coulomb/flex-auth
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Pin IR-WP-0005-T02 review to memo version 3.
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 3s
Details
Build and Publish Container Image / build-and-push (push) Successful in 1m24s
Details

Browse source 
The consumed T03 approval IDs cannot be created again. The T03 review
package and the sitting list pins now name three new approval IDs.
Binding digests and the sitting act records stay as they are.

Assistant: grok
Assistant-Session: 01a0e2a1-8058-7553-9999-b7d106c17047
This commit is contained in:
tegwick 2026-09-27 15:29:25 +02:00
parent 160bbfafc9
commit d5c91095ed
4 changed files with 27 additions and 27 deletions
Download patch file Download diff file Expand all files Collapse all files

12
examples/informed-decision-sitting/list_only_records.json
View file

@ -1,20 +1,20 @@
{
"memo:SECRETS-WP-0010-T03-apply": {
"approval_id": "9935335c-8e9a-566e-a48e-6a5b5f4882eb",
"approval_id": "b5fcbfcc-ad56-456f-bc36-c823052e9917",
"binding_digest": "sha256:03cc5b37437f14e86b686ce4054f976556334eff3fa260b03e8014ed3d9217e5",
"memo_version": 2,
"memo_version": 3,
"label": "t03-apply"
},
"memo:SECRETS-WP-0010-T03-verify": {
"approval_id": "273d6882-6253-5dc9-ac54-544f92ef5e56",
"approval_id": "4e9ff881-d59f-4143-9155-929afbe8dd43",
"binding_digest": "sha256:72d9267d038c17107c880ffc9009793ce9c70defbddfe2219628854b811a04b2",
"memo_version": 2,
"memo_version": 3,
"label": "t03-verify"
},
"memo:SECRETS-WP-0010-T03-exec": {
"approval_id": "7ba0c13b-68cd-5b3e-9481-42ba9e385e68",
"approval_id": "a24e0898-b3c5-4e50-85a8-18a2c2aa229e",
"binding_digest": "sha256:f2cf0fb53b740900756ccde5587c3578fcff44beef2f1edab17b9a198a4033d8",
"memo_version": 2,
"memo_version": 3,
"label": "t03-exec"
}
}

16
examples/informed-decision-sitting/policy.md
View file

@ -34,7 +34,7 @@ rule, not an extra member of the act set, and it changes nothing else:
the same 900-second MFA window. A `list` allow satisfies no other action.
- `list` covers the **union** of this package's eight records and the three
`SECRETS-WP-0010-T03-*` records from `informed-decision.t03-review`, each
pinned by approval id, binding digest and its own memo version (T03 at 2).
pinned by approval id, binding digest and its own memo version (T03 at 3).
Scope stays exact-record: a memo is listable only once someone admitted it.
The operator declined resource-type-wide scope because the PDP checks no
recipient, and a type-wide rule would have left consumer code — which the
@ -94,24 +94,24 @@ records := {
list_only_records := {
"memo:SECRETS-WP-0010-T03-apply": {
"approval_id": "9935335c-8e9a-566e-a48e-6a5b5f4882eb",
"approval_id": "b5fcbfcc-ad56-456f-bc36-c823052e9917",
"binding_digest": "sha256:03cc5b37437f14e86b686ce4054f976556334eff3fa260b03e8014ed3d9217e5",
"memo_version": 2
"memo_version": 3
},
"memo:SECRETS-WP-0010-T03-verify": {
"approval_id": "273d6882-6253-5dc9-ac54-544f92ef5e56",
"approval_id": "4e9ff881-d59f-4143-9155-929afbe8dd43",
"binding_digest": "sha256:72d9267d038c17107c880ffc9009793ce9c70defbddfe2219628854b811a04b2",
"memo_version": 2
"memo_version": 3
},
"memo:SECRETS-WP-0010-T03-exec": {
"approval_id": "7ba0c13b-68cd-5b3e-9481-42ba9e385e68",
"approval_id": "a24e0898-b3c5-4e50-85a8-18a2c2aa229e",
"binding_digest": "sha256:f2cf0fb53b740900756ccde5587c3578fcff44beef2f1edab17b9a198a4033d8",
"memo_version": 2
"memo_version": 3
}
}
# listable is the union list may range over. Sitting records are memo version 1,
# as the act rule pins; T03 records carry their own version (2).
# as the act rule pins; T03 records carry their own version (3).
listable := object.union(
{id: object.union(r, {"memo_version": 1}) | some id, r in records},
list_only_records,

14
examples/informed-decision-t03/policy.md
View file

@ -22,7 +22,7 @@ Operator confirmation on 2026-09-14 grants net-kingdom-admins review/bind
permission for only the three exact T03 records. The seven already-admitted
compact-sitting records are preserved verbatim at memo version 1 because the
shared review service currently serves that mandate. T03 renewals require
memo version 2; no existing approval or human entry is copied. The authenticated
memo version 3; no existing approval or human entry is copied. The authenticated
informed-decision caller imports signed KeyCape groups and MFA facts.
No permission follows from memo content or presentation state. The independent
caller binding must be enforced by TokenReview before this package is served.
@ -35,19 +35,19 @@ import rego.v1
records := {
"memo:SECRETS-WP-0010-T03-apply": {
"approval_id": "9935335c-8e9a-566e-a48e-6a5b5f4882eb",
"approval_id": "b5fcbfcc-ad56-456f-bc36-c823052e9917",
"binding_digest": "sha256:03cc5b37437f14e86b686ce4054f976556334eff3fa260b03e8014ed3d9217e5",
"memo_version": 2
"memo_version": 3
},
"memo:SECRETS-WP-0010-T03-verify": {
"approval_id": "273d6882-6253-5dc9-ac54-544f92ef5e56",
"approval_id": "4e9ff881-d59f-4143-9155-929afbe8dd43",
"binding_digest": "sha256:72d9267d038c17107c880ffc9009793ce9c70defbddfe2219628854b811a04b2",
"memo_version": 2
"memo_version": 3
},
"memo:SECRETS-WP-0010-T03-exec": {
"approval_id": "7ba0c13b-68cd-5b3e-9481-42ba9e385e68",
"approval_id": "a24e0898-b3c5-4e50-85a8-18a2c2aa229e",
"binding_digest": "sha256:f2cf0fb53b740900756ccde5587c3578fcff44beef2f1edab17b9a198a4033d8",
"memo_version": 2
"memo_version": 3
},
"memo:infd-20260914-c02": {
"approval_id": "ccfd8007-2061-48fd-9356-99b16279dac1",

12
examples/informed-decision-t03/records.json
View file

@ -1,6 +1,6 @@
{
"memo:SECRETS-WP-0010-T03-apply": {
"approval_id": "9935335c-8e9a-566e-a48e-6a5b5f4882eb",
"approval_id": "b5fcbfcc-ad56-456f-bc36-c823052e9917",
"binding_digest": "sha256:03cc5b37437f14e86b686ce4054f976556334eff3fa260b03e8014ed3d9217e5",
"action": "apply",
"binding": {
@ -24,10 +24,10 @@
}
}
},
"memo_version": 2
"memo_version": 3
},
"memo:SECRETS-WP-0010-T03-verify": {
"approval_id": "273d6882-6253-5dc9-ac54-544f92ef5e56",
"approval_id": "4e9ff881-d59f-4143-9155-929afbe8dd43",
"binding_digest": "sha256:72d9267d038c17107c880ffc9009793ce9c70defbddfe2219628854b811a04b2",
"action": "verify",
"binding": {
@ -53,10 +53,10 @@
}
}
},
"memo_version": 2
"memo_version": 3
},
"memo:SECRETS-WP-0010-T03-exec": {
"approval_id": "7ba0c13b-68cd-5b3e-9481-42ba9e385e68",
"approval_id": "a24e0898-b3c5-4e50-85a8-18a2c2aa229e",
"binding_digest": "sha256:f2cf0fb53b740900756ccde5587c3578fcff44beef2f1edab17b9a198a4033d8",
"action": "exec",
"binding": {
@ -82,6 +82,6 @@
}
}
},
"memo_version": 2
"memo_version": 3
}
}