From d5c91095ed2e01e866b87af2d8626789044ac821 Mon Sep 17 00:00:00 2001 From: tegwick Date: Sun, 27 Sep 2026 15:29:25 +0200 Subject: [PATCH] Pin IR-WP-0005-T02 review to memo version 3. The consumed T03 approval IDs cannot be created again. The T03 review package and the sitting list pins now name three new approval IDs. Binding digests and the sitting act records stay as they are. Assistant: grok Assistant-Session: 01a0e2a1-8058-7553-9999-b7d106c17047 --- .../list_only_records.json | 12 ++++++------ examples/informed-decision-sitting/policy.md | 16 ++++++++-------- examples/informed-decision-t03/policy.md | 14 +++++++------- examples/informed-decision-t03/records.json | 12 ++++++------ 4 files changed, 27 insertions(+), 27 deletions(-) diff --git a/examples/informed-decision-sitting/list_only_records.json b/examples/informed-decision-sitting/list_only_records.json index ec8644f..5278f13 100644 --- a/examples/informed-decision-sitting/list_only_records.json +++ b/examples/informed-decision-sitting/list_only_records.json @@ -1,20 +1,20 @@ { "memo:SECRETS-WP-0010-T03-apply": { - "approval_id": "9935335c-8e9a-566e-a48e-6a5b5f4882eb", + "approval_id": "b5fcbfcc-ad56-456f-bc36-c823052e9917", "binding_digest": "sha256:03cc5b37437f14e86b686ce4054f976556334eff3fa260b03e8014ed3d9217e5", - "memo_version": 2, + "memo_version": 3, "label": "t03-apply" }, "memo:SECRETS-WP-0010-T03-verify": { - "approval_id": "273d6882-6253-5dc9-ac54-544f92ef5e56", + "approval_id": "4e9ff881-d59f-4143-9155-929afbe8dd43", "binding_digest": "sha256:72d9267d038c17107c880ffc9009793ce9c70defbddfe2219628854b811a04b2", - "memo_version": 2, + "memo_version": 3, "label": "t03-verify" }, "memo:SECRETS-WP-0010-T03-exec": { - "approval_id": "7ba0c13b-68cd-5b3e-9481-42ba9e385e68", + "approval_id": "a24e0898-b3c5-4e50-85a8-18a2c2aa229e", "binding_digest": "sha256:f2cf0fb53b740900756ccde5587c3578fcff44beef2f1edab17b9a198a4033d8", - "memo_version": 2, + "memo_version": 3, "label": "t03-exec" } } diff --git a/examples/informed-decision-sitting/policy.md b/examples/informed-decision-sitting/policy.md index 291158a..bb7d665 100644 --- a/examples/informed-decision-sitting/policy.md +++ b/examples/informed-decision-sitting/policy.md @@ -34,7 +34,7 @@ rule, not an extra member of the act set, and it changes nothing else: the same 900-second MFA window. A `list` allow satisfies no other action. - `list` covers the **union** of this package's eight records and the three `SECRETS-WP-0010-T03-*` records from `informed-decision.t03-review`, each - pinned by approval id, binding digest and its own memo version (T03 at 2). + pinned by approval id, binding digest and its own memo version (T03 at 3). Scope stays exact-record: a memo is listable only once someone admitted it. The operator declined resource-type-wide scope because the PDP checks no recipient, and a type-wide rule would have left consumer code — which the @@ -94,24 +94,24 @@ records := { list_only_records := { "memo:SECRETS-WP-0010-T03-apply": { - "approval_id": "9935335c-8e9a-566e-a48e-6a5b5f4882eb", + "approval_id": "b5fcbfcc-ad56-456f-bc36-c823052e9917", "binding_digest": "sha256:03cc5b37437f14e86b686ce4054f976556334eff3fa260b03e8014ed3d9217e5", - "memo_version": 2 + "memo_version": 3 }, "memo:SECRETS-WP-0010-T03-verify": { - "approval_id": "273d6882-6253-5dc9-ac54-544f92ef5e56", + "approval_id": "4e9ff881-d59f-4143-9155-929afbe8dd43", "binding_digest": "sha256:72d9267d038c17107c880ffc9009793ce9c70defbddfe2219628854b811a04b2", - "memo_version": 2 + "memo_version": 3 }, "memo:SECRETS-WP-0010-T03-exec": { - "approval_id": "7ba0c13b-68cd-5b3e-9481-42ba9e385e68", + "approval_id": "a24e0898-b3c5-4e50-85a8-18a2c2aa229e", "binding_digest": "sha256:f2cf0fb53b740900756ccde5587c3578fcff44beef2f1edab17b9a198a4033d8", - "memo_version": 