coulomb/flex-auth
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Make the layer declaration a boundary, and review the boundaries it implies.

Browse source 
INTENT.md pinned standard_version: "0.7" in the frontmatter §11 requires. That
conflated two things the standard separates itself: assent "records assent to a
BOUNDARY, given at the version named. It is not assent to the current text."
flex-auth is Engine/PDP at v0.6, v0.7, v0.8 and after; the role does not change
when the text is amended. The field was also decorative — parsed into
Declaration.StandardVersion and never validated — so the version was load-bearing
only via a test asserting it equalled 0.7.

That test is inverted rather than deleted: internal/layer now rejects a version
pin in the declaration and requires conformance_record to name a file that
exists. Version-scoped state moves to docs/conformance/security-layer-conformance.md,
a derived artifact carrying what it derives from and the version derived at, as
§11 requires of derived artifacts.

SCOPE.md: gap assessment replaces "conforming with one declared gap" with three
gaps, each with an owner and a route. G2 is new — flex-auth declares no emission
guarantee where §11 requires one of every §4 source of evidence. It is recorded
as a gap rather than as conformance because the flattering reading, that
audit-core is the source and flex-auth merely produces, has been asserted by
nobody but flex-auth. Also corrects the stance register from two rows to five.

Fixing one line meant reading what the declaration asserts, and a boundary is
only half held here. docs/conformance/boundaries-review.md checks the other
halves across twelve counterparts and finds four security-relevant repositories
with no layer declaration at all — including key-cape, the identity source whose
claims flex-auth consumes as normative input. That boundary is asserted from one
side only. Recorded as unstated, never as agreed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 28468@bnt-lap001
Assistant-Session: c76569b2-6056-4dad-aea4-49cd7a018f5d
This commit is contained in:
tegwick 2026-09-21 00:11:56 +02:00
parent 5a2e1959e5
commit c0d0d92e9f
7 changed files with 470 additions and 26 deletions
Download patch file Download diff file Expand all files Collapse all files

