Admit exact T03 human review mandate with caller-bound policy
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a09cbb-87c6-7900-a145-4ce53ba9f1a6
This commit is contained in:
parent
8dcdecf6cf
commit
e62c0cfc36
10 changed files with 585 additions and 0 deletions
|
|
@ -34,6 +34,7 @@
|
|||
| workplan | FLEX-WP-0024 | active | — | workplans/FLEX-WP-0024-decision-envelope-authenticity.md |
|
||||
| workplan | FLEX-WP-0025 | ready | — | workplans/FLEX-WP-0025-fact-versus-assertion.md |
|
||||
| workplan | FLEX-WP-0026 | finished | — | workplans/FLEX-WP-0026-openrouter-native-contract.md |
|
||||
| workplan | FLEX-WP-0027 | active | — | workplans/FLEX-WP-0027-t03-human-review.md |
|
||||
| task | FLEX-WP-0001-T001 | done | — | workplans/FLEX-WP-0001-repo-intent-and-architecture-baseline.md |
|
||||
| task | FLEX-WP-0001-T002 | done | — | workplans/FLEX-WP-0001-repo-intent-and-architecture-baseline.md |
|
||||
| task | FLEX-WP-0001-T003 | done | — | workplans/FLEX-WP-0001-repo-intent-and-architecture-baseline.md |
|
||||
|
|
@ -154,6 +155,9 @@
|
|||
| task | FLEX-WP-0025-T03 | wait | — | workplans/FLEX-WP-0025-fact-versus-assertion.md |
|
||||
| task | FLEX-WP-0026-T01 | done | — | workplans/FLEX-WP-0026-openrouter-native-contract.md |
|
||||
| task | FLEX-WP-0026-T02 | done | — | workplans/FLEX-WP-0026-openrouter-native-contract.md |
|
||||
| task | FLEX-WP-0027-T01 | done | — | workplans/FLEX-WP-0027-t03-human-review.md |
|
||||
| task | FLEX-WP-0027-T02 | done | — | workplans/FLEX-WP-0027-t03-human-review.md |
|
||||
| task | FLEX-WP-0027-T03 | wait | — | workplans/FLEX-WP-0027-t03-human-review.md |
|
||||
| intake | FLEX-IN-0001 | closed | — | intakes/intakes.md |
|
||||
| intake | FLEX-IN-0002 | closed | — | intakes/intakes.md |
|
||||
| decision | FLEX-DEC-2026-001 | resolved | — | decisions/decisions.md |
|
||||
|
|
|
|||
47
docs/evidence/2026-09-14-t03-native-review-policy.json
Normal file
47
docs/evidence/2026-09-14-t03-native-review-policy.json
Normal file
|
|
@ -0,0 +1,47 @@
|
|||
{
|
||||
"scope": "native caller and policy with synthetic subject claims; not real human approval",
|
||||
"checks": [
|
||||
{
|
||||
"action": "apply",
|
||||
"case": "admitted-group",
|
||||
"effect": "allow",
|
||||
"policy_package_digest": "sha256:139992f3e0780c7627a52c447df4f9582a180cadb1d71b2b748073f10a42b96e",
|
||||
"caller": "system:serviceaccount:informed-decision:review"
|
||||
},
|
||||
{
|
||||
"action": "apply",
|
||||
"case": "unrelated-group",
|
||||
"effect": "deny",
|
||||
"policy_package_digest": "sha256:139992f3e0780c7627a52c447df4f9582a180cadb1d71b2b748073f10a42b96e",
|
||||
"caller": "system:serviceaccount:informed-decision:review"
|
||||
},
|
||||
{
|
||||
"action": "verify",
|
||||
"case": "admitted-group",
|
||||
"effect": "allow",
|
||||
"policy_package_digest": "sha256:139992f3e0780c7627a52c447df4f9582a180cadb1d71b2b748073f10a42b96e",
|
||||
"caller": "system:serviceaccount:informed-decision:review"
|
||||
},
|
||||
{
|
||||
"action": "verify",
|
||||
"case": "unrelated-group",
|
||||
"effect": "deny",
|
||||
"policy_package_digest": "sha256:139992f3e0780c7627a52c447df4f9582a180cadb1d71b2b748073f10a42b96e",
|
||||
"caller": "system:serviceaccount:informed-decision:review"
|
||||
},
|
||||
{
|
||||
"action": "exec",
|
||||
"case": "admitted-group",
|
||||
"effect": "allow",
|
||||
"policy_package_digest": "sha256:139992f3e0780c7627a52c447df4f9582a180cadb1d71b2b748073f10a42b96e",
|
||||
"caller": "system:serviceaccount:informed-decision:review"
|
||||
},
|
||||
{
|
||||
"action": "exec",
|
||||
"case": "unrelated-group",
|
||||
"effect": "deny",
|
||||
"policy_package_digest": "sha256:139992f3e0780c7627a52c447df4f9582a180cadb1d71b2b748073f10a42b96e",
|
||||
"caller": "system:serviceaccount:informed-decision:review"
|
||||
}
|
||||
]
|
||||
}
|
||||
233
docs/evidence/2026-09-14-t03-review-policy.json
Normal file
233
docs/evidence/2026-09-14-t03-review-policy.json
Normal file
|
|
@ -0,0 +1,233 @@
|
|||
{
|
||||
"scope": "local actual evaluator with synthetic identity; no live human approvals",
|
||||
"checks": [
|
||||
{
|
||||
"check": "apply:read",
|
||||
"effect": "allow"
|
||||
},
|
||||
{
|
||||
"check": "apply:acknowledge",
|
||||
"effect": "allow"
|
||||
},
|
||||
{
|
||||
"check": "apply:accept",
|
||||
"effect": "allow"
|
||||
},
|
||||
{
|
||||
"check": "apply:return",
|
||||
"effect": "allow"
|
||||
},
|
||||
{
|
||||
"check": "apply:discuss",
|
||||
"effect": "allow"
|
||||
},
|
||||
{
|
||||
"check": "apply:decline",
|
||||
"effect": "allow"
|
||||
},
|
||||
{
|
||||
"check": "apply:wrong-group",
|
||||
"effect": "deny"
|
||||
},
|
||||
{
|
||||
"check": "apply:no-group",
|
||||
"effect": "deny"
|
||||
},
|
||||
{
|
||||
"check": "apply:service",
|
||||
"effect": "deny"
|
||||
},
|
||||
{
|
||||
"check": "apply:stale-mfa",
|
||||
"effect": "deny"
|
||||
},
|
||||
{
|
||||
"check": "apply:future-mfa",
|
||||
"effect": "deny"
|
||||
},
|
||||
{
|
||||
"check": "apply:no-mfa",
|
||||
"effect": "deny"
|
||||
},
|
||||
{
|
||||
"check": "apply:forged-human-route",
|
||||
"effect": "deny"
|
||||
},
|
||||
{
|
||||
"check": "apply:wrong-tenant",
|
||||
"effect": "deny"
|
||||
},
|
||||
{
|
||||
"check": "apply:other-memo",
|
||||
"effect": "deny"
|
||||
},
|
||||
{
|
||||
"check": "apply:changed-version",
|
||||
"effect": "deny"
|
||||
},
|
||||
{
|
||||
"check": "apply:changed-approval",
|
||||
"effect": "deny"
|
||||
},
|
||||
{
|
||||
"check": "apply:changed-digest",
|
||||
"effect": "deny"
|
||||
},
|
||||
{
|
||||
"check": "apply:consume",
|
||||
"effect": "deny"
|
||||
},
|
||||
{
|
||||
"check": "verify:read",
|
||||
"effect": "allow"
|
||||
},
|
||||
{
|
||||
"check": "verify:acknowledge",
|
||||
"effect": "allow"
|
||||
},
|
||||
{
|
||||
"check": "verify:accept",
|
||||
"effect": "allow"
|
||||
},
|
||||
{
|
||||
"check": "verify:return",
|
||||
"effect": "allow"
|
||||
},
|
||||
{
|
||||
"check": "verify:discuss",
|
||||
"effect": "allow"
|
||||
},
|
||||
{
|
||||
"check": "verify:decline",
|
||||
"effect": "allow"
|
||||
},
|
||||
{
|
||||
"check": "verify:wrong-group",
|
||||
"effect": "deny"
|
||||
},
|
||||
{
|
||||
"check": "verify:no-group",
|
||||
"effect": "deny"
|
||||
},
|
||||
{
|
||||
"check": "verify:service",
|
||||
"effect": "deny"
|
||||
},
|
||||
{
|
||||
"check": "verify:stale-mfa",
|
||||
"effect": "deny"
|
||||
},
|