2 + "memo_version": 3 } } # listable is the union list may range over. Sitting records are memo version 1, -# as the act rule pins; T03 records carry their own version (2). +# as the act rule pins; T03 records carry their own version (3). listable := object.union( {id: object.union(r, {"memo_version": 1}) | some id, r in records}, list_only_records, diff --git a/examples/informed-decision-t03/policy.md b/examples/informed-decision-t03/policy.md index 915350a..a389d83 100644 --- a/examples/informed-decision-t03/policy.md +++ b/examples/informed-decision-t03/policy.md @@ -22,7 +22,7 @@ Operator confirmation on 2026-09-14 grants net-kingdom-admins review/bind permission for only the three exact T03 records. The seven already-admitted compact-sitting records are preserved verbatim at memo version 1 because the shared review service currently serves that mandate. T03 renewals require -memo version 2; no existing approval or human entry is copied. The authenticated +memo version 3; no existing approval or human entry is copied. The authenticated informed-decision caller imports signed KeyCape groups and MFA facts. No permission follows from memo content or presentation state. The independent caller binding must be enforced by TokenReview before this package is served. @@ -35,19 +35,19 @@ import rego.v1 records := { "memo:SECRETS-WP-0010-T03-apply": { - "approval_id": "9935335c-8e9a-566e-a48e-6a5b5f4882eb", + "approval_id": "b5fcbfcc-ad56-456f-bc36-c823052e9917", "binding_digest": "sha256:03cc5b37437f14e86b686ce4054f976556334eff3fa260b03e8014ed3d9217e5", - "memo_version": 2 + "memo_version": 3 }, "memo:SECRETS-WP-0010-T03-verify": { - "approval_id": "273d6882-6253-5dc9-ac54-544f92ef5e56", + "approval_id": "4e9ff881-d59f-4143-9155-929afbe8dd43", "binding_digest": "sha256:72d9267d038c17107c880ffc9009793ce9c70defbddfe2219628854b811a04b2", - "memo_version": 2 + "memo_version": 3 }, "memo:SECRETS-WP-0010-T03-exec": { - "approval_id": "7ba0c13b-68cd-5b3e-9481-42ba9e385e68", + "approval_id": "a24e0898-b3c5-4e50-85a8-18a2c2aa229e", "binding_digest": "sha256:f2cf0fb53b740900756ccde5587c3578fcff44beef2f1edab17b9a198a4033d8", - "memo_version": 2 + "memo_version": 3 }, "memo:infd-20260914-c02": { "approval_id": "ccfd8007-2061-48fd-9356-99b16279dac1", diff --git a/examples/informed-decision-t03/records.json b/examples/informed-decision-t03/records.json index 93cd574..a7f73db 100644 --- a/examples/informed-decision-t03/records.json +++ b/examples/informed-decision-t03/records.json @@ -1,6 +1,6 @@ { "memo:SECRETS-WP-0010-T03-apply": { - "approval_id": "9935335c-8e9a-566e-a48e-6a5b5f4882eb", + "approval_id": "b5fcbfcc-ad56-456f-bc36-c823052e9917", "binding_digest": "sha256:03cc5b37437f14e86b686ce4054f976556334eff3fa260b03e8014ed3d9217e5", "action": "apply", "binding": { @@ -24,10 +24,10 @@ } } }, - "memo_version": 2 + "memo_version": 3 }, "memo:SECRETS-WP-0010-T03-verify": { - "approval_id": "273d6882-6253-5dc9-ac54-544f92ef5e56", + "approval_id": "4e9ff881-d59f-4143-9155-929afbe8dd43", "binding_digest": "sha256:72d9267d038c17107c880ffc9009793ce9c70defbddfe2219628854b811a04b2", "action": "verify", "binding": { @@ -53,10 +53,10 @@ } } }, - "memo_version": 2 + "memo_version": 3 }, "memo:SECRETS-WP-0010-T03-exec": { - "approval_id": "7ba0c13b-68cd-5b3e-9481-42ba9e385e68", + "approval_id": "a24e0898-b3c5-4e50-85a8-18a2c2aa229e", "binding_digest": "sha256:f2cf0fb53b740900756ccde5587c3578fcff44beef2f1edab17b9a198a4033d8", "action": "exec", "binding": { @@ -82,6 +82,6 @@ } } }, - "memo_version": 2 + "memo_version": 3 } }