Admit six exact metered credential memos for human review
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a0e387-534d-70e3-ad53-4ea05676db8c
This commit is contained in:
parent
335741fb1d
commit
d80c45a618
2 changed files with 213 additions and 1 deletions
|
|
@ -2,7 +2,7 @@
|
|||
id: informed-decision.compact-sitting
|
||||
name: Compact sitting exact-record human review
|
||||
namespace: informed-decision:decision-memo
|
||||
version: v5
|
||||
version: v6
|
||||
status: ready
|
||||
package: flexauth.informed_decision.compact_sitting
|
||||
allow_ttl: 30s
|
||||
|
|
@ -54,6 +54,11 @@ v5 (2026-09-27, REINAH-WP-0003-T06) admits the replacement-window memo
|
|||
`memo:infd-20260927-b02` with fresh native pins. The accepted b01 record is
|
||||
preserved; this change does not extend its signed execution window.
|
||||
|
||||
v6 (2026-09-27, REINAH-WP-0003-T06) admits six exact native metered
|
||||
credential requests, apply/verify/exec per provider and worker lane. All acts
|
||||
still require the authenticated human and fresh MFA. Ordinary worker approvals
|
||||
retain their native control type and require exact-ID consumer configuration.
|
||||
|
||||
The identity bar matches T03: authenticated informed-decision caller,
|
||||
`net-kingdom-admins`, fresh KeyCape AAL2 MFA. No permission follows from
|
||||
memo content or presentation state. TokenReview must admit
|
||||
|
|
@ -106,6 +111,30 @@ records := {
|
|||
"memo:infd-20260927-b02": {
|
||||
"approval_id": "1e73e514-ef74-4bff-83e7-fa88a3eaba0c",
|
||||
"binding_digest": "sha256:3e5951847e1909abe1561f561b4591228848a2e1a939b9bf5acab61e2db42773"
|
||||
},
|
||||
"memo:metered-20260927-provider-apply": {
|
||||
"approval_id": "0c05bd0a-f81f-451d-840c-5565628e2edc",
|
||||
"binding_digest": "sha256:a36b88244c26b1ffcd765cbadc201ff79260c7bcbd71d20d1584c3c0a3b1c3de"
|
||||
},
|
||||
"memo:metered-20260927-provider-verify": {
|
||||
"approval_id": "47f118a3-a86c-43ad-969d-42e09a0f45bb",
|
||||
"binding_digest": "sha256:98636335ccd36286c02fe018f296fd7d4dfd091ee89d27fe1b629e3db00cf121"
|
||||
},
|
||||
"memo:metered-20260927-provider-exec": {
|
||||
"approval_id": "7b32443a-a817-400c-a130-01b9ef04c8ee",
|
||||
"binding_digest": "sha256:8b31dd5911552b901b1f807a8cd6348d09547f3dbb2a52e3b42ad9fd948a2b01"
|
||||
},
|
||||
"memo:metered-20260927-worker-apply": {
|
||||
"approval_id": "2ce76d7f-01c3-4b63-8476-8d1230679769",
|
||||
"binding_digest": "sha256:412b79fb537d4444e52e3358820b6ea204fa17173a4420ab6372c52d010ee018"
|
||||
},
|
||||
"memo:metered-20260927-worker-verify": {
|
||||
"approval_id": "c2af4bcf-15b4-4305-aac1-acc7e4dcb099",
|
||||
"binding_digest": "sha256:bce6e2091ed076ec0040804d24c822078ac1eda18cd62703801fc9da77898303"
|
||||
},
|
||||
"memo:metered-20260927-worker-exec": {
|
||||
"approval_id": "dc22666a-d5d7-46bc-9490-ebe9fe09dc38",
|
||||
"binding_digest": "sha256:ae261c9271a21b626be354646054f493d0951f69aecdbde3cfce3ac0c5667e8f"
|
||||
}
|
||||
}
|
||||
|
||||
|
|
@ -246,4 +275,17 @@ test_tool_proof_without_mfa_denied if {
|
|||
with input.subject.attributes.assurance.mfa as false
|
||||
}
|
||||
|
||||
|
||||
test_six_exact_metered_memos_allow_human_review if {
|
||||