||||
{
|
||||
"check": "verify:future-mfa",
|
||||
"effect": "deny"
|
||||
},
|
||||
{
|
||||
"check": "verify:no-mfa",
|
||||
"effect": "deny"
|
||||
},
|
||||
{
|
||||
"check": "verify:forged-human-route",
|
||||
"effect": "deny"
|
||||
},
|
||||
{
|
||||
"check": "verify:wrong-tenant",
|
||||
"effect": "deny"
|
||||
},
|
||||
{
|
||||
"check": "verify:other-memo",
|
||||
"effect": "deny"
|
||||
},
|
||||
{
|
||||
"check": "verify:changed-version",
|
||||
"effect": "deny"
|
||||
},
|
||||
{
|
||||
"check": "verify:changed-approval",
|
||||
"effect": "deny"
|
||||
},
|
||||
{
|
||||
"check": "verify:changed-digest",
|
||||
"effect": "deny"
|
||||
},
|
||||
{
|
||||
"check": "verify:consume",
|
||||
"effect": "deny"
|
||||
},
|
||||
{
|
||||
"check": "exec:read",
|
||||
"effect": "allow"
|
||||
},
|
||||
{
|
||||
"check": "exec:acknowledge",
|
||||
"effect": "allow"
|
||||
},
|
||||
{
|
||||
"check": "exec:accept",
|
||||
"effect": "allow"
|
||||
},
|
||||
{
|
||||
"check": "exec:return",
|
||||
"effect": "allow"
|
||||
},
|
||||
{
|
||||
"check": "exec:discuss",
|
||||
"effect": "allow"
|
||||
},
|
||||
{
|
||||
"check": "exec:decline",
|
||||
"effect": "allow"
|
||||
},
|
||||
{
|
||||
"check": "exec:wrong-group",
|
||||
"effect": "deny"
|
||||
},
|
||||
{
|
||||
"check": "exec:no-group",
|
||||
"effect": "deny"
|
||||
},
|
||||
{
|
||||
"check": "exec:service",
|
||||
"effect": "deny"
|
||||
},
|
||||
{
|
||||
"check": "exec:stale-mfa",
|
||||
"effect": "deny"
|
||||
},
|
||||
{
|
||||
"check": "exec:future-mfa",
|
||||
"effect": "deny"
|
||||
},
|
||||
{
|
||||
"check": "exec:no-mfa",
|
||||
"effect": "deny"
|
||||
},
|
||||
{
|
||||
"check": "exec:forged-human-route",
|
||||
"effect": "deny"
|
||||
},
|
||||
{
|
||||
"check": "exec:wrong-tenant",
|
||||
"effect": "deny"
|
||||
},
|
||||
{
|
||||
"check": "exec:other-memo",
|
||||
"effect": "deny"
|
||||
},
|
||||
{
|
||||
"check": "exec:changed-version",
|
||||
"effect": "deny"
|
||||
},
|
||||
{
|
||||
"check": "exec:changed-approval",
|
||||
"effect": "deny"
|
||||
},
|
||||
{
|
||||
"check": "exec:changed-digest",
|
||||
"effect": "deny"
|
||||
},
|
||||
{
|
||||
"check": "exec:consume",
|
||||
"effect": "deny"
|
||||
}
|
||||
]
|
||||
}
|
||||
21
examples/informed-decision-t03/fixtures.json
Normal file
21
examples/informed-decision-t03/fixtures.json
Normal file
|
|
@ -0,0 +1,21 @@
|
|||
[
|
||||
{
|
||||
"id": "unknown-request-denied",
|
||||
"request": {
|
||||
"id": "unknown",
|
||||
"subject": {
|
||||
"id": "unknown",
|
||||
"type": "human"
|
||||
},
|
||||
"action": "accept",
|
||||
"resource": {
|
||||
"id": "memo:unrelated",
|
||||
"type": "decision-memo",
|
||||
"system": "informed-decision"
|
||||
}
|
||||
},
|
||||
"expect": {
|
||||
"effect": "deny"
|
||||
}
|
||||
}
|
||||
]
|
||||
88
examples/informed-decision-t03/policy.md
Normal file
88
examples/informed-decision-t03/policy.md
Normal file
|
|
@ -0,0 +1,88 @@
|
|||
---
|
||||
id: informed-decision.t03-review
|
||||
name: T03 exact OpenRouter lifecycle human review
|
||||
namespace: informed-decision:decision-memo
|
||||
version: v1
|
||||
status: ready
|
||||
package: flexauth.informed_decision.t03_review
|
||||