73
SCOPE.md
View file

@ -4,8 +4,8 @@
flex-auth is a policy-as-code authorization registry and decision engine for
NetKingdom-aligned systems. Under the NetKingdom Security Layer Model
(`security-layer-model_v0.7`, accepted 2026-08-29) it is **Engine / PDP** — the
estate's only policy decision point.
(declared 2026-08-29) it is **Engine / PDP** — the estate's only policy decision
point.
## Core Idea
@ -36,7 +36,7 @@ can be coordinated behind a stable flex-auth API.
- Delegated PDP and directory adapter boundaries after the standalone core is
stable.
- The **decision-record schema**, published as flex-auth's own contract
(`security-layer-model_v0.7` §17).
(Security Layer Model §17).
- The **canonical request digest** as the published replay test for consumers
(§6.4.2) — `binding.submitted_request_digest`, over the request as sent.
`request_digest` is over the *enriched* request and is flex-auth's own
@ -152,11 +152,13 @@ certificates the ops-bridge tunnels depend on, one of which carries the policy
call itself. `ADR-0009` retires `policy.enabled` and the global `policy.fail_closed`
outright and replaces them with a total per-zone stance map in the consumer PEP
(`ops-warden/pep-stance.yaml`): open for `z0`-`z2` and `unknown`, closed for
`z3-critical`. That map is the reference shape for `security-layer-model_v0.7`
`z3-critical`. That map is the reference shape for the Security Layer Model's
§6.4 obligation 3. It is no longer the only published one: `secrets-engine`
published `pep-stance.yaml` (total over catalog stage plus `unknown`, runtime-read
and test-pinned), so §13.1's register now has **two rows** rather than the one the
standard recorded as itself the finding. flex-auth reviewed the pair in
and test-pinned), so §13.1's register grew past the single row the standard
recorded as itself the finding. It now carries **five** — `ops-warden`,
`user-engine`, `tenant-engine`, `secrets-engine`, and `ops-mason` with no map at
all — two of them marked non-conformant. flex-auth reviewed the pair in
`docs/stance-register-review.md` — the first exercise of the aggregate-divergence
capability it claimed on 2026-08-29 — and found that the two maps take opposite
stances on `unknown` (`fail_open` vs `fail_closed`) and scope on different axes
@ -172,15 +174,52 @@ PDP at all** and stays a consumer-side setting. The enforcing pins stay
enforcing regardless — an enforcing pin with no enforcing consumer still turns
the anonymous path into a 401 rather than a decision.
**Layer position (2026-08-29).** The NetKingdom Security Layer Model was
accepted at v0.7. flex-auth is **Engine / PDP**, declared machine-readably in
`INTENT.md` frontmatter per §11. Four of flex-auth's review findings were adopted
into the standard: §9.3's two-owner split for degraded mode, §6.4.2 scoped to the
decision's own binding with the canonical request digest as its mechanical test
and negative caching ruled explicitly, §9.7.2 split by role, and §17 moving the
decision-record schema to flex-auth. Conformance state is **conforming with one
declared gap** — the registry-snapshot digest in decision provenance, which §9.7.2
promotes to a conformance prerequisite. `FLEX-WP-0019` carries the work.
**Layer position (declared 2026-08-29).** flex-auth is **Engine / PDP** under
the NetKingdom Security Layer Model, declared machine-readably in `INTENT.md`
frontmatter per §11. That declaration deliberately carries **no standard
version**: a layer is a boundary and does not change when the text is amended,
which is the distinction the standard itself draws when it says assent is *"to a
BOUNDARY, given at the version named. It is not assent to the current text."* The
absence is enforced by test in `internal/layer`, and raised to `gate-house` as
`FLEX-WP-0030` B4 in case §11 should say so generally.
Version-scoped state therefore lives in
`docs/conformance/security-layer-conformance.md` — a derived artifact that names
what it derives from and the version it was derived at, as §11 requires. It
carries the assent history (v0.4 `FLEX-DEC-2026-002`, v0.6 `FLEX-DEC-2026-003`,
v0.8 `FLEX-DEC-2026-011`) and the gap table below.
Findings of flex-auth's adopted into the standard: §9.3's two-owner split for
degraded mode, §6.4.2 scoped to the decision's own binding with the canonical
request digest as its mechanical test and negative caching ruled explicitly,
§9.7.2 split by role, §17 moving the decision-record schema to flex-auth, and
four more in the v0.8 round (`FLEX-DEC-2026-011`), of which F1 — that a decision
must be *attributable* to flex-auth and that a digest comparison does not
discharge it — was the finding of the round.
Conformance state is **conforming with three declared gaps**, each with an owner
and a route rather than a sentence:
| # | Gap | Owner | Route |
| --- | --- | --- | --- |
| G1 | Registry-snapshot digest absent from decision provenance (§9.7.2 conformance prerequisite) | `flex-auth` | `FLEX-WP-0019` |
| G2 | No emission guarantee declared, where §11 requires one of every §4 source of evidence | `gate-house` to rule, then `flex-auth` | `FLEX-WP-0030` B3 |
| G3 | Published stance-register review stale — written at two register rows, §13.1 now carries five | `flex-auth` | `FLEX-WP-0029` |
G2 is new and is recorded as a gap rather than as conformance on purpose: whether
flex-auth is a §4 *source of evidence* or only the producer of an artifact
`audit-core` sources has been asserted by nobody but flex-auth, and §11 says a
source declaring no emission guarantee is not conforming. The conservative entry
is the honest one until the boundary is ruled.
**Boundaries review (2026-09-21).** `FLEX-WP-0030` reviews flex-auth's boundary
against every security-relevant counterpart and raises five items: inconsistent
`layer:` casing across the estate against §11's mechanical-checkability claim
(B1); four security-relevant repositories with no layer declaration at all —
`gate-house`, `key-cape`, `ops-mason`, `net-kingdom` — of which `key-cape` is the
identity source whose claims flex-auth consumes as normative input, making that
boundary asserted from one side only (B2); G2 above (B3); B4; and canon naming
`access-engine` while the repository still answers to `flex-auth` (B5).
State Hub integration is present through:
@ -297,12 +336,12 @@ description: Workplan for Topaz evaluation, relationship PDP adapters, rule PDP
type: contract
title: Decision-record contract
status: current
description: Published decision-record schema, the submitted-request digest as the replay test for consumers, request-enrichment precedence, and decision provenance — flex-auth's own contract under security-layer-model v0.7 section 17.
description: Published decision-record schema, the submitted-request digest as the replay test for consumers, request-enrichment precedence, and decision provenance — flex-auth's own contract under the Security Layer Model section 17.
```
```capability
type: orientation
title: Layer declaration
status: current
description: Machine-readable Engine/PDP declaration in INTENT.md frontmatter with conformance state and the one declared gap, per security-layer-model v0.7 section 11.
description: Machine-readable Engine/PDP boundary declaration in INTENT.md frontmatter, carrying no standard version by design, with version-stamped conformance state and three declared gaps in docs/conformance/security-layer-conformance.md, per Security Layer Model section 11.
```