every id in ["memo:metered-20260927-provider-apply", "memo:metered-20260927-provider-verify", "memo:metered-20260927-provider-exec", "memo:metered-20260927-worker-apply", "memo:metered-20260927-worker-verify", "memo:metered-20260927-worker-exec"] {
|
||||
record := compact_sitting.records[id]
|
||||
request := object.union(tool_proof_input, {
|
||||
"resource": object.union(tool_proof_input.resource, {"id": id}),
|
||||
"context": {"memo_version": 1, "approval_id": record.approval_id,
|
||||
"approval_binding_digest": record.binding_digest},
|
||||
})
|
||||
compact_sitting.decision.effect == "allow" with input as request
|
||||
}
|
||||
}
|
||||
|
||||
```
|
||||
|
|
|
|||
|
|
@ -168,5 +168,175 @@
|
|||
}
|
||||
},
|
||||
"memo_version": 1
|
||||
},
|
||||
"memo:metered-20260927-provider-apply": {
|
||||
"approval_id": "0c05bd0a-f81f-451d-840c-5565628e2edc",
|
||||
"binding_digest": "sha256:a36b88244c26b1ffcd765cbadc201ff79260c7bcbd71d20d1584c3c0a3b1c3de",
|
||||
"label": "metered-20260927-provider-apply",
|
||||
"binding": {
|
||||
"action": "apply",
|
||||
"actor": "secrets-engine",
|
||||
"principal": "secrets-engine",
|
||||
"purpose": "Owner-admitted glas-harness agt run through the reviewed local profile; no caller-facing key fetch",
|
||||
"target": {
|
||||
"attributes": {
|
||||
"auth_targets": [
|
||||
"se-prod-glas-claude-agent-dev-anthropic"
|
||||
],
|
||||
"fields": [],
|
||||
"policy_targets": [
|
||||
"se-prod-glas-claude-agent-dev-anthropic"
|
||||
],
|
||||
"stage": "prod"
|
||||
},
|
||||
"id": "catalog:glas-claude-agent-dev-anthropic",
|
||||
"system": "secrets-engine",
|
||||
"type": "secret-catalog-lane"
|
||||
}
|
||||
},
|
||||
"memo_version": 1
|
||||
},
|
||||
"memo:metered-20260927-provider-verify": {
|
||||
"approval_id": "47f118a3-a86c-43ad-969d-42e09a0f45bb",
|
||||
"binding_digest": "sha256:98636335ccd36286c02fe018f296fd7d4dfd091ee89d27fe1b629e3db00cf121",
|
||||
"label": "metered-20260927-provider-verify",
|
||||
"binding": {
|
||||
"action": "verify",
|
||||
"actor": "secrets-engine",
|
||||
"principal": "secrets-engine",
|
||||
"purpose": "Owner-admitted glas-harness agt run through the reviewed local profile; no caller-facing key fetch",
|
||||
"target": {
|
||||
"attributes": {
|
||||
"auth_targets": [
|
||||
"se-prod-glas-claude-agent-dev-anthropic"
|
||||
],
|
||||
"fields": [
|
||||
"ANTHROPIC_API_KEY"
|
||||
],
|
||||
"policy_targets": [
|
||||
"se-prod-glas-claude-agent-dev-anthropic"
|
||||
],
|
||||
"stage": "prod"
|
||||
},
|
||||
"id": "catalog:glas-claude-agent-dev-anthropic",
|
||||
"system": "secrets-engine",
|
||||
"type": "secret-catalog-lane"
|
||||
}
|
||||
},
|
||||
"memo_version": 1
|
||||
},
|
||||
"memo:metered-20260927-provider-exec": {
|
||||
"approval_id": "7b32443a-a817-400c-a130-01b9ef04c8ee",
|
||||
"binding_digest": "sha256:8b31dd5911552b901b1f807a8cd6348d09547f3dbb2a52e3b42ad9fd948a2b01",
|
||||
"label": "metered-20260927-provider-exec",
|
||||
"binding": {
|
||||
"action": "exec",
|
||||
"actor": "secrets-engine",
|
||||
"principal": "secrets-engine",
|
||||
"purpose": "Owner-admitted glas-harness agt run through the reviewed local profile; no caller-facing key fetch",
|
||||
"target": {
|
||||
"attributes": {
|
||||
"auth_targets": [
|
||||
"se-prod-glas-claude-agent-dev-anthropic"
|
||||
],
|
||||
"fields": [
|
||||
"ANTHROPIC_API_KEY"
|
||||
],
|
||||
"policy_targets": [
|
||||