allow_ttl: 30s
|
||||
actions: [read, acknowledge, accept, return, discuss, decline]
|
||||
owner: flex-auth
|
||||
fixtures: [fixtures.json]
|
||||
caring:
|
||||
profile: caring-0.4.0-rc2
|
||||
enforce: false
|
||||
activation:
|
||||
mode: local
|
||||
---
|
||||
|
||||
# Operator-admitted T03 review mandate
|
||||
|
||||
Operator confirmation on 2026-09-14 grants net-kingdom-admins review/bind
|
||||
permission for only these three exact T03 records. The authenticated
|
||||
informed-decision caller imports signed KeyCape groups and MFA facts.
|
||||
No permission follows from memo content or presentation state. The independent
|
||||
caller binding must be enforced by TokenReview before this package is served.
|
||||
Membership tenant provenance may follow the explicitly accepted registration
|
||||
route; it does not assert directory membership in tenant:platform.
|
||||
Only a real human uses accept. This package neither issues nor consumes approval.
|
||||
|
||||
```rego
|
||||
import rego.v1
|
||||
|
||||
records := {
|
||||
"memo:SECRETS-WP-0010-T03-apply": {
|
||||
"approval_id": "09592588-ab15-53e7-89b8-c4e9f29aaacf",
|
||||
"binding_digest": "sha256:03cc5b37437f14e86b686ce4054f976556334eff3fa260b03e8014ed3d9217e5"
|
||||
},
|
||||
"memo:SECRETS-WP-0010-T03-verify": {
|
||||
"approval_id": "9416fa31-fa9e-5603-8289-f35bc9625409",
|
||||
"binding_digest": "sha256:72d9267d038c17107c880ffc9009793ce9c70defbddfe2219628854b811a04b2"
|
||||
},
|
||||
"memo:SECRETS-WP-0010-T03-exec": {
|
||||
"approval_id": "da678b61-35be-598e-8d95-a7aefa2fdc73",
|
||||
"binding_digest": "sha256:f2cf0fb53b740900756ccde5587c3578fcff44beef2f1edab17b9a198a4033d8"
|
||||
}
|
||||
}
|
||||
|
||||
decision := {"effect": "allow", "reason": "operator_admitted_t03_review"} if {
|
||||
input.tenant == "tenant:platform"
|
||||
input.subject.tenant == "tenant:platform"
|
||||
input.subject.type == "human"
|
||||
is_string(input.subject.id)
|
||||
input.subject.id != ""
|
||||
input.subject.attributes.principal_type_source == "authentication-derived"
|
||||
input.subject.attributes.tenant_source in {"registration-supplied", "directory-asserted"}
|
||||
"net-kingdom-admins" in input.subject.attributes.groups
|
||||
assurance := input.subject.attributes.assurance
|
||||
assurance.level == "aal2"
|
||||
assurance.mfa == true
|
||||
assurance.source == "key-cape"
|
||||
assurance.methods == ["pwd", "otp"]
|
||||
is_number(assurance.at)
|
||||
assurance.at > 0
|
||||
age := time.now_ns() / 1000000000 - assurance.at
|
||||
age >= -30
|
||||
age <= 900
|
||||
input.resource.tenant == "tenant:platform"
|
||||
input.resource.system == "informed-decision"
|
||||
input.resource.type == "decision-memo"
|
||||
record := records[input.resource.id]
|
||||
input.context.memo_version == 1
|
||||
input.context.approval_id == record.approval_id
|
||||
input.context.approval_binding_digest == record.binding_digest
|
||||
input.action in {"read", "acknowledge", "accept", "return", "discuss", "decline"}
|
||||
} else := {"effect": "deny", "reason": "t03_review_scope_or_identity_refused"} if {
|
||||
true
|
||||
}
|
||||
```
|
||||
|
||||
```rego test
|
||||
package flexauth.informed_decision.t03_review_test
|
||||
import rego.v1
|
||||
import data.flexauth.informed_decision.t03_review
|
||||
|
||||
test_unknown_request_denied if {
|
||||
t03_review.decision.effect == "deny" with input as {}
|
||||
}
|
||||
```
|
||||
87
examples/informed-decision-t03/records.json
Normal file
87
examples/informed-decision-t03/records.json
Normal file
|
|
@ -0,0 +1,87 @@
|
|||
{
|
||||
"memo:SECRETS-WP-0010-T03-apply": {
|
||||
"approval_id": "09592588-ab15-53e7-89b8-c4e9f29aaacf",
|
||||
"binding_digest": "sha256:03cc5b37437f14e86b686ce4054f976556334eff3fa260b03e8014ed3d9217e5",
|
||||
"action": "apply",
|
||||
"binding": {
|
||||
"action": "apply",
|
||||
"actor": "secrets-engine",
|
||||
"principal": "secrets-engine",
|
||||
"purpose": "IR-WP-0004 read-only OpenRouter key authentication check; no inference",
|
||||
"target": {
|
||||
"id": "catalog:openrouter-llm-connect",
|
||||
"type": "secret-catalog-lane",
|
||||
"system": "secrets-engine",
|
||||
"attributes": {
|
||||
"stage": "prod",
|
||||
"fields": [],
|
||||
"policy_targets": [
|
||||
"se-prod-openrouter-llm-connect"
|
||||
],
|
||||
"auth_targets": [
|
||||
"se-prod-openrouter-llm-connect"
|
||||
]
|
||||
}
|
||||
}
|
||||
},
|
||||
"memo_version": 1
|
||||
},
|
||||
"memo:SECRETS-WP-0010-T03-verify": {
|
||||
"approval_id": "9416fa31-fa9e-5603-8289-f35bc9625409",
|
||||
"binding_digest": "sha256:72d9267d038c17107c880ffc9009793ce9c70defbddfe2219628854b811a04b2",
|
||||
"action": "verify",
|
||||
"binding": {
|
||||
"action": "verify",
|
||||
"actor": "secrets-engine",
|
||||
"principal": "secrets-engine",
|
||||
"purpose": "IR-WP-0004 read-only OpenRouter key authentication check; no inference",
|
||||
"target": {
|
||||
"id": "catalog:openrouter-llm-connect",
|
||||
"type": "secret-catalog-lane",
|
||||
"system": "secrets-engine",
|
||||
"attributes": {
|
||||
"stage": "prod",
|
||||
"fields": [
|
||||
"OPENROUTER_API_KEY"
|
||||
],
|
||||
"policy_targets": [
|
||||
"se-prod-openrouter-llm-connect"
|
||||
],
|
||||
"auth_targets": [
|
||||
"se-prod-openrouter-llm-connect"
|
||||
]
|
||||
}
|
||||
}
|
||||
},
|
||||
"memo_version": 1
|
||||
},
|
||||
"memo:SECRETS-WP-0010-T03-exec": {
|
||||
"approval_id": "da678b61-35be-598e-8d95-a7aefa2fdc73",
|
||||
"binding_digest": "sha256:f2cf0fb53b740900756ccde5587c3578fcff44beef2f1edab17b9a198a4033d8",
|
||||
"action": "exec",
|
||||
"binding": {
|
||||
"action": "exec",
|
||||
"actor": "secrets-engine",
|
||||
"principal": "secrets-engine",
|
||||
"purpose": "IR-WP-0004 read-only OpenRouter key authentication check; no inference",
|
||||
"target": {
|
||||
"id": "catalog:openrouter-llm-connect",
|
||||
"type": "secret-catalog-lane",
|
||||
"system": "secrets-engine",
|
||||
"attributes": {
|
||||
"stage": "prod",
|
||||
"fields": [
|
||||
"OPENROUTER_API_KEY"
|
||||
],
|
||||
"policy_targets": [
|
||||
"se-prod-openrouter-llm-connect"
|
||||
],
|
||||
"auth_targets": [
|
||||
"se-prod-openrouter-llm-connect"
|
||||
]
|
||||
}
|
||||
}
|
||||
},
|
||||
"memo_version": 1
|
||||
}
|
||||
}
|
||||
1
examples/informed-decision-t03/registry.json
Normal file
1
examples/informed-decision-t03/registry.json
Normal file
|
|
@ -0,0 +1 @@
|
|||
{"subjects": [], "resources": []}
|
||||
27
tools/exercise_t03_review_policy.py
Normal file
27
tools/exercise_t03_review_policy.py
Normal file
|
|
@ -0,0 +1,27 @@
|
|||
import json,time,copy,subprocess,tempfile
|
||||
from pathlib import Path
|
||||
import argparse
|
||||
p=argparse.ArgumentParser();p.add_argument('--binary',required=True);p.add_argument('--receipt',type=Path,required=True);args=p.parse_args()
|
||||
r=Path(__file__).resolve().parents[1]/'examples/informed-decision-t03'
|
||||
records=json.loads((r/'records.json').read_text())
|
||||
results=[]
|
||||
with tempfile.TemporaryDirectory() as temp:
|
||||
request_path=Path(temp)/'request.json'
|
||||
def check(name,request,expected):
|
||||
request_path.write_text(json.dumps(request))
|
||||
result=subprocess.run([args.binary,'check','--registry',str(r/'registry.json'),'--policy',str(r/'policy.md'),'--request',str(request_path)],capture_output=True,text=True,check=True)
|
||||
d=json.loads(result.stdout)
|
||||
assert d['effect']==expected,(name,d)
|
||||
results.append({'check':name,'effect':d['effect']})
|
||||
return d
|
||||
for memo,record in records.items():
|
||||
request={'id':'local-regression','tenant':'tenant:platform','subject':{'id':'synthetic-reviewer','type':'human','tenant':'tenant:platform','attributes':{'groups':['net-kingdom-admins'],'roles':[],'tenant_source':'registration-supplied','principal_type_source':'authentication-derived','assurance':{'level':'aal2','mfa':True,'methods':['pwd','otp'],'source':'key-cape','at':int(time.time())}}},'resource':{'id':memo,'type':'decision-memo','system':'informed-decision','tenant':'tenant:platform'},'action':'accept','context':{'memo_version':1,'approval_id':record['approval_id'],'approval_binding_digest':record['binding_digest']},'policy_version':'v1'}
|
||||
for action in ['read','acknowledge','accept','return','discuss','decline']:
|
||||
d=check(record['action']+':'+action,request|{'action':action},'allow')
|
||||
for name,path,value in [('wrong-group',['subject','attributes','groups'],['net-kingdom-users']),('no-group',['subject','attributes','groups'],[]),('service',['subject','type'],'service'),('stale-mfa',['subject','attributes','assurance','at'],int(time.time())-901),('future-mfa',['subject','attributes','assurance','at'],int(time.time())+300),('no-mfa',['subject','attributes','assurance','mfa'],False),('forged-human-route',['subject','attributes','principal_type_source'],'registration-supplied'),('wrong-tenant',['subject','tenant'],'tenant:other'),('other-memo',['resource','id'],'memo:other'),('changed-version',['context','memo_version'],2),('changed-approval',['context','approval_id'],'other'),('changed-digest',['context','approval_binding_digest'],'sha256:'+'0'*64),('consume',['action'],'consume')]:
|
||||
candidate=copy.deepcopy(request); target=candidate
|
||||
for key in path[:-1]:target=target[key]
|
||||
target[path[-1]]=value
|
||||
check(record['action']+':'+name,candidate,'deny')
|
||||
args.receipt.write_text(json.dumps({'scope':'local actual evaluator with synthetic identity; no live human approvals','checks':results},indent=2)+'\n')
|
||||
print(len(results),'policy checks passed')
|
||||
24
values/informed-decision-t03.yaml
Normal file
24
values/informed-decision-t03.yaml
Normal file
|
|
@ -0,0 +1,24 @@
|
|||
# Operator-admitted exact T03 human review, SECRETS-WP-0010-T03.
|
||||
name: flex-auth-informed-decision-t03
|
||||
image:
|
||||
repository: forgejo.coulomb.social/coulomb/flex-auth
|
||||
digest: sha256:c9f028b49dfcede930a9cc48757ec8371ecc71d20b1bfee2733e55298dffcc7c
|
||||
args:
|
||||
- serve
|
||||
- --addr
|
||||
- 0.0.0.0:8080
|
||||
- --registry
|
||||
- /opt/flex-auth/examples/informed-decision-t03/registry.json
|
||||
- --policy
|
||||
- /opt/flex-auth/examples/informed-decision-t03/policy.md
|
||||
callerAuth:
|
||||
mode: enforce
|
||||
kubernetesURL: https://10.43.0.1
|
||||
binding: informed-decision=system:serviceaccount:informed-decision:review
|
||||
consumer:
|
||||
isolated: false
|
||||
namespace: informed-decision
|
||||
podName: informed-decision
|
||||
resources:
|
||||
requests: {cpu: 5m, memory: 32Mi}
|
||||
limits: {cpu: 300m, memory: 192Mi}
|
||||
53
workplans/FLEX-WP-0027-t03-human-review.md
Normal file
53
workplans/FLEX-WP-0027-t03-human-review.md
Normal file
|
|
@ -0,0 +1,53 @@
|
|||
---
|
||||
id: FLEX-WP-0027
|
||||
type: workplan
|
||||
title: "Admit scoped human review for the three T03 actions"
|
||||
domain: infotech
|
||||
repo: flex-auth
|
||||
status: active
|
||||
owner: codex
|
||||
topic_slug: netkingdom
|
||||
created: "2026-09-14"
|
||||
updated: "2026-09-14"
|
||||
state_hub_workstream_id: "954635b2-8377-5227-ab4f-10607b2a02c6"
|
||||
---
|
||||
|
||||
## Implement the explicit group and exact-record mandate
|
||||
|
||||
```task
|
||||
id: FLEX-WP-0027-T01
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "7b5af88b-2630-5f94-a085-78180690e08c"
|
||||
```
|
||||
|
||||
The operator admitted net-kingdom-admins for the three T03 reviews only.
|
||||
`examples/informed-decision-t03` pins record IDs, versions and native bindings.
|
||||
Fresh verified KeyCape MFA and groups are mandatory. 57 evaluator checks pass.
|
||||
Reproduce with `python3 tools/exercise_t03_review_policy.py --binary /path/to/flex-auth --receipt /tmp/t03-checks.json`.
|
||||
|
||||
## Deploy the isolated caller-bound policy
|
||||
|
||||
```task
|
||||
id: FLEX-WP-0027-T02
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "129568a0-cb1c-5f7b-8f5d-f44f1d2bcfff"
|
||||
```
|
||||
|
||||
`values/informed-decision-t03.yaml` pins the live image and policy. TokenReview
|
||||
admits only system:serviceaccount:informed-decision:review. Six native caller
|
||||
checks pass with synthetic identities; evidence is retained in docs/evidence.
|
||||
|
||||
## Verify actual human review through the native service
|
||||
|
||||
```task
|
||||
id: FLEX-WP-0027-T03
|
||||
status: wait
|
||||
priority: high
|
||||
state_hub_task_id: "9417d64a-308c-566f-af29-217c5c45d294"
|
||||
```
|
||||
|
||||
Wait for the operator's exact signed-in account, then address the three memos
|
||||
and verify actual human acknowledgements/entries. Synthetic policy checks are
|
||||
not acceptance evidence. SECRETS-WP-0010-T03 retains live consume and execution.
|
||||
Loading…
Add table
Add a link
Reference in a new issue