§11 requires of derived artifacts.

SCOPE.md: gap assessment replaces "conforming with one declared gap" with three
gaps, each with an owner and a route. G2 is new — flex-auth declares no emission
guarantee where §11 requires one of every §4 source of evidence. It is recorded
as a gap rather than as conformance because the flattering reading, that
audit-core is the source and flex-auth merely produces, has been asserted by
nobody but flex-auth. Also corrects the stance register from two rows to five.

Fixing one line meant reading what the declaration asserts, and a boundary is
only half held here. docs/conformance/boundaries-review.md checks the other
halves across twelve counterparts and finds four security-relevant repositories
with no layer declaration at all — including key-cape, the identity source whose
claims flex-auth consumes as normative input. That boundary is asserted from one
side only. Recorded as unstated, never as agreed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 28468@bnt-lap001
Assistant-Session: c76569b2-6056-4dad-aea4-49cd7a018f5d
This commit is contained in:
tegwick 2026-09-21 00:11:56 +02:00
parent 5a2e1959e5
commit c0d0d92e9f
7 changed files with 470 additions and 26 deletions
Download patch file Download diff file Expand all files Collapse all files

21
INTENT.md
View file

@ -1,13 +1,22 @@
---
# NetKingdom security layer declaration (security-layer-model_v0.7 §11).
# NetKingdom security layer declaration (security-layer-model §11).
# Machine-readable because §11 requires it: prose cannot distinguish a
# declaration from a transcribed review. Reference form: ops-warden layer.yaml.
#
# This declares a BOUNDARY, and carries no standard version on purpose. The
# standard draws the distinction itself: assent "records assent to a BOUNDARY,
# given at the version named. It is not assent to the current text." flex-auth is
# Engine / PDP at v0.6, v0.7, v0.8 and after; the role does not change when the
# text is amended, so a version here would make every revision read as though it
# invalidated the declaration. Version-scoped conformance state is derived, moves,
# and lives in conformance_record below — which carries the version it was
# derived at, as §11 requires of a derived artifact.
layer: Engine
role: PDP
framework: netkingdom-security-layer-model
standard_version: "0.7"
declared_by: decisions/decisions.md FLEX-DEC-2026-001, FLEX-DEC-2026-002, FLEX-DEC-2026-003
declared_at: "2026-08-29"
conformance_record: docs/conformance/security-layer-conformance.md
pep_stance: null # not PEP-shaped: flex-auth renders decisions, it causes no protected side effect
tooling_contacts: [] # §5 binds Staff; flex-auth holds no Tooling client
---
@ -15,8 +24,8 @@ tooling_contacts: [] # §5 binds Staff; flex-auth holds no Tooling client
# Flex-Auth Intent
> **Layer declaration.** flex-auth is **Engine / PDP** under the NetKingdom
> Security Layer Model (`net-kingdom/canon/standards/security-layer-model_v0.7.md`,
> accepted 2026-08-29). It is **the only policy decision point in NetKingdom**
> Security Layer Model (`net-kingdom/canon/standards/`, the Security
> Layer Model; declared 2026-08-29). It is **the only policy decision point in NetKingdom**
> (§6): no other repository, in any layer, renders or caches an authorization
> decision. The frontmatter above is the machine-readable form §11 requires; this
> paragraph is the declaration in flex-auth's own voice.
@ -38,7 +47,7 @@ tooling_contacts: [] # §5 binds Staff; flex-auth holds no Tooling client
> three records: `FLEX-DEC-2026-001` (Engine framing, the `access-engine` name,
> the authoring/evaluation split), `FLEX-DEC-2026-002` (§9.3 contested and
> upheld), and `FLEX-DEC-2026-003` (v0.6 review; §6.4.2, §9.7.2 and §17 as
> adopted in v0.7).
> adopted into the standard).
>
> *One item remains open: the ruled rename to `access-engine`. It is a separate
> governed migration — it touches `FLEX-WP` prefix ownership, State Hub
@ -62,7 +71,7 @@ enterprise-grade authorization without giving up clear ownership, local
development ergonomics, or inspectable policy decisions.
It is an **Engine**, role **PDP**, in the NetKingdom security layer model
(`net-kingdom/canon/standards/security-layer-model_v0.7.md`): a deterministic
(`net-kingdom/canon/standards/`, the Security Layer Model): a deterministic
API for a modeled concept, where the same authoritative input state yields the
same result.