"se-prod-glas-claude-agent-dev-anthropic"
|
||||
],
|
||||
"stage": "prod"
|
||||
},
|
||||
"id": "catalog:glas-claude-agent-dev-anthropic",
|
||||
"system": "secrets-engine",
|
||||
"type": "secret-catalog-lane"
|
||||
}
|
||||
},
|
||||
"memo_version": 1
|
||||
},
|
||||
"memo:metered-20260927-worker-apply": {
|
||||
"approval_id": "2ce76d7f-01c3-4b63-8476-8d1230679769",
|
||||
"binding_digest": "sha256:412b79fb537d4444e52e3358820b6ea204fa17173a4420ab6372c52d010ee018",
|
||||
"label": "metered-20260927-worker-apply",
|
||||
"binding": {
|
||||
"action": "apply",
|
||||
"actor": "secrets-engine",
|
||||
"principal": "secrets-engine",
|
||||
"purpose": "Claim the admitted hfact-metered ops_run as rein-aharness-metered@railiance01 inside the catalog-bound Glas metered owner",
|
||||
"target": {
|
||||
"attributes": {
|
||||
"auth_targets": [
|
||||
"se-prod-activity-core-metered-worker-token"
|
||||
],
|
||||
"fields": [],
|
||||
"policy_targets": [
|
||||
"se-prod-activity-core-metered-worker-token"
|
||||
],
|
||||
"stage": "prod"
|
||||
},
|
||||
"id": "catalog:activity-core-metered-worker-token",
|
||||
"system": "secrets-engine",
|
||||
"type": "secret-catalog-lane"
|
||||
}
|
||||
},
|
||||
"memo_version": 1
|
||||
},
|
||||
"memo:metered-20260927-worker-verify": {
|
||||
"approval_id": "c2af4bcf-15b4-4305-aac1-acc7e4dcb099",
|
||||
"binding_digest": "sha256:bce6e2091ed076ec0040804d24c822078ac1eda18cd62703801fc9da77898303",
|
||||
"label": "metered-20260927-worker-verify",
|
||||
"binding": {
|
||||
"action": "verify",
|
||||
"actor": "secrets-engine",
|
||||
"principal": "secrets-engine",
|
||||
"purpose": "Claim the admitted hfact-metered ops_run as rein-aharness-metered@railiance01 inside the catalog-bound Glas metered owner",
|
||||
"target": {
|
||||
"attributes": {
|
||||
"auth_targets": [
|
||||
"se-prod-activity-core-metered-worker-token"
|
||||
],
|
||||
"fields": [
|
||||
"token"
|
||||
],
|
||||
"policy_targets": [
|
||||
"se-prod-activity-core-metered-worker-token"
|
||||
],
|
||||
"stage": "prod"
|
||||
},
|
||||
"id": "catalog:activity-core-metered-worker-token",
|
||||
"system": "secrets-engine",
|
||||
"type": "secret-catalog-lane"
|
||||
}
|
||||
},
|
||||
"memo_version": 1
|
||||
},
|
||||
"memo:metered-20260927-worker-exec": {
|
||||
"approval_id": "dc22666a-d5d7-46bc-9490-ebe9fe09dc38",
|
||||
"binding_digest": "sha256:ae261c9271a21b626be354646054f493d0951f69aecdbde3cfce3ac0c5667e8f",
|
||||
"label": "metered-20260927-worker-exec",
|
||||
"binding": {
|
||||
"action": "exec",
|
||||
"actor": "secrets-engine",
|
||||
"principal": "secrets-engine",
|
||||
"purpose": "Claim the admitted hfact-metered ops_run as rein-aharness-metered@railiance01 inside the catalog-bound Glas metered owner",
|
||||
"target": {
|
||||
"attributes": {
|
||||
"auth_targets": [
|
||||
"se-prod-activity-core-metered-worker-token"
|
||||
],
|
||||
"fields": [
|
||||
"token"
|
||||
],
|
||||
"policy_targets": [
|
||||
"se-prod-activity-core-metered-worker-token"
|
||||
],
|
||||
"stage": "prod"
|
||||
},
|
||||
"id": "catalog:activity-core-metered-worker-token",
|
||||
"system": "secrets-engine",
|
||||
"type": "secret-catalog-lane"
|
||||
}
|
||||
},
|
||||
"memo_version": 1
|
||||
}
|
||||
}
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue