coulomb/flex-auth
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Record authenticated caller in the decision envelope.
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
Build and Publish Container Image / build-and-push (push) Successful in 1m0s
Details

Browse source 
FLEX-WP-0023-T04: provenance.caller is additive (mode required;
principal/audience/not_after when a token was reviewed). TokenReview
keeps the JWT exp. request_digest is unchanged because the caller is
not binding material.

Assistant: grok
Assistant-Session: 01a09dc1-b21e-77e1-919e-fcad2f82b267
This commit is contained in:
tegwick 2026-09-14 04:44:07 +02:00
parent e62c0cfc36
commit ca070df32d
15 changed files with 344 additions and 35 deletions
Download patch file Download diff file Expand all files Collapse all files

2
decisions/decisions.md
View file

@ -1184,7 +1184,7 @@ cross-tenant scope from a missing rule. Carried as `FLEX-WP-0022`.
## FLEX-DEC-2026-009 — The decision record cannot show who called: caller identity is absent from `flex-auth.decision-record.v1`
**Date:** 2026-09-06
**Status:** accepted, gap open
**Status:** accepted, implemented 2026-09-14
**Workplan:** `FLEX-WP-0023`
**Raised by:** flex-auth, while designing the operator access path `glas-harness` asked for